tests/qemu-iotests: validate NBD TLS with UNIX sockets and PSK
This validates that connections to an NBD server running on a UNIX socket can use TLS with pre-shared keys (PSK). Reviewed-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20220304193610.3293146-13-berrange@redhat.com> [eblake: squash in rebase fix] Tested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Eric Blake <eblake@redhat.com>
This commit is contained in:
Daniel P. Berrangé
Eric Blake
parent
f0620835c5
commit
10cc95c38f
|
|
@ -61,6 +61,8 @@ tls_x509_create_server "ca1" "server1"
|
|||
tls_x509_create_client "ca1" "client1"
|
||||
tls_x509_create_client "ca2" "client2"
|
||||
tls_x509_create_client "ca1" "client3"
|
||||
tls_psk_create_creds "psk1"
|
||||
tls_psk_create_creds "psk2"
|
||||
|
||||
echo
|
||||
echo "== preparing image =="
|
||||
|
|
@ -191,6 +193,32 @@ $QEMU_IMG info --image-opts --object $obj1 \
|
|||
$QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
|
||||
--tls-creds=tls0 --tls-hostname=127.0.0.1 2>&1 | _filter_qemu_nbd_exports
|
||||
|
||||
|
||||
echo
|
||||
echo "== check TLS works over UNIX with PSK =="
|
||||
nbd_server_stop
|
||||
|
||||
nbd_server_start_unix_socket \
|
||||
--object tls-creds-psk,dir=${tls_dir}/psk1,endpoint=server,id=tls0,verify-peer=on \
|
||||
--tls-creds tls0 \
|
||||
-f $IMGFMT "$TEST_IMG" 2>> "$TEST_DIR/server.log"
|
||||
|
||||
obj1=tls-creds-psk,dir=${tls_dir}/psk1,username=psk1,endpoint=client,id=tls0
|
||||
$QEMU_IMG info --image-opts --object $obj1 \
|
||||
driver=nbd,path=$nbd_unix_socket,tls-creds=tls0 \
|
||||
2>&1 | _filter_nbd
|
||||
$QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
|
||||
--tls-creds=tls0 2>&1 | _filter_qemu_nbd_exports
|
||||
|
||||
echo
|
||||
echo "== check TLS fails over UNIX with mismatch PSK =="
|
||||
obj1=tls-creds-psk,dir=${tls_dir}/psk2,username=psk2,endpoint=client,id=tls0
|
||||
$QEMU_IMG info --image-opts --object $obj1 \
|
||||
driver=nbd,path=$nbd_unix_socket,tls-creds=tls0 \
|
||||
2>&1 | _filter_nbd
|
||||
$QEMU_NBD_PROG -L -k $nbd_unix_socket --object $obj1 \
|
||||
--tls-creds=tls0 2>&1 | _filter_qemu_nbd_exports
|
||||
|
||||
echo
|
||||
echo "== final server log =="
|
||||
cat "$TEST_DIR/server.log" | _filter_authz_check_tls
|
||||
|
|
|
|||
|
|
@ -7,6 +7,8 @@ Generating a signed certificate...
|
|||
Generating a signed certificate...
|
||||
Generating a signed certificate...
|
||||
Generating a signed certificate...
|
||||
Generating a random key for user 'psk1'
|
||||
Generating a random key for user 'psk2'
|
||||
|
||||
== preparing image ==
|
||||
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
||||
|
|
@ -82,6 +84,20 @@ exports available: 1
|
|||
size: 67108864
|
||||
min block: 1
|
||||
|
||||
== check TLS works over UNIX with PSK ==
|
||||
image: nbd+unix://?socket=SOCK_DIR/qemu-nbd.sock
|
||||
file format: nbd
|
||||
virtual size: 64 MiB (67108864 bytes)
|
||||
disk size: unavailable
|
||||
exports available: 1
|
||||
export: ''
|
||||
size: 67108864
|
||||
min block: 1
|
||||
|
||||
== check TLS fails over UNIX with mismatch PSK ==
|
||||
qemu-img: Could not open 'driver=nbd,path=SOCK_DIR/qemu-nbd.sock,tls-creds=tls0': TLS handshake failed: The TLS connection was non-properly terminated.
|
||||
qemu-nbd: TLS handshake failed: The TLS connection was non-properly terminated.
|
||||
|
||||
== final server log ==
|
||||
qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read from TLS channel: Software caused connection abort
|
||||
qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read from TLS channel: Software caused connection abort
|
||||
|
|
@ -91,4 +107,6 @@ qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME
|
|||
qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME is denied
|
||||
qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read from TLS channel: Software caused connection abort
|
||||
qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read from TLS channel: Software caused connection abort
|
||||
qemu-nbd: option negotiation failed: TLS handshake failed: An illegal parameter has been received.
|
||||
qemu-nbd: option negotiation failed: TLS handshake failed: An illegal parameter has been received.
|
||||
*** done
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@ tls_x509_cleanup()
|
|||
{
|
||||
rm -f "${tls_dir}"/*.pem
|
||||
rm -f "${tls_dir}"/*/*.pem
|
||||
rm -f "${tls_dir}"/*/*.psk
|
||||
rmdir "${tls_dir}"/*
|
||||
rmdir "${tls_dir}"
|
||||
}
|
||||
|
|
@ -40,6 +41,18 @@ tls_certtool()
|
|||
rm -f "${tls_dir}"/certtool.log
|
||||
}
|
||||
|
||||
tls_psktool()
|
||||
{
|
||||
psktool "$@" 1>"${tls_dir}"/psktool.log 2>&1
|
||||
if test "$?" = 0; then
|
||||
head -1 "${tls_dir}"/psktool.log
|
||||
else
|
||||
cat "${tls_dir}"/psktool.log
|
||||
fi
|
||||
rm -f "${tls_dir}"/psktool.log
|
||||
}
|
||||
|
||||
|
||||
tls_x509_init()
|
||||
{
|
||||
(certtool --help) >/dev/null 2>&1 || \
|
||||
|
|
@ -176,3 +189,14 @@ EOF
|
|||
|
||||
rm -f "${tls_dir}/cert.info"
|
||||
}
|
||||
|
||||
tls_psk_create_creds()
|
||||
{
|
||||
name=$1
|
||||
|
||||
mkdir -p "${tls_dir}/$name"
|
||||
|
||||
tls_psktool \
|
||||
--pskfile "${tls_dir}/$name/keys.psk" \
|
||||
--username "$name"
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue