External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2024-11-05 04:41:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
9b86bbccb3
libvirt/tests/virnettlscontexttest.c

644 lines
25 KiB
C
Raw Normal View History

Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/*
Require spaces around equality comparisons Commit a1cbe4b5 added a check for spaces around assignments and this patch extends it to checks for spaces around '=='. One exception is virAssertCmpInt where comma after '==' is acceptable (since it is a macro and '==' is its argument). Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
2014-03-17 09:38:38 +00:00
* Copyright (C) 2011-2014 Red Hat, Inc.
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
maint: fix up copyright notice inconsistencies https://www.gnu.org/licenses/gpl-howto.html recommends that the 'If not, see <url>.' phrase be a separate sentence. * tests/securityselinuxhelper.c: Remove doubled line. * tests/securityselinuxtest.c: Likewise. * globally: s/; If/. If/
2012-09-20 22:30:55 +00:00
* License along with this library. If not, see
Desert the FSF address in copyright Per the FSF address could be changed from time to time, and GNU recommends the following now: (http://www.gnu.org/licenses/gpl-howto.html) You should have received a copy of the GNU General Public License along with Foobar. If not, see <http://www.gnu.org/licenses/>. This patch removes the explicit FSF address, and uses above instead (of course, with inserting 'Lesser' before 'General'). Except a bunch of files for security driver, all others are changed automatically, the copyright for securify files are not complete, that's why to do it manually: src/security/security_selinux.h src/security/security_driver.h src/security/security_selinux.c src/security/security_apparmor.h src/security/security_apparmor.c src/security/security_driver.c
2012-07-21 10:06:23 +00:00
* <http://www.gnu.org/licenses/>.
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
*/
#include <config.h>
#include <fcntl.h>
#include <sys/socket.h>
#include "testutils.h"
Split TLS test into two separate tests The virnettlscontexttest.c tests both virNetTLSContext and virNetTLSSession functionality. Split into two separate tests, to make the code size more manageable Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 15:49:24 +00:00
#include "virnettlshelpers.h"
Rename util.{c,h} to virutil.{c,h}
2012-12-13 17:44:57 +00:00
#include "virutil.h"
Rename virterror.c virterror_internal.h to virerror.{c,h}
2012-12-13 18:21:53 +00:00
#include "virerror.h"
Rename memory.{c,h} to viralloc.{c,h}
2012-12-12 18:06:53 +00:00
#include "viralloc.h"
Rename logging.{c,h} to virlog.{c,h}
2012-12-12 17:59:27 +00:00
#include "virlog.h"
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
#include "virfile.h"
Rename command.{c,h} to vircommand.{c,h}
2012-12-12 16:27:01 +00:00
#include "vircommand.h"
Split src/util/network.{c,h} into 5 pieces The src/util/network.c file is a dumping ground for many different APIs. Split it up into 5 pieces, along functional lines - src/util/virnetdevbandwidth.c: virNetDevBandwidth type & helper APIs - src/util/virnetdevvportprofile.c: virNetDevVPortProfile type & helper APIs - src/util/virsocketaddr.c: virSocketAddr and APIs - src/conf/netdev_bandwidth_conf.c: XML parsing / formatting for virNetDevBandwidth - src/conf/netdev_vport_profile_conf.c: XML parsing / formatting for virNetDevVPortProfile * src/util/network.c, src/util/network.h: Split into 5 pieces * src/conf/netdev_bandwidth_conf.c, src/conf/netdev_bandwidth_conf.h, src/conf/netdev_vport_profile_conf.c, src/conf/netdev_vport_profile_conf.h, src/util/virnetdevbandwidth.c, src/util/virnetdevbandwidth.h, src/util/virnetdevvportprofile.c, src/util/virnetdevvportprofile.h, src/util/virsocketaddr.c, src/util/virsocketaddr.h: New pieces * daemon/libvirtd.h, daemon/remote.c, src/conf/domain_conf.c, src/conf/domain_conf.h, src/conf/network_conf.c, src/conf/network_conf.h, src/conf/nwfilter_conf.h, src/esx/esx_util.h, src/network/bridge_driver.c, src/qemu/qemu_conf.c, src/rpc/virnetsocket.c, src/rpc/virnetsocket.h, src/util/dnsmasq.h, src/util/interface.h, src/util/iptables.h, src/util/macvtap.c, src/util/macvtap.h, src/util/virnetdev.h, src/util/virnetdevtap.c, tools/virsh.c: Update include files
2011-11-02 15:40:08 +00:00
#include "virsocketaddr.h"
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
tests: virnettlscontexttest needs gnutls-2.6.0 virnettlscontexttest uses gnutls_x509_crt_set_subject_alt_name() and GNUTLS_FSAN_APPEND, which - according to <http://www.gnu.org/software/gnutls/manual/gnutls.html> - are only available since 2.6.0. Since libvirt still works fine with gnutls-1.0.25 from RHEL5, only enable the test when the version of GNUTLS is at least 2.6.0. Signed-off-by: Philipp Hahn <hahn@univention.de> Signed-off-by: Eric Blake <eblake@redhat.com>
