crypto-tls-x509-helpers.h (8807B)
1 /* 2 * Copyright (C) 2015 Red Hat, Inc. 3 * 4 * This library is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU Lesser General Public 6 * License as published by the Free Software Foundation; either 7 * version 2.1 of the License, or (at your option) any later version. 8 * 9 * This library is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 12 * Lesser General Public License for more details. 13 * 14 * You should have received a copy of the GNU Lesser General Public 15 * License along with this library. If not, see 16 * <http://www.gnu.org/licenses/>. 17 * 18 * Author: Daniel P. Berrange <berrange@redhat.com> 19 */ 20 21 #ifndef TESTS_CRYPTO_TLS_X509_HELPERS_H 22 #define TESTS_CRYPTO_TLS_X509_HELPERS_H 23 24 #include <gnutls/gnutls.h> 25 #include <gnutls/x509.h> 26 #include <libtasn1.h> 27 28 29 #define QCRYPTO_TLS_TEST_CLIENT_NAME "ACME QEMU Client" 30 #define QCRYPTO_TLS_TEST_CLIENT_HOSTILE_NAME "ACME Hostile Client" 31 32 /* 33 * This contains parameter about how to generate 34 * certificates. 35 */ 36 typedef struct QCryptoTLSTestCertReq QCryptoTLSTestCertReq; 37 struct QCryptoTLSTestCertReq { 38 gnutls_x509_crt_t crt; 39 40 const char *filename; 41 42 /* Identifying information */ 43 const char *country; 44 const char *cn; 45 const char *altname1; 46 const char *altname2; 47 const char *ipaddr1; 48 const char *ipaddr2; 49 50 /* Basic constraints */ 51 bool basicConstraintsEnable; 52 bool basicConstraintsCritical; 53 bool basicConstraintsIsCA; 54 55 /* Key usage */ 56 bool keyUsageEnable; 57 bool keyUsageCritical; 58 int keyUsageValue; 59 60 /* Key purpose (aka Extended key usage) */ 61 bool keyPurposeEnable; 62 bool keyPurposeCritical; 63 const char *keyPurposeOID1; 64 const char *keyPurposeOID2; 65 66 /* zero for current time, or non-zero for hours from now */ 67 int start_offset; 68 /* zero for 24 hours from now, or non-zero for hours from now */ 69 int expire_offset; 70 }; 71 72 void test_tls_generate_cert(QCryptoTLSTestCertReq *req, 73 gnutls_x509_crt_t ca); 74 void test_tls_write_cert_chain(const char *filename, 75 gnutls_x509_crt_t *certs, 76 size_t ncerts); 77 void test_tls_discard_cert(QCryptoTLSTestCertReq *req); 78 79 void test_tls_init(const char *keyfile); 80 void test_tls_cleanup(const char *keyfile); 81 82 # define TLS_CERT_REQ(varname, cavarname, \ 83 country, commonname, \ 84 altname1, altname2, \ 85 ipaddr1, ipaddr2, \ 86 basicconsenable, basicconscritical, basicconsca, \ 87 keyusageenable, keyusagecritical, keyusagevalue, \ 88 keypurposeenable, keypurposecritical, \ 89 keypurposeoid1, keypurposeoid2, \ 90 startoffset, endoffset) \ 91 static QCryptoTLSTestCertReq varname = { \ 92 NULL, WORKDIR #varname "-ctx.pem", \ 93 country, commonname, altname1, altname2, \ 94 ipaddr1, ipaddr2, \ 95 basicconsenable, basicconscritical, basicconsca, \ 96 keyusageenable, keyusagecritical, keyusagevalue, \ 97 keypurposeenable, keypurposecritical, \ 98 keypurposeoid1, keypurposeoid2, \ 99 startoffset, endoffset \ 100 }; \ 101 test_tls_generate_cert(&varname, cavarname.crt) 102 103 # define TLS_ROOT_REQ(varname, \ 104 country, commonname, \ 105 altname1, altname2, \ 106 ipaddr1, ipaddr2, \ 107 basicconsenable, basicconscritical, basicconsca, \ 108 keyusageenable, keyusagecritical, keyusagevalue, \ 109 keypurposeenable, keypurposecritical, \ 110 keypurposeoid1, keypurposeoid2, \ 111 startoffset, endoffset) \ 112 static QCryptoTLSTestCertReq varname = { \ 113 NULL, WORKDIR #varname "-ctx.pem", \ 114 country, commonname, altname1, altname2, \ 115 ipaddr1, ipaddr2, \ 116 basicconsenable, basicconscritical, basicconsca, \ 117 keyusageenable, keyusagecritical, keyusagevalue, \ 118 keypurposeenable, keypurposecritical, \ 119 keypurposeoid1, keypurposeoid2, \ 120 startoffset, endoffset \ 121 }; \ 122 test_tls_generate_cert(&varname, NULL) 123 124 # define TLS_ROOT_REQ_SIMPLE(varname, fname) \ 125 QCryptoTLSTestCertReq varname = { \ 126 .filename = fname, \ 127 .cn = "qemu-CA", \ 128 .basicConstraintsEnable = true, \ 129 .basicConstraintsCritical = true, \ 130 .basicConstraintsIsCA = true, \ 131 .keyUsageEnable = true, \ 132 .keyUsageCritical = true, \ 133 .keyUsageValue = GNUTLS_KEY_KEY_CERT_SIGN, \ 134 }; \ 135 test_tls_generate_cert(&varname, NULL) 136 137 # define TLS_CERT_REQ_SIMPLE_CLIENT(varname, cavarname, cname, fname) \ 138 QCryptoTLSTestCertReq varname = { \ 139 .filename = fname, \ 140 .cn = cname, \ 141 .basicConstraintsEnable = true, \ 142 .basicConstraintsCritical = true, \ 143 .basicConstraintsIsCA = false, \ 144 .keyUsageEnable = true, \ 145 .keyUsageCritical = true, \ 146 .keyUsageValue = \ 147 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \ 148 .keyPurposeEnable = true, \ 149 .keyPurposeCritical = true, \ 150 .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \ 151 }; \ 152 test_tls_generate_cert(&varname, cavarname.crt) 153 154 # define TLS_CERT_REQ_SIMPLE_SERVER(varname, cavarname, fname, \ 155 hostname, ipaddr) \ 156 QCryptoTLSTestCertReq varname = { \ 157 .filename = fname, \ 158 .cn = hostname ? hostname : ipaddr, \ 159 .altname1 = hostname, \ 160 .ipaddr1 = ipaddr, \ 161 .basicConstraintsEnable = true, \ 162 .basicConstraintsCritical = true, \ 163 .basicConstraintsIsCA = false, \ 164 .keyUsageEnable = true, \ 165 .keyUsageCritical = true, \ 166 .keyUsageValue = \ 167 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \ 168 .keyPurposeEnable = true, \ 169 .keyPurposeCritical = true, \ 170 .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \ 171 }; \ 172 test_tls_generate_cert(&varname, cavarname.crt) 173 174 extern const asn1_static_node pkix_asn1_tab[]; 175 176 #endif