/* GIO TLS tests
*
* Copyright 2011 Collabora, Ltd.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General
* Public License along with this library; if not, see
* <http://www.gnu.org/licenses/>.
*
* In addition, when the library is used with OpenSSL, a special
* exception applies. Refer to the LICENSE_EXCEPTION file for details.
*
* Author: Stef Walter <stefw@collabora.co.uk>
*/
#include "config.h"
#include <gio/gio.h>
#include "gnutls/gtlscertificate-gnutls.h"
#include <sys/types.h>
#include <string.h>
static const gchar *
tls_test_file_path (const char *name)
{
const gchar *const_path;
gchar *path;
path = g_test_build_filename (G_TEST_DIST, "files", name, NULL);
if (!g_path_is_absolute (path))
{
gchar *cwd, *abs;
cwd = g_get_current_dir ();
abs = g_build_filename (cwd, path, NULL);
g_free (cwd);
g_free (path);
path = abs;
}
const_path = g_intern_string (path);
g_free (path);
return const_path;
}
/* -----------------------------------------------------------------------------
* CERTIFICATE VERIFY
*/
typedef struct {
GTlsCertificate *cert;
GSocketConnectable *identity;
GTlsDatabase *database;
} TestVerify;
static void
setup_verify (TestVerify *test,
gconstpointer data)
{
GError *error = NULL;
test->cert = g_tls_certificate_new_from_file (tls_test_file_path ("server.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (test->cert));
test->identity = g_network_address_new ("server.example.com", 80);
test->database = g_tls_file_database_new (tls_test_file_path ("ca.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_DATABASE (test->database));
}
static void
teardown_verify (TestVerify *test,
gconstpointer data)
{
g_assert (G_IS_TLS_CERTIFICATE (test->cert));
g_object_add_weak_pointer (G_OBJECT (test->cert),
(gpointer *)&test->cert);
g_object_unref (test->cert);
g_assert (test->cert == NULL);
g_assert (G_IS_TLS_DATABASE (test->database));
g_object_add_weak_pointer (G_OBJECT (test->database),
(gpointer *)&test->database);
g_object_unref (test->database);
g_assert (test->database == NULL);
g_object_add_weak_pointer (G_OBJECT (test->identity),
(gpointer *)&test->identity);
g_object_unref (test->identity);
g_assert (test->identity == NULL);
}
static void
test_verify_database_good (TestVerify *test,
gconstpointer data)
{
GTlsCertificateFlags errors;
GError *error = NULL;
errors = g_tls_database_verify_chain (test->database, test->cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
test->identity, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, 0);
errors = g_tls_database_verify_chain (test->database, test->cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
NULL, NULL, 0, NULL, &error);
g_assert_cmpuint (errors, ==, 0);
}
static void
test_verify_database_bad_identity (TestVerify *test,
gconstpointer data)
{
GSocketConnectable *identity;
GTlsCertificateFlags errors;
GError *error = NULL;
identity = g_network_address_new ("other.example.com", 80);
errors = g_tls_database_verify_chain (test->database, test->cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
identity, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_BAD_IDENTITY);
g_object_unref (identity);
}
static void
test_verify_database_bad_ca (TestVerify *test,
gconstpointer data)
{
GTlsCertificateFlags errors;
GTlsCertificate *cert;
GError *error = NULL;
/* Use another certificate which isn't in our CA list */
cert = g_tls_certificate_new_from_file (tls_test_file_path ("server-self.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (cert));
errors = g_tls_database_verify_chain (test->database, cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
test->identity, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_UNKNOWN_CA);
g_object_unref (cert);
}
static void
test_verify_database_bad_before (TestVerify *test,
gconstpointer data)
{
GTlsCertificateFlags errors;
GTlsCertificate *cert;
GError *error = NULL;
/* This is a certificate in the future */
cert = g_tls_certificate_new_from_file (tls_test_file_path ("client-future.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (cert));
errors = g_tls_database_verify_chain (test->database, cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
NULL, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_NOT_ACTIVATED);
g_object_unref (cert);
}
static void
test_verify_database_bad_expired (TestVerify *test,
gconstpointer data)
{
GTlsCertificateFlags errors;
GTlsCertificate *cert;
GError *error = NULL;
/* This is a certificate in the future */
cert = g_tls_certificate_new_from_file (tls_test_file_path ("client-past.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (cert));
errors = g_tls_database_verify_chain (test->database, cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
NULL, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_EXPIRED);
g_object_unref (cert);
}
static void
test_verify_database_bad_combo (TestVerify *test,
gconstpointer data)
{
GTlsCertificate *cert;
GSocketConnectable *identity;
GTlsCertificateFlags errors;
GError *error = NULL;
cert = g_tls_certificate_new_from_file (tls_test_file_path ("server-self.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (cert));
/*
* - Use is self signed
* - Use wrong identity.
