From 680346fad34cbd3c7f30947d50e2b5d3b25c496c Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 8 Sep 2016 15:14:37 +0200 Subject: tests: added unit tests for gnutls_certificate_set_x509_key() In addition these tests verify that the expected index is returned and that can be used with gnutls_certificate_get_crt_raw() afterwards. --- tests/Makefile.am | 2 +- tests/set_key.c | 248 +++++++++++++++++++++++++++++++++++++++++++++++++++ tests/set_x509_key.c | 148 +++++++++--------------------- 3 files changed, 289 insertions(+), 109 deletions(-) create mode 100644 tests/set_key.c diff --git a/tests/Makefile.am b/tests/Makefile.am index 55343ca72c..f0f81105fd 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -111,7 +111,7 @@ ctests = mini-record-2 simple gc set_pkcs12_cred certder certuniqueid \ set_x509_key_file_ocsp client-fastopen rng-sigint srp \ safe-renegotiation/srn0 safe-renegotiation/srn1 safe-renegotiation/srn2 \ safe-renegotiation/srn3 safe-renegotiation/srn4 safe-renegotiation/srn5 \ - rsa-illegal-import set_x509_key_file_ocsp_multi + rsa-illegal-import set_x509_key_file_ocsp_multi set_key if HAVE_SECCOMP_TESTS ctests += dtls-with-seccomp tls-with-seccomp dtls-client-with-seccomp tls-client-with-seccomp diff --git a/tests/set_key.c b/tests/set_key.c new file mode 100644 index 0000000000..deae8a335b --- /dev/null +++ b/tests/set_key.c @@ -0,0 +1,248 @@ +/* + * Copyright (C) 2016 Red Hat, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +/* Parts copied from GnuTLS example programs. */ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include +#include +#include +#if !defined(_WIN32) +#include +#include +#include +#include +#endif +#include +#include +#include +#include +#include +#include + +#include "cert-common.h" +#include "utils.h" + +/* Test for gnutls_certificate_set_key() + * + */ + +static void tls_log_func(int level, const char *str) +{ + fprintf(stderr, "<%d>| %s", level, str); +} + +static time_t mytime(time_t * t) +{ + time_t then = 1461671166; + if (t) + *t = then; + + return then; +} + +static unsigned import_key(gnutls_certificate_credentials_t xcred, const gnutls_datum_t *skey, const gnutls_datum_t *cert) +{ + gnutls_pcert_st pcert_list[16]; + gnutls_privkey_t key; + unsigned pcert_list_size, idx, i; + gnutls_datum_t tcert; + const char *names[] = {"localhost", "localhost2"}; + int ret; + + assert(gnutls_privkey_init(&key)>=0); + + pcert_list_size = sizeof(pcert_list)/sizeof(pcert_list[0]); + ret = gnutls_pcert_list_import_x509_raw(pcert_list, &pcert_list_size, + cert, GNUTLS_X509_FMT_PEM, 0); + if (ret < 0) { + fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_privkey_import_x509_raw(key, skey, GNUTLS_X509_FMT_PEM, NULL, 0); + if (ret < 0) { + fail("error in key import: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_certificate_set_key(xcred, names, 2, pcert_list, + pcert_list_size, key); + if (ret < 0) { + fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); + exit(1); + } + + /* return index */ + idx = ret; + + /* verify whether the stored certificate match the ones we have */ + for (i=0;i= 0); + assert(gnutls_certificate_allocate_credentials(&x509_cred)>=0); + + ret = gnutls_certificate_set_x509_trust_mem(clicred, &ca_cert, GNUTLS_X509_FMT_PEM); + if (ret < 0) + fail("set_x509_trust_file failed: %s\n", gnutls_strerror(ret)); + + idx = import_key(x509_cred, &server_key, &server_cert); + assert(idx == 0); + + test_cli_serv(x509_cred, clicred, "NORMAL", "localhost", NULL, NULL, NULL); + + /* verify that we can add certs, and that their index will change */ + for (i=0;i<16;i++) { + idx = import_key(x509_cred, &server_ecc_key, &server_ecc_cert); + assert(idx == 1+i); + } + + gnutls_certificate_free_credentials(x509_cred); + gnutls_certificate_free_credentials(clicred); + + gnutls_global_deinit(); + + if (debug) + success("success"); +} + +static void auto_parse(void) +{ + gnutls_certificate_credentials_t x509_cred, clicred; + gnutls_pcert_st pcert_list[16]; + gnutls_privkey_t key; + gnutls_pcert_st second_pcert[2]; + gnutls_privkey_t second_key; + unsigned pcert_list_size; + int ret; + + /* this must be called once in the program + */ + global_init(); + + gnutls_global_set_time_function(time); + + gnutls_global_set_log_function(tls_log_func); + if (debug) + gnutls_global_set_log_level(6); + + assert(gnutls_certificate_allocate_credentials(&x509_cred)>=0); + assert(gnutls_privkey_init(&key)>=0); + + assert(gnutls_certificate_allocate_credentials(&clicred) >= 0); + + ret = gnutls_certificate_set_x509_trust_mem(clicred, &ca3_cert, GNUTLS_X509_FMT_PEM); + if (ret < 0) + fail("set_x509_trust_file failed: %s\n", gnutls_strerror(ret)); + + pcert_list_size = sizeof(pcert_list)/sizeof(pcert_list[0]); + ret = gnutls_pcert_list_import_x509_raw(pcert_list, &pcert_list_size, + &server_ca3_localhost_cert_chain, GNUTLS_X509_FMT_PEM, 0); + if (ret < 0) { + fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_privkey_import_x509_raw(key, &server_ca3_key, GNUTLS_X509_FMT_PEM, NULL, 0); + if (ret < 0) { + fail("error in key import: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_certificate_set_key(x509_cred, NULL, 0, pcert_list, + pcert_list_size, key); + if (ret < 0) { + fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); + exit(1); + } + + /* set the ECC key */ + assert(gnutls_privkey_init(&second_key)>=0); + + pcert_list_size = 2; + ret = gnutls_pcert_list_import_x509_raw(second_pcert, &pcert_list_size, + &server_ca3_localhost6_cert_chain, GNUTLS_X509_FMT_PEM, 0); + if (ret < 0) { + fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_privkey_import_x509_raw(second_key, &server_ca3_key, GNUTLS_X509_FMT_PEM, NULL, 0); + if (ret < 0) { + fail("error in key import: %s\n", gnutls_strerror(ret)); + } + + ret = gnutls_certificate_set_key(x509_cred, NULL, 0, second_pcert, + 2, second_key); + if (ret < 0) { + fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); + exit(1); + } + + test_cli_serv(x509_cred, clicred, "NORMAL", "localhost", NULL, NULL, NULL); /* the DNS name of the first cert */ + test_cli_serv(x509_cred, clicred, "NORMAL", "localhost6", NULL, NULL, NULL); /* the DNS name of ECC cert */ + test_cli_serv(x509_cred, clicred, "NORMAL", "www.none.org", NULL, NULL, NULL); /* the DNS name of ECC cert */ + + gnutls_certificate_free_credentials(x509_cred); + gnutls_certificate_free_credentials(clicred); + + gnutls_global_deinit(); + + if (debug) + success("success"); +} + +void doit(void) +{ + basic(); + auto_parse(); +} diff --git a/tests/set_x509_key.c b/tests/set_x509_key.c index deae8a335b..aa540144a8 100644 --- a/tests/set_x509_key.c +++ b/tests/set_x509_key.c @@ -45,8 +45,9 @@ #include "cert-common.h" #include "utils.h" +#define MIN(x,y) (((x)<(y))?(x):(y)) -/* Test for gnutls_certificate_set_key() +/* Test for gnutls_certificate_set_x509_key() * */ @@ -64,33 +65,49 @@ static time_t mytime(time_t * t) return then; } +static void compare(const gnutls_datum_t *der, const void *ipem) +{ + gnutls_datum_t pem = {(void*)ipem, strlen((char*)ipem)}; + gnutls_datum_t new_der; + int ret; + + ret = gnutls_pem_base64_decode2("CERTIFICATE", &pem, &new_der); + if (ret < 0) { + fail("error: %s\n", gnutls_strerror(ret)); + } + + if (der->size != new_der.size || memcmp(der->data, new_der.data, der->size) != 0) { + fail("error in %d: %s\n", __LINE__, "cert don't match"); + exit(1); + } + gnutls_free(new_der.data); + return; +} + static unsigned import_key(gnutls_certificate_credentials_t xcred, const gnutls_datum_t *skey, const gnutls_datum_t *cert) { - gnutls_pcert_st