testbench: add tests for gnutls subsystem certificate validation

tests/Makefile.am

@@ -932,6 +932,10 @@ TESTS +=  \
 	sndrcv_tls_priorityString.sh \
 	sndrcv_tls_certvalid.sh \
 	sndrcv_tls_certvalid_expired.sh \
+	imtcp-tls-gtls-x509fingerprint-invld.sh \
+	imtcp-tls-gtls-x509fingerprint.sh \
+	imtcp-tls-gtls-x509name-invld.sh \
+	imtcp-tls-gtls-x509name.sh \
 	imtcp-tls-basic.sh
 if HAVE_VALGRIND
 TESTS += \
@@ -1524,6 +1528,10 @@ EXTRA_DIST= \
 	imtcp-msg-truncation-on-number2.sh \
 	imtcp-NUL.sh \
 	imtcp-NUL-rawmsg.sh \
+	imtcp-tls-gtls-x509fingerprint-invld.sh \
+	imtcp-tls-gtls-x509fingerprint.sh \
+	imtcp-tls-gtls-x509name-invld.sh \
+	imtcp-tls-gtls-x509name.sh \
 	imtcp-tls-basic.sh \
 	imtcp-tls-basic-vg.sh \
 	imtcp_incomplete_frame_at_end.sh \

tests/imtcp-tls-basic.sh

@@ -1,8 +1,6 @@
 #!/bin/bash
 # added 2011-02-28 by Rgerhards
 # This file is part of the rsyslog project, released  under GPLv3
-echo ===============================================================================
-echo \[imtcp-tls-basic.sh\]: testing imtcp in TLS mode - basic test
 . ${srcdir:=.}/diag.sh init
 generate_conf
 add_conf '

tests/imtcp-tls-gtls-x509fingerprint-invld.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# added 2018-12-22 by Rainer Gerhards
+# check for INVALID fingerprint!
+# This file is part of the rsyslog project, released under ASL 2.0
+. ${srcdir:=.}/diag.sh init
+export NUMMESSAGES=1
+generate_conf
+add_conf '
+global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
+	defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
+	defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
+#	debug.whitelist="on"
+#	debug.files=["nsd_ossl.c", "tcpsrv.c", "nsdsel_ossl.c", "nsdpoll_ptcp.c", "dnscache.c"]
+)
+
+module(	load="../plugins/imtcp/.libs/imtcp"
+	StreamDriver.Name="gtls"
+	StreamDriver.Mode="1"
+	StreamDriver.AuthMode="x509/fingerprint"
+	PermittedPeer=["SHA1:FF:C6:62:D5:9D:25:9F:BC:F3:CB:61:FA:D2:B3:8B:61:88:D7:06:C3"] # INVALID!
+	)
+input(type="imtcp" port="'$TCPFLOOD_PORT'" )
+
+action(type="omfile" file="'$RSYSLOG_OUT_LOG'")
+'
+startup
+tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem 
+shutdown_when_empty
+wait_shutdown
+content_check --regex "peer fingerprint .* unknown"
+exit_test

tests/imtcp-tls-gtls-x509fingerprint.sh

@@ -0,0 +1,35 @@
+#!/bin/bash
+# added 2018-12-22 by Rainer Gerhards
+# This file is part of the rsyslog project, released under ASL 2.0
+. ${srcdir:=.}/diag.sh init
+export NUMMESSAGES=10
+generate_conf
+add_conf '
+global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
+	defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
+	defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
+#	debug.whitelist="on"
+#	debug.files=["nsd_ossl.c", "tcpsrv.c", "nsdsel_ossl.c", "nsdpoll_ptcp.c", "dnscache.c"]
+)
+
+module(	load="../plugins/imtcp/.libs/imtcp"
+	StreamDriver.Name="gtls"
+	StreamDriver.Mode="1"
+	StreamDriver.AuthMode="x509/fingerprint" 
+	PermittedPeer=["SHA1:5C:C6:62:D5:9D:25:9F:BC:F3:CB:61:FA:D2:B3:8B:61:88:D7:06:C3"]
+	)
+input(	type="imtcp"
+	port="'$TCPFLOOD_PORT'" )
+
+template(name="outfmt" type="string" string="%msg:F,58:2%\n")
+:msg, contains, "msgnum:" action(	type="omfile" 
+					template="outfmt"
+					file=`echo $RSYSLOG_OUT_LOG`)
+'
+startup
+tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem 
+wait_file_lines
+shutdown_when_empty
+wait_shutdown
+seq_check
+exit_test