*/
identity = g_network_address_new ("other.example.com", 80);
errors = g_tls_database_verify_chain (test->database, cert,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
identity, NULL, 0, NULL, &error);
g_assert_no_error (error);
g_assert_cmpuint (errors, ==, G_TLS_CERTIFICATE_UNKNOWN_CA |
G_TLS_CERTIFICATE_BAD_IDENTITY);
g_object_unref (cert);
g_object_unref (identity);
}
static GTlsCertificate *
load_certificate_chain (const char *filename,
GError **error)
{
GList *certificates;
GTlsCertificate *chain = NULL, *prev_chain = NULL;
GTlsBackend *backend;
GByteArray *der;
GList *l;
certificates = g_tls_certificate_list_new_from_file (filename, error);
if (certificates == NULL)
return NULL;
backend = g_tls_backend_get_default ();
certificates = g_list_reverse (certificates);
for (l = certificates; l != NULL; l = g_list_next (l))
{
prev_chain = chain;
g_object_get (l->data, "certificate", &der, NULL);
chain = g_object_new (g_tls_backend_get_certificate_type (backend),
"certificate", der,
"issuer", prev_chain,
NULL);
g_byte_array_unref (der);
g_clear_object (&prev_chain);
}
g_list_free_full (certificates, g_object_unref);
return chain;
}
static gboolean
is_certificate_in_chain (GTlsCertificate *chain,
GTlsCertificate *cert)
{
while (chain != NULL)
{
if (g_tls_certificate_is_same (chain, cert))
return TRUE;
chain = g_tls_certificate_get_issuer (chain);
}
return FALSE;
}
static void
test_verify_with_incorrect_root_in_chain (void)
{
GTlsCertificate *ca_verisign_sha1;
GTlsDatabase *database;
GError *error = NULL;
GTlsCertificate *chain;
GSocketConnectable *identity;
GTlsCertificateFlags errors;
/*
* This database contains a single anchor certificate of:
* C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
*/
database = g_tls_file_database_new (tls_test_file_path ("ca-verisign-sha1.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_DATABASE (database));
ca_verisign_sha1 = g_tls_certificate_new_from_file (tls_test_file_path ("ca-verisign-sha1.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (ca_verisign_sha1));
/*
* This certificate chain contains a root certificate with that same issuer, public key:
* C = US, O = "VeriSign, Inc.", OU = Class 3 Public Primary Certification Authority
*
* But it is not the same certificate in our database. However our database should
* verify this chain as valid, since the issuer fields and signatures should chain up
* to the certificate in our database.
