OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

tests: add multifd migration tests of TLS with x509 credentials

Browse Source 
This validates that we correctly handle multifd migration success
and failure scenarios when using TLS with x509 certificates. There
are quite a few different scenarios that matter in relation to
hostname validation, but we skip a couple as we can assume that
the non-multifd coverage applies to some extent.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220426160048.812266-9-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2022-04-26 17:00:47 +01:00 committed by Dr. David Alan Gilbert
parent 4d6d2e872a
commit ff32f1dd32
1 changed files with 127 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

127
tests/qtest/migration-test.c
View File

@ -1833,6 +1833,48 @@ test_migrate_multifd_tcp_tls_psk_start_mismatch(QTestState *from,
return test_migrate_tls_psk_start_mismatch(from, to);
}
#ifdef CONFIG_TASN1
static void *
test_migrate_multifd_tls_x509_start_default_host(QTestState *from,
QTestState *to)
{
test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
return test_migrate_tls_x509_start_default_host(from, to);
}
static void *
test_migrate_multifd_tls_x509_start_override_host(QTestState *from,
QTestState *to)
{
test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
return test_migrate_tls_x509_start_override_host(from, to);
}
static void *
test_migrate_multifd_tls_x509_start_mismatch_host(QTestState *from,
QTestState *to)
{
test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
return test_migrate_tls_x509_start_mismatch_host(from, to);
}
static void *
test_migrate_multifd_tls_x509_start_allow_anon_client(QTestState *from,
QTestState *to)
{
test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
return test_migrate_tls_x509_start_allow_anon_client(from, to);
}
static void *
test_migrate_multifd_tls_x509_start_reject_anon_client(QTestState *from,
QTestState *to)
{
test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
return test_migrate_tls_x509_start_reject_anon_client(from, to);
}
#endif /* CONFIG_TASN1 */
static void test_multifd_tcp_tls_psk_match(void)
{
MigrateCommon args = {
@ -1856,6 +1898,79 @@ static void test_multifd_tcp_tls_psk_mismatch(void)
};
test_precopy_common(&args);
}
#ifdef CONFIG_TASN1
static void test_multifd_tcp_tls_x509_default_host(void)
{
MigrateCommon args = {
.listen_uri = "defer",
.start_hook = test_migrate_multifd_tls_x509_start_default_host,
.finish_hook = test_migrate_tls_x509_finish,
};
test_precopy_common(&args);
}
static void test_multifd_tcp_tls_x509_override_host(void)
{
MigrateCommon args = {
.listen_uri = "defer",
.start_hook = test_migrate_multifd_tls_x509_start_override_host,
.finish_hook = test_migrate_tls_x509_finish,
};
test_precopy_common(&args);
}
static void test_multifd_tcp_tls_x509_mismatch_host(void)
{
/*
* This has different behaviour to the non-multifd case.
*
* In non-multifd case when client aborts due to mismatched
* cert host, the server has already started trying to load
* migration state, and so it exits with I/O failure.
*
* In multifd case when client aborts due to mismatched
* cert host, the server is still waiting for the other
* multifd connections to arrive so hasn't started trying
* to load migration state, and thus just aborts the migration
* without exiting.
*/
MigrateCommon args = {
.start = {
.hide_stderr = true,
},
.listen_uri = "defer",
.start_hook = test_migrate_multifd_tls_x509_start_mismatch_host,
.finish_hook = test_migrate_tls_x509_finish,
.result = MIG_TEST_FAIL,
};
test_precopy_common(&args);
}
static void test_multifd_tcp_tls_x509_allow_anon_client(void)
{
MigrateCommon args = {
.listen_uri = "defer",
.start_hook = test_migrate_multifd_tls_x509_start_allow_anon_client,
.finish_hook = test_migrate_tls_x509_finish,
};
test_precopy_common(&args);
}
static void test_multifd_tcp_tls_x509_reject_anon_client(void)
{
MigrateCommon args = {
.start = {
.hide_stderr = true,
},
.listen_uri = "defer",
.start_hook = test_migrate_multifd_tls_x509_start_reject_anon_client,
.finish_hook = test_migrate_tls_x509_finish,
.result = MIG_TEST_FAIL,
};
test_precopy_common(&args);
}
#endif /* CONFIG_TASN1 */
#endif /* CONFIG_GNUTLS */
/*
@ -2083,6 +2198,18 @@ int main(int argc, char **argv)
test_multifd_tcp_tls_psk_match);
qtest_add_func("/migration/multifd/tcp/tls/psk/mismatch",
test_multifd_tcp_tls_psk_mismatch);
#ifdef CONFIG_TASN1
qtest_add_func("/migration/multifd/tcp/tls/x509/default-host",
test_multifd_tcp_tls_x509_default_host);
qtest_add_func("/migration/multifd/tcp/tls/x509/override-host",
test_multifd_tcp_tls_x509_override_host);
qtest_add_func("/migration/multifd/tcp/tls/x509/mismatch-host",
test_multifd_tcp_tls_x509_mismatch_host);
qtest_add_func("/migration/multifd/tcp/tls/x509/allow-anon-client",
test_multifd_tcp_tls_x509_allow_anon_client);
qtest_add_func("/migration/multifd/tcp/tls/x509/reject-anon-client",
test_multifd_tcp_tls_x509_reject_anon_client);
#endif /* CONFIG_TASN1 */
#endif /* CONFIG_GNUTLS */
if (kvm_dirty_ring_supported()) {