3 # Test NBD TLS certificate / authorization integration
5 # Copyright (C) 2018-2019 Red Hat, Inc.
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 2 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 owner
=berrange@redhat.com
25 echo "QA output created by $seq"
27 status
=1 # failure is the default!
33 # If we aborted early we want to see this log for diagnosis
34 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log"
35 rm -f "$TEST_DIR/server.log"
38 trap "_cleanup; exit \$status" 0 1 2 3 15
40 # get standard environment, filters and checks
47 _supported_fmt raw qcow2
49 # If porting to non-Linux, consider using socat instead of ss in common.nbd
51 _require_command QEMU_NBD
53 nbd_server_set_tcp_port
57 echo "== preparing TLS creds =="
59 tls_x509_create_root_ca
"ca1"
60 tls_x509_create_root_ca
"ca2"
61 tls_x509_create_server
"ca1" "server1"
62 tls_x509_create_client
"ca1" "client1"
63 tls_x509_create_client
"ca2" "client2"
64 tls_x509_create_client
"ca1" "client3"
67 echo "== preparing image =="
69 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
72 echo "== check TLS client to plain server fails =="
73 nbd_server_start_tcp_socket
-f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log"
75 obj
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
76 $QEMU_IMG info
--image-opts --object $obj \
77 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
78 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
79 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
85 echo "== check plain client to TLS server fails =="
87 nbd_server_start_tcp_socket \
88 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=yes \
90 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
92 $QEMU_IMG info nbd
://localhost
:$nbd_tcp_port 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
93 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
96 echo "== check TLS works =="
97 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
98 obj2
=tls-creds-x509
,dir
=${tls_dir}/client3
,endpoint
=client
,id
=tls0
99 $QEMU_IMG info
--image-opts --object $obj1 \
100 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
101 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
102 $QEMU_IMG info
--image-opts --object $obj2 \
103 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
104 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
105 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
109 echo "== check TLS with different CA fails =="
110 obj
=tls-creds-x509
,dir
=${tls_dir}/client2
,endpoint
=client
,id
=tls0
111 $QEMU_IMG info
--image-opts --object $obj \
112 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
113 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
114 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
118 echo "== perform I/O over TLS =="
119 QEMU_IO_OPTIONS
=$QEMU_IO_OPTIONS_NO_FMT
120 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
121 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
122 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
123 2>&1 | _filter_qemu_io
125 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
128 echo "== check TLS with authorization =="
132 nbd_server_start_tcp_socket \
133 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=yes \
134 --object "authz-simple,id=authz0,identity=CN=localhost,, \
135 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \
138 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
140 $QEMU_IMG info
--image-opts \
141 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
142 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0
144 $QEMU_IMG info
--image-opts \
145 --object tls-creds-x509
,dir
=${tls_dir}/client3
,endpoint
=client
,id
=tls0 \
146 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0
149 echo "== final server log =="
150 cat "$TEST_DIR/server.log"
151 rm -f "$TEST_DIR/server.log"