From patchwork Thu Jan 11 08:05:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: aginwala aginwala X-Patchwork-Id: 1885608 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=P6QM5e3D; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=openvswitch.org (client-ip=140.211.166.133; helo=smtp2.osuosl.org; envelope-from=ovs-dev-bounces@openvswitch.org; receiver=patchwork.ozlabs.org) Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4T9lrw6P4dz1yPf for ; Fri, 12 Jan 2024 00:29:52 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 673B2405D3; Thu, 11 Jan 2024 13:29:50 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 673B2405D3 Authentication-Results: smtp2.osuosl.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=P6QM5e3D X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id luCJ4RFOiuvM; Thu, 11 Jan 2024 13:29:47 +0000 (UTC) Received: from lists.linuxfoundation.org (lf-lists.osuosl.org [140.211.9.56]) by smtp2.osuosl.org (Postfix) with ESMTPS id 898B343883; Thu, 11 Jan 2024 13:29:46 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 898B343883 Received: from lf-lists.osuosl.org (localhost [127.0.0.1]) by lists.linuxfoundation.org (Postfix) with ESMTP id D830EC0DDA; Thu, 11 Jan 2024 13:29:43 +0000 (UTC) X-Original-To: dev@openvswitch.org Delivered-To: ovs-dev@lists.linuxfoundation.org Received: from smtp2.osuosl.org (smtp2.osuosl.org [IPv6:2605:bc80:3010::133]) by lists.linuxfoundation.org (Postfix) with ESMTP id 48D84C0037 for ; Thu, 11 Jan 2024 08:06:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 23288400F3 for ; Thu, 11 Jan 2024 08:06:32 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 23288400F3 X-Virus-Scanned: amavisd-new at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aVZHS_Y-GguZ for ; Thu, 11 Jan 2024 08:06:30 +0000 (UTC) Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) by smtp2.osuosl.org (Postfix) with ESMTPS id CB19F40323 for ; Thu, 11 Jan 2024 08:06:30 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org CB19F40323 Received: by mail-pj1-x1032.google.com with SMTP id 98e67ed59e1d1-28c7e30c83fso3336808a91.1 for ; Thu, 11 Jan 2024 00:06:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1704960390; x=1705565190; darn=openvswitch.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Kq02PxkTQKYYtITyv7OfAK/SY5GZLIAZbjUfds8BPE4=; b=P6QM5e3DoTvhjWMkC9W0HXQBMkz2jii6KfViIsohRf+j0WHT4pqbYPJAG/xz2ohFgU Uu51OAhzcLFa93EZvTfsDv8P1TmQzaTrHD/8b/p6imGrUfp/LuebOOqiMjk7hrRhb6Xr nw4QCjWLakikeT1wWgy9jlVon8V6bJk8CTEsIZxA7kzaXK2KNDbJmF+TVMdIcgOHC1Ps oIGoV7K4RCt+ANiudqw/rT6htECRn7SbvIUDwWGhzrZBGzoKEKLsL0F69+aEhnfcYemF ZjXuniBgGdF/Dkj4hKpC2L05VOt0Z1hhGw9c0PcFqetio0d9scWgn/G1kQPMkRNjHZeQ 3pww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1704960390; x=1705565190; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Kq02PxkTQKYYtITyv7OfAK/SY5GZLIAZbjUfds8BPE4=; b=sU0lEqRqRZznfE1/3opav1wrGB00fFkyNVjMUEGgkQlmCOkFAQ+TKokcsRk7s7ea0k huZjcFBJVng+2u5YDUHFc6uPUbJN837Db9Q5x/3lHG0F9lDjxLPU0RvdhyxQqmQHyNVI V/mzaW0gRBscn5KJl8IoW8bfUjQj9LqboodNTq1YPYV+ffUvyHnk8jSDO+3SBSPMyNsQ /4Pq9nivLA1Ady5wqspuPA8fU5V1kYOYFpshx4uzCvFvU//wbdtYVdd2s6NAs/Bb/7sz zr5VbHXG6veouw7UU/fr0Zy9dsYM/HBcIHjYgKxhvPJD7wjGTOwAtq3omz97srTy/4kv PEbw== X-Gm-Message-State: AOJu0YzfJNG4ovL8MQSOLCmyW4rKLq2teg4HniAFBLmzEE/mnPXZ82Xc fSYMQ22EAwONAIa60HM+EebOz+ZxRcc= X-Google-Smtp-Source: AGHT+IF2PAs1pFtMFUE+TSNe6/pVp9Mahp+A6909ANj+NgDvtRZFA1wbIx+BCRofJa3sC/dwWFq6lw== X-Received: by 2002:a17:90b:4d91:b0:28b:d90c:c724 with SMTP id oj17-20020a17090b4d9100b0028bd90cc724mr529067pjb.54.1704960389737; Thu, 