1#!/bin/bash 2# 3# Test NBD TLS certificate / authorization integration 4# 5# Copyright (C) 2018 Red Hat, Inc. 6# 7# This program is free software; you can redistribute it and/or modify 8# it under the terms of the GNU General Public License as published by 9# the Free Software Foundation; either version 2 of the License, or 10# (at your option) any later version. 11# 12# This program is distributed in the hope that it will be useful, 13# but WITHOUT ANY WARRANTY; without even the implied warranty of 14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15# GNU General Public License for more details. 16# 17# You should have received a copy of the GNU General Public License 18# along with this program. If not, see <http://www.gnu.org/licenses/>. 19# 20 21# creator 22owner=berrange@redhat.com 23 24seq=$(basename $0) 25echo "QA output created by $seq" 26 27status=1 # failure is the default! 28 29_cleanup() 30{ 31 nbd_server_stop 32 _cleanup_test_img 33 tls_x509_cleanup 34} 35trap "_cleanup; exit \$status" 0 1 2 3 15 36 37# get standard environment, filters and checks 38. ./common.rc 39. ./common.filter 40. ./common.pattern 41. ./common.tls 42. ./common.nbd 43 44_supported_fmt raw qcow2 45_supported_proto file 46# If porting to non-Linux, consider using socat instead of ss in common.nbd 47_supported_os Linux 48_require_command QEMU_NBD 49 50nbd_server_set_tcp_port 51tls_x509_init 52 53echo 54echo "== preparing TLS creds ==" 55 56tls_x509_create_root_ca "ca1" 57tls_x509_create_root_ca "ca2" 58tls_x509_create_server "ca1" "server1" 59tls_x509_create_client "ca1" "client1" 60tls_x509_create_client "ca2" "client2" 61 62echo 63echo "== preparing image ==" 64_make_test_img 64M 65$QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io 66 67echo 68echo "== check TLS client to plain server fails ==" 69nbd_server_start_tcp_socket -f $IMGFMT "$TEST_IMG" 70 71$QEMU_IMG info --image-opts \ 72 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 73 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 74 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 75 76nbd_server_stop 77 78echo 79echo "== check plain client to TLS server fails ==" 80 81nbd_server_start_tcp_socket \ 82 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \ 83 --tls-creds tls0 \ 84 -f $IMGFMT "$TEST_IMG" 85 86$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 87 88echo 89echo "== check TLS works ==" 90$QEMU_IMG info --image-opts \ 91 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 92 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 93 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 94 95echo 96echo "== check TLS with different CA fails ==" 97$QEMU_IMG info --image-opts \ 98 --object tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0 \ 99 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 100 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 101 102echo 103echo "== perform I/O over TLS ==" 104QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT 105$QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \ 106 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 107 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 108 2>&1 | _filter_qemu_io 109 110$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io 111 112# success, all done 113echo "*** done" 114rm -f $seq.full 115status=0 116