1da668aa1SThomas Huth /* 2da668aa1SThomas Huth * Copyright (C) 2015 Red Hat, Inc. 3da668aa1SThomas Huth * 4da668aa1SThomas Huth * This library is free software; you can redistribute it and/or 5da668aa1SThomas Huth * modify it under the terms of the GNU Lesser General Public 6da668aa1SThomas Huth * License as published by the Free Software Foundation; either 7da668aa1SThomas Huth * version 2.1 of the License, or (at your option) any later version. 8da668aa1SThomas Huth * 9da668aa1SThomas Huth * This library is distributed in the hope that it will be useful, 10da668aa1SThomas Huth * but WITHOUT ANY WARRANTY; without even the implied warranty of 11da668aa1SThomas Huth * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12da668aa1SThomas Huth * Lesser General Public License for more details. 13da668aa1SThomas Huth * 14da668aa1SThomas Huth * You should have received a copy of the GNU Lesser General Public 15da668aa1SThomas Huth * License along with this library. If not, see 16da668aa1SThomas Huth * <http://www.gnu.org/licenses/>. 17da668aa1SThomas Huth * 18da668aa1SThomas Huth * Author: Daniel P. Berrange <berrange@redhat.com> 19da668aa1SThomas Huth */ 20da668aa1SThomas Huth 21da668aa1SThomas Huth #include "qemu/osdep.h" 22da668aa1SThomas Huth 23da668aa1SThomas Huth #include "crypto-tls-x509-helpers.h" 24da668aa1SThomas Huth #include "crypto/init.h" 25da668aa1SThomas Huth #include "qemu/sockets.h" 26da668aa1SThomas Huth 27da668aa1SThomas Huth /* 28da668aa1SThomas Huth * This stores some static data that is needed when 29da668aa1SThomas Huth * encoding extensions in the x509 certs 30da668aa1SThomas Huth */ 31da668aa1SThomas Huth asn1_node pkix_asn1; 32da668aa1SThomas Huth 33da668aa1SThomas Huth /* 34da668aa1SThomas Huth * To avoid consuming random entropy to generate keys, 35da668aa1SThomas Huth * here's one we prepared earlier :-) 36da668aa1SThomas Huth */ 37da668aa1SThomas Huth gnutls_x509_privkey_t privkey; 38da668aa1SThomas Huth # define PRIVATE_KEY \ 39da668aa1SThomas Huth "-----BEGIN RSA PRIVATE KEY-----\n" \ 40da668aa1SThomas Huth "MIIG5AIBAAKCAYEAyjWyLSNm5PZvYUKUcDWGqbLX10b2ood+YaFjWSnJrqx/q3qh\n" \ 41da668aa1SThomas Huth "rVGBJglD25AJENJsmZF3zPP1oMhfIxsXu63Hdkb6Rdlc2RUoUP34x9VC1izH25mR\n" \ 42da668aa1SThomas Huth "6c8DPDp1d6IraZ/llDMI1HsBFz0qGWtvOHgm815XG4PAr/N8rDsuqfv/cJ01KlnO\n" \ 43da668aa1SThomas Huth "0OdO5QRXCJf9g/dYd41MPu7wOXk9FqjQlmRoP59HgtJ+zUpE4z+Keruw9cMT9VJj\n" \ 44da668aa1SThomas Huth "0oT+pQ9ysenqeZ3gbT224T1khrEhT5kifhtFLNyDssRchUUWH0hiqoOO1vgb+850\n" \ 45da668aa1SThomas Huth "W6/1VdxvuPam48py4diSPi1Vip8NITCOBaX9FIpVp4Ruw4rTPVMNMjq9Cpx/DwMP\n" \ 46da668aa1SThomas Huth "9MbfXfnaVaZaMrmq67/zPhl0eVbUrecH2hQ3ZB9oIF4GkNskzlWF5+yPy6zqk304\n" \ 47da668aa1SThomas Huth "AKaiFR6jRyh3YfHo2XFqV8x/hxdsIEXOtEUGhSIcpynsW+ckUCartzu7xbhXjd4b\n" \ 48da668aa1SThomas Huth "kxJT89+riPFYij09AgMBAAECggGBAKyFkaZXXROeejrmHlV6JZGlp+fhgM38gkRz\n" \ 49da668aa1SThomas Huth "+Jp7P7rLLAY3E7gXIPQ91WqAAmwazFNdvHPd9USfkCQYmnAi/VoZhrCPmlsQZRxt\n" \ 50da668aa1SThomas Huth "A5QjjOnEvSPMa6SrXZxGWDCg6R8uMCb4P+FhrPWR1thnRDZOtRTQ+crc50p3mHgt\n" \ 51da668aa1SThomas Huth "6ktXWIJRbqnag8zSfQqCYGtRmhe8sfsWT+Yl4El4+jjaAVU/B364u7+PLmaiphGp\n" \ 52da668aa1SThomas Huth "BdJfTsTwEpgtGkPj+osDmhzXcZkfq3V+fz5JLkemsCiQKmn4VJRpg8c3ZmE8NPNt\n" \ 53da668aa1SThomas Huth "gRtGWZ4W3WKDvhotT65WpQx4+6R8Duux/blNPBmH1Upmwd7kj7GYFBArbCjgd9PT\n" \ 54da668aa1SThomas Huth "xgfCSUZpgOZHHkcgSB+022a8XncXna7WYYij28SLtwImFyu0nNtqECFQHH5u+k6C\n" \ 55da668aa1SThomas Huth "LRYBSN+3t3At8dQuk01NVrJBndmjmXRfxpqUtTdeaNgVpdUYRY98s30G68NYGSra\n" \ 56da668aa1SThomas Huth "aEvhhRSghkcLNetkobpY9pUgeqW/tQKBwQDZHHK9nDMt/zk1TxtILeUSitPXcv1/\n" \ 57da668aa1SThomas Huth "8ufXqO0miHdH23XuXhIEA6Ef26RRVGDGgpjkveDJK/1w5feJ4H/ni4Vclil/cm38\n" \ 58da668aa1SThomas Huth "OwRqjjd7ElHJX6JQbsxEx/gNTk5/QW1iAL9TXUalgepsSXYT6AJ0/CJv0jmJSJ36\n" \ 59da668aa1SThomas Huth "YoKMOM8uqzb2KhN6i+RlJRi5iY53kUhWTJq5ArWvNhUzQNSYODI4bNxlsKSBL2Ik\n" \ 60da668aa1SThomas Huth "LZ5QKHuaEjQet0IlPlfIb4PzMm8CHa/urOcCgcEA7m3zW/lL5bIFoKPjWig5Lbn1\n" \ 61da668aa1SThomas Huth "aHfrG2ngqzWtgWtfZqMH8OkZc1Mdhhmvd46titjiLjeI+UP/uHXR0068PnrNngzl\n" \ 62da668aa1SThomas Huth "tTgwlakzu+bWzqhBm1F+3/341st/FEk07r0P/3/PhezVjwfO8c8Exj7pLxH4wrH0\n" \ 63da668aa1SThomas Huth "ROHgDbClmlJRu6OO78wk1+Vapf5DWa8YfA+q+fdvr7KvgGyytheKMT/b/dsqOq7y\n" \ 64da668aa1SThomas Huth "qZPjmaJKWAvV3RWG8lWHFSdHx2IAHMHfGr17Y/w7AoHBALzwZeYebeekiVucGSjq\n" \ 65da668aa1SThomas Huth "T8SgLhT7zCIx+JMUPjVfYzaUhP/Iu7Lkma6IzWm9nW6Drpy5pUpMzwUWDCLfzU9q\n" \ 66da668aa1SThomas Huth "eseFIl337kEn9wLn+t5OpgAyCqYmlftxbqvdrrBN9uvnrJjWvqk/8wsDrw9JxAGc\n" \ 67da668aa1SThomas Huth "fjeD4nBXUqvYWLXApoR9mZoGKedmoH9pFig4zlO9ig8YITnKYuQ0k6SD0b8agJHc\n" \ 68da668aa1SThomas Huth "Ir0YSUDnRGgpjvFBGbeOCe+FGbohk/EpItJc3IAh5740lwKBwAdXd2DjokSmYKn7\n" \ 69da668aa1SThomas Huth "oeqKxofz6+yVlLW5YuOiuX78sWlVp87xPolgi84vSEnkKM/Xsc8+goc6YstpRVa+\n" \ 70da668aa1SThomas Huth "W+mImoA9YW1dF5HkLeWhTAf9AlgoAEIhbeIfTgBv6KNZSv7RDrDPBBxtXx/vAfSg\n" \ 71da668aa1SThomas Huth "x0ldwk0scZsVYXLKd67yzfV7KdGUdaX4N/xYgfZm/9gCG3+q8NN2KxVHQ5F71BOE\n" \ 72da668aa1SThomas Huth "JeABOaGo9WvnU+DNMIDZjHJMUWVw4MHz/a/UArDf/2CxaPVBNQKBwASg6j4ohSTk\n" \ 73da668aa1SThomas Huth "J7aE6RQ3OBmmDDpixcoCJt9u9SjHVYMlbs5CEJGVSczk0SG3y8P1lOWNDSRnMksZ\n" \ 74da668aa1SThomas Huth "xWnHdP/ogcuYMuvK7UACNAF0zNddtzOhzcpNmejFj+WCHYY/UmPr2/Kf6t7Cxk2K\n" \ 75da668aa1SThomas Huth "3cZ4tqWsiTmBT8Bknmah7L5DrhS+ZBJliDeFAA8fZHdMH0Xjr4UBp9kF90EMTdW1\n" \ 76da668aa1SThomas Huth "Xr5uz7ZrMsYpYQI7mmyqV9SSjUg4iBXwVSoag1iDJ1K8Qg/L7Semgg==\n" \ 77da668aa1SThomas Huth "-----END RSA PRIVATE KEY-----\n" 78da668aa1SThomas Huth 79da668aa1SThomas Huth /* 80da668aa1SThomas Huth * This loads the private key we defined earlier 81da668aa1SThomas Huth */ 82da668aa1SThomas Huth static gnutls_x509_privkey_t test_tls_load_key(void) 83da668aa1SThomas Huth { 84da668aa1SThomas Huth gnutls_x509_privkey_t key; 85da668aa1SThomas Huth const gnutls_datum_t data = { (unsigned char *)PRIVATE_KEY, 86da668aa1SThomas Huth strlen(PRIVATE_KEY) }; 87da668aa1SThomas Huth int err; 88da668aa1SThomas Huth 89da668aa1SThomas Huth err = gnutls_x509_privkey_init(&key); 90da668aa1SThomas Huth if (err < 0) { 91da668aa1SThomas Huth g_critical("Failed to init key %s", gnutls_strerror(err)); 92da668aa1SThomas Huth abort(); 93da668aa1SThomas Huth } 94da668aa1SThomas Huth 95da668aa1SThomas Huth err = gnutls_x509_privkey_import(key, &data, 96da668aa1SThomas Huth GNUTLS_X509_FMT_PEM); 97da668aa1SThomas Huth if (err < 0) { 98da668aa1SThomas Huth if (err != GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR && 99da668aa1SThomas Huth err != