rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2025-12-13 07:10:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

testbench: add tests for gnutls subsystem certificate validation

Browse Source
This commit is contained in:
Rainer Gerhards 2018-12-22 11:21:15 +01:00
parent 567fe73c07
commit 88f5cb3c9d
No known key found for this signature in database
GPG Key ID: 0CB6B2A8BE80B499
8 changed files with 140 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tests/Makefile.am
View File

@ -932,6 +932,10 @@ TESTS += \
sndrcv_tls_priorityString.sh \
sndrcv_tls_certvalid.sh \
sndrcv_tls_certvalid_expired.sh \
imtcp-tls-gtls-x509fingerprint-invld.sh \
imtcp-tls-gtls-x509fingerprint.sh \
imtcp-tls-gtls-x509name-invld.sh \
imtcp-tls-gtls-x509name.sh \
imtcp-tls-basic.sh
if HAVE_VALGRIND
TESTS += \
@ -1524,6 +1528,10 @@ EXTRA_DIST= \
imtcp-msg-truncation-on-number2.sh \
imtcp-NUL.sh \
imtcp-NUL-rawmsg.sh \
imtcp-tls-gtls-x509fingerprint-invld.sh \
imtcp-tls-gtls-x509fingerprint.sh \
imtcp-tls-gtls-x509name-invld.sh \
imtcp-tls-gtls-x509name.sh \
imtcp-tls-basic.sh \
imtcp-tls-basic-vg.sh \
imtcp_incomplete_frame_at_end.sh \

2
tests/imtcp-tls-basic.sh
View File

@ -1,8 +1,6 @@
#!/bin/bash
# added 2011-02-28 by Rgerhards
# This file is part of the rsyslog project, released under GPLv3
echo ===============================================================================
echo \[imtcp-tls-basic.sh\]: testing imtcp in TLS mode - basic test
. ${srcdir:=.}/diag.sh init
generate_conf
add_conf '

31
tests/imtcp-tls-gtls-x509fingerprint-invld.sh Executable file
View File

@ -0,0 +1,31 @@
#!/bin/bash
# added 2018-12-22 by Rainer Gerhards
# check for INVALID fingerprint!
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=1
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
# debug.whitelist="on"
# debug.files=["nsd_ossl.c", "tcpsrv.c", "nsdsel_ossl.c", "nsdpoll_ptcp.c", "dnscache.c"]
)
module( load="../plugins/imtcp/.libs/imtcp"
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.AuthMode="x509/fingerprint"
PermittedPeer=["SHA1:FF:C6:62:D5:9D:25:9F:BC:F3:CB:61:FA:D2:B3:8B:61:88:D7:06:C3"] # INVALID!
)
input(type="imtcp" port="'$TCPFLOOD_PORT'" )
action(type="omfile" file="'$RSYSLOG_OUT_LOG'")
'
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
shutdown_when_empty
wait_shutdown
content_check --regex "peer fingerprint .* unknown"
exit_test

35
tests/imtcp-tls-gtls-x509fingerprint.sh Executable file
View File

@ -0,0 +1,35 @@
#!/bin/bash
# added 2018-12-22 by Rainer Gerhards
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=10
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
# debug.whitelist="on"
# debug.files=["nsd_ossl.c", "tcpsrv.c", "nsdsel_ossl.c", "nsdpoll_ptcp.c", "dnscache.c"]
)
module( load="../plugins/imtcp/.libs/imtcp"
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.AuthMode="x509/fingerprint"
PermittedPeer=["SHA1:5C:C6:62:D5:9D:25:9F:BC:F3:CB:61:FA:D2:B3:8B:61:88:D7:06:C3"]
)
input( type="imtcp"
port="'$TCPFLOOD_PORT'" )
template(name="outfmt" type="string" string="%msg:F,58:2%\n")
:msg, contains, "msgnum:" action( type="omfile"
template="outfmt"
file=`echo $RSYSLOG_OUT_LOG`)
'
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
wait_file_lines
shutdown_when_empty
wait_shutdown
seq_check
exit_test

28
tests/imtcp-tls-gtls-x509name-invld.sh Executable file
View File

@ -0,0 +1,28 @@
#!/bin/bash
# added 2018-12-22 by alorbach
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=10
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
)
module( load="../plugins/imtcp/.libs/imtcp"
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.AuthMode="x509/name"
PermittedPeer=["INVALID"]
)
input(type="imtcp" port="'$TCPFLOOD_PORT'" )
action(type="omfile" file="'$RSYSLOG_OUT_LOG'")
'
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
shutdown_when_empty
wait_shutdown
content_check --regex "peer name not authorized"
exit_test

33
tests/imtcp-tls-gtls-x509name.sh Executable file
View File

@ -0,0 +1,33 @@
#!/bin/bash
# added 2018-12-22 by alorbach
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=1
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
)
module( load="../plugins/imtcp/.libs/imtcp"
StreamDriver.Name="gtls"
StreamDriver.Mode="1"
StreamDriver.AuthMode="x509/name"
PermittedPeer=["rsyslog-client"]
)
input( type="imtcp"
port="'$TCPFLOOD_PORT'" )
template(name="outfmt" type="string" string="%msg:F,58:2%\n")
:msg, contains, "msgnum:" action( type="omfile"
template="outfmt"
file=`echo $RSYSLOG_OUT_LOG`)
'
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
wait_file_lines
shutdown_when_empty
wait_shutdown
seq_check
exit_test

8
tests/imtcp-tls-ossl-x509fingerprint.sh
View File

@ -1,8 +1,8 @@
#!/bin/bash
# added 2018-04-27 by alorbach
# This file is part of the rsyslog project, released under GPLv3
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=10000
export NUMMESSAGES=10
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
@ -26,12 +26,10 @@ template(name="outfmt" type="string" string="%msg:F,58:2%\n")
template="outfmt"
file=`echo $RSYSLOG_OUT_LOG`)
'
# Begin actuall testcase
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
wait_file_lines
# -L5
shutdown_when_empty # shut down rsyslogd when done processing messages
shutdown_when_empty
wait_shutdown
seq_check
exit_test

5
tests/imtcp-tls-ossl-x509name.sh
View File

@ -2,7 +2,7 @@
# added 2018-04-27 by alorbach
# This file is part of the rsyslog project, released under ASL 2.0
. ${srcdir:=.}/diag.sh init
export NUMMESSAGES=10000
export NUMMESSAGES=10
generate_conf
add_conf '
global( defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
@ -26,11 +26,10 @@ template(name="outfmt" type="string" string="%msg:F,58:2%\n")
template="outfmt"
file=`echo $RSYSLOG_OUT_LOG`)
'
# Begin actuall testcase
startup
tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
wait_file_lines
shutdown_when_empty # shut down rsyslogd when done processing messages
shutdown_when_empty
wait_shutdown
seq_check
exit_test