vga: build virtio-gpu as module
[qemu/ar7.git] / tests / qemu-iotests / 233
bloba5c17c39639de6fc94cb7c2cab3bf603f62e6d62
1 #!/usr/bin/env bash
3 # Test NBD TLS certificate / authorization integration
5 # Copyright (C) 2018-2019 Red Hat, Inc.
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 2 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
21 # creator
22 owner=berrange@redhat.com
24 seq=$(basename $0)
25 echo "QA output created by $seq"
27 status=1 # failure is the default!
29 _cleanup()
31 nbd_server_stop
32 _cleanup_test_img
33 # If we aborted early we want to see this log for diagnosis
34 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log"
35 rm -f "$TEST_DIR/server.log"
36 tls_x509_cleanup
38 trap "_cleanup; exit \$status" 0 1 2 3 15
40 # get standard environment, filters and checks
41 . ./common.rc
42 . ./common.filter
43 . ./common.pattern
44 . ./common.tls
45 . ./common.nbd
47 _supported_fmt raw qcow2
48 _supported_proto file
49 # If porting to non-Linux, consider using socat instead of ss in common.nbd
50 _require_command QEMU_NBD
52 tls_x509_init
54 echo
55 echo "== preparing TLS creds =="
57 tls_x509_create_root_ca "ca1"
58 tls_x509_create_root_ca "ca2"
59 tls_x509_create_server "ca1" "server1"
60 tls_x509_create_client "ca1" "client1"
61 tls_x509_create_client "ca2" "client2"
62 tls_x509_create_client "ca1" "client3"
64 echo
65 echo "== preparing image =="
66 _make_test_img 64M
67 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
69 echo
70 echo "== check TLS client to plain server fails =="
71 nbd_server_start_tcp_socket -f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log"
73 obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
74 $QEMU_IMG info --image-opts --object $obj \
75 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
76 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
77 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
78 --tls-creds=tls0
80 nbd_server_stop
82 echo
83 echo "== check plain client to TLS server fails =="
85 nbd_server_start_tcp_socket \
86 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \
87 --tls-creds tls0 \
88 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
90 $QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
91 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
93 echo
94 echo "== check TLS works =="
95 obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
96 obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0
97 $QEMU_IMG info --image-opts --object $obj1 \
98 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
99 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
100 $QEMU_IMG info --image-opts --object $obj2 \
101 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
102 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
103 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
104 --tls-creds=tls0
106 echo
107 echo "== check TLS with different CA fails =="
108 obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0
109 $QEMU_IMG info --image-opts --object $obj \
110 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
111 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
112 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
113 --tls-creds=tls0
115 echo
116 echo "== perform I/O over TLS =="
117 QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT
118 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
119 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
120 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
121 2>&1 | _filter_qemu_io
123 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
125 echo
126 echo "== check TLS with authorization =="
128 nbd_server_stop
130 nbd_server_start_tcp_socket \
131 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \
132 --object "authz-simple,id=authz0,identity=CN=localhost,, \
133 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \
134 --tls-authz authz0 \
135 --tls-creds tls0 \
136 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
138 $QEMU_IMG info --image-opts \
139 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
140 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
141 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
143 $QEMU_IMG info --image-opts \
144 --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \
145 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
146 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
148 echo
149 echo "== final server log =="
150 cat "$TEST_DIR/server.log"
151 rm -f "$TEST_DIR/server.log"
153 # success, all done
154 echo "*** done"
155 rm -f $seq.full
156 status=0