| 1 | #!/usr/bin/env bash |
| 2 | # |
| 3 | # Helpers for TLS related config |
| 4 | # |
| 5 | # Copyright (C) 2018 Red Hat, Inc. |
| 6 | # |
| 7 | # This program is free software; you can redistribute it and/or modify |
| 8 | # it under the terms of the GNU General Public License as published by |
| 9 | # the Free Software Foundation; either version 2 of the License, or |
| 10 | # (at your option) any later version. |
| 11 | # |
| 12 | # This program is distributed in the hope that it will be useful, |
| 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | # GNU General Public License for more details. |
| 16 | # |
| 17 | # You should have received a copy of the GNU General Public License |
| 18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 19 | # |
| 20 | |
| 21 | tls_dir="${TEST_DIR}/tls" |
| 22 | |
| 23 | tls_x509_cleanup() |
| 24 | { |
| 25 | rm -f "${tls_dir}"/*.pem |
| 26 | rm -f "${tls_dir}"/*/*.pem |
| 27 | rm -f "${tls_dir}"/*/*.psk |
| 28 | rmdir "${tls_dir}"/* |
| 29 | rmdir "${tls_dir}" |
| 30 | } |
| 31 | |
| 32 | |
| 33 | tls_certtool() |
| 34 | { |
| 35 | certtool "$@" 1>"${tls_dir}"/certtool.log 2>&1 |
| 36 | if test "$?" = 0; then |
| 37 | head -1 "${tls_dir}"/certtool.log |
| 38 | else |
| 39 | cat "${tls_dir}"/certtool.log |
| 40 | fi |
| 41 | rm -f "${tls_dir}"/certtool.log |
| 42 | } |
| 43 | |
| 44 | tls_psktool() |
| 45 | { |
| 46 | psktool "$@" 1>"${tls_dir}"/psktool.log 2>&1 |
| 47 | if test "$?" = 0; then |
| 48 | head -1 "${tls_dir}"/psktool.log |
| 49 | else |
| 50 | cat "${tls_dir}"/psktool.log |
| 51 | fi |
| 52 | rm -f "${tls_dir}"/psktool.log |
| 53 | } |
| 54 | |
| 55 | |
| 56 | tls_x509_init() |
| 57 | { |
| 58 | (certtool --help) >/dev/null 2>&1 || \ |
| 59 | _notrun "certtool utility not found, skipping test" |
| 60 | |
| 61 | mkdir -p "${tls_dir}" |
| 62 | |
| 63 | # use a fixed key so we don't waste system entropy on |
| 64 | # each test run |
| 65 | cat > "${tls_dir}/key.pem" <<EOF |
| 66 | -----BEGIN RSA PRIVATE KEY----- |
| 67 | MIIG5AIBAAKCAYEAyjWyLSNm5PZvYUKUcDWGqbLX10b2ood+YaFjWSnJrqx/q3qh |
| 68 | rVGBJglD25AJENJsmZF3zPP1oMhfIxsXu63Hdkb6Rdlc2RUoUP34x9VC1izH25mR |
| 69 | 6c8DPDp1d6IraZ/llDMI1HsBFz0qGWtvOHgm815XG4PAr/N8rDsuqfv/cJ01KlnO |
| 70 | 0OdO5QRXCJf9g/dYd41MPu7wOXk9FqjQlmRoP59HgtJ+zUpE4z+Keruw9cMT9VJj |
| 71 | 0oT+pQ9ysenqeZ3gbT224T1khrEhT5kifhtFLNyDssRchUUWH0hiqoOO1vgb+850 |
| 72 | W6/1VdxvuPam48py4diSPi1Vip8NITCOBaX9FIpVp4Ruw4rTPVMNMjq9Cpx/DwMP |
| 73 | 9MbfXfnaVaZaMrmq67/zPhl0eVbUrecH2hQ3ZB9oIF4GkNskzlWF5+yPy6zqk304 |
| 74 | AKaiFR6jRyh3YfHo2XFqV8x/hxdsIEXOtEUGhSIcpynsW+ckUCartzu7xbhXjd4b |