2012-01-30 17:44:13 +00:00
#if !defined WIN32 && HAVE_LIBTASN1_H && LIBGNUTLS_VERSION_NUMBER >= 0x020600
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
# include "rpc/virnettlscontext.h"
# define VIR_FROM_THIS VIR_FROM_RPC
Add virLogSource variables to all source files Any source file which calls the logging APIs now needs to have a VIR_LOG_INIT("source.name") declaration at the start of the file. This provides a static variable of the virLogSource type. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2014-02-28 12:16:17 +00:00
VIR_LOG_INIT("tests.nettlscontexttest");
Fix parallel runs of TLS test suites Use a separate keyfile name for the two TLS test suites so that they don't clash when running tests in parallel Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-08 22:08:25 +00:00
# define KEYFILE "key-ctx.pem"
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
struct testTLSContextData {
bool isServer;
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
const char *cacrt;
const char *crt;
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
bool expectFail;
};
/*
* This tests sanity checking of our own certificates
*
* This code is done when libvirtd starts up, or before
* a libvirt client connects. The test is ensuring that
* the creation of virNetTLSContextPtr fails if we
Various typos and misspellings
2012-10-11 16:31:20 +00:00
* give bogus certs, or succeeds for good certs
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
*/
static int testTLSContextInit(const void *opaque)
{
struct testTLSContextData *data = (struct testTLSContextData *)opaque;
virNetTLSContextPtr ctxt = NULL;
int ret = -1;
if (data->isServer) {
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
ctxt = virNetTLSContextNewServer(data->cacrt,
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
NULL,
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
data->crt,
Fix parallel runs of TLS test suites Use a separate keyfile name for the two TLS test suites so that they don't clash when running tests in parallel Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-08 22:08:25 +00:00
KEYFILE,
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
NULL,
tests: force use of "NORMAL" TLS priority in test suite When generating certificates we rely on GNUTLS' built-in default setup for the ciphers used in the certs. We then currently run with the distro specific TLS priority setup which can be much stronger, to the extent that the certificates we generate are considered untrustworthy. We don't care about the quality of the ciphers we use in the test suite, so just force the priority to "NORMAL" which should ensure our certs are accepted by GNUTLS. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-03-05 12:46:16 +00:00
"NORMAL",
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
true,
true);
} else {
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
ctxt = virNetTLSContextNewClient(data->cacrt,
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
NULL,
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
data->crt,
Fix parallel runs of TLS test suites Use a separate keyfile name for the two TLS test suites so that they don't clash when running tests in parallel Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-08 22:08:25 +00:00
KEYFILE,
tests: force use of "NORMAL" TLS priority in test suite When generating certificates we rely on GNUTLS' built-in default setup for the ciphers used in the certs. We then currently run with the distro specific TLS priority setup which can be much stronger, to the extent that the certificates we generate are considered untrustworthy. We don't care about the quality of the ciphers we use in the test suite, so just force the priority to "NORMAL" which should ensure our certs are accepted by GNUTLS. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2018-03-05 12:46:16 +00:00
"NORMAL",
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
true,
true);
}
if (ctxt) {
if (data->expectFail) {
VIR_WARN("Expected failure %s against %s",
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
data->cacrt, data->crt);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
goto cleanup;
}
} else {
if (!data->expectFail) {
VIR_WARN("Unexpected failure %s against %s",
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
data->cacrt, data->crt);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
goto cleanup;
}
tests: virtnettlscontexttest: Use virGetLastErrorMessage() Use virGetLastErrorMessage() rather than open code it
2016-03-18 20:58:02 +00:00
VIR_DEBUG("Got error %s", virGetLastErrorMessage());