pcert_list[16]; - gnutls_privkey_t key; - unsigned pcert_list_size, idx, i; + gnutls_x509_privkey_t key; + gnutls_x509_crt_t *crt_list; + unsigned crt_list_size, idx, i; gnutls_datum_t tcert; - const char *names[] = {"localhost", "localhost2"}; int ret; - assert(gnutls_privkey_init(&key)>=0); + assert(gnutls_x509_privkey_init(&key)>=0); - pcert_list_size = sizeof(pcert_list)/sizeof(pcert_list[0]); - ret = gnutls_pcert_list_import_x509_raw(pcert_list, &pcert_list_size, - cert, GNUTLS_X509_FMT_PEM, 0); + ret = gnutls_x509_crt_list_import2(&crt_list, &crt_list_size, cert, GNUTLS_X509_FMT_PEM, 0); if (ret < 0) { - fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); + fail("error in gnutls_x509_crt_list_import2: %s\n", gnutls_strerror(ret)); } - ret = gnutls_privkey_import_x509_raw(key, skey, GNUTLS_X509_FMT_PEM, NULL, 0); + ret = gnutls_x509_privkey_import(key, skey, GNUTLS_X509_FMT_PEM); if (ret < 0) { fail("error in key import: %s\n", gnutls_strerror(ret)); } - ret = gnutls_certificate_set_key(xcred, names, 2, pcert_list, - pcert_list_size, key); + ret = gnutls_certificate_set_x509_key(xcred, crt_list, + crt_list_size, key); if (ret < 0) { - fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); + fail("error in gnutls_certificate_set_x509_key: %s\n", gnutls_strerror(ret)); exit(1); } @@ -98,23 +115,26 @@ static unsigned import_key(gnutls_certificate_credentials_t xcred, const gnutls_ idx = ret; /* verify whether the stored certificate match the ones we have */ - for (i=0;idata+i); + } + + gnutls_x509_privkey_deinit(key); + for (i=0;i=0); - assert(gnutls_privkey_init(&key)>=0); - - assert(gnutls_certificate_allocate_credentials(&clicred) >= 0); - - ret = gnutls_certificate_set_x509_trust_mem(clicred, &ca3_cert, GNUTLS_X509_FMT_PEM); - if (ret < 0) - fail("set_x509_trust_file failed: %s\n", gnutls_strerror(ret)); - - pcert_list_size = sizeof(pcert_list)/sizeof(pcert_list[0]); - ret = gnutls_pcert_list_import_x509_raw(pcert_list, &pcert_list_size, - &server_ca3_localhost_cert_chain, GNUTLS_X509_FMT_PEM, 0); - if (ret < 0) { - fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); - } - - ret = gnutls_privkey_import_x509_raw(key, &server_ca3_key, GNUTLS_X509_FMT_PEM, NULL, 0); - if (ret < 0) { - fail("error in key import: %s\n", gnutls_strerror(ret)); - } - - ret = gnutls_certificate_set_key(x509_cred, NULL, 0, pcert_list, - pcert_list_size, key); - if (ret < 0) { - fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); - exit(1); - } - - /* set the ECC key */ - assert(gnutls_privkey_init(&second_key)>=0); - - pcert_list_size = 2; - ret = gnutls_pcert_list_import_x509_raw(second_pcert, &pcert_list_size, - &server_ca3_localhost6_cert_chain, GNUTLS_X509_FMT_PEM, 0); - if (ret < 0) { - fail("error in gnutls_pcert_list_import_x509_raw: %s\n", gnutls_strerror(ret)); - } - - ret = gnutls_privkey_import_x509_raw(second_key, &server_ca3_key, GNUTLS_X509_FMT_PEM, NULL, 0); - if (ret < 0) { - fail("error in key import: %s\n", gnutls_strerror(ret)); - } - - ret = gnutls_certificate_set_key(x509_cred, NULL, 0, second_pcert, - 2, second_key); - if (ret < 0) { - fail("error in gnutls_certificate_set_key: %s\n", gnutls_strerror(ret)); - exit(1); - } - - test_cli_serv(x509_cred, clicred, "NORMAL", "localhost", NULL, NULL, NULL); /* the DNS name of the first cert */ - test_cli_serv(x509_cred, clicred, "NORMAL", "localhost6", NULL, NULL, NULL); /* the DNS name of ECC cert */ - test_cli_serv(x509_cred, clicred, "NORMAL", "www.none.org", NULL, NULL, NULL); /* the DNS name of ECC cert */ - - gnutls_certificate_free_credentials(x509_cred); - gnutls_certificate_free_credentials(clicred); - - gnutls_global_deinit(); - - if (debug) - success("success"); -} - -void doit(void) -{ - basic(); - auto_parse(); -} -- cgit v1.2.1