From: Nikos Mavrogiannopoulos Date: Mon, 28 Apr 2014 13:06:24 +0000 (+0200) Subject: Added test to verify whether gnutls_x509_trust_list_get_issuer() operates correctly... X-Git-Tag: gnutls_3_3_2~40 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e2ff14549d60cb2cf0fc29c83b91d1b60608c935;p=thirdparty%2Fgnutls.git Added test to verify whether gnutls_x509_trust_list_get_issuer() operates correctly under PKCS #11 trust list. --- diff --git a/tests/suite/Makefile.am b/tests/suite/Makefile.am index ee29384815..c1b87c1505 100644 --- a/tests/suite/Makefile.am +++ b/tests/suite/Makefile.am @@ -90,8 +90,8 @@ TESTS = ciphersuite/test-ciphersuites.sh eagain testsrn testcompat chain invalid testpkcs11 if ENABLE_PKCS11 -check_PROGRAMS += pkcs11-chainverify -TESTS += pkcs11-chainverify +check_PROGRAMS += pkcs11-chainverify pkcs11-get-issuer +TESTS += pkcs11-chainverify pkcs11-get-issuer endif TESTS_ENVIRONMENT = EXEEXT=$(EXEEXT) \ diff --git a/tests/suite/pkcs11-get-issuer.c b/tests/suite/pkcs11-get-issuer.c new file mode 100644 index 0000000000..6c4b6494ce --- /dev/null +++ b/tests/suite/pkcs11-get-issuer.c @@ -0,0 +1,266 @@ +/* + * Copyright (C) 2008-2014 Free Software Foundation, Inc. + * + * Author: Simon Josefsson, Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * GnuTLS is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * GnuTLS is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with GnuTLS; if not, write to the Free Software Foundation, + * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA + */ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include +#include +#include + +#include +#include + +#include "../utils.h" +#include "../test-chains.h" + +#define URL "pkcs11:model=SoftHSM;manufacturer=SoftHSM;serial=1;token=test" +#define CONFIG "softhsm-issuer.config" + +/* GnuTLS internally calls time() to find out the current time when + verifying certificates. To avoid a time bomb, we hard code the + current time. This should work fine on systems where the library + call to time is resolved at run-time. */ +static time_t mytime(time_t * t) +{ + time_t then = 1256803113; + + if (t) + *t = then; + + return then; +} + +static void tls_log_func(int level, const char *str) +{ + fprintf(stderr, "|<%d>| %s", level, str); +} + +static +int pin_func(void* userdata, int attempt, const char* url, const char *label, + unsigned flags, char *pin, size_t pin_max) +{ + if (attempt == 0) { + strcpy(pin, "1234"); + return 0; + } + return -1; +} + +#define LIB1 "/usr/lib64/softhsm/libsofthsm.so" +#define LIB2 "/usr/lib/softhsm/libsofthsm.so" + +void doit(void) +{ + int exit_val = 0; + int ret; + unsigned j; + FILE *fp; + const char *lib; + gnutls_x509_crt_t issuer = NULL; + gnutls_x509_trust_list_t tl; + gnutls_x509_crt_t certs[MAX_CHAIN]; + gnutls_x509_crt_t ca; + gnutls_datum_t tmp; + + /* The overloading of time() seems to work in linux (ELF?) + * systems only. Disable it on windows. + */ +#ifdef _WIN32 + exit(77); +#endif + + if (access("/usr/bin/softhsm", X_OK) < 0) { + fprintf(stderr, "cannot find softhsm binary\n"); + exit(77); + } + + if (access(LIB1, R_OK) == 0) { + lib = LIB1; + } else if (access(LIB2, R_OK) == 0) { + lib = LIB2; + } else { + fprintf(stderr, "cannot find softhsm module\n"); + exit(77); + } + + + ret = global_init(); + if (ret != 0) { + fail("%d: %s\n", ret, gnutls_strerror(ret)); + exit(1); + } + + gnutls_pkcs11_set_pin_function(pin_func, NULL); + gnutls_global_set_time_function(mytime); + gnutls_global_set_log_function(tls_log_func); + if (debug) + gnutls_global_set_log_level(4711); + + /* write softhsm.config */ + fp = fopen(CONFIG, "w"); + if (fp == NULL) { + fprintf(stderr, "error writing %s\n", CONFIG); + exit(1); + } + fputs("0:./softhsm.db\n", fp); + fclose(fp); + + setenv("SOFTHSM_CONF", CONFIG, 0); + + system("softhsm --init-token --slot 0 --label test --so-pin 1234 --pin 1234"); + + ret = gnutls_pkcs11_add_provider(lib, "trusted"); + if (ret < 0) { + fprintf(stderr, "gnutls_x509_crt_init: %s\n", + gnutls_strerror(ret)); + exit(1); + } + + for (j = 0; chains[3].chain[j]; j++) { + if (debug > 2) + printf("\tAdding certificate %d...", + (int) j); + + ret = gnutls_x509_crt_init(&certs[j]); + if (ret < 0) { + fprintf(stderr, + "gnutls_x509_crt_init[%d,%d]: %s\n", + (int) 3, (int) j, + gnutls_strerror(ret)); + exit(1); + } + + tmp.data = (unsigned char *) chains[3].chain[j]; + tmp.size = strlen(chains[3].chain[j]); + + ret = + gnutls_x509_crt_import(certs[j], &tmp, + GNUTLS_X509_FMT_PEM); + if (debug > 2) + printf("done\n"); + if (ret < 0) { + fprintf(stderr, + "gnutls_x509_crt_import[%s,%d]: %s\n", + chains[3].name, (int) j, + gnutls_strerror(ret)); + exit(1); + } + + gnutls_x509_crt_print(certs[j], + GNUTLS_CRT_PRINT_ONELINE, + &tmp); + if (debug) + printf("\tCertificate %d: %.*s\n", (int) j, + tmp.size, tmp.data); + gnutls_free(tmp.data); + } + + if (debug > 2) + printf("\tAdding CA certificate..."); + + ret = gnutls_x509_crt_init(&ca); + if (ret < 0) { + fprintf(stderr, "gnutls_x509_crt_init: %s\n", + gnutls_strerror(ret)); + exit(1); + } + + tmp.data = (unsigned char *) *chains[3].ca; + tmp.size = strlen(*chains[3].ca); + + ret = + gnutls_x509_crt_import(ca, &tmp, GNUTLS_X509_FMT_PEM); + if (ret < 0) { + fprintf(stderr, "gnutls_x509_crt_import: %s\n", + gnutls_strerror(ret)); + exit(1); + } + + if (debug > 2) + printf("done\n"); + + gnutls_x509_crt_print(ca, GNUTLS_CRT_PRINT_ONELINE, &tmp); + if (debug) + printf("\tCA Certificate: %.*s\n", tmp.size, + tmp.data); + gnutls_free(tmp.data); + + if (debug) + printf("\tVerifying..."); + + /* initialize softhsm token */ + ret = gnutls_pkcs11_token_init(URL, "1234", "test"); + if (ret < 0) { + fail("gnutls_pkcs11_token_init\n"); + exit(1); + } + + /* write CA certificate to softhsm */ + ret = gnutls_pkcs11_copy_x509_crt(URL, ca, "test-ca", GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED|GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO); + if (ret < 0) { + fail("gnutls_pkcs11_copy_x509_crt: %s\n", gnutls_strerror(ret)); + exit(1); + } + + gnutls_x509_trust_list_init(&tl, 0); + + ret = gnutls_x509_trust_list_add_trust_file(tl, URL, NULL, 0, 0, 0); + if (ret < 0) { + fail("gnutls_x509_trust_list_add_trust_file\n"); + exit(1); + } + + /* extract the issuer of the certificate */ + ret = gnutls_x509_trust_list_get_issuer(tl, certs[2], &issuer, 0); + if (ret < 0) { + fail("error in gnutls_x509_trust_list_get_issuer\n"); + exit(1); + } + + /* extract (again) the issuer of the certificate - check for any leaks */ + ret = gnutls_x509_trust_list_get_issuer(tl, certs[2], &issuer, 0); + if (ret < 0) { + fail("error in gnutls_x509_trust_list_get_issuer\n"); + exit(1); + } + + if (debug) + printf("\tCleanup..."); + + gnutls_x509_trust_list_deinit(tl, 0); + gnutls_x509_crt_deinit(ca); + for (j = 0; chains[3].chain[j]; j++) + gnutls_x509_crt_deinit(certs[j]); + if (debug) + printf("done\n\n\n"); + + gnutls_global_deinit(); + + if (debug) + printf("Exit status...%d\n", exit_val); + remove(CONFIG); + + exit(exit_val); +}