1 /* 2 * Copyright (C) 2015 Red Hat, Inc. 3 * 4 * This library is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU Lesser General Public 6 * License as published by the Free Software Foundation; either 7 * version 2.1 of the License, or (at your option) any later version. 8 * 9 * This library is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 * Lesser General Public License for more details. 13 * 14 * You should have received a copy of the GNU Lesser General Public 15 * License along with this library. If not, see 16 * <http://www.gnu.org/licenses/>. 17 * 18 * Author: Daniel P. Berrange <berrange@redhat.com> 19 */ 20 21 #include <gnutls/gnutls.h> 22 #include <gnutls/x509.h> 23 24 #include <gnutls/gnutls.h> 25 #include <gnutls/x509.h> 26 27 #if !(defined WIN32) && \ 28 defined(CONFIG_TASN1) && \ 29 (LIBGNUTLS_VERSION_NUMBER >= 0x020600) 30 # define QCRYPTO_HAVE_TLS_TEST_SUPPORT 31 #endif 32 33 #ifdef QCRYPTO_HAVE_TLS_TEST_SUPPORT 34 # include <libtasn1.h> 35 36 # include "qemu-common.h" 37 38 /* 39 * This contains parameter about how to generate 40 * certificates. 41 */ 42 typedef struct QCryptoTLSTestCertReq QCryptoTLSTestCertReq; 43 struct QCryptoTLSTestCertReq { 44 gnutls_x509_crt_t crt; 45 46 const char *filename; 47 48 /* Identifying information */ 49 const char *country; 50 const char *cn; 51 const char *altname1; 52 const char *altname2; 53 const char *ipaddr1; 54 const char *ipaddr2; 55 56 /* Basic constraints */ 57 bool basicConstraintsEnable; 58 bool basicConstraintsCritical; 59 bool basicConstraintsIsCA; 60 61 /* Key usage */ 62 bool keyUsageEnable; 63 bool keyUsageCritical; 64 int keyUsageValue; 65 66 /* Key purpose (aka Extended key usage) */ 67 bool keyPurposeEnable; 68 bool keyPurposeCritical; 69 const char *keyPurposeOID1; 70 const char *keyPurposeOID2; 71 72 /* zero for current time, or non-zero for hours from now */ 73 int start_offset; 74 /* zero for 24 hours from now, or non-zero for hours from now */ 75 int expire_offset; 76 }; 77 78 void test_tls_generate_cert(QCryptoTLSTestCertReq *req, 79 gnutls_x509_crt_t ca); 80 void test_tls_write_cert_chain(const char *filename, 81 gnutls_x509_crt_t *certs, 82 size_t ncerts); 83 void test_tls_discard_cert(QCryptoTLSTestCertReq *req); 84 85 void test_tls_init(const char *keyfile); 86 void test_tls_cleanup(const char *keyfile); 87 88 # define TLS_CERT_REQ(varname, cavarname, \ 89 country, commonname, \ 90 altname1, altname2, \ 91 ipaddr1, ipaddr2, \ 92 basicconsenable, basicconscritical, basicconsca, \ 93 keyusageenable, keyusagecritical, keyusagevalue, \ 94 keypurposeenable, keypurposecritical, \ 95 keypurposeoid1, keypurposeoid2, \ 96 startoffset, endoffset) \ 97 static QCryptoTLSTestCertReq varname = { \ 98 NULL, WORKDIR #varname "-ctx.pem", \ 99 country, commonname, altname1, altname2, \ 100 ipaddr1, ipaddr2, \ 101 basicconsenable, basicconscritical, basicconsca, \ 102 keyusageenable, keyusagecritical, keyusagevalue, \ 103 keypurposeenable, keypurposecritical, \ 104 keypurposeoid1, keypurposeoid2, \ 105 startoffset, endoffset \ 106 }; \ 107 test_tls_generate_cert(&varname, cavarname.crt) 108 109 # define TLS_ROOT_REQ(varname, \ 110 country, commonname, \ 111 altname1, altname2, \ 112 ipaddr1, ipaddr2, \ 113 basicconsenable, basicconscritical, basicconsca, \ 114 keyusageenable, keyusagecritical, keyusagevalue, \ 115 keypurposeenable, keypurposecritical, \ 116 keypurposeoid1, keypurposeoid2, \ 117 startoffset, endoffset) \ 118 static QCryptoTLSTestCertReq varname = { \ 119 NULL, WORKDIR #varname "-ctx.pem", \ 120 country, commonname, altname1, altname2, \ 121 ipaddr1, ipaddr2, \ 122 basicconsenable, basicconscritical, basicconsca, \ 123 keyusageenable, keyusagecritical, keyusagevalue, \ 124 keypurposeenable, keypurposecritical, \ 125 keypurposeoid1, keypurposeoid2, \ 126 startoffset, endoffset \ 127 }; \ 128 test_tls_generate_cert(&varname, NULL) 129 130 extern const ASN1_ARRAY_TYPE pkix_asn1_tab[]; 131 132 #endif /* QCRYPTO_HAVE_TLS_TEST_SUPPORT */ 133