1#!/usr/bin/env bash 2# 3# Helpers for TLS related config 4# 5# Copyright (C) 2018 Red Hat, Inc. 6# 7# This program is free software; you can redistribute it and/or modify 8# it under the terms of the GNU General Public License as published by 9# the Free Software Foundation; either version 2 of the License, or 10# (at your option) any later version. 11# 12# This program is distributed in the hope that it will be useful, 13# but WITHOUT ANY WARRANTY; without even the implied warranty of 14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15# GNU General Public License for more details. 16# 17# You should have received a copy of the GNU General Public License 18# along with this program. If not, see <http://www.gnu.org/licenses/>. 19# 20 21tls_dir="${TEST_DIR}/tls" 22 23tls_x509_cleanup() 24{ 25 rm -f "${tls_dir}"/*.pem 26 rm -f "${tls_dir}"/*/*.pem 27 rm -f "${tls_dir}"/*/*.psk 28 rmdir "${tls_dir}"/* 29 rmdir "${tls_dir}" 30} 31 32 33tls_certtool() 34{ 35 certtool "$@" 1>"${tls_dir}"/certtool.log 2>&1 36 if test "$?" = 0; then 37 head -1 "${tls_dir}"/certtool.log 38 else 39 cat "${tls_dir}"/certtool.log 40 fi 41 rm -f "${tls_dir}"/certtool.log 42} 43 44tls_psktool() 45{ 46 psktool "$@" 1>"${tls_dir}"/psktool.log 2>&1 47 if test "$?" = 0; then 48 head -1 "${tls_dir}"/psktool.log 49 else 50 cat "${tls_dir}"/psktool.log 51 fi 52 rm -f "${tls_dir}"/psktool.log 53} 54 55 56tls_x509_init() 57{ 58 (certtool --help) >/dev/null 2>&1 || \ 59 _notrun "certtool utility not found, skipping test" 60 61 mkdir -p "${tls_dir}" 62 63 # use a fixed key so we don't waste system entropy on 64 # each test run 65 cat > "${tls_dir}/key.pem" <<EOF 66-----BEGIN RSA PRIVATE KEY----- 67MIIG5AIBAAKCAYEAyjWyLSNm5PZvYUKUcDWGqbLX10b2ood+YaFjWSnJrqx/q3qh 68rVGBJglD25AJENJsmZF3zPP1oMhfIxsXu63Hdkb6Rdlc2RUoUP34x9VC1izH25mR 696c8DPDp1d6IraZ/llDMI1HsBFz0qGWtvOHgm815XG4PAr/N8rDsuqfv/cJ01KlnO 700OdO5QRXCJf9g/dYd41MPu7wOXk9FqjQlmRoP59HgtJ+zUpE4z+Keruw9cMT9VJj 710oT+pQ9ysenqeZ3gbT224T1khrEhT5kifhtFLNyDssRchUUWH0hiqoOO1vgb+850 72W6/1VdxvuPam48py4diSPi1Vip8NITCOBaX9FIpVp4Ruw4rTPVMNMjq9Cpx/DwMP 739MbfXfnaVaZaMrmq67/zPhl0eVbUrecH2hQ3ZB9oIF4GkNskzlWF5+yPy6zqk304 74AKaiFR6jRyh3YfHo2XFqV8x/hxdsIEXOtEUGhSIcpynsW+ckUCartzu7xbhXjd4b 75kxJT89+riPFYij09AgMBAAECggGBAKyFkaZXXROeejrmHlV6JZGlp+fhgM38gkRz 76+Jp7P7rLLAY3E7gXIPQ91WqAAmwazFNdvHPd9USfkCQYmnAi/VoZhrCPmlsQZRxt 77A5QjjOnEvSPMa6SrXZxGWDCg6R8uMCb4P+FhrPWR1thnRDZOtRTQ+crc50p3mHgt 786ktXWIJRbqnag8zSfQqCYGtRmhe8sfsWT+Yl4El4+jjaAVU/B364u7+PLmaiphGp 79BdJfTsTwEpgtGkPj+osDmhzXcZkfq3V+fz5JLkemsCiQKmn4VJRpg8c3ZmE8NPNt 80gRtGWZ4W3WKDvhotT65WpQx4+6R8Duux/blNPBmH1Upmwd7kj7GYFBArbCjgd9PT 81xgfCSUZpgOZHHkcgSB+022a8XncXna7WYYij28SLtwImFyu0nNtqECFQHH5u+k6C 82LRYBSN+3t3At8dQuk01NVrJBndmjmXRfxpqUtTdeaNgVpdUYRY98s30G68NYGSra 83aEvhhRSghkcLNetkobpY9pUgeqW/tQKBwQDZHHK9nDMt/zk1TxtILeUSitPXcv1/ 848ufXqO0miHdH23XuXhIEA6Ef26RRVGDGgpjkveDJK/1w5feJ4H/ni4Vclil/cm38 85OwRqjjd7ElHJX6JQbsxEx/gNTk5/QW1iAL9TXUalgepsSXYT6AJ0/CJv0jmJSJ36 86YoKMOM8uqzb2KhN6i+RlJRi5iY53kUhWTJq5ArWvNhUzQNSYODI4bNxlsKSBL2Ik 87LZ5QKHuaEjQet0IlPlfIb4PzMm8CHa/urOcCgcEA7m3zW/lL5bIFoKPjWig5Lbn1 88aHfrG2ngqzWtgWtfZqMH8OkZc1Mdhhmvd46titjiLjeI+UP/uHXR0068PnrNngzl 89tTgwlakzu+bWzqhBm1F+3/341st/FEk07r0P/3/PhezVjwfO8c8Exj7pLxH4wrH0 