mirror of
https://github.com/xcat2/xcat-core.git
synced 2026-10-12 08:12:33 +00:00
Daniel Hilst
e70166d694
The nameless-request scenario was still labelled P-61, the scenario that found it, rather than the one written for it.
98 lines
3.6 KiB
Plaintext
98 lines
3.6 KiB
Plaintext
# Stage 11: getcredentials. Spec P-61, P-62, P-63, P-76.
|
|
#
|
|
# This is the one request a forged client cannot simply ask for. Before xcatd
|
|
# signs anything it connects back to the client on TCP 300 and sends
|
|
# `CREDOKBYYOU?`; it signs only if the client answers `CREDOKBYME`
|
|
# (credentials.pm:611, callback port checked at credentials.pm:130-136).
|
|
#
|
|
# That callback is the only thing standing between "an address with a PTR" and
|
|
# "a signed cluster certificate", so both halves are asserted: that it is made,
|
|
# and that a client which cannot answer it gets nothing.
|
|
#
|
|
# The credential asked for is named in <arg>, exactly as getcredentials.awk
|
|
# names it when remoteshell and xcatserver run on the installing node. Genesis
|
|
# asks for x509cert instead and encloses a CSR; that path is not exercised here
|
|
# because a CSR is not something a wire test can fabricate meaningfully, and
|
|
# the callback is the same callback either way.
|
|
#
|
|
# provtest run \
|
|
# --set server=10.99.1.1 --set client=10.99.1.11 \
|
|
# --set xcatport=3001 --set credtype=xcat_server_cred \
|
|
# conf/xcatd-credentials.conf
|
|
|
|
[defaults]
|
|
server = %(server)s
|
|
port = %(xcatport)s
|
|
bind = %(client)s
|
|
callback_port = 300
|
|
timeout = 30
|
|
retries = 1
|
|
|
|
# --- P-62, P-63 -------------------------------------------------------------
|
|
|
|
[scenario credentials-granted]
|
|
description = A client that answers the callback is given a signed certificate
|
|
|
|
[step getcredentials]
|
|
type = xcatreq
|
|
command = getcredentials
|
|
element =
|
|
arg = %(credtype)s
|
|
# The listener goes up on the client's port 300 before the request is sent,
|
|
# because the server connects back while the request is still open: a listener
|
|
# started afterwards would be started too late.
|
|
callback_listen = 300
|
|
callback_reply = CREDOKBYME
|
|
callback_wait = 20
|
|
assert =
|
|
# P-63: the callback arrived, and on the port the request named.
|
|
callback_seen == yes
|
|
callback_data contains CREDOKBYYOU
|
|
# P-62: and the answer carries the credential that was asked for. The
|
|
# payload is wrapped as <data><content>..</content><desc>..</desc></data>
|
|
# (credentials.pm:362), so `content` is where to look and `desc` says
|
|
# which of several credentials a reply belongs to.
|
|
desc == %(credtype)s
|
|
content contains -----BEGIN
|
|
error absent
|
|
|
|
# --- P-61 -------------------------------------------------------------------
|
|
|
|
[scenario credentials-refused]
|
|
description = A client with no listener on the callback port is given nothing
|
|
|
|
[step norefused]
|
|
type = xcatreq
|
|
command = getcredentials
|
|
element =
|
|
arg = %(credtype)s
|
|
# No callback_listen: the port is closed, the server's connection is refused,
|
|
# and the challenge goes unanswered. Anything signed arriving here would mean
|
|
# an address alone is enough to collect a cluster certificate.
|
|
expect = any
|
|
assert =
|
|
callback_seen == no
|
|
content absent
|
|
|
|
# --- P-76 -------------------------------------------------------------------
|
|
|
|
[scenario credentials-nameless]
|
|
description = A request that names no credential is refused without a callback
|
|
|
|
[step nameless]
|
|
type = xcatreq
|
|
command = getcredentials
|
|
# No <arg>: the request is well formed as XML and says nothing about what it
|
|
# wants. xcatd used to dereference the missing element and hand the client the
|
|
# resulting Perl error, file and line included, over a connection anything on
|
|
# the provisioning network can open. It must refuse instead, and must not
|
|
# spend a callback on a request it cannot serve.
|
|
callback_listen = 300
|
|
callback_reply = CREDOKBYME
|
|
callback_wait = 5
|
|
expect = any
|
|
assert =
|
|
content absent
|
|
callback_seen == no
|
|
error absent
|