From cf6a3656682dbca37f1a506fdb56145fd1a637d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian=20Peliz=C3=A4us?= Date: Thu, 4 Apr 2024 10:33:59 +0200 Subject: [PATCH 1/2] bin/helpers: Add certificateFingerprint and certificateFingerprintShort MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julian Pelizäus --- bin/helpers | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/bin/helpers b/bin/helpers index 6c9a1722c..13f04fd4d 100644 --- a/bin/helpers +++ b/bin/helpers @@ -173,6 +173,16 @@ createCertificateAndKey() ( openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -sha384 -keyout "${key_file}" -nodes -out "${crt_file}" -days 1 -subj "/CN=${cn}" ) +# certificateFingerprint: returns the certificate's fingerprint. +certificateFingerprint() ( + openssl x509 -in "${1}" -outform der | sha256sum +) + +# certificateFingerprintShort: returns the certificate's fingerprint in short form as used by LXD. +certificateFingerprintShort() ( + certificateFingerprint "${1}" | head -c12 +) + # cleanup: report if the test passed or not and return the appropriate return code. cleanup() { set +e From c1bfa62568a5225a58380e2fec74b8f993a7e762 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Julian=20Peliz=C3=A4us?= Date: Thu, 4 Apr 2024 10:34:29 +0200 Subject: [PATCH 2/2] tests/cluster: Use new fingerprint helper functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julian Pelizäus --- tests/cluster | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/cluster b/tests/cluster index a9dded770..de2ce2c34 100755 --- a/tests/cluster +++ b/tests/cluster @@ -97,8 +97,8 @@ createCertificateAndKey "${tmp_cert_dir}/cert.key" "${tmp_cert_dir}/cert.crt" "c createCertificateAndKey "${tmp_cert_dir}/cert-restricted.key" "${tmp_cert_dir}/cert-restricted.crt" "cert-restricted.local" lxc config trust add "${tmp_cert_dir}/cert.crt" lxc config trust add "${tmp_cert_dir}/cert-restricted.crt" --restricted --projects default -unrestricted_fingerprint="$(openssl x509 -in "${tmp_cert_dir}/cert.crt" -outform der | sha256sum | head -c12)" -restricted_fingerprint="$(openssl x509 -in "${tmp_cert_dir}/cert-restricted.crt" -outform der | sha256sum | head -c12)" +unrestricted_fingerprint="$(certificateFingerprintShort "${tmp_cert_dir}/cert.crt")" +restricted_fingerprint="$(certificateFingerprintShort "${tmp_cert_dir}/cert-restricted.crt")" echo "==> Check the certificates for its permissions" lxc query "/1.0/certificates/${unrestricted_fingerprint}" | jq -r ".restricted" | grep -xF false @@ -112,8 +112,8 @@ createCertificateAndKey "${tmp_cert_dir}/metrics.key" "${tmp_cert_dir}/metrics.c createCertificateAndKey "${tmp_cert_dir}/metrics-restricted.key" "${tmp_cert_dir}/metrics-restricted.crt" "metrics-restricted.local" lxc config trust add "${tmp_cert_dir}/metrics.crt" --type metrics lxc config trust add "${tmp_cert_dir}/metrics-restricted.crt" --type metrics --restricted --projects default -unrestricted_metrics_fingerprint="$(openssl x509 -in "${tmp_cert_dir}/metrics.crt" -outform der | sha256sum | head -c12)" -restricted_metrics_fingerprint="$(openssl x509 -in "${tmp_cert_dir}/metrics-restricted.crt" -outform der | sha256sum | head -c12)" +unrestricted_metrics_fingerprint="$(certificateFingerprintShort "${tmp_cert_dir}/metrics.crt")" +restricted_metrics_fingerprint="$(certificateFingerprintShort "${tmp_cert_dir}/metrics-restricted.crt")" echo "==> Check the metrics certificates for its permissions" lxc query "/1.0/certificates/${unrestricted_metrics_fingerprint}" | jq -r ".restricted" | grep -xF false