3 # Test NBD TLS certificate / authorization integration
5 # Copyright (C) 2018-2019 Red Hat, Inc.
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 2 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 owner
=berrange@redhat.com
25 echo "QA output created by $seq"
27 status
=1 # failure is the default!
33 rm -f "$TEST_DIR/server.log"
36 trap "_cleanup; exit \$status" 0 1 2 3 15
38 # get standard environment, filters and checks
45 _supported_fmt raw qcow2
47 # If porting to non-Linux, consider using socat instead of ss in common.nbd
49 _require_command QEMU_NBD
51 nbd_server_set_tcp_port
55 echo "== preparing TLS creds =="
57 tls_x509_create_root_ca
"ca1"
58 tls_x509_create_root_ca
"ca2"
59 tls_x509_create_server
"ca1" "server1"
60 tls_x509_create_client
"ca1" "client1"
61 tls_x509_create_client
"ca2" "client2"
64 echo "== preparing image =="
66 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
69 echo "== check TLS client to plain server fails =="
70 nbd_server_start_tcp_socket
-f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log"
72 obj
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
73 $QEMU_IMG info
--image-opts --object $obj \
74 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
75 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
76 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
82 echo "== check plain client to TLS server fails =="
84 nbd_server_start_tcp_socket \
85 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=yes \
87 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
89 $QEMU_IMG info nbd
://localhost
:$nbd_tcp_port 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
90 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
93 echo "== check TLS works =="
94 obj
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
95 $QEMU_IMG info
--image-opts --object $obj \
96 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
97 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
98 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
102 echo "== check TLS with different CA fails =="
103 obj
=tls-creds-x509
,dir
=${tls_dir}/client2
,endpoint
=client
,id
=tls0
104 $QEMU_IMG info
--image-opts --object $obj \
105 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
106 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
107 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
111 echo "== perform I/O over TLS =="
112 QEMU_IO_OPTIONS
=$QEMU_IO_OPTIONS_NO_FMT
113 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
114 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
115 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
116 2>&1 | _filter_qemu_io
118 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
121 echo "== final server log =="
122 cat "$TEST_DIR/server.log"