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) { 100da668aa1SThomas Huth g_critical("Failed to import key %s", gnutls_strerror(err)); 101da668aa1SThomas Huth abort(); 102da668aa1SThomas Huth } 103da668aa1SThomas Huth 104da668aa1SThomas Huth err = gnutls_x509_privkey_import_pkcs8( 105da668aa1SThomas Huth key, &data, GNUTLS_X509_FMT_PEM, NULL, 0); 106da668aa1SThomas Huth if (err < 0) { 107da668aa1SThomas Huth g_critical("Failed to import PKCS8 key %s", gnutls_strerror(err)); 108da668aa1SThomas Huth abort(); 109da668aa1SThomas Huth } 110da668aa1SThomas Huth } 111da668aa1SThomas Huth 112da668aa1SThomas Huth return key; 113da668aa1SThomas Huth } 114da668aa1SThomas Huth 115da668aa1SThomas Huth 116da668aa1SThomas Huth void test_tls_init(const char *keyfile) 117da668aa1SThomas Huth { 118da668aa1SThomas Huth qcrypto_init(&error_abort); 119da668aa1SThomas Huth 120da668aa1SThomas Huth if (asn1_array2tree(pkix_asn1_tab, &pkix_asn1, NULL) != ASN1_SUCCESS) { 121da668aa1SThomas Huth abort(); 122da668aa1SThomas Huth } 123da668aa1SThomas Huth 124da668aa1SThomas Huth privkey = test_tls_load_key(); 125da668aa1SThomas Huth if (!g_file_set_contents(keyfile, PRIVATE_KEY, -1, NULL)) { 126da668aa1SThomas Huth abort(); 127da668aa1SThomas Huth } 128da668aa1SThomas Huth } 129da668aa1SThomas Huth 130da668aa1SThomas Huth 131da668aa1SThomas Huth void test_tls_cleanup(const char *keyfile) 132da668aa1SThomas Huth { 133da668aa1SThomas Huth asn1_delete_structure(&pkix_asn1); 134da668aa1SThomas Huth unlink(keyfile); 135da668aa1SThomas Huth } 136da668aa1SThomas Huth 137da668aa1SThomas Huth /* 138da668aa1SThomas Huth * Turns an ASN1 object into a DER encoded byte array 139da668aa1SThomas Huth */ 140da668aa1SThomas Huth static void test_tls_der_encode(asn1_node src, 141da668aa1SThomas Huth const char *src_name, 142da668aa1SThomas Huth gnutls_datum_t *res) 143da668aa1SThomas Huth { 144da668aa1SThomas Huth int size; 145da668aa1SThomas Huth char *data = NULL; 146da668aa1SThomas Huth 147da668aa1SThomas Huth size = 0; 148da668aa1SThomas Huth asn1_der_coding(src, src_name, NULL, &size, NULL); 149da668aa1SThomas Huth 150da668aa1SThomas Huth data = g_new0(char, size); 151da668aa1SThomas Huth 152da668aa1SThomas Huth asn1_der_coding(src, src_name, data, &size, NULL); 153da668aa1SThomas Huth 154da668aa1SThomas Huth res->data = (unsigned char *)data; 155da668aa1SThomas Huth res->size = size; 156da668aa1SThomas Huth } 157da668aa1SThomas Huth 158da668aa1SThomas Huth 159da668aa1SThomas Huth static void 160da668aa1SThomas Huth test_tls_get_ipaddr(const char *addrstr, 161da668aa1SThomas Huth char **data, 162da668aa1SThomas Huth int *datalen) 163da668aa1SThomas Huth { 164da668aa1SThomas Huth struct addrinfo *res; 165da668aa1SThomas Huth struct addrinfo hints; 166da668aa1SThomas Huth 167da668aa1SThomas Huth memset(&hints, 0, sizeof(hints)); 168da668aa1SThomas Huth hints.ai_flags = AI_NUMERICHOST; 169da668aa1SThomas Huth g_assert(getaddrinfo(addrstr, NULL, &hints, &res) == 0); 170da668aa1SThomas Huth 171*c98ce274SDaniel P. Berrangé if (res->ai_family == AF_INET) { 