2cf6dc4101
In the migration test we create several TLS certificates with
the TLS_* macros from crypto-tls-x509-helpers.h. These macros
create both a QCryptoTLSCertReq object which must be deinitialized
and also an on-disk certificate file. The migration test currently
removes the on-disk file in test_migrate_tls_x509_finish() but
never deinitializes the QCryptoTLSCertReq, which means that memory
allocated as part of it is leaked:
Indirect leak of 2 byte(s) in 1 object(s) allocated from:
#0 0x5558ba33712e in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/asan/tests/qtest/migration-test+0x22f12e) (BuildId: 4c8618f663e538538cad19d35233124cea161491)
#1 0x7f64afc131f4 (/lib/x86_64-linux-gnu/libtasn1.so.6+0x81f4) (BuildId: 2fde6ecb43c586fe4077118f771077aa1298e7ea)
#2 0x7f64afc18d58 in asn1_write_value (/lib/x86_64-linux-gnu/libtasn1.so.6+0xdd58) (BuildId: 2fde6ecb43c586fe4077118f771077aa1298e7ea)
#3 0x7f64af8fc678 in gnutls_x509_crt_set_version (/lib/x86_64-linux-gnu/libgnutls.so.30+0xe7678) (BuildId: 97b8f99f392f1fd37b969a7164bcea884e23649b)
#4 0x5558ba470035 in test_tls_generate_cert tests/unit/crypto-tls-x509-helpers.c:234:5
#5 0x5558ba464e4a in test_migrate_tls_x509_start_common tests/qtest/migration-test.c:1058:5
#6 0x5558ba462c8a in test_migrate_tls_x509_start_default_host tests/qtest/migration-test.c:1123:12
#7 0x5558ba45ab40 in test_precopy_common tests/qtest/migration-test.c:1786:21
#8 0x5558ba450015 in test_precopy_unix_tls_x509_default_host tests/qtest/migration-test.c:2077:5
#9 0x5558ba46d3c7 in migration_test_wrapper tests/qtest/migration-helpers.c:456:5
(and similar reports).
The only function currently provided to deinit a QCryptoTLSCertReq is
test_tls_discard_cert(), which also removes the on-disk certificate
file. For the migration tests we need to retain the on-disk files
until we've finished running the test, so the simplest fix is to
provide a new function test_tls_deinit_cert() which does only the
cleanup of the QCryptoTLSCertReq, and call it in the right places.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
180 lines
8.8 KiB
C
180 lines
8.8 KiB
C
/*
|
|
* Copyright (C) 2015 Red Hat, Inc.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library. If not, see
|
|
* <http://www.gnu.org/licenses/>.
|
|
*
|
|
* Author: Daniel P. Berrange <berrange@redhat.com>
|
|
*/
|
|
|
|
#ifndef TESTS_CRYPTO_TLS_X509_HELPERS_H
|
|
#define TESTS_CRYPTO_TLS_X509_HELPERS_H
|
|
|
|
#include <gnutls/gnutls.h>
|
|
#include <gnutls/x509.h>
|
|
|
|
|
|
#define QCRYPTO_TLS_TEST_CLIENT_NAME "ACME QEMU Client"
|
|
#define QCRYPTO_TLS_TEST_CLIENT_HOSTILE_NAME "ACME Hostile Client"
|
|
|
|
/*
|
|
* This contains parameter about how to generate
|
|
* certificates.
|
|
*/
|
|
typedef struct QCryptoTLSTestCertReq QCryptoTLSTestCertReq;
|
|
struct QCryptoTLSTestCertReq {
|
|
gnutls_x509_crt_t crt;
|
|
|
|
const char *filename;
|
|
|
|
/* Identifying information */
|
|
const char *country;
|
|
const char *cn;
|
|
const char *altname1;
|
|
const char *altname2;
|
|
const char *ipaddr1;
|
|
const char *ipaddr2;
|
|
|
|
/* Basic constraints */
|
|
bool basicConstraintsEnable;
|
|
bool basicConstraintsCritical;
|
|
bool basicConstraintsIsCA;
|
|
|
|
/* Key usage */
|
|
bool keyUsageEnable;
|
|
bool keyUsageCritical;
|
|
int keyUsageValue;
|
|
|
|
/* Key purpose (aka Extended key usage) */
|
|
bool keyPurposeEnable;
|
|
bool keyPurposeCritical;
|
|
const char *keyPurposeOID1;
|
|
const char *keyPurposeOID2;
|
|
|
|
/* zero for current time, or non-zero for hours from now */
|
|
int start_offset;
|
|
/* zero for 24 hours from now, or non-zero for hours from now */
|
|
int expire_offset;
|
|
};
|
|
|
|
void test_tls_generate_cert(QCryptoTLSTestCertReq *req,
|
|
gnutls_x509_crt_t ca);
|
|
void test_tls_write_cert_chain(const char *filename,
|
|
gnutls_x509_crt_t *certs,
|
|
size_t ncerts);
|
|
/*
|
|
* Deinitialize the QCryptoTLSTestCertReq, but don't delete the certificate
|
|
* file on disk. (The caller is then responsible for doing that themselves.