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
}
ret = 0;
Indent top-level labels by one space in tests/
2014-03-25 06:53:44 +00:00
cleanup:
Turn virNetTLSContext and virNetTLSSession into virObject instances Make virNetTLSContext and virNetTLSSession use the virObject APIs for reference counting Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2012-07-11 13:35:48 +00:00
virObjectUnref(ctxt);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
return ret;
}
static int
mymain(void)
{
int ret = 0;
tests: force FIPS testing mode with new enough GNU TLS versions Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2014-09-04 09:23:16 +00:00
setenv("GNUTLS_FORCE_FIPS_MODE", "2", 1);
Fix parallel runs of TLS test suites Use a separate keyfile name for the two TLS test suites so that they don't clash when running tests in parallel Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-08 22:08:25 +00:00
testTLSInit(KEYFILE);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Remove backslash alignment attempts Right-aligning backslashes when defining macros or using complex commands in Makefiles looks cute, but as soon as any changes is required to the code you end up with either distractingly broken alignment or unnecessarily big diffs where most of the changes are just pushing all backslashes a few characters to one side. Generated using $ git grep -El '[[:blank:]][[:blank:]]\\$' | \ grep -E '*\.([chx]|am|mk)$$' | \ while read f; do \ sed -Ei 's/[[:blank:]]*[[:blank:]]\\$/ \\/g' "$f"; \ done Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2017-11-03 12:09:47 +00:00
# define DO_CTX_TEST(_isServer, _caCrt, _crt, _expectFail) \
do { \
static struct testTLSContextData data; \
data.isServer = _isServer; \
data.cacrt = _caCrt; \
data.crt = _crt; \
data.expectFail = _expectFail; \
if (virTestRun("TLS Context " #_caCrt " + " #_crt, \
testTLSContextInit, &data) < 0) \
ret = -1; \
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
} while (0)
Remove backslash alignment attempts Right-aligning backslashes when defining macros or using complex commands in Makefiles looks cute, but as soon as any changes is required to the code you end up with either distractingly broken alignment or unnecessarily big diffs where most of the changes are just pushing all backslashes a few characters to one side. Generated using $ git grep -El '[[:blank:]][[:blank:]]\\$' | \ grep -E '*\.([chx]|am|mk)$$' | \ while read f; do \ sed -Ei 's/[[:blank:]]*[[:blank:]]\\$/ \\/g' "$f"; \ done Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2017-11-03 12:09:47 +00:00
# define TLS_CERT_REQ(varname, cavarname, \
co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \
kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \
static struct testTLSCertReq varname = { \
NULL, #varname "-ctx.pem", \
co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \
kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo \
}; \
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
testTLSGenerateCert(&varname, cavarname.crt)
Remove backslash alignment attempts Right-aligning backslashes when defining macros or using complex commands in Makefiles looks cute, but as soon as any changes is required to the code you end up with either distractingly broken alignment or unnecessarily big diffs where most of the changes are just pushing all backslashes a few characters to one side. Generated using $ git grep -El '[[:blank:]][[:blank:]]\\$' | \ grep -E '*\.([chx]|am|mk)$$' | \ while read f; do \ sed -Ei 's/[[:blank:]]*[[:blank:]]\\$/ \\/g' "$f"; \ done Signed-off-by: Andrea Bolognani <abologna@redhat.com>
2017-11-03 12:09:47 +00:00
# define TLS_ROOT_REQ(varname, \
co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \
kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo) \
static struct testTLSCertReq varname = { \
NULL, #varname "-ctx.pem", \
co, cn, an1, an2, ia1, ia2, bce, bcc, bci, \
kue, kuc, kuv, kpe, kpc, kpo1, kpo2, so, eo \
}; \
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
testTLSGenerateCert(&varname, NULL)
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* A perfect CA, perfect client & perfect server */
/* Basic:CA:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacertreq,
"UK", "libvirt CA", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercertreq, cacertreq,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertreq, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacertreq.filename, servercertreq.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcertreq.filename, false);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Some other CAs which are good */
/* Basic:CA:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert1req,
