1#!/usr/bin/env bash 2# group: quick 3# 4# Test NBD TLS certificate / authorization integration 5# 6# Copyright (C) 2018-2019 Red Hat, Inc. 7# 8# This program is free software; you can redistribute it and/or modify 9# it under the terms of the GNU General Public License as published by 10# the Free Software Foundation; either version 2 of the License, or 11# (at your option) any later version. 12# 13# This program is distributed in the hope that it will be useful, 14# but WITHOUT ANY WARRANTY; without even the implied warranty of 15# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16# GNU General Public License for more details. 17# 18# You should have received a copy of the GNU General Public License 19# along with this program. If not, see <http://www.gnu.org/licenses/>. 20# 21 22# creator 23owner=berrange@redhat.com 24 25seq=$(basename $0) 26echo "QA output created by $seq" 27 28status=1 # failure is the default! 29 30_cleanup() 31{ 32 nbd_server_stop 33 _cleanup_test_img 34 # If we aborted early we want to see this log for diagnosis 35 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log" 36 rm -f "$TEST_DIR/server.log" 37 tls_x509_cleanup 38} 39trap "_cleanup; exit \$status" 0 1 2 3 15 40 41# get standard environment, filters and checks 42. ./common.rc 43. ./common.filter 44. ./common.pattern 45. ./common.tls 46. ./common.nbd 47 48_supported_fmt raw qcow2 49_supported_proto file 50# If porting to non-Linux, consider using socat instead of ss in common.nbd 51_require_command QEMU_NBD 52 53tls_x509_init 54 55echo 56echo "== preparing TLS creds ==" 57 58tls_x509_create_root_ca "ca1" 59tls_x509_create_root_ca "ca2" 60tls_x509_create_server "ca1" "server1" 61tls_x509_create_client "ca1" "client1" 62tls_x509_create_client "ca2" "client2" 63tls_x509_create_client "ca1" "client3" 64 65echo 66echo "== preparing image ==" 67_make_test_img 64M 68$QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io 69 70echo 71echo "== check TLS client to plain server fails ==" 72nbd_server_start_tcp_socket -f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log" 73 74obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 75$QEMU_IMG info --image-opts --object $obj \ 76 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 77 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 78$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \ 79 --tls-creds=tls0 80 81nbd_server_stop 82 83echo 84echo "== check plain client to TLS server fails ==" 85 86nbd_server_start_tcp_socket \ 87 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=on \ 88 --tls-creds tls0 \ 89 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log" 90 91$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 92$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port 93 94echo 95echo "== check TLS works ==" 96obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 97obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 98$QEMU_IMG info --image-opts --object $obj1 \ 99 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 100 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 101$QEMU_IMG info --image-opts --object $obj2 \ 102 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 103 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 104$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \ 105 --tls-creds=tls0 106 107echo 108echo "== check TLS with different CA fails ==" 109obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0 110$QEMU_IMG info --image-opts --object $obj \ 111 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 112 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 113$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \ 114 --tls-creds=tls0 115 116echo 117echo "== perform I/O over TLS ==" 118QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT 119$QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \ 120 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 121 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 122 2>&1 | _filter_qemu_io 123 124$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io 125 126echo 127echo "== check TLS with authorization ==" 128 129nbd_server_stop 130 131nbd_server_start_tcp_socket \ 132 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=on \ 133 --object "authz-simple,id=authz0,identity=CN=localhost,, \ 134 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \ 135 --tls-authz authz0 \ 136 --tls-creds tls0 \ 137 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log" 138 139$QEMU_IMG info --image-opts \ 140 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 141 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 142 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 143 144$QEMU_IMG info --image-opts \ 145 --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \ 146 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 147 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 148 149echo 150echo "== final server log ==" 151cat "$TEST_DIR/server.log" | _filter_authz_check_tls 152rm -f "$TEST_DIR/server.log" 153 154# success, all done 155echo "*** done" 156rm -f $seq.full 157status=0 158