90ROHgDbClmlJRu6OO78wk1+Vapf5DWa8YfA+q+fdvr7KvgGyytheKMT/b/dsqOq7y 91qZPjmaJKWAvV3RWG8lWHFSdHx2IAHMHfGr17Y/w7AoHBALzwZeYebeekiVucGSjq 92T8SgLhT7zCIx+JMUPjVfYzaUhP/Iu7Lkma6IzWm9nW6Drpy5pUpMzwUWDCLfzU9q 93eseFIl337kEn9wLn+t5OpgAyCqYmlftxbqvdrrBN9uvnrJjWvqk/8wsDrw9JxAGc 94fjeD4nBXUqvYWLXApoR9mZoGKedmoH9pFig4zlO9ig8YITnKYuQ0k6SD0b8agJHc 95Ir0YSUDnRGgpjvFBGbeOCe+FGbohk/EpItJc3IAh5740lwKBwAdXd2DjokSmYKn7 96oeqKxofz6+yVlLW5YuOiuX78sWlVp87xPolgi84vSEnkKM/Xsc8+goc6YstpRVa+ 97W+mImoA9YW1dF5HkLeWhTAf9AlgoAEIhbeIfTgBv6KNZSv7RDrDPBBxtXx/vAfSg 98x0ldwk0scZsVYXLKd67yzfV7KdGUdaX4N/xYgfZm/9gCG3+q8NN2KxVHQ5F71BOE 99JeABOaGo9WvnU+DNMIDZjHJMUWVw4MHz/a/UArDf/2CxaPVBNQKBwASg6j4ohSTk 100J7aE6RQ3OBmmDDpixcoCJt9u9SjHVYMlbs5CEJGVSczk0SG3y8P1lOWNDSRnMksZ 101xWnHdP/ogcuYMuvK7UACNAF0zNddtzOhzcpNmejFj+WCHYY/UmPr2/Kf6t7Cxk2K 1023cZ4tqWsiTmBT8Bknmah7L5DrhS+ZBJliDeFAA8fZHdMH0Xjr4UBp9kF90EMTdW1 103Xr5uz7ZrMsYpYQI7mmyqV9SSjUg4iBXwVSoag1iDJ1K8Qg/L7Semgg== 104-----END RSA PRIVATE KEY----- 105EOF 106} 107 108 109tls_x509_create_root_ca() 110{ 111 name=${1:-ca-cert} 112 113 cat > "${tls_dir}/ca.info" <<EOF 114cn = Cthulhu Dark Lord Enterprises $name 115ca 116cert_signing_key 117EOF 118 119 tls_certtool \ 120 --generate-self-signed \ 121 --load-privkey "${tls_dir}/key.pem" \ 122 --template "${tls_dir}/ca.info" \ 123 --outfile "${tls_dir}/$name-cert.pem" 124 125 rm -f "${tls_dir}/ca.info" 126} 127 128 129tls_x509_create_server() 130{ 131 caname=$1 132 name=$2 133 134 # We don't include 'localhost' in the cert, as 135 # we want to keep it unlisted to let tests 136 # validate hostname override 137 mkdir -p "${tls_dir}/$name" 138 cat > "${tls_dir}/cert.info" <<EOF 139organization = Cthulhu Dark Lord Enterprises $name 140cn = iotests.qemu.org 141ip_address = 127.0.0.1 142ip_address = ::1 143tls_www_server 144encryption_key 145signing_key 146EOF 147 148 tls_certtool \ 149 --generate-certificate \ 150 --load-ca-privkey "${tls_dir}/key.pem" \ 151 --load-ca-certificate "${tls_dir}/$caname-cert.pem" \ 152 --load-privkey "${tls_dir}/key.pem" \ 153 --template "${tls_dir}/cert.info" \ 154 --outfile "${tls_dir}/$name/server-cert.pem" 155 156 ln -s "${tls_dir}/$caname-cert.pem" "${tls_dir}/$name/ca-cert.pem" 157 ln -s "${tls_dir}/key.pem" "${tls_dir}/$name/server-key.pem" 158 159 rm -f "${tls_dir}/cert.info" 160} 161 162 163tls_x509_create_client() 164{ 165 caname=$1 166 name=$2 167 168 mkdir -p "${tls_dir}/$name" 169 cat > "${tls_dir}/cert.info" <<EOF 170country = South Pacific 171locality = R'lyeh 172organization = Cthulhu Dark Lord Enterprises $name 173cn = localhost 174tls_www_client 175encryption_key 176signing_key 177EOF 178 179 tls_certtool \ 180 --generate-certificate \ 181 --load-ca-privkey "${tls_dir}/key.pem" \ 182 --load-ca-certificate "${tls_dir}/$caname-cert.pem" \ 183 --load-privkey "${tls_dir}/key.pem" \ 184 --template "${tls_dir}/cert.info" \ 185 --outfile "${tls_dir}/$name/client-cert.pem" 186 187 ln -s "${tls_dir}/$caname-cert.pem" "${tls_dir}/$name/ca-cert.pem" 188 ln -s "${tls_dir}/key.pem" "${tls_dir}/$name/client-key.pem" 189 190 rm -f "${tls_dir}/cert.info" 191} 192 193tls_psk_create_creds() 194{ 195 name=$1 196 197 mkdir -p "${tls_dir}/$name" 198 199 tls_psktool \ 200 --pskfile "${tls_dir}/$name/keys.psk" \ 201 --username "$name" 202} 203