|
|
*/
|
|
void test_tls_deinit_cert(QCryptoTLSTestCertReq *req);
|
|
/* Deinit the QCryptoTLSTestCertReq, and delete the certificate file */
|
|
void test_tls_discard_cert(QCryptoTLSTestCertReq *req);
|
|
|
|
void test_tls_init(const char *keyfile);
|
|
void test_tls_cleanup(const char *keyfile);
|
|
|
|
# define TLS_CERT_REQ(varname, cavarname, \
|
|
country, commonname, \
|
|
altname1, altname2, \
|
|
ipaddr1, ipaddr2, \
|
|
basicconsenable, basicconscritical, basicconsca, \
|
|
keyusageenable, keyusagecritical, keyusagevalue, \
|
|
keypurposeenable, keypurposecritical, \
|
|
keypurposeoid1, keypurposeoid2, \
|
|
startoffset, endoffset) \
|
|
static QCryptoTLSTestCertReq varname = { \
|
|
NULL, WORKDIR #varname "-ctx.pem", \
|
|
country, commonname, altname1, altname2, \
|
|
ipaddr1, ipaddr2, \
|
|
basicconsenable, basicconscritical, basicconsca, \
|
|
keyusageenable, keyusagecritical, keyusagevalue, \
|
|
keypurposeenable, keypurposecritical, \
|
|
keypurposeoid1, keypurposeoid2, \
|
|
startoffset, endoffset \
|
|
}; \
|
|
test_tls_generate_cert(&varname, cavarname.crt)
|
|
|
|
# define TLS_ROOT_REQ(varname, \
|
|
country, commonname, \
|
|
altname1, altname2, \
|
|
ipaddr1, ipaddr2, \
|
|
basicconsenable, basicconscritical, basicconsca, \
|
|
keyusageenable, keyusagecritical, keyusagevalue, \
|
|
keypurposeenable, keypurposecritical, \
|
|
keypurposeoid1, keypurposeoid2, \
|
|
startoffset, endoffset) \
|
|
static QCryptoTLSTestCertReq varname = { \
|
|
NULL, WORKDIR #varname "-ctx.pem", \
|
|
country, commonname, altname1, altname2, \
|
|
ipaddr1, ipaddr2, \
|
|
basicconsenable, basicconscritical, basicconsca, \
|
|
keyusageenable, keyusagecritical, keyusagevalue, \
|
|
keypurposeenable, keypurposecritical, \
|
|
keypurposeoid1, keypurposeoid2, \
|
|
startoffset, endoffset \
|
|
}; \
|
|
test_tls_generate_cert(&varname, NULL)
|
|
|
|
# define TLS_ROOT_REQ_SIMPLE(varname, fname) \
|
|
QCryptoTLSTestCertReq varname = { \
|
|
.filename = fname, \
|
|
.cn = "qemu-CA", \
|
|
.basicConstraintsEnable = true, \
|
|
.basicConstraintsCritical = true, \
|
|
.basicConstraintsIsCA = true, \
|
|
.keyUsageEnable = true, \
|
|
.keyUsageCritical = true, \
|
|
.keyUsageValue = GNUTLS_KEY_KEY_CERT_SIGN, \
|
|
}; \
|
|
test_tls_generate_cert(&varname, NULL)
|
|
|
|
# define TLS_CERT_REQ_SIMPLE_CLIENT(varname, cavarname, cname, fname) \
|
|
QCryptoTLSTestCertReq varname = { \
|
|
.filename = fname, \
|
|
.cn = cname, \
|
|
.basicConstraintsEnable = true, \
|
|
.basicConstraintsCritical = true, \
|
|
.basicConstraintsIsCA = false, \
|
|
.keyUsageEnable = true, \
|
|
.keyUsageCritical = true, \
|
|
.keyUsageValue = \
|
|
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
|
|
.keyPurposeEnable = true, \
|
|
.keyPurposeCritical = true, \
|
|
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT, \
|
|
}; \
|
|
test_tls_generate_cert(&varname, cavarname.crt)
|
|
|
|
# define TLS_CERT_REQ_SIMPLE_SERVER(varname, cavarname, fname, \
|
|
hostname, ipaddr) \
|
|
QCryptoTLSTestCertReq varname = { \
|
|
.filename = fname, \
|
|
.cn = hostname ? hostname : ipaddr, \
|
|
.altname1 = hostname, \
|
|
.ipaddr1 = ipaddr, \
|
|
.basicConstraintsEnable = true, \
|
|
.basicConstraintsCritical = true, \
|
|
.basicConstraintsIsCA = false, \
|
|
.keyUsageEnable = true, \
|
|
.keyUsageCritical = true, \
|
|
.keyUsageValue = \
|
|
GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT, \
|
|
.keyPurposeEnable = true, \
|
|
.keyPurposeCritical = true, \
|
|
.keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER, \
|
|
}; \
|
|
test_tls_generate_cert(&varname, cavarname.crt)
|
|
|
|
#endif
|