172*c98ce274SDaniel P. Berrangé struct sockaddr_in *in = (struct sockaddr_in *)res->ai_addr; 173*c98ce274SDaniel P. Berrangé *datalen = sizeof(in->sin_addr); 174da668aa1SThomas Huth *data = g_new(char, *datalen); 175*c98ce274SDaniel P. Berrangé memcpy(*data, &in->sin_addr, *datalen); 176*c98ce274SDaniel P. Berrangé } else if (res->ai_family == AF_INET6) { 177*c98ce274SDaniel P. Berrangé struct sockaddr_in6 *in = (struct sockaddr_in6 *)res->ai_addr; 178*c98ce274SDaniel P. Berrangé *datalen = sizeof(in->sin6_addr); 179*c98ce274SDaniel P. Berrangé *data = g_new(char, *datalen); 180*c98ce274SDaniel P. Berrangé memcpy(*data, &in->sin6_addr, *datalen); 181*c98ce274SDaniel P. Berrangé } else { 182*c98ce274SDaniel P. Berrangé g_assert_not_reached(); 183*c98ce274SDaniel P. Berrangé } 184da668aa1SThomas Huth freeaddrinfo(res); 185da668aa1SThomas Huth } 186da668aa1SThomas Huth 187da668aa1SThomas Huth /* 188da668aa1SThomas Huth * This is a fairly lame x509 certificate generator. 189da668aa1SThomas Huth * 190da668aa1SThomas Huth * Do not copy/use this code for generating real certificates 191da668aa1SThomas Huth * since it leaves out many things that you would want in 192da668aa1SThomas Huth * certificates for real world usage. 193da668aa1SThomas Huth * 194da668aa1SThomas Huth * This is good enough only for doing tests of the QEMU 195da668aa1SThomas Huth * TLS certificate code 196da668aa1SThomas Huth */ 197da668aa1SThomas Huth void 198da668aa1SThomas Huth test_tls_generate_cert(QCryptoTLSTestCertReq *req, 199da668aa1SThomas Huth gnutls_x509_crt_t ca) 200da668aa1SThomas Huth { 201da668aa1SThomas Huth gnutls_x509_crt_t crt; 202da668aa1SThomas Huth int err; 203da668aa1SThomas Huth static char buffer[1024 * 1024]; 204da668aa1SThomas Huth size_t size = sizeof(buffer); 205da668aa1SThomas Huth char serial[5] = { 1, 2, 3, 4, 0 }; 206da668aa1SThomas Huth gnutls_datum_t der; 207da668aa1SThomas Huth time_t start = time(NULL) + (60 * 60 * req->start_offset); 208da668aa1SThomas Huth time_t expire = time(NULL) + (60 * 60 * (req->expire_offset 209da668aa1SThomas Huth ? req->expire_offset : 24)); 210da668aa1SThomas Huth 211da668aa1SThomas Huth /* 212da668aa1SThomas Huth * Prepare our new certificate object 213da668aa1SThomas Huth */ 214da668aa1SThomas Huth err = gnutls_x509_crt_init(&crt); 215da668aa1SThomas Huth if (err < 0) { 216da668aa1SThomas Huth g_critical("Failed to initialize certificate %s", gnutls_strerror(err)); 217da668aa1SThomas Huth abort(); 218da668aa1SThomas Huth } 219da668aa1SThomas Huth err = gnutls_x509_crt_set_key(crt, privkey); 220da668aa1SThomas Huth if (err < 0) { 221da668aa1SThomas Huth g_critical("Failed to set certificate key %s", gnutls_strerror(err)); 222da668aa1SThomas Huth abort(); 223da668aa1SThomas Huth } 224da668aa1SThomas Huth 225da668aa1SThomas Huth /* 226da668aa1SThomas Huth * A v3 certificate is required in order to be able 227da668aa1SThomas Huth * set any of the basic constraints, key purpose and 228da668aa1SThomas Huth * key usage data 229da668aa1SThomas Huth */ 230da668aa1SThomas Huth gnutls_x509_crt_set_version(crt, 3); 231da668aa1SThomas Huth 232da668aa1SThomas Huth if (req->country) { 233da668aa1SThomas Huth err = gnutls_x509_crt_set_dn_by_oid( 234da668aa1SThomas