[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 10/15] tests/qemu-iotests: validate NBD TLS with hostname mismatch
From: |
Eric Blake |
Subject: |
[PULL 10/15] tests/qemu-iotests: validate NBD TLS with hostname mismatch |
Date: |
Mon, 7 Mar 2022 19:44:14 -0600 |
From: Daniel P. Berrangé <berrange@redhat.com>
This validates that connections to an NBD server where the certificate
hostname does not match will fail. It further validates that using the
new 'tls-hostname' override option can solve the failure.
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220304193610.3293146-11-berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
tests/qemu-iotests/common.tls | 7 ++++---
tests/qemu-iotests/233 | 18 ++++++++++++++++++
tests/qemu-iotests/233.out | 16 ++++++++++++++++
3 files changed, 38 insertions(+), 3 deletions(-)
diff --git a/tests/qemu-iotests/common.tls b/tests/qemu-iotests/common.tls
index 6ba28a78d3c8..4a5760949d0f 100644
--- a/tests/qemu-iotests/common.tls
+++ b/tests/qemu-iotests/common.tls
@@ -118,12 +118,13 @@ tls_x509_create_server()
caname=$1
name=$2
+ # We don't include 'localhost' in the cert, as
+ # we want to keep it unlisted to let tests
+ # validate hostname override
mkdir -p "${tls_dir}/$name"
cat > "${tls_dir}/cert.info" <<EOF
organization = Cthulhu Dark Lord Enterprises $name
-cn = localhost
-dns_name = localhost
-dns_name = localhost.localdomain
+cn = iotests.qemu.org
ip_address = 127.0.0.1
ip_address = ::1
tls_www_server
diff --git a/tests/qemu-iotests/233 b/tests/qemu-iotests/233
index 050267298d67..c24d877be88e 100755
--- a/tests/qemu-iotests/233
+++ b/tests/qemu-iotests/233
@@ -106,6 +106,24 @@ $QEMU_IMG info --image-opts --object $obj2 \
$QEMU_NBD_PROG -L -b $nbd_tcp_addr -p $nbd_tcp_port --object $obj1 \
--tls-creds=tls0 2>&1 | _filter_qemu_nbd_exports
+echo
+echo "== check TLS fail over TCP with mismatched hostname =="
+obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
+$QEMU_IMG info --image-opts --object $obj1 \
+ driver=nbd,host=localhost,port=$nbd_tcp_port,tls-creds=tls0 \
+ 2>&1 | _filter_nbd
+$QEMU_NBD_PROG -L -b localhost -p $nbd_tcp_port --object $obj1 \
+ --tls-creds=tls0 | _filter_qemu_nbd_exports
+
+echo
+echo "== check TLS works over TCP with mismatched hostname and override =="
+obj1=tls-creds-x509,dir=${tls_dir}/client1,endpoint=client,id=tls0
+$QEMU_IMG info --image-opts --object $obj1 \
+
driver=nbd,host=localhost,port=$nbd_tcp_port,tls-creds=tls0,tls-hostname=127.0.0.1
\
+ 2>&1 | _filter_nbd
+$QEMU_NBD_PROG -L -b localhost -p $nbd_tcp_port --object $obj1 \
+ --tls-creds=tls0 --tls-hostname=127.0.0.1 | _filter_qemu_nbd_exports
+
echo
echo "== check TLS with different CA fails =="
obj=tls-creds-x509,dir=${tls_dir}/client2,endpoint=client,id=tls0
diff --git a/tests/qemu-iotests/233.out b/tests/qemu-iotests/233.out
index 67a027d87986..d42611bf74a6 100644
--- a/tests/qemu-iotests/233.out
+++ b/tests/qemu-iotests/233.out
@@ -38,6 +38,20 @@ exports available: 1
size: 67108864
min block: 1
+== check TLS fail over TCP with mismatched hostname ==
+qemu-img: Could not open 'driver=nbd,host=localhost,port=PORT,tls-creds=tls0':
Certificate does not match the hostname localhost
+qemu-nbd: Certificate does not match the hostname localhost
+
+== check TLS works over TCP with mismatched hostname and override ==
+image: nbd://localhost:PORT
+file format: nbd
+virtual size: 64 MiB (67108864 bytes)
+disk size: unavailable
+exports available: 1
+ export: ''
+ size: 67108864
+ min block: 1
+
== check TLS with different CA fails ==
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0':
The certificate hasn't got a known issuer
qemu-nbd: The certificate hasn't got a known issuer
@@ -55,6 +69,8 @@ qemu-img: Could not open
'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': F
qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0':
Failed to read option reply: Cannot read from TLS channel: Software caused
connection abort
== final server log ==
+qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read
from TLS channel: Software caused connection abort
+qemu-nbd: option negotiation failed: Failed to read opts magic: Cannot read
from TLS channel: Software caused connection abort
qemu-nbd: option negotiation failed: Verify failed: No certificate was found.
qemu-nbd: option negotiation failed: Verify failed: No certificate was found.
qemu-nbd: option negotiation failed: TLS x509 authz check for
DISTINGUISHED-NAME is denied
--
2.35.1
- [PULL 00/15] NBD patches for 7.0-rc0, Eric Blake, 2022/03/07
- [PULL 01/15] crypto: mandate a hostname when checking x509 creds on a client, Eric Blake, 2022/03/07
- [PULL 03/15] block/nbd: support override of hostname for TLS certificate validation, Eric Blake, 2022/03/07
- [PULL 02/15] block: pass desired TLS hostname through from block driver client, Eric Blake, 2022/03/07
- [PULL 05/15] block/nbd: don't restrict TLS usage to IP sockets, Eric Blake, 2022/03/07
- [PULL 04/15] qemu-nbd: add --tls-hostname option for TLS certificate validation, Eric Blake, 2022/03/07
- [PULL 06/15] tests/qemu-iotests: add QEMU_IOTESTS_REGEN=1 to update reference file, Eric Blake, 2022/03/07
- [PULL 07/15] tests/qemu-iotests: expand _filter_nbd rules, Eric Blake, 2022/03/07
- [PULL 12/15] tests/qemu-iotests: validate NBD TLS with UNIX sockets and PSK, Eric Blake, 2022/03/07
- [PULL 10/15] tests/qemu-iotests: validate NBD TLS with hostname mismatch,
Eric Blake <=
- [PULL 09/15] tests/qemu-iotests: convert NBD TLS test to use standard filters, Eric Blake, 2022/03/07
- [PULL 08/15] tests/qemu-iotests: introduce filter for qemu-nbd export list, Eric Blake, 2022/03/07
- [PULL 11/15] tests/qemu-iotests: validate NBD TLS with UNIX sockets, Eric Blake, 2022/03/07
- [PULL 14/15] qemu-io: Utilize 64-bit status during map, Eric Blake, 2022/03/07
- [PULL 13/15] nbd/server: Minor cleanups, Eric Blake, 2022/03/07
- [PULL 15/15] qemu-io: Allow larger write zeroes under no fallback, Eric Blake, 2022/03/07
- Re: [PULL 00/15] NBD patches for 7.0-rc0, Peter Maydell, 2022/03/09