| 75 | kxJT89+riPFYij09AgMBAAECggGBAKyFkaZXXROeejrmHlV6JZGlp+fhgM38gkRz |
| 76 | +Jp7P7rLLAY3E7gXIPQ91WqAAmwazFNdvHPd9USfkCQYmnAi/VoZhrCPmlsQZRxt |
| 77 | A5QjjOnEvSPMa6SrXZxGWDCg6R8uMCb4P+FhrPWR1thnRDZOtRTQ+crc50p3mHgt |
| 78 | 6ktXWIJRbqnag8zSfQqCYGtRmhe8sfsWT+Yl4El4+jjaAVU/B364u7+PLmaiphGp |
| 79 | BdJfTsTwEpgtGkPj+osDmhzXcZkfq3V+fz5JLkemsCiQKmn4VJRpg8c3ZmE8NPNt |
| 80 | gRtGWZ4W3WKDvhotT65WpQx4+6R8Duux/blNPBmH1Upmwd7kj7GYFBArbCjgd9PT |
| 81 | xgfCSUZpgOZHHkcgSB+022a8XncXna7WYYij28SLtwImFyu0nNtqECFQHH5u+k6C |
| 82 | LRYBSN+3t3At8dQuk01NVrJBndmjmXRfxpqUtTdeaNgVpdUYRY98s30G68NYGSra |
| 83 | aEvhhRSghkcLNetkobpY9pUgeqW/tQKBwQDZHHK9nDMt/zk1TxtILeUSitPXcv1/ |
| 84 | 8ufXqO0miHdH23XuXhIEA6Ef26RRVGDGgpjkveDJK/1w5feJ4H/ni4Vclil/cm38 |
| 85 | OwRqjjd7ElHJX6JQbsxEx/gNTk5/QW1iAL9TXUalgepsSXYT6AJ0/CJv0jmJSJ36 |
| 86 | YoKMOM8uqzb2KhN6i+RlJRi5iY53kUhWTJq5ArWvNhUzQNSYODI4bNxlsKSBL2Ik |
| 87 | LZ5QKHuaEjQet0IlPlfIb4PzMm8CHa/urOcCgcEA7m3zW/lL5bIFoKPjWig5Lbn1 |
| 88 | aHfrG2ngqzWtgWtfZqMH8OkZc1Mdhhmvd46titjiLjeI+UP/uHXR0068PnrNngzl |
| 89 | tTgwlakzu+bWzqhBm1F+3/341st/FEk07r0P/3/PhezVjwfO8c8Exj7pLxH4wrH0 |
| 90 | ROHgDbClmlJRu6OO78wk1+Vapf5DWa8YfA+q+fdvr7KvgGyytheKMT/b/dsqOq7y |
| 91 | qZPjmaJKWAvV3RWG8lWHFSdHx2IAHMHfGr17Y/w7AoHBALzwZeYebeekiVucGSjq |
| 92 | T8SgLhT7zCIx+JMUPjVfYzaUhP/Iu7Lkma6IzWm9nW6Drpy5pUpMzwUWDCLfzU9q |
| 93 | eseFIl337kEn9wLn+t5OpgAyCqYmlftxbqvdrrBN9uvnrJjWvqk/8wsDrw9JxAGc |
| 94 | fjeD4nBXUqvYWLXApoR9mZoGKedmoH9pFig4zlO9ig8YITnKYuQ0k6SD0b8agJHc |
| 95 | Ir0YSUDnRGgpjvFBGbeOCe+FGbohk/EpItJc3IAh5740lwKBwAdXd2DjokSmYKn7 |
| 96 | oeqKxofz6+yVlLW5YuOiuX78sWlVp87xPolgi84vSEnkKM/Xsc8+goc6YstpRVa+ |
| 97 | W+mImoA9YW1dF5HkLeWhTAf9AlgoAEIhbeIfTgBv6KNZSv7RDrDPBBxtXx/vAfSg |
| 98 | x0ldwk0scZsVYXLKd67yzfV7KdGUdaX4N/xYgfZm/9gCG3+q8NN2KxVHQ5F71BOE |
| 99 | JeABOaGo9WvnU+DNMIDZjHJMUWVw4MHz/a/UArDf/2CxaPVBNQKBwASg6j4ohSTk |
| 100 | J7aE6RQ3OBmmDDpixcoCJt9u9SjHVYMlbs5CEJGVSczk0SG3y8P1lOWNDSRnMksZ |
| 101 | xWnHdP/ogcuYMuvK7UACNAF0zNddtzOhzcpNmejFj+WCHYY/UmPr2/Kf6t7Cxk2K |
| 102 | 3cZ4tqWsiTmBT8Bknmah7L5DrhS+ZBJliDeFAA8fZHdMH0Xjr4UBp9kF90EMTdW1 |
| 103 | Xr5uz7ZrMsYpYQI7mmyqV9SSjUg4iBXwVSoag1iDJ1K8Qg/L7Semgg== |
| 104 | -----END RSA PRIVATE KEY----- |
| 105 | EOF |
| 106 | } |
| 107 | |
| 108 | |
| 109 | tls_x509_create_root_ca() |
| 110 | { |
| 111 | name=${1:-ca-cert} |
| 112 | |
| 113 | cat > "${tls_dir}/ca.info" <<EOF |
| 114 | cn = Cthulhu Dark Lord Enterprises $name |
| 115 | ca |
| 116 | cert_signing_key |
| 117 | EOF |
| 118 | |
| 119 | tls_certtool \ |
| 120 | --generate-self-signed \ |
