Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging
[qemu/ar7.git] / tests / qemu-iotests / 233
blobda150cd27bbfd7f5a4dfa6f70024e5eebafc0052
1 #!/usr/bin/env bash
2 # group: quick
4 # Test NBD TLS certificate / authorization integration
6 # Copyright (C) 2018-2019 Red Hat, Inc.
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 2 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 # creator
23 owner=berrange@redhat.com
25 seq=$(basename $0)
26 echo "QA output created by $seq"
28 status=1 # failure is the default!
30 _cleanup()
32 nbd_server_stop
33 _cleanup_test_img
34 # If we aborted early we want to see this log for diagnosis
35 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log"
36 rm -f "$TEST_DIR/server.log"
37 tls_x509_cleanup
39 trap "_cleanup; exit \$status" 0 1 2 3 15
41 # get standard environment, filters and checks
42 . ./common.rc
43 . ./common.filter
44 . ./common.pattern
45 . ./common.tls
46 . ./common.nbd
48 _supported_fmt raw qcow2
49 _supported_proto file
50 # If porting to non-Linux, consider using socat instead of ss in common.nbd
51 _require_command QEMU_NBD
53 tls_x509_init
55 echo
56 echo "== preparing TLS creds =="
58 tls_x509_create_root_ca "ca1"
59 tls_x509_create_root_ca "ca2"
60 tls_x509_create_server "ca1" "server1"
61 tls_x509_create_client "ca1" "client1"
62 tls_x509_create_client "ca2" "client2"
63 tls_x509_create_client "ca1" "client3"
65 echo
66 echo "== preparing image =="
67 _make_test_img 64M
68 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
70 echo
71 echo "== check TLS client to plain server fails =="
72 nbd_server_start_tcp_socket -f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log"
74 obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
75 $QEMU_IMG info --image-opts --object $obj \
76 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
77 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
78 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
79 --tls-creds=tls0
81 nbd_server_stop
83 echo
84 echo "== check plain client to TLS server fails =="
86 nbd_server_start_tcp_socket \
87 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=on \
88 --tls-creds tls0 \
89 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
91 $QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
92 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
94 echo
95 echo "== check TLS works =="
96 obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
97 obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0
98 $QEMU_IMG info --image-opts --object $obj1 \
99 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
100 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
101 $QEMU_IMG info --image-opts --object $obj2 \
102 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
103 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
104 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
105 --tls-creds=tls0
107 echo
108 echo "== check TLS with different CA fails =="
109 obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0
110 $QEMU_IMG info --image-opts --object $obj \
111 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
112 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
113 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
114 --tls-creds=tls0
116 echo
117 echo "== perform I/O over TLS =="
118 QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT
119 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
120 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
121 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
122 2>&1 | _filter_qemu_io
124 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
126 echo
127 echo "== check TLS with authorization =="
129 nbd_server_stop
131 nbd_server_start_tcp_socket \
132 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=on \
133 --object "authz-simple,id=authz0,identity=CN=localhost,, \
134 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \
135 --tls-authz authz0 \
136 --tls-creds tls0 \
137 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
139 $QEMU_IMG info --image-opts \
140 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
141 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
142 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
144 $QEMU_IMG info --image-opts \
145 --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \
146 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
147 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
149 echo
150 echo "== final server log =="
151 cat "$TEST_DIR/server.log"
152 rm -f "$TEST_DIR/server.log"
154 # success, all done
155 echo "*** done"
156 rm -f $seq.full
157 status=0