"UK", "libvirt CA 1", NULL, NULL, NULL, NULL,
true, true, true,
false, false, 0,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert1req, cacert1req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Basic:CA:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert2req,
"UK", "libvirt CA 2", NULL, NULL, NULL, NULL,
true, false, true,
false, false, 0,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert2req, cacert2req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Split TLS test into two separate tests The virnettlscontexttest.c tests both virNetTLSContext and virNetTLSSession functionality. Split into two separate tests, to make the code size more manageable Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 15:49:24 +00:00
/* Key usage:cert-sign:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert3req,
"UK", "libvirt CA 3", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert3req, cacert3req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacert1req.filename, servercert1req.filename, false);
DO_CTX_TEST(true, cacert2req.filename, servercert2req.filename, false);
DO_CTX_TEST(true, cacert3req.filename, servercert3req.filename, false);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Now some bad certs */
Fix TLS tests with gnutls 3 When given a CA cert with basic constraints to set non-critical, and key usage of 'key signing', this should be rejected. Version of GNUTLS < 3 do not rejecte it though, so we never noticed the test case was broken Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-03-04 17:27:38 +00:00
/* Key usage:dig-sig:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert4req,
"UK", "libvirt CA 4", NULL, NULL, NULL, NULL,
true, true, true,
true, false, GNUTLS_KEY_DIGITAL_SIGNATURE,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert4req, cacert4req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* no-basic */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert5req,
"UK", "libvirt CA 5", NULL, NULL, NULL, NULL,
false, false, false,
false, false, 0,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert5req, cacert5req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Key usage:dig-sig:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacert6req,
"UK", "libvirt CA 6", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercert6req, cacert6req,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Fix TLS tests with gnutls 3 When given a CA cert with basic constraints to set non-critical, and key usage of 'key signing', this should be rejected. Version of GNUTLS < 3 do not rejecte it though, so we never noticed the test case was broken Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-03-04 17:27:38 +00:00
/* Technically a CA cert with basic constraints
* key purpose == key signing + non-critical should
virnettlscontexttest fails with GNUTLS 3.0.28 On openSUSE 12.x with GNUTLS 3.0.28, virnettlscontexttest fails. It has been reported to work from GNUTLS 3.1.11 on Fedora 19. Changed the constraints on gnutls to 3.1+ for unit test cacert4req. Signed-off-by: Eric Blake <eblake@redhat.com>
2013-12-23 08:01:42 +00:00
* be rejected. GNUTLS < 3.1 does not reject it and
Fix TLS tests with gnutls 3 When given a CA cert with basic constraints to set non-critical, and key usage of 'key signing', this should be rejected. Version of GNUTLS < 3 do not rejecte it though, so we never noticed the test case was broken Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-03-04 17:27:38 +00:00
* we don't anticipate them changing this behaviour
*/
virnettlscontexttest fails with GNUTLS 3.0.28 On openSUSE 12.x with GNUTLS 3.0.28, virnettlscontexttest fails. It has been reported to work from GNUTLS 3.1.11 on Fedora 19. Changed the constraints on gnutls to 3.1+ for unit test cacert4req. Signed-off-by: Eric Blake <eblake@redhat.com>
2013-12-23 08:01:42 +00:00
DO_CTX_TEST(true, cacert4req.filename, servercert4req.filename,
(GNUTLS_VERSION_MAJOR == 3 && GNUTLS_VERSION_MINOR >= 1) ||
GNUTLS_VERSION_MAJOR > 3);
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacert5req.filename, servercert5req.filename, true);
DO_CTX_TEST(true, cacert6req.filename, servercert6req.filename, true);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Various good servers */
