Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backport more TLS related commits #663

Merged
merged 2 commits into from
Oct 8, 2024
Merged

backport more TLS related commits #663

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e16b3fa
basic-attestation-on-localhost: Use TLS for webhook
ansasaki Jul 12, 2024
204c7ec
keylime-non-default-ports: Use TLS for webhook server
ansasaki Aug 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 21 additions & 11 deletions functional/basic-attestation-on-localhost/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

# set REVOCATION_NOTIFIER=zeromq to use the zeromq notifier
[ -n "$REVOCATION_NOTIFIER" ] || REVOCATION_NOTIFIER=agent
HTTP_SERVER_PORT=8080
WEBHOOK_PORT=8080
AGENT_ID="d432fbb3-d2f1-4a97-9ef7-75bd81c00000"

rlJournalStart
Expand All @@ -17,7 +17,7 @@ rlJournalStart
limeBackupConfig
# verifier
rlRun "limeUpdateConf revocations enabled_revocation_notifications '[\"${REVOCATION_NOTIFIER}\",\"webhook\"]'"
rlRun "limeUpdateConf revocations webhook_url http://localhost:${HTTP_SERVER_PORT}"
rlRun "limeUpdateConf revocations webhook_url https://localhost:${WEBHOOK_PORT}"
if [ -n "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
rlRun "limeUpdateConf revocations enabled_revocation_notifications '[]'"
fi
Expand Down Expand Up @@ -51,10 +51,16 @@ rlJournalStart
rlRun "echo -e '#!/bin/bash\necho This is good-script2' > $TESTDIR/good-script2.sh && chmod a+x $TESTDIR/good-script2.sh"
# create allowlist and excludelist
rlRun "limeCreateTestPolicy ${TESTDIR}/*"
HTTP_SERVER_LOG=$( mktemp )
# start revocation notifier webhook server using ncat
rlRun "ncat --no-shutdown -k -l ${HTTP_SERVER_PORT} -c '/usr/bin/sleep 3 && echo HTTP/1.1 200 OK' -o ${HTTP_SERVER_LOG} &"
HTTP_SERVER_PID=$!
if [ -z "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
WEBHOOK_LOG=$( mktemp )
WEBHOOK_CERT="/var/lib/keylime/cv_ca/server-cert.crt"
WEBHOOK_KEY="/var/lib/keylime/cv_ca/server-private.pem"
rlAssertExists "${WEBHOOK_CERT}"
rlAssertExists "${WEBHOOK_KEY}"
# start revocation notifier webhook server
rlRun "sleep 500 | openssl s_server -cert ${WEBHOOK_CERT} -key ${WEBHOOK_KEY} -port ${WEBHOOK_PORT} &> ${WEBHOOK_LOG} &"
WEBHOOK_PID=$!
fi
rlPhaseEnd

rlPhaseStartTest "Add keylime agent"
Expand Down Expand Up @@ -96,15 +102,19 @@ _EOF"
rlRun "tail -20 $(limeAgentLogfile) | grep 'Executing revocation action local_action_modify_payload'"
rlRun "tail $(limeAgentLogfile) | grep 'A node in the network has been compromised: 127.0.0.1'"
rlAssertNotExists /var/tmp/test_payload_file
cat ${HTTP_SERVER_LOG}
rlAssertGrep '\\"type\\": \\"revocation\\", \\"ip\\": \\"127.0.0.1\\", \\"agent_id\\": \\"d432fbb3-d2f1-4a97-9ef7-75bd81c00000\\"' ${HTTP_SERVER_LOG} -i
rlAssertNotGrep ERROR ${HTTP_SERVER_LOG} -i
cat ${WEBHOOK_LOG}
rlAssertGrep '\\"type\\": \\"revocation\\", \\"ip\\": \\"127.0.0.1\\", \\"agent_id\\": \\"d432fbb3-d2f1-4a97-9ef7-75bd81c00000\\"' ${WEBHOOK_LOG} -i
rlAssertNotGrep ERROR ${WEBHOOK_LOG} -i
fi
rlPhaseEnd

rlPhaseStartCleanup "Do the keylime cleanup"
rlRun "kill ${HTTP_SERVER_PID}"
rlRun "rm ${HTTP_SERVER_LOG}"
if [ -z "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
rlRun "kill ${WEBHOOK_PID}"
rlRun "pkill -f 'sleep 500'"
limeLogfileSubmit "${WEBHOOK_LOG}"
rlRun "rm ${WEBHOOK_LOG}"
fi
rlRun "rm -f /var/tmp/test_payload_file"
rlRun "limeStopAgent"
rlRun "limeStopRegistrar"
Expand Down
18 changes: 16 additions & 2 deletions functional/keylime-non-default-ports/test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

# set REVOCATION_NOTIFIER=zeromq to use the zeromq notifier
[ -n "$REVOCATION_NOTIFIER" ] || REVOCATION_NOTIFIER=agent
HTTP_SERVER_PORT=8080
WEBHOOK_PORT=8080
AGENT_ID="d432fbb3-d2f1-4a97-9ef7-75bd81c00000"

rlJournalStart
Expand All @@ -17,7 +17,7 @@ rlJournalStart
limeBackupConfig
# verifier
rlRun "limeUpdateConf revocations enabled_revocation_notifications '[\"${REVOCATION_NOTIFIER}\",\"webhook\"]'"
rlRun "limeUpdateConf revocations webhook_url http://localhost:${HTTP_SERVER_PORT}"
rlRun "limeUpdateConf revocations webhook_url https://localhost:${WEBHOOK_PORT}"
if [ -n "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
rlRun "limeUpdateConf revocations enabled_revocation_notifications '[]'"
fi
Expand Down Expand Up @@ -73,6 +73,14 @@ rlJournalStart
rlRun "limeWaitForAgentRegistration ${AGENT_ID}"
# create allowlist and excludelist
limeCreateTestPolicy
if [ -z "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
# start revocation notification webhook server
WEBHOOK_LOG=$( mktemp )
WEBHOOK_CERT="/var/lib/keylime/cv_ca/server-cert.crt"
WEBHOOK_KEY="/var/lib/keylime/cv_ca/server-private.pem"
rlRun "sleep 500 | openssl s_server -cert ${WEBHOOK_CERT} -key ${WEBHOOK_KEY} -port ${WEBHOOK_PORT} &> ${WEBHOOK_LOG} &"
WEBHOOK_PID=$!
fi
rlPhaseEnd

rlPhaseStartTest "Add keylime agent"
Expand Down Expand Up @@ -110,6 +118,12 @@ _EOF"
rlRun "limeStopAgent"
rlRun "limeStopRegistrar"
rlRun "limeStopVerifier"
if [ -z "$KEYLIME_TEST_DISABLE_REVOCATION" ]; then
rlRun "kill ${WEBHOOK_PID}"
rlRun "pkill -f 'sleep 500'"
limeLogfileSubmit "${WEBHOOK_LOG}"
rlRun "rm ${WEBHOOK_LOG}"
fi
#remove keylime_port_t label from non default ports
if rlIsRHEL '>=9.3' || rlIsFedora '>=38' || rlIsCentOS '>=9';then
rlRun "semanage port -d -t keylime_port_t -p tcp 19002"
Expand Down
Loading