Huth crt, GNUTLS_OID_X520_COUNTRY_NAME, 0, 235da668aa1SThomas Huth req->country, strlen(req->country)); 236da668aa1SThomas Huth if (err < 0) { 237da668aa1SThomas Huth g_critical("Failed to set certificate country name %s", 238da668aa1SThomas Huth gnutls_strerror(err)); 239da668aa1SThomas Huth abort(); 240da668aa1SThomas Huth } 241da668aa1SThomas Huth } 242da668aa1SThomas Huth if (req->cn) { 243da668aa1SThomas Huth err = gnutls_x509_crt_set_dn_by_oid( 244da668aa1SThomas Huth crt, GNUTLS_OID_X520_COMMON_NAME, 0, 245da668aa1SThomas Huth req->cn, strlen(req->cn)); 246da668aa1SThomas Huth if (err < 0) { 247da668aa1SThomas Huth g_critical("Failed to set certificate common name %s", 248da668aa1SThomas Huth gnutls_strerror(err)); 249da668aa1SThomas Huth abort(); 250da668aa1SThomas Huth } 251da668aa1SThomas Huth } 252da668aa1SThomas Huth 253da668aa1SThomas Huth /* 254da668aa1SThomas Huth * Setup the subject altnames, which are used 255da668aa1SThomas Huth * for hostname checks in live sessions 256da668aa1SThomas Huth */ 257da668aa1SThomas Huth if (req->altname1) { 258da668aa1SThomas Huth err = gnutls_x509_crt_set_subject_alt_name( 259da668aa1SThomas Huth crt, GNUTLS_SAN_DNSNAME, 260da668aa1SThomas Huth req->altname1, 261da668aa1SThomas Huth strlen(req->altname1), 262da668aa1SThomas Huth GNUTLS_FSAN_APPEND); 263da668aa1SThomas Huth if (err < 0) { 264da668aa1SThomas Huth g_critical("Failed to set certificate alt name %s", 265da668aa1SThomas Huth gnutls_strerror(err)); 266da668aa1SThomas Huth abort(); 267da668aa1SThomas Huth } 268da668aa1SThomas Huth } 269da668aa1SThomas Huth if (req->altname2) { 270da668aa1SThomas Huth err = gnutls_x509_crt_set_subject_alt_name( 271da668aa1SThomas Huth crt, GNUTLS_SAN_DNSNAME, 272da668aa1SThomas Huth req->altname2, 273da668aa1SThomas Huth strlen(req->altname2), 274da668aa1SThomas Huth GNUTLS_FSAN_APPEND); 275da668aa1SThomas Huth if (err < 0) { 276da668aa1SThomas Huth g_critical("Failed to set certificate %s alt name", 277da668aa1SThomas Huth gnutls_strerror(err)); 278da668aa1SThomas Huth abort(); 279da668aa1SThomas Huth } 280da668aa1SThomas Huth } 281da668aa1SThomas Huth 282da668aa1SThomas Huth /* 283da668aa1SThomas Huth * IP address need to be put into the cert in their 284da668aa1SThomas Huth * raw byte form, not strings, hence this is a little 285da668aa1SThomas Huth * more complicated 286da668aa1SThomas Huth */ 287da668aa1SThomas Huth if (req->ipaddr1) { 288da668aa1SThomas Huth char *data; 289da668aa1SThomas Huth int len; 290da668aa1SThomas Huth 291da668aa1SThomas Huth test_tls_get_ipaddr(req->ipaddr1, &data, &len); 292da668aa1SThomas Huth 293da668aa1SThomas Huth err = gnutls_x509_crt_set_subject_alt_name( 294da668aa1SThomas Huth crt, GNUTLS_SAN_IPADDRESS, 295da668aa1SThomas Huth data, len, GNUTLS_FSAN_APPEND); 296da668aa1SThomas Huth if (err < 0) { 297da668aa1SThomas Huth g_critical("Failed to set certificate alt name %s", 298da668aa1SThomas Huth gnutls_strerror(err)); 299da668aa1SThomas Huth abort(); 300da668aa1SThomas Huth } 301da668aa1SThomas Huth g_free(data); 302da668aa1SThomas Huth } 303da668aa1SThomas Huth if (req->ipaddr2) { 304da668aa1SThomas Huth char *data; 305da668aa1SThomas Huth int len; 306da668aa1SThomas Huth 