233 (093a2af7b67e98808dbb7c5364ac21602bec0881) 233 (b25e12daff2c3e5ba933f85e8ba278f5bcba8f4d)
1#!/bin/bash
2#
3# Test NBD TLS certificate / authorization integration
4#
5# Copyright (C) 2018-2019 Red Hat, Inc.
6#
7# This program is free software; you can redistribute it and/or modify
8# it under the terms of the GNU General Public License as published by

--- 47 unchanged lines hidden (view full) ---

56echo
57echo "== preparing TLS creds =="
58
59tls_x509_create_root_ca "ca1"
60tls_x509_create_root_ca "ca2"
61tls_x509_create_server "ca1" "server1"
62tls_x509_create_client "ca1" "client1"
63tls_x509_create_client "ca2" "client2"
1#!/bin/bash
2#
3# Test NBD TLS certificate / authorization integration
4#
5# Copyright (C) 2018-2019 Red Hat, Inc.
6#
7# This program is free software; you can redistribute it and/or modify
8# it under the terms of the GNU General Public License as published by

--- 47 unchanged lines hidden (view full) ---

56echo
57echo "== preparing TLS creds =="
58
59tls_x509_create_root_ca "ca1"
60tls_x509_create_root_ca "ca2"
61tls_x509_create_server "ca1" "server1"
62tls_x509_create_client "ca1" "client1"
63tls_x509_create_client "ca2" "client2"
64tls_x509_create_client "ca1" "client3"
64
65echo
66echo "== preparing image =="
67_make_test_img 64M
68$QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
69
70echo
71echo "== check TLS client to plain server fails =="

--- 16 unchanged lines hidden (view full) ---

88 --tls-creds tls0 \
89 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
90
91$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
92$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
93
94echo
95echo "== check TLS works =="
65
66echo
67echo "== preparing image =="
68_make_test_img 64M
69$QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io
70
71echo
72echo "== check TLS client to plain server fails =="

--- 16 unchanged lines hidden (view full) ---

89 --tls-creds tls0 \
90 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
91
92$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
93$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port
94
95echo
96echo "== check TLS works =="
96obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
97$QEMU_IMG info --image-opts --object $obj \
97obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
98obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0
99$QEMU_IMG info --image-opts --object $obj1 \
98 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
99 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
100 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
101 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
100$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \
102$QEMU_IMG info --image-opts --object $obj2 \
103 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
104 2>&1 | sed "s/$nbd_tcp_port/PORT/g"
105$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
101 --tls-creds=tls0
102
103echo
104echo "== check TLS with different CA fails =="
105obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0
106$QEMU_IMG info --image-opts --object $obj \
107 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
108 2>&1 | sed "s/$nbd_tcp_port/PORT/g"

--- 6 unchanged lines hidden (view full) ---

115$QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
116 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
117 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
118 2>&1 | _filter_qemu_io
119
120$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
121
122echo
106 --tls-creds=tls0
107
108echo
109echo "== check TLS with different CA fails =="
110obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0
111$QEMU_IMG info --image-opts --object $obj \
112 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
113 2>&1 | sed "s/$nbd_tcp_port/PORT/g"

--- 6 unchanged lines hidden (view full) ---

120$QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \
121 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
122 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \
123 2>&1 | _filter_qemu_io
124
125$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io
126
127echo
128echo "== check TLS with authorization =="
129
130nbd_server_stop
131
132nbd_server_start_tcp_socket \
133 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \
134 --object "authz-simple,id=authz0,identity=CN=localhost,, \
135 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \
136 --tls-authz authz0 \
137 --tls-creds tls0 \
138 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
139
140$QEMU_IMG info --image-opts \
141 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \
142 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0
143
144$QEMU_IMG info --image-opts \
145 --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \
146 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0
147
148echo
123echo "== final server log =="
124cat "$TEST_DIR/server.log"
125rm -f "$TEST_DIR/server.log"
126
127# success, all done
128echo "*** done"
129rm -f $seq.full
130status=0
149echo "== final server log =="
150cat "$TEST_DIR/server.log"
151rm -f "$TEST_DIR/server.log"
152
153# success, all done
154echo "*** done"
155rm -f $seq.full
156status=0