tests/imtcp-tls-gtls-x509name-invld.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# added 2018-12-22 by alorbach
+# This file is part of the rsyslog project, released under ASL 2.0
+. ${srcdir:=.}/diag.sh init
+export NUMMESSAGES=10
+generate_conf
+add_conf '
+global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
+	defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
+	defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
+)
+
+module(	load="../plugins/imtcp/.libs/imtcp"
+	StreamDriver.Name="gtls"
+	StreamDriver.Mode="1"
+	StreamDriver.AuthMode="x509/name"
+	PermittedPeer=["INVALID"]
+	)
+input(type="imtcp" port="'$TCPFLOOD_PORT'" )
+
+action(type="omfile" file="'$RSYSLOG_OUT_LOG'")
+'
+startup
+tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
+shutdown_when_empty
+wait_shutdown
+content_check --regex "peer name not authorized"
+exit_test

tests/imtcp-tls-gtls-x509name.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# added 2018-12-22 by alorbach
+# This file is part of the rsyslog project, released under ASL 2.0
+. ${srcdir:=.}/diag.sh init
+export NUMMESSAGES=1
+generate_conf
+add_conf '
+global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
+	defaultNetstreamDriverCertFile="'$srcdir/tls-certs/cert.pem'"
+	defaultNetstreamDriverKeyFile="'$srcdir/tls-certs/key.pem'"
+)
+
+module(	load="../plugins/imtcp/.libs/imtcp"
+	StreamDriver.Name="gtls"
+	StreamDriver.Mode="1"
+	StreamDriver.AuthMode="x509/name"
+	PermittedPeer=["rsyslog-client"]
+	)
+input(	type="imtcp"
+	port="'$TCPFLOOD_PORT'" )
+
+template(name="outfmt" type="string" string="%msg:F,58:2%\n")
+:msg, contains, "msgnum:" action(	type="omfile" 
+					template="outfmt"
+					file=`echo $RSYSLOG_OUT_LOG`)
+'
+startup
+tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
+wait_file_lines
+shutdown_when_empty
+wait_shutdown
+seq_check
+exit_test

tests/imtcp-tls-ossl-x509fingerprint.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 # added 2018-04-27 by alorbach
-# This file is part of the rsyslog project, released  under GPLv3
+# This file is part of the rsyslog project, released under ASL 2.0
 . ${srcdir:=.}/diag.sh init
-export NUMMESSAGES=10000
+export NUMMESSAGES=10
 generate_conf
 add_conf '
 global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
@@ -26,12 +26,10 @@ template(name="outfmt" type="string" string="%msg:F,58:2%\n")
 					template="outfmt"
 					file=`echo $RSYSLOG_OUT_LOG`)
 '
-# Begin actuall testcase
 startup
 tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem 
 wait_file_lines
-# -L5
+shutdown_when_empty
-shutdown_when_empty # shut down rsyslogd when done processing messages
 wait_shutdown
 seq_check
 exit_test

tests/imtcp-tls-ossl-x509name.sh

@@ -2,7 +2,7 @@
 # added 2018-04-27 by alorbach
 # This file is part of the rsyslog project, released under ASL 2.0
 . ${srcdir:=.}/diag.sh init
-export NUMMESSAGES=10000
+export NUMMESSAGES=10
 generate_conf
 add_conf '
 global(	defaultNetstreamDriverCAFile="'$srcdir/tls-certs/ca.pem'"
@@ -26,11 +26,10 @@ template(name="outfmt" type="string" string="%msg:F,58:2%\n")
 					template="outfmt"
 					file=`echo $RSYSLOG_OUT_LOG`)
 '
-# Begin actuall testcase
 startup
 tcpflood -p'$TCPFLOOD_PORT' -m$NUMMESSAGES -Ttls -x$srcdir/tls-certs/ca.pem -Z$srcdir/tls-certs/cert.pem -z$srcdir/tls-certs/key.pem
 wait_file_lines
-shutdown_when_empty # shut down rsyslogd when done processing messages
+shutdown_when_empty
 wait_shutdown
 seq_check
 exit_test