/* no usage or purpose */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert7req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage:cert-sign+dig-sig+encipher:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert8req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage:cert-sign:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert9req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, false, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:server:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert10req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:server:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert11req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, false, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client+server:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert12req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client+server:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert13req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
0, 0);
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacertreq.filename, servercert7req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert8req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert9req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert10req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert11req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert12req.filename, false);
DO_CTX_TEST(true, cacertreq.filename, servercert13req.filename, false);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Bad servers */
/* usage:cert-sign:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert14req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert15req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage: none:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(servercert16req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, 0,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacertreq.filename, servercert14req.filename, true);
DO_CTX_TEST(true, cacertreq.filename, servercert15req.filename, true);
DO_CTX_TEST(true, cacertreq.filename, servercert16req.filename, true);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Various good clients */
/* no usage or purpose */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert1req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage:cert-sign+dig-sig+encipher:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert2req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT | GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage:cert-sign:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert3req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, false, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert4req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert5req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, false, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client+client:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert6req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client+client:not-critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert7req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, false, GNUTLS_KP_TLS_WWW_CLIENT, GNUTLS_KP_TLS_WWW_SERVER,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(false, cacertreq.filename, clientcert1req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert2req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert3req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert4req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert5req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert6req.filename, false);
DO_CTX_TEST(false, cacertreq.filename, clientcert7req.filename, false);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Bad clients */
/* usage:cert-sign:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert8req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* purpose:client:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert9req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
false, false, 0,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* usage: none:critical */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_CERT_REQ(clientcert10req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, 0,
false, false, NULL, NULL,
0, 0);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(false, cacertreq.filename, clientcert8req.filename, true);
DO_CTX_TEST(false, cacertreq.filename, clientcert9req.filename, true);
DO_CTX_TEST(false, cacertreq.filename, clientcert10req.filename, true);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Expired stuff */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacertexpreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, -1);
TLS_CERT_REQ(servercertexpreq, cacertexpreq,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(servercertexp1req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, -1);
TLS_CERT_REQ(clientcertexp1req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, -1);
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacertexpreq.filename, servercertexpreq.filename, true);
DO_CTX_TEST(true, cacertreq.filename, servercertexp1req.filename, true);
