116 lines
5 KiB
Bash
Executable file
116 lines
5 KiB
Bash
Executable file
#!/bin/bash
|
|
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
|
|
# Include Beaker environment
|
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
|
|
RUBY=${RUBY:-ruby}
|
|
|
|
_TEST_DIR="$(realpath "$(dirname "${0}")")"
|
|
_OPENSSL_CONF="/etc/pki/tls/openssl.cnf"
|
|
# Symbolic link
|
|
_CRYPTO_POLICIES_OPENSSLCNF="/etc/crypto-policies/back-ends/opensslcnf.config"
|
|
_SSL_DOMAIN="localhost"
|
|
_TLS_12_PORT="44312"
|
|
_TLS_13_PORT="44313"
|
|
_TLS_12_SERVER_NAME="tls-12.${_SSL_DOMAIN}"
|
|
_TLS_13_SERVER_NAME="tls-13.${_SSL_DOMAIN}"
|
|
|
|
rlJournalStart
|
|
rlPhaseStartSetup
|
|
rlAssertExists "${_CRYPTO_POLICIES_OPENSSLCNF}" || rlDie
|
|
rlLog "Using crypto-policies opensslcnf.config from $(rpm -qf ${_CRYPTO_POLICIES_OPENSSLCNF})."
|
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
rlRun "pushd ${TmpDir}"
|
|
|
|
# Prepare custom crypto-policies OpenSSL file to test with
|
|
# TLS.MinProtocol TLSv1.3 forcibly because we want to test a connection
|
|
# to TLS 1.2 server is rejected, and we have to change SECLEVEL in the
|
|
# file on TLS < 1.2, and OpenSSL doesn't support TLS < 1.2.
|
|
rlRun "cp -p ${_OPENSSL_CONF} openssl.cnf" 0 \
|
|
"Copying system OpenSSL configuration file to create custom file" \
|
|
|| rlDie
|
|
# Copy the source file of the symbolic file
|
|
rlRun "cp -pH ${_CRYPTO_POLICIES_OPENSSLCNF} opensslcnf.config" 0 \
|
|
"Copying crypto-policies opensslcnf.config file to create custom file" \
|
|
|| rlDie
|
|
rlRun "sed -i -E -e '/^\.include = .*opensslcnf\.config$/ s|([^ ]+)$|'${TmpDir}'/opensslcnf\.config|' openssl.cnf" \
|
|
0 \
|
|
"Modifying crypto-policies opensslcnf.config file path in OpenSSL configuration file" \
|
|
|| rlDie
|
|
rlRun -t "diff ${_OPENSSL_CONF} openssl.cnf" 1 \
|
|
"Printing the modified part in OpenSSL configuration file for debugging use" \
|
|
&& rlDie
|
|
rlRun "sed -i -E -e '/^TLS.MinProtocol/ s/[^ ]+$/TLSv1.3/' opensslcnf.config" \
|
|
0 \
|
|
"Modifying TLS.MinProtocol in crypto-policies opensslcnf.config file" \
|
|
|| rlDie
|
|
# If the TLSv1.3 is already set, there can be no difference between the files.
|
|
rlRun -t "diff ${_CRYPTO_POLICIES_OPENSSLCNF} opensslcnf.config || :" 0 \
|
|
"Printing the modified part in crypto-policies opensslcnf.config file for debugging use"
|
|
|
|
rlRun "export OPENSSL_CONF=${TmpDir}/openssl.cnf" 0 \
|
|
"Setting environment variable OPENSSL_CONF to load custom OpenSSL configuration files" \
|
|
|| rlDie
|
|
|
|
# Prepare files to run SSL servers
|
|
rlRun "openssl genrsa -out test.key 4096" 0 \
|
|
"Creating RSA private key test.key" || rlDie
|
|
rlRun "openssl req -new -key test.key -config ${_TEST_DIR}/cert.conf -out test.csr -sha512 -batch" \
|
|
0 "Creating certificate request (CSR) test.csr" || rlDie
|
|
rlRun "openssl x509 -req -in test.csr -signkey test.key -out test.crt -sha512" \
|
|
0 "Creating certificate test.crt" || rlDie
|
|
|
|
# Start SSL servers
|
|
# Stop existing SSL servers
|
|
pkill -f 'openssl s_server' || :
|
|
# Start SSL servers
|
|
TLS_12_CMD="
|
|
openssl s_server \
|
|
-port ${_TLS_12_PORT} \
|
|
-servername ${_TLS_12_SERVER_NAME} \
|
|
-tls1_2 \
|
|
-cert "${TmpDir}/test.crt" -key "${TmpDir}/test.key" \
|
|
-cert2 "${TmpDir}/test.crt" -key2 "${TmpDir}/test.key" \
|
|
-www \
|
|
-debug \
|
|
"
|
|
rlRun "${TLS_12_CMD} >& /dev/null &" 0 \
|
|
"Running openssl s_server TLS 1.2 in background" || rlDie
|
|
TLS_13_CMD="
|
|
openssl s_server \
|
|
-port ${_TLS_13_PORT} \
|
|
-servername ${_TLS_13_SERVER_NAME} \
|
|
-tls1_3 \
|
|
-cert "${TmpDir}/test.crt" -key "${TmpDir}/test.key" \
|
|
-cert2 "${TmpDir}/test.crt" -key2 "${TmpDir}/test.key" \
|
|
-www \
|
|
-debug \
|
|
"
|
|
rlRun "${TLS_13_CMD} >& /dev/null &" 0 \
|
|
"Running openssl s_server TLS 1.3 in background" || rlDie
|
|
|
|
# Verify running SSL servers
|
|
rlRun "sleep 1" 0 "Waiting for 1 second to check SSL servers listening"
|
|
rlRun "pgrep -f 'openssl s_server -port ${_TLS_12_PORT} '" 0 \
|
|
"Checking TLS 1.2 server starting" || rlDie
|
|
rlRun "pgrep -f 'openssl s_server -port ${_TLS_13_PORT} '" 0 \
|
|
"Checking TLS 1.3 server starting" || rlDie
|
|
rlRun "ss -tnl | grep ${_TLS_12_PORT} " 0 \
|
|
"Checking TLS 1.2 server listening" || rlDie
|
|
rlRun "ss -tnl | grep ${_TLS_13_PORT} " 0 \
|
|
"Checking TLS 1.3 server listening" || rlDie
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartTest
|
|
rlRun -t "${RUBY} ${_TEST_DIR}/test.rb -v" 0 \
|
|
"Running Ruby OpenSSL client"
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartCleanup
|
|
rlRun "pkill -f 'openssl s_server'" 0 "Stopping SSL servers"
|
|
rlRun "popd"
|
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
rlPhaseEnd
|
|
rlJournalPrintText
|
|
rlJournalEnd
|