| 121 | --load-privkey "${tls_dir}/key.pem" \ |
| 122 | --template "${tls_dir}/ca.info" \ |
| 123 | --outfile "${tls_dir}/$name-cert.pem" |
| 124 | |
| 125 | rm -f "${tls_dir}/ca.info" |
| 126 | } |
| 127 | |
| 128 | |
| 129 | tls_x509_create_server() |
| 130 | { |
| 131 | caname=$1 |
| 132 | name=$2 |
| 133 | |
| 134 | # We don't include 'localhost' in the cert, as |
| 135 | # we want to keep it unlisted to let tests |
| 136 | # validate hostname override |
| 137 | mkdir -p "${tls_dir}/$name" |
| 138 | cat > "${tls_dir}/cert.info" <<EOF |
| 139 | organization = Cthulhu Dark Lord Enterprises $name |
| 140 | cn = iotests.qemu.org |
| 141 | ip_address = 127.0.0.1 |
| 142 | ip_address = ::1 |
| 143 | tls_www_server |
| 144 | encryption_key |
| 145 | signing_key |
| 146 | EOF |
| 147 | |
| 148 | tls_certtool \ |
| 149 | --generate-certificate \ |
| 150 | --load-ca-privkey "${tls_dir}/key.pem" \ |
| 151 | --load-ca-certificate "${tls_dir}/$caname-cert.pem" \ |
| 152 | --load-privkey "${tls_dir}/key.pem" \ |
| 153 | --template "${tls_dir}/cert.info" \ |
| 154 | --outfile "${tls_dir}/$name/server-cert.pem" |
| 155 | |
| 156 | ln -s "${tls_dir}/$caname-cert.pem" "${tls_dir}/$name/ca-cert.pem" |
| 157 | ln -s "${tls_dir}/key.pem" "${tls_dir}/$name/server-key.pem" |
| 158 | |
| 159 | rm -f "${tls_dir}/cert.info" |
| 160 | } |
| 161 | |
| 162 | |
| 163 | tls_x509_create_client() |
| 164 | { |
| 165 | caname=$1 |
| 166 | name=$2 |
| 167 | |
| 168 | mkdir -p "${tls_dir}/$name" |
| 169 | cat > "${tls_dir}/cert.info" <<EOF |
| 170 | country = South Pacific |
| 171 | locality = R'lyeh |
| 172 | organization = Cthulhu Dark Lord Enterprises $name |
| 173 | cn = localhost |
| 174 | tls_www_client |
| 175 | encryption_key |
| 176 | signing_key |
| 177 | EOF |
| 178 | |
| 179 | tls_certtool \ |
| 180 | --generate-certificate \ |
| 181 | --load-ca-privkey "${tls_dir}/key.pem" \ |
| 182 | --load-ca-certificate "${tls_dir}/$caname-cert.pem" \ |
| 183 | --load-privkey "${tls_dir}/key.pem" \ |
| 184 | --template "${tls_dir}/cert.info" \ |
| 185 | --outfile "${tls_dir}/$name/client-cert.pem" |
| 186 | |
| 187 | ln -s "${tls_dir}/$caname-cert.pem" "${tls_dir}/$name/ca-cert.pem" |
| 188 | ln -s "${tls_dir}/key.pem" "${tls_dir}/$name/client-key.pem" |
| 189 | |
| 190 | rm -f "${tls_dir}/cert.info" |
| 191 | } |
| 192 | |
| 193 | tls_psk_create_creds() |
| 194 | { |
| 195 | name=$1 |
| 196 | |
| 197 | mkdir -p "${tls_dir}/$name" |
| 198 | |
| 199 | tls_psktool \ |
| 200 | --pskfile "${tls_dir}/$name/keys.psk" \ |
| 201 | --username "$name" |
| 202 | } |