4 # Test NBD TLS certificate / authorization integration
6 # Copyright (C) 2018-2019 Red Hat, Inc.
8 # This program is free software; you can redistribute it and/or modify
9 # it under the terms of the GNU General Public License as published by
10 # the Free Software Foundation; either version 2 of the License, or
11 # (at your option) any later version.
13 # This program is distributed in the hope that it will be useful,
14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 # GNU General Public License for more details.
18 # You should have received a copy of the GNU General Public License
19 # along with this program. If not, see <http://www.gnu.org/licenses/>.
23 owner
=berrange@redhat.com
26 echo "QA output created by $seq"
28 status
=1 # failure is the default!
34 # If we aborted early we want to see this log for diagnosis
35 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log"
36 rm -f "$TEST_DIR/server.log"
39 trap "_cleanup; exit \$status" 0 1 2 3 15
41 # get standard environment, filters and checks
48 _supported_fmt raw qcow2
50 # If porting to non-Linux, consider using socat instead of ss in common.nbd
51 _require_command QEMU_NBD
56 echo "== preparing TLS creds =="
58 tls_x509_create_root_ca
"ca1"
59 tls_x509_create_root_ca
"ca2"
60 tls_x509_create_server
"ca1" "server1"
61 tls_x509_create_client
"ca1" "client1"
62 tls_x509_create_client
"ca2" "client2"
63 tls_x509_create_client
"ca1" "client3"
64 tls_psk_create_creds
"psk1"
65 tls_psk_create_creds
"psk2"
68 echo "== preparing image =="
70 $QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" 2>&1 | _filter_qemu_io
73 echo "== check TLS client to plain server fails =="
74 nbd_server_start_tcp_socket
-f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log"
76 obj
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
77 $QEMU_IMG info
--image-opts --object $obj \
78 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
80 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
81 --tls-creds=tls0
2>&1 | _filter_qemu_nbd_exports
86 echo "== check plain client to TLS server fails =="
88 nbd_server_start_tcp_socket \
89 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=on \
91 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
93 $QEMU_IMG info nbd
://localhost
:$nbd_tcp_port \
95 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port \
96 2>&1 | _filter_qemu_nbd_exports
99 echo "== check TLS works =="
100 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
101 obj2
=tls-creds-x509
,dir
=${tls_dir}/client3
,endpoint
=client
,id
=tls0
102 $QEMU_IMG info
--image-opts --object $obj1 \
103 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
105 $QEMU_IMG info
--image-opts --object $obj2 \
106 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
108 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
109 --tls-creds=tls0
2>&1 | _filter_qemu_nbd_exports
112 echo "== check TLS fail over TCP with mismatched hostname =="
113 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
114 $QEMU_IMG info
--image-opts --object $obj1 \
115 driver
=nbd
,host=localhost
,port
=$nbd_tcp_port,tls-creds
=tls0 \
117 $QEMU_NBD_PROG -L -b localhost
-p $nbd_tcp_port --object $obj1 \
118 --tls-creds=tls0 | _filter_qemu_nbd_exports
121 echo "== check TLS works over TCP with mismatched hostname and override =="
122 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
123 $QEMU_IMG info
--image-opts --object $obj1 \
124 driver
=nbd
,host=localhost
,port
=$nbd_tcp_port,tls-creds
=tls0
,tls-hostname
=127.0.0.1 \
126 $QEMU_NBD_PROG -L -b localhost
-p $nbd_tcp_port --object $obj1 \
127 --tls-creds=tls0
--tls-hostname=127.0.0.1 | _filter_qemu_nbd_exports
130 echo "== check TLS with different CA fails =="
131 obj
=tls-creds-x509
,dir
=${tls_dir}/client2
,endpoint
=client
,id
=tls0
132 $QEMU_IMG info
--image-opts --object $obj \
133 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
135 $QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
136 --tls-creds=tls0
2>&1 | _filter_qemu_nbd_exports
139 echo "== perform I/O over TLS =="
140 QEMU_IO_OPTIONS
=$QEMU_IO_OPTIONS_NO_FMT
141 $QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
142 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
143 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
144 2>&1 | _filter_qemu_io
146 $QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" \
147 2>&1 | _filter_qemu_io
150 echo "== check TLS with authorization =="
154 nbd_server_start_tcp_socket \
155 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=on \
156 --object "authz-simple,id=authz0,identity=CN=localhost,, \
157 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \
160 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
162 $QEMU_IMG info
--image-opts \
163 --object tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0 \
164 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
167 $QEMU_IMG info
--image-opts \
168 --object tls-creds-x509
,dir
=${tls_dir}/client3
,endpoint
=client
,id
=tls0 \
169 driver
=nbd
,host=$nbd_tcp_addr,port
=$nbd_tcp_port,tls-creds
=tls0 \
174 nbd_server_start_unix_socket \
175 --object tls-creds-x509
,dir
=${tls_dir}/server1
,endpoint
=server
,id
=tls0
,verify-peer
=on \
177 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
180 echo "== check TLS fail over UNIX with no hostname =="
181 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
182 $QEMU_IMG info
--image-opts --object $obj1 \
183 driver
=nbd
,path
=$nbd_unix_socket,tls-creds
=tls0
2>&1 | _filter_nbd
184 $QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 --tls-creds=tls0 \
185 2>&1 | _filter_qemu_nbd_exports
188 echo "== check TLS works over UNIX with hostname override =="
189 obj1
=tls-creds-x509
,dir
=${tls_dir}/client1
,endpoint
=client
,id
=tls0
190 $QEMU_IMG info
--image-opts --object $obj1 \
191 driver
=nbd
,path
=$nbd_unix_socket,tls-creds
=tls0
,tls-hostname
=127.0.0.1 \
193 $QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
194 --tls-creds=tls0
--tls-hostname=127.0.0.1 2>&1 | _filter_qemu_nbd_exports
198 echo "== check TLS works over UNIX with PSK =="
201 nbd_server_start_unix_socket \
202 --object tls-creds-psk
,dir
=${tls_dir}/psk1
,endpoint
=server
,id
=tls0
,verify-peer
=on \
204 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
206 obj1
=tls-creds-psk
,dir
=${tls_dir}/psk1
,username
=psk1
,endpoint
=client
,id
=tls0
207 $QEMU_IMG info
--image-opts --object $obj1 \
208 driver
=nbd
,path
=$nbd_unix_socket,tls-creds
=tls0 \
210 $QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
211 --tls-creds=tls0
2>&1 | _filter_qemu_nbd_exports
214 echo "== check TLS fails over UNIX with mismatch PSK =="
215 obj1
=tls-creds-psk
,dir
=${tls_dir}/psk2
,username
=psk2
,endpoint
=client
,id
=tls0
216 $QEMU_IMG info
--image-opts --object $obj1 \
217 driver
=nbd
,path
=$nbd_unix_socket,tls-creds
=tls0 \
219 $QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
220 --tls-creds=tls0
2>&1 | _filter_qemu_nbd_exports
223 echo "== final server log =="
224 cat "$TEST_DIR/server.log" | _filter_authz_check_tls
225 rm -f "$TEST_DIR/server.log"