path: root/tests/x509_test.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls/x509.h>

#define MAX_FILE_SIZE 16*1024

struct file_res
{
  char *test_file;
  int result;
};

static struct file_res test_files[] = {
  {"test1.pem", 0},
  {"test2.pem", GNUTLS_CERT_NOT_TRUSTED},
  {"test3.pem", GNUTLS_CERT_INVALID | GNUTLS_CERT_NOT_TRUSTED},
  {"test10.pem", 0},
  {"test13.pem", GNUTLS_CERT_INVALID | GNUTLS_CERT_NOT_TRUSTED},
  {"test20.pem", GNUTLS_CERT_REVOKED | GNUTLS_CERT_NOT_TRUSTED},
  {"test21.pem", GNUTLS_CERT_REVOKED | GNUTLS_CERT_NOT_TRUSTED},
  {"test22.pem", GNUTLS_CERT_INVALID | GNUTLS_CERT_NOT_TRUSTED},
  {"test23.pem", GNUTLS_CERT_INVALID | GNUTLS_CERT_NOT_TRUSTED},
  {"test24.pem", 0},
  {"test25.pem", GNUTLS_CERT_INVALID | GNUTLS_CERT_NOT_TRUSTED},
  {"test26.pem", 0},
  {NULL, 0}
};

#define CA_FILE "ca.pem"

int _verify_x509_file (const char *certfile, const char *cafile);


static void
print_res (int x)
{
  if (x & GNUTLS_CERT_INVALID)
    printf ("- certificate is invalid\n");
  else
    printf ("- certificate is valid\n");
  if (x & GNUTLS_CERT_NOT_TRUSTED)
    printf ("- certificate is NOT trusted\n");
  else
    printf ("- certificate is trusted\n");

  if (x & GNUTLS_CERT_CORRUPTED)
    printf ("- Found a corrupted certificate.\n");

  if (x & GNUTLS_CERT_REVOKED)
    printf ("- certificate is revoked.\n");
}

int
main ()
{

  int x;
  char *file;
  int i = 0, exp_result;

  gnutls_global_init ();

  fprintf (stderr,
           "This test will perform some checks on X.509 certificate\n");
  fprintf (stderr, "verification functions.\n\n");

  for (;;)
    {
      exp_result = test_files[i].result;
      file = test_files[i++].test_file;

      if (file == NULL)
        break;
      x = _verify_x509_file (file, CA_FILE);

      if (x < 0)
        {
          fprintf (stderr, "Unexpected error: %d\n", x);
          exit (1);
        }
      printf ("Test %d, file %s: ", i, file);

      if (x != exp_result)
        {
          printf ("failed.\n");
          fflush (stdout);
          fprintf (stderr, "Unexpected error in verification.\n");
          fprintf (stderr, "Certificate was found to be: \n");
          print_res (x);
        }
      else
        {
          printf ("ok.");

          printf ("\n");
        }
    }

  printf ("\n");

  gnutls_global_deinit ();

  return 0;

}

#define CERT_SEP "-----BEGIN CERT"
#define CRL_SEP "-----BEGIN X509 CRL"

/* Verifies a base64 encoded certificate list from memory 
 */
int
_verify_x509_mem (const char *cert, int cert_size,
                  const char *ca, int ca_size, const char *crl, int crl_size)
{
  int siz, i;
  const char *ptr;
  int ret;
  unsigned int output;
  gnutls_datum_t tmp;
  gnutls_x509_crt *x509_cert_list = NULL;
  gnutls_x509_crt x509_ca;
  gnutls_x509_crl *x509_crl_list = NULL;
  int x509_ncerts, x509_ncrls;

  /* Decode the CA certificate
   */
  tmp.data = (char *) ca;
  tmp.size = ca_size;

  ret = gnutls_x509_crt_init (&x509_ca);
  if (ret < 0)
    {
      fprintf (stderr, "Error parsing the CA certificate: %s\n",
               gnutls_strerror (ret));
      exit (1);
    }

  ret = gnutls_x509_crt_import (x509_ca, &tmp, GNUTLS_X509_FMT_PEM);

  if (ret < 0)
    {
      fprintf (stderr, "Error parsing the CA certificate: %s\n",
               gnutls_strerror (ret));
      exit (1);
    }