307da668aa1SThomas Huth test_tls_get_ipaddr(req->ipaddr2, &data, &len); 308da668aa1SThomas Huth 309da668aa1SThomas Huth err = gnutls_x509_crt_set_subject_alt_name( 310da668aa1SThomas Huth crt, GNUTLS_SAN_IPADDRESS, 311da668aa1SThomas Huth data, len, GNUTLS_FSAN_APPEND); 312da668aa1SThomas Huth if (err < 0) { 313da668aa1SThomas Huth g_critical("Failed to set certificate alt name %s", 314da668aa1SThomas Huth gnutls_strerror(err)); 315da668aa1SThomas Huth abort(); 316da668aa1SThomas Huth } 317da668aa1SThomas Huth g_free(data); 318da668aa1SThomas Huth } 319da668aa1SThomas Huth 320da668aa1SThomas Huth 321da668aa1SThomas Huth /* 322da668aa1SThomas Huth * Basic constraints are used to decide if the cert 323da668aa1SThomas Huth * is for a CA or not. We can't use the convenient 324da668aa1SThomas Huth * gnutls API for setting this, since it hardcodes 325da668aa1SThomas Huth * the 'critical' field which we want control over 326da668aa1SThomas Huth */ 327da668aa1SThomas Huth if (req->basicConstraintsEnable) { 328da668aa1SThomas Huth asn1_node ext = NULL; 329da668aa1SThomas Huth 330da668aa1SThomas Huth asn1_create_element(pkix_asn1, "PKIX1.BasicConstraints", &ext); 331da668aa1SThomas Huth asn1_write_value(ext, "cA", 332da668aa1SThomas Huth req->basicConstraintsIsCA ? "TRUE" : "FALSE", 1); 333da668aa1SThomas Huth asn1_write_value(ext, "pathLenConstraint", NULL, 0); 334da668aa1SThomas Huth test_tls_der_encode(ext, "", &der); 335da668aa1SThomas Huth err = gnutls_x509_crt_set_extension_by_oid( 336da668aa1SThomas Huth crt, "2.5.29.19", 337da668aa1SThomas Huth der.data, der.size, 338da668aa1SThomas Huth req->basicConstraintsCritical); 339da668aa1SThomas Huth if (err < 0) { 340da668aa1SThomas Huth g_critical("Failed to set certificate basic constraints %s", 341da668aa1SThomas Huth gnutls_strerror(err)); 342da668aa1SThomas Huth g_free(der.data); 343da668aa1SThomas Huth abort(); 344da668aa1SThomas Huth } 345da668aa1SThomas Huth asn1_delete_structure(&ext); 346da668aa1SThomas Huth g_free(der.data); 347da668aa1SThomas Huth } 348da668aa1SThomas Huth 349da668aa1SThomas Huth /* 350da668aa1SThomas Huth * Next up the key usage extension. Again we can't 351da668aa1SThomas Huth * use the gnutls API since it hardcodes the extension 352da668aa1SThomas Huth * to be 'critical' 353da668aa1SThomas Huth */ 354da668aa1SThomas Huth if (req->keyUsageEnable) { 355da668aa1SThomas Huth asn1_node ext = NULL; 356da668aa1SThomas Huth char str[2]; 357da668aa1SThomas Huth 358da668aa1SThomas Huth str[0] = req->keyUsageValue & 0xff; 359da668aa1SThomas Huth str[1] = (req->keyUsageValue >> 8) & 0xff; 360da668aa1SThomas Huth 361da668aa1SThomas Huth asn1_create_element(pkix_asn1, "PKIX1.KeyUsage", &ext); 362da668aa1SThomas Huth asn1_write_value(ext, "", str, 9); 363da668aa1SThomas Huth test_tls_der_encode(ext, "", &der); 364da668aa1SThomas Huth err = gnutls_x509_crt_set_extension_by_oid( 365da668aa1SThomas Huth crt, "2.5.29.15", 366da668aa1SThomas Huth der.data, der.size, 367da668aa1SThomas Huth req->keyUsageCritical); 368da668aa1SThomas Huth if (err < 0) { 369da668aa1SThomas Huth g_critical("Failed to set certificate key usage %s", 370da668aa1SThomas Huth gnutls_strerror(err)); 371da668aa1SThomas Huth g_free(der.data); 372da668aa1SThomas Huth abort(); 373da668aa1SThomas Huth } 374da668aa1SThomas Huth asn1_delete_structure(&ext); 375da668aa1SThomas Huth g_free(der.data); 376da668aa1SThomas Huth } 377da668aa1SThomas Huth 378da668aa1SThomas Huth /* 379da668aa1SThomas Huth * Finally the key purpose extension. This time 380da668aa1SThomas Huth * gnutls has the opposite problem, always hardcoding 381da668aa1SThomas Huth * it to be non-critical. So once again we have to 382da668aa1SThomas Huth * set this the hard way building up ASN1 data ourselves 383da668aa1SThomas Huth */ 384da668aa1SThomas Huth if (req->keyPurposeEnable) { 385da668aa1SThomas Huth asn1_node ext = NULL; 386da668aa1SThomas Huth 387da668aa1SThomas Huth asn1_create_element(pkix_asn1, "PKIX1.ExtKeyUsageSyntax", &ext); 388da668aa1SThomas Huth if (req->keyPurposeOID1) { 389da668aa1SThomas Huth asn1_write_value(ext, "", "NEW", 1); 390da668aa1SThomas Huth asn1_write_value(ext, "?LAST", req->keyPurposeOID1, 1); 391da668aa1SThomas Huth } 392da668aa1SThomas Huth if (req->keyPurposeOID2) { 393da668aa1SThomas Huth asn1_write_value(ext, "", "NEW", 1); 394da668aa1SThomas Huth asn1_write_value(ext, "?LAST", req->keyPurposeOID2, 1); 395da668aa1SThomas Huth } 396da668aa1SThomas Huth test_tls_der_encode(ext, "", &der); 397da668aa1SThomas Huth err = gnutls_x509_crt_set_extension_by_oid( 398da668aa1SThomas Huth crt, "2.5.29.37", 399da668aa1SThomas Huth der.data, der.size, 400da668aa1SThomas Huth req->keyPurposeCritical); 401da668aa1SThomas Huth if (err < 0) { 402da668aa1SThomas Huth g_critical("Failed to set certificate key purpose %s", 403da668aa1SThomas Huth gnutls_strerror(err)); 404da668aa1SThomas Huth g_free(der.data); 405da668aa1SThomas Huth abort(); 406da668aa1SThomas Huth } 407da668aa1SThomas Huth asn1_delete_structure(&ext); 408da668aa1SThomas Huth g_free(der.data); 409da668aa1SThomas Huth } 410da668aa1SThomas Huth 411da668aa1SThomas Huth /* 412da668aa1SThomas Huth * Any old serial number will do, so lets pick 5 413da668aa1SThomas Huth */ 414da668aa1SThomas Huth err = gnutls_x509_crt_set_serial(crt, serial, 5); 415da668aa1SThomas Huth if (err < 0) { 416da668aa1SThomas Huth g_critical("Failed to set certificate serial %s", 417da668aa1SThomas Huth gnutls_strerror(err)); 418da668aa1SThomas Huth abort(); 419da668aa1SThomas Huth } 420da668aa1SThomas Huth 421da668aa1SThomas Huth err = gnutls_x509_crt_set_activation_time(crt, start); 422da668aa1SThomas Huth if (err < 0) { 423da668aa1SThomas Huth g_critical("Failed to set certificate activation %s", 424da668aa1SThomas Huth gnutls_strerror(err)); 425da668aa1SThomas Huth abort(); 426da668aa1SThomas Huth } 427da668aa1SThomas Huth err = gnutls_x509_crt_set_expiration_time(crt, expire); 428da668aa1SThomas Huth if (err < 0) { 429da668aa1SThomas Huth g_critical("Failed to set certificate expiration %s", 430da668aa1SThomas Huth gnutls_strerror(err)); 431da668aa1SThomas Huth abort(); 432da668aa1SThomas Huth } 433da668aa1SThomas Huth 434da668aa1SThomas Huth 435da668aa1SThomas Huth /* 436da668aa1SThomas Huth * If no 'ca' is set then we are self signing 437da668aa1SThomas Huth * the cert. This is done for the root CA certs 438da668aa1SThomas Huth */ 439da668aa1SThomas Huth err = gnutls_x509_crt_sign2(crt, ca ? ca : crt, privkey, 440da668aa1SThomas Huth GNUTLS_DIG_SHA256, 0); 441da668aa1SThomas Huth if (err < 0) { 442da668aa1SThomas Huth g_critical("Failed to sign certificate %s", 443da668aa1SThomas Huth gnutls_strerror(err)); 444da668aa1SThomas Huth abort(); 445da668aa1SThomas Huth } 446da668aa1SThomas Huth 447da668aa1SThomas Huth /* 448da668aa1SThomas Huth * Finally write the new cert out to disk 449da668aa1SThomas Huth */ 450da668aa1SThomas Huth err = gnutls_x509_crt_export( 451da668aa1SThomas Huth crt, GNUTLS_X509_FMT_PEM, buffer, &size); 452da668aa1SThomas Huth if (err < 0) { 453da668aa1SThomas Huth g_critical("Failed to export certificate %s: %d", 454da668aa1SThomas Huth gnutls_strerror(err), err); 455da668aa1SThomas Huth abort(); 456da668aa1SThomas Huth } 457da668aa1SThomas Huth 458da668aa1SThomas Huth if (!g_file_set_contents(req->filename, buffer, -1, NULL)) { 459da668aa1SThomas Huth g_critical("Failed to write certificate %s", 460da668aa1SThomas Huth req->filename); 461da668aa1SThomas Huth abort(); 462da668aa1SThomas Huth } 463da668aa1SThomas Huth 464da668aa1SThomas Huth req->crt = crt; 465da668aa1SThomas Huth } 466da668aa1SThomas Huth 467da668aa1SThomas Huth 468da668aa1SThomas Huth void test_tls_write_cert_chain(const char *filename, 469da668aa1SThomas Huth gnutls_x509_crt_t *certs, 470da668aa1SThomas Huth size_t ncerts) 471da668aa1SThomas Huth { 472da668aa1SThomas Huth size_t i; 473da668aa1SThomas Huth size_t capacity = 1024, offset = 0; 474da668aa1SThomas Huth char *buffer = g_new0(char, capacity); 475da668aa1SThomas Huth int err; 476da668aa1SThomas Huth 477da668aa1SThomas Huth for (i = 0; i < ncerts; i++) { 478da668aa1SThomas Huth size_t len = capacity - offset; 479da668aa1SThomas Huth retry: 480da668aa1SThomas Huth err = gnutls_x509_crt_export(certs[i], GNUTLS_X509_FMT_PEM, 481da668aa1SThomas Huth buffer + offset, &len); 482da668aa1SThomas Huth if (err < 0) { 483da668aa1SThomas Huth if (err == GNUTLS_E_SHORT_MEMORY_BUFFER) { 484da668aa1SThomas Huth buffer = g_renew(char, buffer, offset + len); 485da668aa1SThomas Huth capacity = offset + len; 486da668aa1SThomas Huth goto retry; 487da668aa1SThomas Huth } 488da668aa1SThomas Huth g_critical("Failed to export certificate chain %s: %d", 489da668aa1SThomas Huth gnutls_strerror(err), err); 490da668aa1SThomas Huth abort(); 491da668aa1SThomas Huth } 492da668aa1SThomas Huth offset += len; 493da668aa1SThomas Huth } 494da668aa1SThomas Huth 495da668aa1SThomas Huth if (!g_file_set_contents(filename, buffer, offset, NULL)) { 496da668aa1SThomas Huth abort(); 497da668aa1SThomas Huth } 498da668aa1SThomas Huth g_free(buffer); 499da668aa1SThomas Huth } 500da668aa1SThomas Huth 501da668aa1SThomas Huth 502da668aa1SThomas Huth void test_tls_discard_cert(QCryptoTLSTestCertReq *req) 503da668aa1SThomas Huth { 504da668aa1SThomas Huth if (!req->crt) { 505da668aa1SThomas Huth return; 506da668aa1SThomas Huth } 507da668aa1SThomas Huth 508da668aa1SThomas Huth gnutls_x509_crt_deinit(req->crt); 509da668aa1SThomas Huth req->crt = NULL; 510da668aa1SThomas Huth 511da668aa1SThomas Huth if (getenv("QEMU_TEST_DEBUG_CERTS") == NULL) { 512da668aa1SThomas Huth unlink(req->filename); 513da668aa1SThomas Huth } 514da668aa1SThomas Huth } 515