3 # Test NBD TLS certificate / authorization integration
5 # Copyright (C) 2018 Red Hat, Inc.
7 # This program is free software; you can redistribute it and/or modify
8 # it under the terms of the GNU General Public License as published by
9 # the Free Software Foundation; either version 2 of the License, or
10 # (at your option) any later version.
12 # This program is distributed in the hope that it will be useful,
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 # GNU General Public License for more details.
17 # You should have received a copy of the GNU General Public License
18 # along with this program. If not, see <http://www.gnu.org/licenses/>.
22 owner
=berrange@redhat.com
25 echo "QA output created by $seq"
27 status
=1 # failure is the default!
35 trap "_cleanup; exit \$status" 0 1 2 3 15
37 # get standard environment, filters and checks
44 _supported_fmt raw qcow2
46 # If porting to non-Linux, consider using socat instead of ss in common.nbd
48 _require_command QEMU_NBD
50 nbd_server_set_tcp_port
54 echo "== preparing TLS creds =="
56 tls_x509_create_root_ca
"ca1"
57 tls_x509_create_root_ca
"ca2"
58 tls_x509_create_server
"ca1" "server1"
59 tls_x509_create_client
"ca1" "client1"
60 tls_x509_create_client
"ca2" "client2"
63 echo "== preparing image =="
65 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
68 echo "== check TLS client to plain server fails =="
69 nbd_server_start_tcp_socket
-f $IMGFMT "$TEST_IMG"
71 $QEMU_IMG info
--image-opts \
72 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
73 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
74 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
79 echo "== check plain client to TLS server fails =="
81 nbd_server_start_tcp_socket \
82 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=yes \
84 -f $IMGFMT "$TEST_IMG"
86 $QEMU_IMG info nbd
://localhost
:$nbd_tcp_port 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
89 echo "== check TLS works =="
90 $QEMU_IMG info
--image-opts \
91 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
92 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
93 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
96 echo "== check TLS with different CA fails =="
97 $QEMU_IMG info
--image-opts \
98 --object tls-creds-x509
,dir
=${tls_dir}/client2
,endpoint
=client
,id
=tls0 \
99 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
100 2>&1 |
sed "s/$nbd_tcp_port/PORT/g"
103 echo "== perform I/O over TLS =="
104 QEMU_IO_OPTIONS
=$QEMU_IO_OPTIONS_NO_FMT
105 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
106 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
107 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
108 2>&1 | _filter_qemu_io
110 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io