mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-30 13:37:17 +00:00
31d41d9268
The code added to validate CA certificates did not take into account the possibility that the cacert.pem file can contain multiple (concatenated) cert data blocks. Extend the code for loading CA certs to use the gnutls APIs for loading cert lists. Add test cases to check that multi-level trees of certs will validate correctly. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
83 lines
2.2 KiB
C
83 lines
2.2 KiB
C
/*
|
|
* Copyright (C) 2011-2013 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Author: Daniel P. Berrange <berrange@redhat.com>
|
|
*/
|
|
|
|
#include <gnutls/gnutls.h>
|
|
#include <gnutls/x509.h>
|
|
|
|
#if !defined WIN32 && HAVE_LIBTASN1_H && LIBGNUTLS_VERSION_NUMBER >= 0x020600
|
|
# include "gnutls_1_0_compat.h"
|
|
|
|
# include <libtasn1.h>
|
|
|
|
# include "rpc/virnettlscontext.h"
|
|
|
|
extern const char *keyfile;
|
|
|
|
/*
|
|
* This contains parameter about how to generate
|
|
* certificates.
|
|
*/
|
|
struct testTLSCertReq {
|
|
gnutls_x509_crt_t crt;
|
|
|
|
const char *filename;
|
|
|
|
/* Identifying information */
|
|
const char *country;
|
|
const char *cn;
|
|
const char *altname1;
|
|
const char *altname2;
|
|
const char *ipaddr1;
|
|
const char *ipaddr2;
|
|
|
|
/* Basic constraints */
|
|
bool basicConstraintsEnable;
|
|
bool basicConstraintsCritical;
|
|
bool basicConstraintsIsCA;
|
|
|
|
/* Key usage */
|
|
bool keyUsageEnable;
|
|
bool keyUsageCritical;
|
|
int keyUsageValue;
|
|
|
|
/* Key purpose (aka Extended key usage) */
|
|
bool keyPurposeEnable;
|
|
bool keyPurposeCritical;
|
|
const char *keyPurposeOID1;
|
|
const char *keyPurposeOID2;
|
|
|
|
/* zero for current time, or non-zero for hours from now */
|
|
int start_offset;
|
|
/* zero for 24 hours from now, or non-zero for hours from now */
|
|
int expire_offset;
|
|
};
|
|
|
|
void testTLSGenerateCert(struct testTLSCertReq *req,
|
|
gnutls_x509_crt_t ca);
|
|
void testTLSWriteCertChain(const char *filename,
|
|
gnutls_x509_crt_t *certs,
|
|
size_t ncerts);
|
|
void testTLSDiscardCert(struct testTLSCertReq *req);
|
|
|
|
void testTLSInit(void);
|
|
void testTLSCleanup(void);
|
|
|
|
#endif
|