External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-03 03:25:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix TLS tests with gnutls 3

Browse Source 
When given a CA cert with basic constraints to set non-critical,
and key usage of 'key signing', this should be rejected. Version
of GNUTLS < 3 do not rejecte it though, so we never noticed the
test case was broken

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
(cherry picked from commit 0204d6d7a0)
(cherry picked from commit ec5190af86)
This commit is contained in:
Daniel P. Berrange 2013-03-04 17:27:38 +00:00 committed by Eric Blake
parent 9dc3c58641
commit bffb94488b
1 changed files with 16 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
tests/virnettlscontexttest.c
View File

@ -870,6 +870,16 @@ mymain(void)
false, false, NULL, NULL,
0, 0,
};
DO_CTX_TEST(true, cacert1req, servercertreq, false);
DO_CTX_TEST(true, cacert2req, servercertreq, false);
# if 0
DO_CTX_TEST(true, cacert3req, servercertreq, false);
# endif
DO_CTX_TEST(true, cacert4req, servercertreq, false);
/* Now some bad certs */
/* Key usage:dig-sig:not-critical */
static struct testTLSCertReq cacert5req = {
NULL, NULL, "cacert5.pem", "UK",
@ -879,17 +889,6 @@ mymain(void)
false, false, NULL, NULL,
0, 0,
};
DO_CTX_TEST(true, cacert1req, servercertreq, false);
DO_CTX_TEST(true, cacert2req, servercertreq, false);
# if 0
DO_CTX_TEST(true, cacert3req, servercertreq, false);
# endif
DO_CTX_TEST(true, cacert4req, servercertreq, false);
DO_CTX_TEST(true, cacert5req, servercertreq, false);
/* Now some bad certs */
/* no-basic */
static struct testTLSCertReq cacert6req = {
NULL, NULL, "cacert6.pem", "UK",
@ -909,6 +908,12 @@ mymain(void)
0, 0,
};
/* Technically a CA cert with basic constraints
* key purpose == key signing + non-critical should
* be rejected. GNUTLS < 3 does not reject it and
* we don't anticipate them changing this behaviour
*/
DO_CTX_TEST(true, cacert5req, servercertreq, GNUTLS_VERSION_MAJOR >= 3);
DO_CTX_TEST(true, cacert6req, servercertreq, true);
DO_CTX_TEST(true, cacert7req, servercertreq, true);