11 Jan 2024 00:06:29 -0800 (PST) Received: from T92R2DP9Q1.corp.ebay.com ([216.113.160.105]) by smtp.gmail.com with ESMTPSA id sd12-20020a17090b514c00b0028cef021d45sm753889pjb.17.2024.01.11.00.06.27 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 11 Jan 2024 00:06:28 -0800 (PST) From: amginwal@gmail.com To: dev@openvswitch.org Date: Thu, 11 Jan 2024 00:05:57 -0800 Message-Id: <20240111080557.54577-2-amginwal@gmail.com> X-Mailer: git-send-email 2.39.3 (Apple Git-145) In-Reply-To: <20240111080557.54577-1-amginwal@gmail.com> References: <20240111080557.54577-1-amginwal@gmail.com> MIME-Version: 1.0 X-Mailman-Approved-At: Thu, 11 Jan 2024 13:29:41 +0000 Cc: Aliasgar Ginwala Subject: [ovs-dev] [PATCH ovn 2/2] add tests for ssl ciphers X-BeenThere: ovs-dev@openvswitch.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ovs-dev-bounces@openvswitch.org Sender: "dev" From: Aliasgar Ginwala Signed-off-by: Aliasgar Ginwala --- tests/ovn-controller.at | 26 ++++++ tests/ovn.at | 182 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 208 insertions(+) diff --git a/tests/ovn-controller.at b/tests/ovn-controller.at index 9d2a37c72..df5662527 100644 --- a/tests/ovn-controller.at +++ b/tests/ovn-controller.at @@ -2712,3 +2712,29 @@ AT_CHECK([as hv1 ovs-ofctl dump-flows br-int table=40 | grep -q controller], [1] OVN_CLEANUP([hv1]) AT_CLEANUP ]) + + +AT_SETUP([ovn-controller - ssl ciphers using command line options]) +AT_KEYWORDS([ovn]) +AT_SKIP_IF([test "$HAVE_OPENSSL" = no]) +PKIDIR="$(cd $abs_top_builddir/tests && pwd)" +AT_SKIP_IF([expr "$PKIDIR" : ".*[[ '\" +\\]]"]) +ovn_start + +net_add n1 +sim_add hv1 +ovs-vsctl add-br br-phys +ovn_attach n1 br-phys 192.168.0.20 + +# Set cipher and and it should connect +OVS_APP_EXIT_AND_WAIT([ovn-controller]) +start_daemon ovn-controller --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' + +OVS_WAIT_FOR_OUTPUT([ovn-appctl -t ovn-controller connection-status], [0], [connected +]) + +cat hv1/ovn-controller.log + +OVN_CLEANUP([hv1]) +AT_CLEANUP diff --git a/tests/ovn.at b/tests/ovn.at index c3644ac78..34f277ef9 100644 --- a/tests/ovn.at +++ b/tests/ovn.at @@ -37588,3 +37588,185 @@ OVN_CLEANUP([hv1]) AT_CLEANUP ]) + +AT_SETUP([read-only sb db:pssl access with ssl-ciphers and ssl-protocols]) +AT_SKIP_IF([test "$HAVE_OPENSSL" = no]) +PKIDIR="$(cd $abs_top_builddir/tests && pwd)" +AT_SKIP_IF([expr "$PKIDIR" : ".*[[ '\" +\\]]"]) + +: > .$1.db.~lock~ +ovsdb-tool create ovn-sb.db "$abs_top_srcdir"/ovn-sb.ovsschema + +# Add read-only remote to sb ovsdb-server +AT_CHECK( + [ovsdb-tool transact ovn-sb.db \ + ['["OVN_Southbound", + {"op": "insert", + "table": "SB_Global", + "row": { + "connections": ["set", [["named-uuid", "xyz"]]]}}, + {"op": "insert", + "table": "Connection", + "uuid-name": "xyz", + "row": {"target": "pssl:0:127.0.0.1", + "read_only": true}}]']], [0], [ignore], [ignore]) + +start_daemon ovsdb-server --remote=punix:ovn-sb.sock \ + --remote=db:OVN_Southbound,SB_Global,connections \ + --private-key="$PKIDIR/testpki-test2-privkey.pem" \ + --certificate="$PKIDIR/testpki-test2-cert.pem" \ + --ca-cert="$PKIDIR/testpki-cacert.pem" \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + ovn-sb.db + +PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT]) + +# read-only accesses should succeed +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list SB_Global], [0], [stdout], [ignore]) +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list Connection], [0], [stdout], [ignore]) + +# write access should fail +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + chassis-add ch vxlan 1.2.4.8], [1], [ignore], +[ovn-sbctl: transaction error: {"details":"insert operation not allowed when database server is in read only mode","error":"not allowed"} +]) + +OVS_APP_EXIT_AND_WAIT([ovsdb-server]) +AT_CLEANUP + +AT_SETUP([nb connection/ssl commands with ssl-ciphers and ssl-protocols]) +AT_SKIP_IF([test "$HAVE_OPENSSL" = no]) +PKIDIR="$(cd $abs_top_builddir/tests && pwd)" +AT_SKIP_IF([expr "$PKIDIR" : ".