*/
chain = load_certificate_chain (tls_test_file_path ("chain-with-verisign-md2.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (chain));
g_assert (g_tls_certificate_get_issuer (chain) != NULL);
g_assert (g_tls_certificate_get_issuer (g_tls_certificate_get_issuer (chain)) != NULL);
g_assert (is_certificate_in_chain (chain, chain));
g_assert (!is_certificate_in_chain (chain, ca_verisign_sha1));
identity = g_network_address_new ("secure-test.streamline-esolutions.com", 443);
errors = g_tls_database_verify_chain (database, chain,
G_TLS_DATABASE_PURPOSE_AUTHENTICATE_SERVER,
identity, NULL, 0, NULL, &error);
g_assert_no_error (error);
errors &= ~G_TLS_CERTIFICATE_EXPIRED; /* so that this test doesn't expire */
g_assert_cmpuint (errors, ==, 0);
g_object_unref (chain);
g_object_unref (ca_verisign_sha1);
g_object_unref (identity);
g_object_unref (database);
}
/* -----------------------------------------------------------------------------
* FILE DATABASE
*/
typedef struct {
GTlsDatabase *database;
const gchar *path;
} TestFileDatabase;
static void
setup_file_database (TestFileDatabase *test,
gconstpointer data)
{
GError *error = NULL;
test->path = tls_test_file_path ("ca-roots.pem");
test->database = g_tls_file_database_new (test->path, &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_DATABASE (test->database));
}
static void
teardown_file_database (TestFileDatabase *test,
gconstpointer data)
{
g_assert (G_IS_TLS_DATABASE (test->database));
g_object_add_weak_pointer (G_OBJECT (test->database),
(gpointer *)&test->database);
g_object_unref (test->database);
g_assert (test->database == NULL);
}
static void
test_file_database_handle (TestFileDatabase *test,
gconstpointer unused)
{
GTlsCertificate *certificate;
GTlsCertificate *check;
GError *error = NULL;
gchar *handle;
/*
* ca.pem is in the ca-roots.pem that the test->database represents.
* So it should be able to create a handle for it and treat it as if it
* is 'in' the database.
*/
certificate = g_tls_certificate_new_from_file (tls_test_file_path ("ca.pem"), &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (certificate));
handle = g_tls_database_create_certificate_handle (test->database, certificate);
g_assert (handle != NULL);
g_assert (g_str_has_prefix (handle, "file:///"));
check = g_tls_database_lookup_certificate_for_handle (test->database, handle,
NULL, G_TLS_DATABASE_LOOKUP_NONE,
NULL, &error);
g_assert_no_error (error);
g_assert (G_IS_TLS_CERTIFICATE (check));
g_free (handle);
g_object_unref (check);
g_object_unref (certificate);
}
static void
test_file_database_handle_invalid (TestFileDatabase *test,
gconstpointer unused)
{
GTlsCertificate *certificate;
GError *error = NULL;
certificate = g_tls_database_lookup_certificate_for_handle (test->database, "blah:blah",
NULL, G_TLS_DATABASE_LOOKUP_NONE,
NULL, &error);
g_assert_no_error (error);
g_assert (certificate == NULL);
}
/* -----------------------------------------------------------------------------
* DATABASE
*/
static void
test_anchors_property (void)
{
GTlsDatabase *database;
gchar *anchor_filename = NULL;
GError *error = NULL;
database = g_tls_file_database_new (tls_test_file_path ("ca.pem"), &error);
g_assert_no_error (error);
g_object_get (database, "anchors", &anchor_filename, NULL);
g_assert_cmpstr (anchor_filename, ==, tls_test_file_path ("ca.pem"));
g_free (anchor_filename);
g_object_unref (database);
}
static gboolean
certificate_is_in_list (GList *certificates,
const gchar *filename)
{
GTlsCertificate *cert;
GError *error = NULL;
GList *l;
cert = g_tls_certificate_new_from_file (filename, &error);
g_assert_no_error (error);
for (l = certificates; l != NULL; l = g_list_next (l))
{
if (g_tls_certificate_is_same (l->data, cert))
break;
}
g_object_unref (cert);
/* Had an early break from loop */
return l != NULL;
}
static void
test_lookup_certificates_issued_by (void)
{
/* This data is generated from the frob-certificate test tool in gcr library.
* To regenerate (from e.g. a directory containing gcr and glib-networking):
*
* $ gcr/frob-certificate glib-networking/tls/tests/files/ca.pem
*
* Then copy the hex that is printed after "subject" (not "issuer"!) and add
* the missing 'x's.