DO_CTX_TEST(false, cacertreq.filename, clientcertexp1req.filename, true);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
/* Not activated stuff */
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
TLS_ROOT_REQ(cacertnewreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
1, 2);
TLS_CERT_REQ(servercertnewreq, cacertnewreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(servercertnew1req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
1, 2);
TLS_CERT_REQ(clientcertnew1req, cacertreq,
"UK", "libvirt", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
1, 2);
Change data passed into TLS test cases Currently a 'struct testTLSCertReq' instance is passed into the TLS test cases. This is not flexible enough to cope with certificate chains, where one file now corresponds to multiple certificates. Change the test cases so that we pass in filenames instead. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 10:35:49 +00:00
DO_CTX_TEST(true, cacertnewreq.filename, servercertnewreq.filename, true);
DO_CTX_TEST(true, cacertreq.filename, servercertnew1req.filename, true);
DO_CTX_TEST(false, cacertreq.filename, clientcertnew1req.filename, true);
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
Fix validation of CA certificate chains The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 11:31:20 +00:00
TLS_ROOT_REQ(cacertrootreq,
"UK", "libvirt root", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
"UK", "libvirt level 1a", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(cacertlevel1breq, cacertrootreq,
"UK", "libvirt level 1b", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
"UK", "libvirt level 2a", NULL, NULL, NULL, NULL,
true, true, true,
true, true, GNUTLS_KEY_KEY_CERT_SIGN,
false, false, NULL, NULL,
0, 0);
TLS_CERT_REQ(servercertlevel3areq, cacertlevel2areq,
"UK", "libvirt.org", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
0, 0);
TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
"UK", "libvirt client level 2b", NULL, NULL, NULL, NULL,
true, true, false,
true, true, GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
0, 0);
gnutls_x509_crt_t certchain[] = {
cacertrootreq.crt,
cacertlevel1areq.crt,
cacertlevel1breq.crt,
cacertlevel2areq.crt,
};
tests: Fix parallel runs of TLS test suites I noticed this yesterday and fixed it in a different way, but ended up with one more problem. It was probably the way I fixed it combined with one more filename changed. Anyway, why I'm saying this is that one more filename should be renamed in order to avoid a race (which I was unable to reproduce, though). I checked this is the last file those two tests have in common by going through the code and the re-checked by this "script": strace -o session.trace -e open ./virnettlssessiontest strace -o context.trace -e open ./virnettlscontexttest sort \ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' context.trace | sort -u)\ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' session.trace | sort -u)\ | uniq -d| grep '.pem$' So it should be enough to make these tests independent of each other. Signed-off-by: Eric Blake <eblake@redhat.com>
2013-08-09 07:53:30 +00:00
testTLSWriteCertChain("cacertchain-ctx.pem",
Fix validation of CA certificate chains The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 11:31:20 +00:00
certchain,
ARRAY_CARDINALITY(certchain));
tests: Fix parallel runs of TLS test suites I noticed this yesterday and fixed it in a different way, but ended up with one more problem. It was probably the way I fixed it combined with one more filename changed. Anyway, why I'm saying this is that one more filename should be renamed in order to avoid a race (which I was unable to reproduce, though). I checked this is the last file those two tests have in common by going through the code and the re-checked by this "script": strace -o session.trace -e open ./virnettlssessiontest strace -o context.trace -e open ./virnettlscontexttest sort \ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' context.trace | sort -u)\ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' session.trace | sort -u)\ | uniq -d| grep '.pem$' So it should be enough to make these tests independent of each other. Signed-off-by: Eric Blake <eblake@redhat.com>
2013-08-09 07:53:30 +00:00
DO_CTX_TEST(true, "cacertchain-ctx.pem", servercertlevel3areq.filename, false);
DO_CTX_TEST(false, "cacertchain-ctx.pem", clientcertlevel2breq.filename, false);
Fix validation of CA certificate chains The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 11:31:20 +00:00
