[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 08/16] tests: add multifd migration tests of TLS with x509 credent
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 08/16] tests: add multifd migration tests of TLS with x509 credentials |
Date: |
Mon, 9 May 2022 16:02:45 +0100 |
From: Daniel P. Berrangé <berrange@redhat.com>
This validates that we correctly handle multifd migration success
and failure scenarios when using TLS with x509 certificates. There
are quite a few different scenarios that matter in relation to
hostname validation, but we skip a couple as we can assume that
the non-multifd coverage applies to some extent.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220426160048.812266-9-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
tests/qtest/migration-test.c | 127 +++++++++++++++++++++++++++++++++++
1 file changed, 127 insertions(+)
diff --git a/tests/qtest/migration-test.c b/tests/qtest/migration-test.c
index 133665b500..efc6ec1614 100644
--- a/tests/qtest/migration-test.c
+++ b/tests/qtest/migration-test.c
@@ -1833,6 +1833,48 @@
test_migrate_multifd_tcp_tls_psk_start_mismatch(QTestState *from,
return test_migrate_tls_psk_start_mismatch(from, to);
}
+#ifdef CONFIG_TASN1
+static void *
+test_migrate_multifd_tls_x509_start_default_host(QTestState *from,
+ QTestState *to)
+{
+ test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
+ return test_migrate_tls_x509_start_default_host(from, to);
+}
+
+static void *
+test_migrate_multifd_tls_x509_start_override_host(QTestState *from,
+ QTestState *to)
+{
+ test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
+ return test_migrate_tls_x509_start_override_host(from, to);
+}
+
+static void *
+test_migrate_multifd_tls_x509_start_mismatch_host(QTestState *from,
+ QTestState *to)
+{
+ test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
+ return test_migrate_tls_x509_start_mismatch_host(from, to);
+}
+
+static void *
+test_migrate_multifd_tls_x509_start_allow_anon_client(QTestState *from,
+ QTestState *to)
+{
+ test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
+ return test_migrate_tls_x509_start_allow_anon_client(from, to);
+}
+
+static void *
+test_migrate_multifd_tls_x509_start_reject_anon_client(QTestState *from,
+ QTestState *to)
+{
+ test_migrate_precopy_tcp_multifd_start_common(from, to, "none");
+ return test_migrate_tls_x509_start_reject_anon_client(from, to);
+}
+#endif /* CONFIG_TASN1 */
+
static void test_multifd_tcp_tls_psk_match(void)
{
MigrateCommon args = {
@@ -1856,6 +1898,79 @@ static void test_multifd_tcp_tls_psk_mismatch(void)
};
test_precopy_common(&args);
}
+
+#ifdef CONFIG_TASN1
+static void test_multifd_tcp_tls_x509_default_host(void)
+{
+ MigrateCommon args = {
+ .listen_uri = "defer",
+ .start_hook = test_migrate_multifd_tls_x509_start_default_host,
+ .finish_hook = test_migrate_tls_x509_finish,
+ };
+ test_precopy_common(&args);
+}
+
+static void test_multifd_tcp_tls_x509_override_host(void)
+{
+ MigrateCommon args = {
+ .listen_uri = "defer",
+ .start_hook = test_migrate_multifd_tls_x509_start_override_host,
+ .finish_hook = test_migrate_tls_x509_finish,
+ };
+ test_precopy_common(&args);
+}
+
+static void test_multifd_tcp_tls_x509_mismatch_host(void)
+{
+ /*
+ * This has different behaviour to the non-multifd case.
+ *
+ * In non-multifd case when client aborts due to mismatched
+ * cert host, the server has already started trying to load
+ * migration state, and so it exits with I/O failure.
+ *
+ * In multifd case when client aborts due to mismatched
+ * cert host, the server is still waiting for the other
+ * multifd connections to arrive so hasn't started trying
+ * to load migration state, and thus just aborts the migration
+ * without exiting.
