1 /*
2  * Copyright (C) 2015 Red Hat, Inc.
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation; either
7  * version 2.1 of the License, or (at your option) any later version.
8  *
9  * This library is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with this library.  If not, see
16  * <http://www.gnu.org/licenses/>.
17  *
18  * Author: Daniel P. Berrange <berrange@redhat.com>
19  */
20 
21 #ifndef TESTS_CRYPTO_TLS_X509_HELPERS_H
22 #define TESTS_CRYPTO_TLS_X509_HELPERS_H
23 
24 #include <gnutls/gnutls.h>
25 #include <gnutls/x509.h>
26 #include <libtasn1.h>
27 
28 
29 #define QCRYPTO_TLS_TEST_CLIENT_NAME "ACME QEMU Client"
30 #define QCRYPTO_TLS_TEST_CLIENT_HOSTILE_NAME "ACME Hostile Client"
31 
32 /*
33  * This contains parameter about how to generate
34  * certificates.
35  */
36 typedef struct QCryptoTLSTestCertReq QCryptoTLSTestCertReq;
37 struct QCryptoTLSTestCertReq {
38     gnutls_x509_crt_t crt;
39 
40     const char *filename;
41 
42     /* Identifying information */
43     const char *country;
44     const char *cn;
45     const char *altname1;
46     const char *altname2;
47     const char *ipaddr1;
48     const char *ipaddr2;
49 
50     /* Basic constraints */
51     bool basicConstraintsEnable;
52     bool basicConstraintsCritical;
53     bool basicConstraintsIsCA;
54 
55     /* Key usage */
56     bool keyUsageEnable;
57     bool keyUsageCritical;
58     int keyUsageValue;
59 
60     /* Key purpose (aka Extended key usage) */
61     bool keyPurposeEnable;
62     bool keyPurposeCritical;
63     const char *keyPurposeOID1;
64     const char *keyPurposeOID2;
65 
66     /* zero for current time, or non-zero for hours from now */
67     int start_offset;
68     /* zero for 24 hours from now, or non-zero for hours from now */
69     int expire_offset;
70 };
71 
72 void test_tls_generate_cert(QCryptoTLSTestCertReq *req,
73                             gnutls_x509_crt_t ca);
74 void test_tls_write_cert_chain(const char *filename,
75                                gnutls_x509_crt_t *certs,
76                                size_t ncerts);
77 void test_tls_discard_cert(QCryptoTLSTestCertReq *req);
78 
79 void test_tls_init(const char *keyfile);
80 void test_tls_cleanup(const char *keyfile);
81 
82 # define TLS_CERT_REQ(varname, cavarname,                               \
83                       country, commonname,                              \
84                       altname1, altname2,                               \
85                       ipaddr1, ipaddr2,                                 \
86                       basicconsenable, basicconscritical, basicconsca,  \
87                       keyusageenable, keyusagecritical, keyusagevalue,  \
88                       keypurposeenable, keypurposecritical,             \
89                       keypurposeoid1, keypurposeoid2,                   \
90                       startoffset, endoffset)                           \
91     static QCryptoTLSTestCertReq varname = {                            \
92         NULL, WORKDIR #varname "-ctx.pem",                              \
93         country, commonname, altname1, altname2,                        \
94         ipaddr1, ipaddr2,                                               \
95         basicconsenable, basicconscritical, basicconsca,                \
96         keyusageenable, keyusagecritical, keyusagevalue,                \
97         keypurposeenable, keypurposecritical,                           \
98         keypurposeoid1, keypurposeoid2,                                 \
99         startoffset, endoffset                                          \
100     };                                                                  \
101     test_tls_generate_cert(&varname, cavarname.crt)
102 
103 # define TLS_ROOT_REQ(varname,                                          \
104                       country, commonname,                              \
105                       altname1, altname2,                               \
106                       ipaddr1, ipaddr2,                                 \
107                       basicconsenable, basicconscritical, basicconsca,  \
108                       keyusageenable, keyusagecritical, keyusagevalue,  \
109                       keypurposeenable, keypurposecritical,             \
110                       keypurposeoid1, keypurposeoid2,                   \
111                       startoffset, endoffset)                           \
112     static QCryptoTLSTestCertReq varname = {                            \
113         NULL, WORKDIR #varname "-ctx.pem",                              \
114         country, commonname, altname1, altname2,                        \
115         ipaddr1, ipaddr2,                                               \
116         basicconsenable, basicconscritical, basicconsca,                \
117         keyusageenable, keyusagecritical, keyusagevalue,                \
118         keypurposeenable, keypurposecritical,                           \
119         keypurposeoid1, keypurposeoid2,                                 \
120         startoffset, endoffset                                          \
121     };                                                                  \
122     test_tls_generate_cert(&varname, NULL)
123 
124 # define TLS_ROOT_REQ_SIMPLE(varname, fname)                            \
125     QCryptoTLSTestCertReq varname = {                                   \
126         .filename = fname,                                              \
127         .cn = "qemu-CA",                                                \
128         .basicConstraintsEnable = true,                                 \
129         .basicConstraintsCritical = true,                               \
130         .basicConstraintsIsCA = true,                                   \
131         .keyUsageEnable = true,                                         \
132         .keyUsageCritical = true,                                       \
133         .keyUsageValue = GNUTLS_KEY_KEY_CERT_SIGN,                      \
134     };                                                                  \
135     test_tls_generate_cert(&varname, NULL)
136 
137 # define TLS_CERT_REQ_SIMPLE_CLIENT(varname, cavarname, cname, fname)   \
138     QCryptoTLSTestCertReq varname = {                                   \
139         .filename = fname,                                              \
140         .cn = cname,                                                    \
141         .basicConstraintsEnable = true,                                 \
142         .basicConstraintsCritical = true,                               \
143         .basicConstraintsIsCA = false,                                  \
144         .keyUsageEnable = true,                                         \
145         .keyUsageCritical = true,                                       \
146         .keyUsageValue =                                                \
147         GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,     \
148         .keyPurposeEnable = true,                                       \
149         .keyPurposeCritical = true,                                     \
150         .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT,                     \
151     };                                                                  \
152     test_tls_generate_cert(&varname, cavarname.crt)
153 
154 # define TLS_CERT_REQ_SIMPLE_SERVER(varname, cavarname, fname,          \
155                                     hostname, ipaddr)                   \
156     QCryptoTLSTestCertReq varname = {                                   \
157         .filename = fname,                                              \
158         .cn = hostname ? hostname : ipaddr,                             \
159         .altname1 = hostname,                                           \
160         .ipaddr1 = ipaddr,                                              \
161         .basicConstraintsEnable = true,                                 \
162         .basicConstraintsCritical = true,                               \
163         .basicConstraintsIsCA = false,                                  \
164         .keyUsageEnable = true,                                         \
165         .keyUsageCritical = true,                                       \
166         .keyUsageValue =                                                \
167         GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,     \
168         .keyPurposeEnable = true,                                       \
169         .keyPurposeCritical = true,                                     \
170         .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER,                     \
171     };                                                                  \
172     test_tls_generate_cert(&varname, cavarname.crt)
173 
174 extern const asn1_static_node pkix_asn1_tab[];
175 
176 #endif
177