Test handling of non-existent x509 certs In commit f905cc998449c89339d0e2894a71d9a9e45293e5 a use of uninitialized data was fixed based on a coverity report. It turns out it was possible to trigger this issue by pointing libvirt at non-existent certificate files, typically causing a crash. This adds a test case for that scenario. With the above commit reverted, this new test case will crash with a SEGV. With the fix applied, it passes, reporting a normal libvirt error to the caller. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-21 11:48:58 +00:00
DO_CTX_TEST(false, "cacertdoesnotexist.pem", "servercertdoesnotexist.pem", true);
Avoid re-generating certs every time Currently every test case in the TLS test suite generates the certs fresh. This is a waste of time, since its parameters don't change across test cases. Create certs once in main method. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-05 16:08:17 +00:00
testTLSDiscardCert(&cacertreq);
testTLSDiscardCert(&cacert1req);
testTLSDiscardCert(&cacert2req);
testTLSDiscardCert(&cacert3req);
testTLSDiscardCert(&cacert4req);
testTLSDiscardCert(&cacert5req);
testTLSDiscardCert(&cacert6req);
testTLSDiscardCert(&servercertreq);
testTLSDiscardCert(&servercert1req);
testTLSDiscardCert(&servercert2req);
testTLSDiscardCert(&servercert3req);
testTLSDiscardCert(&servercert4req);
testTLSDiscardCert(&servercert5req);
testTLSDiscardCert(&servercert6req);
testTLSDiscardCert(&servercert7req);
testTLSDiscardCert(&servercert8req);
testTLSDiscardCert(&servercert9req);
testTLSDiscardCert(&servercert10req);
testTLSDiscardCert(&servercert11req);
testTLSDiscardCert(&servercert12req);
testTLSDiscardCert(&servercert13req);
testTLSDiscardCert(&servercert14req);
testTLSDiscardCert(&servercert15req);
testTLSDiscardCert(&servercert16req);
testTLSDiscardCert(&clientcertreq);
testTLSDiscardCert(&clientcert1req);
testTLSDiscardCert(&clientcert2req);
testTLSDiscardCert(&clientcert3req);
testTLSDiscardCert(&clientcert4req);
testTLSDiscardCert(&clientcert5req);
testTLSDiscardCert(&clientcert6req);
testTLSDiscardCert(&clientcert7req);
testTLSDiscardCert(&clientcert8req);
testTLSDiscardCert(&clientcert9req);
testTLSDiscardCert(&clientcert10req);
testTLSDiscardCert(&cacertexpreq);
testTLSDiscardCert(&servercertexpreq);
testTLSDiscardCert(&servercertexp1req);
testTLSDiscardCert(&clientcertexp1req);
testTLSDiscardCert(&cacertnewreq);
testTLSDiscardCert(&servercertnewreq);
testTLSDiscardCert(&servercertnew1req);
testTLSDiscardCert(&clientcertnew1req);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Fix validation of CA certificate chains The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 11:31:20 +00:00
testTLSDiscardCert(&cacertrootreq);
testTLSDiscardCert(&cacertlevel1areq);
testTLSDiscardCert(&cacertlevel1breq);
testTLSDiscardCert(&cacertlevel2areq);
testTLSDiscardCert(&servercertlevel3areq);
testTLSDiscardCert(&clientcertlevel2breq);
tests: Fix parallel runs of TLS test suites I noticed this yesterday and fixed it in a different way, but ended up with one more problem. It was probably the way I fixed it combined with one more filename changed. Anyway, why I'm saying this is that one more filename should be renamed in order to avoid a race (which I was unable to reproduce, though). I checked this is the last file those two tests have in common by going through the code and the re-checked by this "script": strace -o session.trace -e open ./virnettlssessiontest strace -o context.trace -e open ./virnettlscontexttest sort \ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' context.trace | sort -u)\ <(sed -n '/^open/s/open("\([^"]*\)",.*$/\1/p' session.trace | sort -u)\ | uniq -d| grep '.pem$' So it should be enough to make these tests independent of each other. Signed-off-by: Eric Blake <eblake@redhat.com>
2013-08-09 07:53:30 +00:00
unlink("cacertchain-ctx.pem");
Fix validation of CA certificate chains The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-06 11:31:20 +00:00
Fix parallel runs of TLS test suites Use a separate keyfile name for the two TLS test suites so that they don't clash when running tests in parallel Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
2013-08-08 22:08:25 +00:00
testTLSCleanup(KEYFILE);
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
Require spaces around equality comparisons Commit a1cbe4b5 added a check for spaces around assignments and this patch extends it to checks for spaces around '=='. One exception is virAssertCmpInt where comma after '==' is acceptable (since it is a macro and '==' is its argument). Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
2014-03-17 09:38:38 +00:00
return ret == 0 ? EXIT_SUCCESS : EXIT_FAILURE;
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
}
tests: Rename VIRT_TEST_* macros to VIR_TEST_* We use the "vir" prefix pretty consistently in our APIs, both external and internal, which made these macros stood out.