+ */
+ MigrateCommon args = {
+ .start = {
+ .hide_stderr = true,
+ },
+ .listen_uri = "defer",
+ .start_hook = test_migrate_multifd_tls_x509_start_mismatch_host,
+ .finish_hook = test_migrate_tls_x509_finish,
+ .result = MIG_TEST_FAIL,
+ };
+ test_precopy_common(&args);
+}
+
+static void test_multifd_tcp_tls_x509_allow_anon_client(void)
+{
+ MigrateCommon args = {
+ .listen_uri = "defer",
+ .start_hook = test_migrate_multifd_tls_x509_start_allow_anon_client,
+ .finish_hook = test_migrate_tls_x509_finish,
+ };
+ test_precopy_common(&args);
+}
+
+static void test_multifd_tcp_tls_x509_reject_anon_client(void)
+{
+ MigrateCommon args = {
+ .start = {
+ .hide_stderr = true,
+ },
+ .listen_uri = "defer",
+ .start_hook = test_migrate_multifd_tls_x509_start_reject_anon_client,
+ .finish_hook = test_migrate_tls_x509_finish,
+ .result = MIG_TEST_FAIL,
+ };
+ test_precopy_common(&args);
+}
+#endif /* CONFIG_TASN1 */
#endif /* CONFIG_GNUTLS */
/*
@@ -2083,6 +2198,18 @@ int main(int argc, char **argv)
test_multifd_tcp_tls_psk_match);
qtest_add_func("/migration/multifd/tcp/tls/psk/mismatch",
test_multifd_tcp_tls_psk_mismatch);
+#ifdef CONFIG_TASN1
+ qtest_add_func("/migration/multifd/tcp/tls/x509/default-host",
+ test_multifd_tcp_tls_x509_default_host);
+ qtest_add_func("/migration/multifd/tcp/tls/x509/override-host",
+ test_multifd_tcp_tls_x509_override_host);
+ qtest_add_func("/migration/multifd/tcp/tls/x509/mismatch-host",
+ test_multifd_tcp_tls_x509_mismatch_host);
+ qtest_add_func("/migration/multifd/tcp/tls/x509/allow-anon-client",
+ test_multifd_tcp_tls_x509_allow_anon_client);
+ qtest_add_func("/migration/multifd/tcp/tls/x509/reject-anon-client",
+ test_multifd_tcp_tls_x509_reject_anon_client);
+#endif /* CONFIG_TASN1 */
#endif /* CONFIG_GNUTLS */
if (kvm_dirty_ring_supported()) {
--
2.36.0
- [PULL 07/16] tests: add multifd migration tests of TLS with PSK credentials, (continued)
- [PULL 07/16] tests: add multifd migration tests of TLS with PSK credentials, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 05/16] tests: convert XBZRLE migration test to use common helper, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 13/16] migration: Add migrate_use_tls() helper, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 03/16] tests: add migration tests of TLS with PSK credentials, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 14/16] multifd: multifd_send_sync_main now returns negative on error, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 09/16] tests: ensure migration status isn't reported as failed, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 12/16] migration: Add zero-copy-send parameter for QMP/HMP for Linux, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 08/16] tests: add multifd migration tests of TLS with x509 credentials,
Dr. David Alan Gilbert (git) <=
- [PULL 10/16] QIOChannel: Add flags on io_writev and introduce io_flush callback, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 15/16] multifd: Send header packet without flags if zero-copy-send is enabled, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 11/16] QIOChannelSocket: Implement io_writev zero copy flag & io_flush for CONFIG_LINUX, Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 16/16] multifd: Implement zero copy write in multifd migration (multifd-zero-copy), Dr. David Alan Gilbert (git), 2022/05/09
- [PULL 00/16] migration queue, Dr. David Alan Gilbert (git), 2022/05/10
- [PULL 01/16] tests: fix encoding of IP addresses in x509 certs, Dr. David Alan Gilbert (git), 2022/05/10
- [PULL 03/16] tests: add migration tests of TLS with PSK credentials, Dr. David Alan Gilbert (git), 2022/05/10
- [PULL 02/16] tests: add more helper macros for creating TLS x509 certs, Dr. David Alan Gilbert (git), 2022/05/10
- [PULL 05/16] tests: convert XBZRLE migration test to use common helper, Dr. David Alan Gilbert (git), 2022/05/10
- [PULL 04/16] tests: add migration tests of TLS with x509 credentials, Dr. David Alan Gilbert (git), 2022/05/10