*/
const guchar ISSUER[] = "\x30\x81\x86\x31\x13\x30\x11\x06\x0A\x09\x92\x26\x89\x93\xF2"
"\x2C\x64\x01\x19\x16\x03\x43\x4F\x4D\x31\x17\x30\x15\x06\x0A"
"\x09\x92\x26\x89\x93\xF2\x2C\x64\x01\x19\x16\x07\x45\x58\x41"
"\x4D\x50\x4C\x45\x31\x1E\x30\x1C\x06\x03\x55\x04\x0B\x0C\x15"
"\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x20\x41\x75\x74"
"\x68\x6F\x72\x69\x74\x79\x31\x17\x30\x15\x06\x03\x55\x04\x03"
"\x0C\x0E\x63\x61\x2E\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F"
"\x6D\x31\x1D\x30\x1B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x09"
"\x01\x16\x0E\x63\x61\x40\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63"
"\x6F\x6D";
GList *certificates;
GByteArray *issuer_dn;
GTlsDatabase *database;
GError *error = NULL;
database = g_tls_file_database_new (tls_test_file_path ("non-ca.pem"), &error);
g_assert_no_error (error);
issuer_dn = g_byte_array_new ();
/* The null terminator is in the array/string above */
g_byte_array_append (issuer_dn, ISSUER, G_N_ELEMENTS (ISSUER) - 1);
certificates = g_tls_database_lookup_certificates_issued_by (database, issuer_dn, NULL,
G_TLS_DATABASE_LOOKUP_NONE,
NULL, &error);
g_byte_array_unref (issuer_dn);
g_assert_cmpuint (g_list_length (certificates), ==, 4);
g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client.pem")));
g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client-future.pem")));
g_assert (certificate_is_in_list (certificates, tls_test_file_path ("client-past.pem")));
g_assert (certificate_is_in_list (certificates, tls_test_file_path ("server.pem")));
g_assert (!certificate_is_in_list (certificates, tls_test_file_path ("server-self.pem")));
g_list_free_full (certificates, g_object_unref);
g_object_unref (database);
}
static void
test_default_database_is_singleton (void)
{
GTlsBackend *backend;
GTlsDatabase *database;
GTlsDatabase *check;
backend = g_tls_backend_get_default ();
g_assert (G_IS_TLS_BACKEND (backend));
database = g_tls_backend_get_default_database (backend);
g_assert (G_IS_TLS_DATABASE (database));
check = g_tls_backend_get_default_database (backend);
g_assert (database == check);
g_object_unref (database);
g_object_unref (check);
}
int
main (int argc,
char *argv[])
{
g_test_init (&argc, &argv, NULL);
g_setenv ("GSETTINGS_BACKEND", "memory", TRUE);
g_setenv ("GIO_EXTRA_MODULES", TOP_BUILDDIR "/tls/gnutls/.libs", TRUE);
g_setenv ("GIO_USE_TLS", "gnutls", TRUE);
g_test_add_func ("/tls/backend/default-database-is-singleton",
test_default_database_is_singleton);
g_test_add ("/tls/database/verify-good", TestVerify, NULL,
setup_verify, test_verify_database_good, teardown_verify);
g_test_add ("/tls/database/verify-bad-identity", TestVerify, NULL,
setup_verify, test_verify_database_bad_identity, teardown_verify);
g_test_add ("/tls/database/verify-bad-ca", TestVerify, NULL,
setup_verify, test_verify_database_bad_ca, teardown_verify);
g_test_add ("/tls/database/verify-bad-before", TestVerify, NULL,
setup_verify, test_verify_database_bad_before, teardown_verify);
g_test_add ("/tls/database/verify-bad-expired", TestVerify, NULL,
setup_verify, test_verify_database_bad_expired, teardown_verify);
g_test_add ("/tls/database/verify-bad-combo", TestVerify, NULL,
setup_verify, test_verify_database_bad_combo, teardown_verify);
g_test_add_func ("/tls/database/verify-with-incorrect-root-in-chain",
test_verify_with_incorrect_root_in_chain);
g_test_add_func ("/tls/file-database/anchors-property",
test_anchors_property);
g_test_add_func ("/tls/file-database/lookup-certificates-issued-by",
test_lookup_certificates_issued_by);
g_test_add ("/tls/file-database/test-handle", TestFileDatabase, NULL,
setup_file_database, test_file_database_handle, teardown_file_database);
g_test_add ("/tls/file-database/test-handle-invalid", TestFileDatabase, NULL,
setup_file_database, test_file_database_handle_invalid, teardown_file_database);
return g_test_run();
}