1#!/usr/bin/env bash 2# 3# Test NBD TLS certificate / authorization integration 4# 5# Copyright (C) 2018-2019 Red Hat, Inc. 6# 7# This program is free software; you can redistribute it and/or modify 8# it under the terms of the GNU General Public License as published by 9# the Free Software Foundation; either version 2 of the License, or 10# (at your option) any later version. 11# 12# This program is distributed in the hope that it will be useful, 13# but WITHOUT ANY WARRANTY; without even the implied warranty of 14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15# GNU General Public License for more details. 16# 17# You should have received a copy of the GNU General Public License 18# along with this program. If not, see <http://www.gnu.org/licenses/>. 19# 20 21# creator 22owner=berrange@redhat.com 23 24seq=$(basename $0) 25echo "QA output created by $seq" 26 27status=1 # failure is the default! 28 29_cleanup() 30{ 31 nbd_server_stop 32 _cleanup_test_img 33 # If we aborted early we want to see this log for diagnosis 34 test -f "$TEST_DIR/server.log" && cat "$TEST_DIR/server.log" 35 rm -f "$TEST_DIR/server.log" 36 tls_x509_cleanup 37} 38trap "_cleanup; exit \$status" 0 1 2 3 15 39 40# get standard environment, filters and checks 41. ./common.rc 42. ./common.filter 43. ./common.pattern 44. ./common.tls 45. ./common.nbd 46 47_supported_fmt raw qcow2 48_supported_proto file 49# If porting to non-Linux, consider using socat instead of ss in common.nbd 50_supported_os Linux 51_require_command QEMU_NBD 52 53nbd_server_set_tcp_port 54tls_x509_init 55 56echo 57echo "== preparing TLS creds ==" 58 59tls_x509_create_root_ca "ca1" 60tls_x509_create_root_ca "ca2" 61tls_x509_create_server "ca1" "server1" 62tls_x509_create_client "ca1" "client1" 63tls_x509_create_client "ca2" "client2" 64tls_x509_create_client "ca1" "client3" 65 66echo 67echo "== preparing image ==" 68_make_test_img 64M 69$QEMU_IO -c 'w -P 0x11 1m 1m' "$TEST_IMG" | _filter_qemu_io 70 71echo 72echo "== check TLS client to plain server fails ==" 73nbd_server_start_tcp_socket -f $IMGFMT "$TEST_IMG" 2> "$TEST_DIR/server.log" 74 75obj=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 76$QEMU_IMG info --image-opts --object $obj \ 77 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 78 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 79$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \ 80 --tls-creds=tls0 81 82nbd_server_stop 83 84echo 85echo "== check plain client to TLS server fails ==" 86 87nbd_server_start_tcp_socket \ 88 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \ 89 --tls-creds tls0 \ 90 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log" 91 92$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 93$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port 94 95echo 96echo "== check TLS works ==" 97obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 98obj2=tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 99$QEMU_IMG info --image-opts --object $obj1 \ 100 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 101 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 102$QEMU_IMG info --image-opts --object $obj2 \ 103 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 104 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 105$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \ 106 --tls-creds=tls0 107 108echo 109echo "== check TLS with different CA fails ==" 110obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0 111$QEMU_IMG info --image-opts --object $obj \ 112 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 113 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 114$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj \ 115 --tls-creds=tls0 116 117echo 118echo "== perform I/O over TLS ==" 119QEMU_IO_OPTIONS=$QEMU_IO_OPTIONS_NO_FMT 120$QEMU_IO -c 'r -P 0x11 1m 1m' -c 'w -P 0x22 1m 1m' --image-opts \ 121 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 122 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 123 2>&1 | _filter_qemu_io 124 125$QEMU_IO -f $IMGFMT -r -U -c 'r -P 0x22 1m 1m' "$TEST_IMG" | _filter_qemu_io 126 127echo 128echo "== check TLS with authorization ==" 129 130nbd_server_stop 131 132nbd_server_start_tcp_socket \ 133 --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes \ 134 --object "authz-simple,id=authz0,identity=CN=localhost,, \ 135 O=Cthulu Dark Lord Enterprises client1,,L=R'lyeh,,C=South Pacific" \ 136 --tls-authz authz0 \ 137 --tls-creds tls0 \ 138 -f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log" 139 140$QEMU_IMG info --image-opts \ 141 --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \ 142 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 143 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 144 145$QEMU_IMG info --image-opts \ 146 --object tls-creds-x509,dir=${tls_dir}/client3,endpoint=client,id=tls0 \ 147 driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \ 148 2>&1 | sed "s/$nbd_tcp_port/PORT/g" 149 150echo 151echo "== final server log ==" 152cat "$TEST_DIR/server.log" 153rm -f "$TEST_DIR/server.log" 154 155# success, all done 156echo "*** done" 157rm -f $seq.full 158status=0 159