a6d2bb25cf
The version of GNUTLS in Fedora 34 has changed the order in which encodes fields when generating new TLS certificates. This in turn changes the order seen when querying the distinguished name. This ultimately breaks the expected output in the NBD TLS iotests. We don't need to be comparing the exact distinguished name text for the purpose of the test though, so it is fine to filter it out. Reported-by: Eric Blake <eblake@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com> Message-Id: <20210804180330.3469683-1-berrange@redhat.com> Reviewed-by: Eric Blake <eblake@redhat.com> Tested-by: Eric Blake <eblake@redhat.com> Signed-off-by: Hanna Reitz <hreitz@redhat.com>
71 lines
2.8 KiB
Plaintext
71 lines
2.8 KiB
Plaintext
QA output created by 233
|
|
|
|
== preparing TLS creds ==
|
|
Generating a self signed certificate...
|
|
Generating a self signed certificate...
|
|
Generating a signed certificate...
|
|
Generating a signed certificate...
|
|
Generating a signed certificate...
|
|
Generating a signed certificate...
|
|
|
|
== preparing image ==
|
|
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864
|
|
wrote 1048576/1048576 bytes at offset 1048576
|
|
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
|
== check TLS client to plain server fails ==
|
|
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': Denied by server for option 5 (starttls)
|
|
server reported: TLS not configured
|
|
qemu-nbd: Denied by server for option 5 (starttls)
|
|
server reported: TLS not configured
|
|
|
|
== check plain client to TLS server fails ==
|
|
qemu-img: Could not open 'nbd://localhost:PORT': TLS negotiation required before option 7 (go)
|
|
Did you forget a valid tls-creds?
|
|
server reported: Option 0x7 not permitted before TLS
|
|
qemu-nbd: TLS negotiation required before option 3 (list)
|
|
Did you forget a valid tls-creds?
|
|
server reported: Option 0x3 not permitted before TLS
|
|
|
|
== check TLS works ==
|
|
image: nbd://127.0.0.1:PORT
|
|
file format: nbd
|
|
virtual size: 64 MiB (67108864 bytes)
|
|
disk size: unavailable
|
|
image: nbd://127.0.0.1:PORT
|
|
file format: nbd
|
|
virtual size: 64 MiB (67108864 bytes)
|
|
disk size: unavailable
|
|
exports available: 1
|
|
export: ''
|
|
size: 67108864
|
|
flags: 0xced ( flush fua trim zeroes df cache fast-zero )
|
|
min block: 1
|
|
opt block: 4096
|
|
max block: 33554432
|
|
available meta contexts: 1
|
|
base:allocation
|
|
|
|
== check TLS with different CA fails ==
|
|
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': The certificate hasn't got a known issuer
|
|
qemu-nbd: The certificate hasn't got a known issuer
|
|
|
|
== perform I/O over TLS ==
|
|
read 1048576/1048576 bytes at offset 1048576
|
|
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
wrote 1048576/1048576 bytes at offset 1048576
|
|
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
read 1048576/1048576 bytes at offset 1048576
|
|
1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
|
|
|
|
== check TLS with authorization ==
|
|
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': Failed to read option reply: Cannot read from TLS channel: Software caused connection abort
|
|
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': Failed to read option reply: Cannot read from TLS channel: Software caused connection abort
|
|
|
|
== final server log ==
|
|
qemu-nbd: option negotiation failed: Verify failed: No certificate was found.
|
|
qemu-nbd: option negotiation failed: Verify failed: No certificate was found.
|
|
qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME is denied
|
|
qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME is denied
|
|
*** done
|