*[[ '\" +\\]]"]) + +: > .$1.db.~lock~ +ovsdb-tool create ovn-nb.db "$abs_top_srcdir"/ovn-nb.ovsschema + +# Start nb db server using db connection/ssl entries (unpopulated initially) +start_daemon ovsdb-server --remote=punix:ovnnb_db.sock \ + --remote=db:OVN_Northbound,NB_Global,connections \ + --private-key=db:OVN_Northbound,SSL,private_key \ + --certificate=db:OVN_Northbound,SSL,certificate \ + --ca-cert=db:OVN_Northbound,SSL,ca_cert \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + ovn-nb.db + +# Populate SSL configuration entries in nb db +AT_CHECK( + [ovn-nbctl set-ssl $PKIDIR/testpki-test-privkey.pem \ + $PKIDIR/testpki-test-cert.pem \ + $PKIDIR/testpki-cacert.pem], [0], [stdout], [ignore]) + +# Populate a passive SSL connection in nb db +AT_CHECK([ovn-nbctl set-connection pssl:0:127.0.0.1], [0], [stdout], [ignore]) + +PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT]) + +# Verify SSL connetivity to nb db server +AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list NB_Global], + [0], [stdout], [ignore]) +AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list Connection], + [0], [stdout], [ignore]) +AT_CHECK([ovn-nbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + get-connection], + [0], [stdout], [ignore]) + +OVS_APP_EXIT_AND_WAIT([ovsdb-server]) +AT_CLEANUP + +AT_SETUP([sb connection/ssl commands with ssl-ciphers and ssl-protocols]) +AT_SKIP_IF([test "$HAVE_OPENSSL" = no]) +PKIDIR="$(cd $abs_top_builddir/tests && pwd)" +AT_SKIP_IF([expr "$PKIDIR" : ".*[[ '\" +\\]]"]) + +: > .$1.db.~lock~ +ovsdb-tool create ovn-sb.db "$abs_top_srcdir"/ovn-sb.ovsschema + +# Start sb db server using db connection/ssl entries (unpopulated initially) +start_daemon ovsdb-server --remote=punix:ovnsb_db.sock \ + --remote=db:OVN_Southbound,SB_Global,connections \ + --private-key=db:OVN_Southbound,SSL,private_key \ + --certificate=db:OVN_Southbound,SSL,certificate \ + --ca-cert=db:OVN_Southbound,SSL,ca_cert \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + ovn-sb.db + +# Populate SSL configuration entries in sb db +AT_CHECK( + [ovn-sbctl set-ssl $PKIDIR/testpki-test-privkey.pem \ + $PKIDIR/testpki-test-cert.pem \ + $PKIDIR/testpki-cacert.pem], [0], [stdout], [ignore]) + +# Populate a passive SSL connection in sb db +AT_CHECK([ovn-sbctl set-connection pssl:0:127.0.0.1], [0], [stdout], [ignore]) + +PARSE_LISTENING_PORT([ovsdb-server.log], [TCP_PORT]) + +# Verify SSL connetivity to sb db server +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list SB_Global], + [0], [stdout], [ignore]) +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + list Connection], + [0], [stdout], [ignore]) +AT_CHECK([ovn-sbctl --db=ssl:127.0.0.1:$TCP_PORT \ + --private-key=$PKIDIR/testpki-test-privkey.pem \ + --certificate=$PKIDIR/testpki-test-cert.pem \ + --ca-cert=$PKIDIR/testpki-cacert.pem \ + --ssl-ciphers='HIGH:!aNULL:!MD5:@SECLEVEL=1' \ + --ssl-protocols='TLSv1,TLSv1.1,TLSv1.2' \ + get-connection], + [0], [stdout], [ignore]) + +OVS_APP_EXIT_AND_WAIT([ovsdb-server]) +AT_CLEANUP