From 74a1f98290aa6ec986bea9bcd87c4fb8b93afd4d Mon Sep 17 00:00:00 2001

From: John Snow <jsnow@redhat.com>

Date: Fri, 22 Mar 2019 03:22:35 +0100

Subject: [PATCH 068/163] tests: exercise NBD server in TLS mode

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

RH-Author: John Snow <jsnow@redhat.com>

Message-id: <20190322032241.8111-23-jsnow@redhat.com>

Patchwork-id: 85104

O-Subject: [RHEL-7.7 qemu-kvm-rhev PATCH 22/28] tests: exercise NBD server in TLS mode

Bugzilla: 1691563

RH-Acked-by: Max Reitz <mreitz@redhat.com>

RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>

RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>

From: Daniel P. Berrangé <berrange@redhat.com>

Add tests that validate it is possible to connect to an NBD server

running TLS mode. Also test mis-matched TLS vs non-TLS connections

correctly fail.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Message-Id: <20181116155325.22428-7-berrange@redhat.com>

Reviewed-by: Eric Blake <eblake@redhat.com>

Tested-by: Eric Blake <eblake@redhat.com>

[eblake: rebase to iotests shell cleanups, use ss instead of socat for

port probing, sanitize port number in expected output]

Signed-off-by: Eric Blake <eblake@redhat.com>

(cherry picked from commit afcd1c2f2d438930a17eb87293c0ac2c377158fa)

Signed-off-by: John Snow <jsnow@redhat.com>

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

---

 tests/qemu-iotests/233        | 102 ++++++++++++++++++++++++++++++++++++++++++

 tests/qemu-iotests/233.out    |  30 +++++++++++++

 tests/qemu-iotests/common.nbd |  45 +++++++++++++++++++

 tests/qemu-iotests/group      |   1 +

 4 files changed, 178 insertions(+)

 create mode 100755 tests/qemu-iotests/233

 create mode 100644 tests/qemu-iotests/233.out

diff --git a/tests/qemu-iotests/233 b/tests/qemu-iotests/233

new file mode 100755

index 0000000..46013ce

--- /dev/null

+++ b/tests/qemu-iotests/233

@@ -0,0 +1,102 @@

+#!/bin/bash

+#

+# Test NBD TLS certificate / authorization integration

+#

+# Copyright (C) 2018 Red Hat, Inc.

+#

+# This program is free software; you can redistribute it and/or modify

+# it under the terms of the GNU General Public License as published by

+# the Free Software Foundation; either version 2 of the License, or

+# (at your option) any later version.

+#

+# This program is distributed in the hope that it will be useful,

+# but WITHOUT ANY WARRANTY; without even the implied warranty of

+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+# GNU General Public License for more details.

+#

+# You should have received a copy of the GNU General Public License

+# along with this program.  If not, see <http://www.gnu.org/licenses/>.

+#

+

+# creator

+owner=berrange@redhat.com

+

+seq=$(basename $0)

+echo "QA output created by $seq"

+

+status=1	# failure is the default!

+

+_cleanup()

+{

+    nbd_server_stop

+    _cleanup_test_img

+    tls_x509_cleanup

+}

+trap "_cleanup; exit \$status" 0 1 2 3 15

+

+# get standard environment, filters and checks

+. ./common.rc

+. ./common.filter

+. ./common.pattern

+. ./common.tls

+. ./common.nbd

+

+_supported_fmt raw qcow2

+_supported_proto file

+# If porting to non-Linux, consider using socat instead of ss in common.nbd

+_supported_os Linux

+_require_command QEMU_NBD

+

+nbd_server_set_tcp_port

+tls_x509_init

+

+echo

+echo "== preparing TLS creds =="

+

+tls_x509_create_root_ca "ca1"

+tls_x509_create_root_ca "ca2"

+tls_x509_create_server "ca1" "server1"

+tls_x509_create_client "ca1" "client1"

+tls_x509_create_client "ca2" "client2"

+

+echo

+echo "== preparing image =="

+_make_test_img 64M

+

+

+echo

+echo "== check TLS client to plain server fails =="

+nbd_server_start_tcp_socket "$TEST_IMG"

+

+$QEMU_IMG info --image-opts \

+    --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \

+    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \

+    2>&1 | sed "s/$nbd_tcp_port/PORT/g"

+

+nbd_server_stop

+

+echo

+echo "== check plain client to TLS server fails =="