  /* Decode the CRL list
   */
  siz = crl_size;
  ptr = crl;

  i = 1;

  if (strstr (ptr, CRL_SEP) != NULL)    /* if CRLs exist */
    do
      {
        x509_crl_list =
          (gnutls_x509_crl *) realloc (x509_crl_list,
                                       i * sizeof (gnutls_x509_crl));
        if (x509_crl_list == NULL)
          {
            fprintf (stderr, "memory error\n");
            exit (1);
          }

        tmp.data = (char *) ptr;
        tmp.size = siz;

        ret = gnutls_x509_crl_init (&x509_crl_list[i - 1]);
        if (ret < 0)
          {
            fprintf (stderr, "Error parsing the CRL[%d]: %s\n", i,
                     gnutls_strerror (ret));
            exit (1);
          }

        ret =
          gnutls_x509_crl_import (x509_crl_list[i - 1], &tmp,
                                  GNUTLS_X509_FMT_PEM);
        if (ret < 0)
          {
            fprintf (stderr, "Error parsing the CRL[%d]: %s\n", i,
                     gnutls_strerror (ret));
            exit (1);
          }

        /* now we move ptr after the pem header */
        ptr = strstr (ptr, CRL_SEP);
        if (ptr != NULL)
          ptr++;

        i++;
      }
    while ((ptr = strstr (ptr, CRL_SEP)) != NULL);

  x509_ncrls = i - 1;


  /* Decode the certificate chain. 
   */
  siz = cert_size;
  ptr = cert;

  i = 1;

  do
    {
      x509_cert_list =
        (gnutls_x509_crt *) realloc (x509_cert_list,
                                     i * sizeof (gnutls_x509_crt));
      if (x509_cert_list == NULL)
        {
          fprintf (stderr, "memory error\n");
          exit (1);
        }

      tmp.data = (char *) ptr;
      tmp.size = siz;

      ret = gnutls_x509_crt_init (&x509_cert_list[i - 1]);
      if (ret < 0)
        {
          fprintf (stderr, "Error parsing the certificate[%d]: %s\n", i,
                   gnutls_strerror (ret));
          exit (1);
        }

      ret =
        gnutls_x509_crt_import (x509_cert_list[i - 1], &tmp,
                                GNUTLS_X509_FMT_PEM);
      if (ret < 0)
        {
          fprintf (stderr, "Error parsing the certificate[%d]: %s\n", i,
                   gnutls_strerror (ret));
          exit (1);
        }

      /* now we move ptr after the pem header */
      ptr = strstr (ptr, CERT_SEP);
      if (ptr != NULL)
        ptr++;

      i++;
    }
  while ((ptr = strstr (ptr, CERT_SEP)) != NULL);

  x509_ncerts = i - 1;

  ret = gnutls_x509_crt_list_verify (x509_cert_list, x509_ncerts,
                                     &x509_ca, 1, x509_crl_list, x509_ncrls,
                                     0, &output);

  gnutls_x509_crt_deinit (x509_ca);

  for (i = 0; i < x509_ncerts; i++)
    {
      gnutls_x509_crt_deinit (x509_cert_list[i]);
    }

  for (i = 0; i < x509_ncrls; i++)
    {
      gnutls_x509_crl_deinit (x509_crl_list[i]);
    }

  free (x509_cert_list);
  free (x509_crl_list);

  if (ret < 0)
    {
      fprintf (stderr, "Error in verification: %s\n", gnutls_strerror (ret));
      exit (1);
    }

  return output;
}



/* Reads and verifies a base64 encoded certificate file 
 */
int
_verify_x509_file (const char *certfile, const char *cafile)
{
  int ca_size, cert_size;
  char ca[MAX_FILE_SIZE];
  char cert[MAX_FILE_SIZE];
  FILE *fd1;

  fd1 = fopen (certfile, "rb");
  if (fd1 == NULL)
    {
      fprintf (stderr, "error opening %s\n", certfile);
      return GNUTLS_E_FILE_ERROR;
    }

  cert_size = fread (cert, 1, sizeof (cert) - 1, fd1);
  fclose (fd1);

  cert[cert_size] = 0;


  fd1 = fopen (cafile, "rb");
  if (fd1 == NULL)
    {
      fprintf (stderr, "error opening %s\n", cafile);
      return GNUTLS_E_FILE_ERROR;
    }

  ca_size = fread (ca, 1, sizeof (ca) - 1, fd1);
  fclose (fd1);

  ca[ca_size] = 0;

  return _verify_x509_mem (cert, cert_size, ca, ca_size, cert, cert_size);
}