2017-03-29 14:45:42 +00:00
VIR_TEST_MAIN_PRELOAD(mymain, abs_builddir "/.libs/virrandommock.so")
tests: fix compilation failures Even though gnutls is a hard-req for libvirt, and gnutls depends on libtasn1, that does not mean that you have to have the libtasn1 development files installed. Skip the test rather than failing compilation in that case. With newer gcc, the test consumed too much stack space. Move things to static storage to fix that. * configure.ac (AC_CHECK_HEADERS): Check for libtasn1.h. (HAVE_LIBTASN1): New automake conditional. * tests/Makefile.am (virnettlsconvirnettlscontexttest_SOURCES) (virnettlscontexttest_LDADD): Allow compilation without libtasn1. * tests/virnettlscontexttest.c: Skip test if headers not present. (struct testTLSCertReq): Alter time members. (testTLSGenerateCert): Reflect the change. (mymain): Reduce stack usage.
2011-07-22 17:59:37 +00:00
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
#else
tests: Unify style of test skipping code Prefer 'return EXIT_AM_SKIP' over 'exit(EXIT_AM_SKIP)'. Prefer 'int main(void)' over 'int main(int argc, char **argv)'. Fix mymain signature in commandtest and nodeinfotest.
2011-07-28 15:48:12 +00:00
tests: fix compilation failures Even though gnutls is a hard-req for libvirt, and gnutls depends on libtasn1, that does not mean that you have to have the libtasn1 development files installed. Skip the test rather than failing compilation in that case. With newer gcc, the test consumed too much stack space. Move things to static storage to fix that. * configure.ac (AC_CHECK_HEADERS): Check for libtasn1.h. (HAVE_LIBTASN1): New automake conditional. * tests/Makefile.am (virnettlsconvirnettlscontexttest_SOURCES) (virnettlscontexttest_LDADD): Allow compilation without libtasn1. * tests/virnettlscontexttest.c: Skip test if headers not present. (struct testTLSCertReq): Alter time members. (testTLSGenerateCert): Reflect the change. (mymain): Reduce stack usage.
2011-07-22 17:59:37 +00:00
int
tests: Unify style of test skipping code Prefer 'return EXIT_AM_SKIP' over 'exit(EXIT_AM_SKIP)'. Prefer 'int main(void)' over 'int main(int argc, char **argv)'. Fix mymain signature in commandtest and nodeinfotest.
2011-07-28 15:48:12 +00:00
main(void)
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
{
tests: Unify style of test skipping code Prefer 'return EXIT_AM_SKIP' over 'exit(EXIT_AM_SKIP)'. Prefer 'int main(void)' over 'int main(int argc, char **argv)'. Fix mymain signature in commandtest and nodeinfotest.
2011-07-28 15:48:12 +00:00
return EXIT_AM_SKIP;
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
}
tests: Unify style of test skipping code Prefer 'return EXIT_AM_SKIP' over 'exit(EXIT_AM_SKIP)'. Prefer 'int main(void)' over 'int main(int argc, char **argv)'. Fix mymain signature in commandtest and nodeinfotest.
2011-07-28 15:48:12 +00:00
Add a test case for certificate validation This test case checks certification validation rules for - Basic constraints - Key purpose - Key usage - Start/expiry times It checks initial context creation sanity checks, and live session validation
2011-07-20 18:04:18 +00:00
#endif
Reference in New Issue Copy Permalink