+

+nbd_server_start_tcp_socket --object tls-creds-x509,dir=${tls_dir}/server1,endpoint=server,id=tls0,verify-peer=yes --tls-creds tls0 "$TEST_IMG"

+

+$QEMU_IMG info nbd://localhost:$nbd_tcp_port 2>&1 | sed "s/$nbd_tcp_port/PORT/g"

+

+echo

+echo "== check TLS works =="

+$QEMU_IMG info --image-opts \

+    --object tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0 \

+    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \

+    2>&1 | sed "s/$nbd_tcp_port/PORT/g"

+

+echo

+echo "== check TLS with different CA fails =="

+$QEMU_IMG info --image-opts \

+    --object tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0 \

+    driver=nbd,host=$nbd_tcp_addr,port=$nbd_tcp_port,tls-creds=tls0 \

+    2>&1 | sed "s/$nbd_tcp_port/PORT/g"

+

+# success, all done

+echo "*** done"

+rm -f $seq.full

+status=0

diff --git a/tests/qemu-iotests/233.out b/tests/qemu-iotests/233.out

new file mode 100644

index 0000000..616e923

--- /dev/null

+++ b/tests/qemu-iotests/233.out

@@ -0,0 +1,30 @@

+QA output created by 233

+

+== preparing TLS creds ==

+Generating a self signed certificate...

+Generating a self signed certificate...

+Generating a signed certificate...

+Generating a signed certificate...

+Generating a signed certificate...

+

+== preparing image ==

+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864

+

+== check TLS client to plain server fails ==

+qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': Denied by server for option 5 (starttls)

+server reported: TLS not configured

+

+== check plain client to TLS server fails ==

+qemu-img: Could not open 'nbd://localhost:PORT': TLS negotiation required before option 8 (structured reply)

+server reported: Option 0x8 not permitted before TLS

+

+== check TLS works ==

+image: nbd://127.0.0.1:PORT

+file format: nbd

+virtual size: 64M (67108864 bytes)

+disk size: unavailable

+

+== check TLS with different CA fails ==

+option negotiation failed: Verify failed: No certificate was found.

+qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': The certificate hasn't got a known issuer

+*** done

diff --git a/tests/qemu-iotests/common.nbd b/tests/qemu-iotests/common.nbd

index 9f841ab..0f4497a 100644

--- a/tests/qemu-iotests/common.nbd

+++ b/tests/qemu-iotests/common.nbd

@@ -20,6 +20,7 @@

 #

 nbd_unix_socket="${TEST_DIR}/qemu-nbd.sock"

+nbd_tcp_addr="127.0.0.1"

 nbd_pid_file="${TEST_DIR}/qemu-nbd.pid"

 function nbd_server_stop()

@@ -62,3 +63,47 @@ function nbd_server_start_unix_socket()

     $QEMU_NBD -v -t -k "$nbd_unix_socket" "$@" &

     nbd_server_wait_for_unix_socket $!

 }

+

+function nbd_server_set_tcp_port()

+{

+    (ss --help) >/dev/null 2>&1 || _notrun "ss utility not found, skipping test"

+

+    for ((port = 10809; port <= 10909; port++))

+    do

+        if ! ss -tln | grep -sqE ":$port\b"; then

+            nbd_tcp_port=$port

+            return

+        fi

+    done

+

+    echo "Cannot find free TCP port for nbd in range 10809-10909"

+    exit 1

+}

+

+function nbd_server_wait_for_tcp_socket()

+{

+    pid=$1

+

+    for ((i = 0; i < 300; i++))

+    do

+        if ss -tln | grep -sqE ":$nbd_tcp_port\b"; then

+            return

+        fi

+        kill -s 0 $pid 2>/dev/null

+        if test $? != 0

+        then

+            echo "qemu-nbd unexpectedly quit"

+            exit 1

+        fi

+        sleep 0.1

+    done

+    echo "Failed in check of TCP socket created by qemu-nbd"

+    exit 1

+}

+

+function nbd_server_start_tcp_socket()

+{

+    nbd_server_stop

+    $QEMU_NBD -v -t -b $nbd_tcp_addr -p $nbd_tcp_port "$@" &

+    nbd_server_wait_for_tcp_socket $!

+}

diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group

index bee2855..b3aeb6b 100644

--- a/tests/qemu-iotests/group

+++ b/tests/qemu-iotests/group

@@ -226,6 +226,7 @@

 229 auto quick

 231 auto quick

 232 auto quick

+233 auto quick

 234 auto quick migration

 236 auto quick

 242 rw auto quick

-- 

1.8.3.1