Skip to content

Commit 7145c22

Browse files
KoncpaKoncpa
committed
Add verifier registrar unreachable test scenario
Test scenario check how is agent behaved when verifier and registrar are unreachable during initial registration or attestation.
1 parent 17c8b8c commit 7145c22

File tree

3 files changed

+128
-14
lines changed

3 files changed

+128
-14
lines changed

‎functional/verifier_registrar_unreachable/main.fmf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
summary: Test unreachability of verifier and registrar
2+
description: |
3+
Running just keylime agent.
4+
Check that registration failed.
5+
Start and stop verifier for generating certs.
6+
Start registrar and check that registration fails.
7+
Start verifier and check that registration is completed.
8+
Stop verifier and try to add agent to attestation.
9+
Verifies that adding agent will cause error.
10+
Start verifier and add agent to attestation.
11+
contact: Patrik Koncity <[email protected]>
12+
component:
13+
- keylime
14+
test: ./test.sh
15+
framework: beakerlib
16+
require:
17+
- yum
18+
recommend:
19+
- keylime
20+
duration: 10m
21+
enabled: true
22+
/unreachability-push:
23+
environment:
24+
AGENT_SERVICE: PushAgent
25+
/unreachability-pull:
26+
environment:
27+
AGENT_SERVICE: Agent

‎functional/verifier_registrar_unreachable/test.sh‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
#!/bin/bash
2+
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
3+
. /usr/share/beakerlib/beakerlib.sh || exit 1
4+
5+
AGENT_ID="d432fbb3-d2f1-4a97-9ef7-75bd81c00001"
6+
7+
TENANT_ARGS=""
8+
[ "${AGENT_SERVICE}" == "PushAgent" ] && TENANT_ARGS="--push-model"
9+
REGISTRATION_RETRY_WAIT=80
10+
11+
rlJournalStart
12+
13+
rlPhaseStartSetup "Do the keylime setup"
14+
[ "${AGENT_SERVICE}" != "Agent" ] && [ "${AGENT_SERVICE}" != "PushAgent" ] && rlDie "Error: AGENT_SERVICE variable is not set. Value 'Agent' or 'PushAgent' expected!"
15+
rlRun 'rlImport "./test-helpers"' || rlDie "Error: Cannot import keylime-tests/test-helpers library"
16+
rlAssertRpm keylime
17+
# update /etc/keylime.conf
18+
limeBackupConfig
19+
# disable revocation notifications on verifier
20+
rlRun "limeUpdateConf revocations enabled_revocation_notifications '[]'"
21+
# disable revocation notifications on agent
22+
rlRun "limeUpdateConf agent enable_revocation_notifications false"
23+
rlRun "limeUpdateConf agent uuid \\\"${AGENT_ID}\\\""
24+
# tenant
25+
rlRun "limeUpdateConf tenant require_ek_cert False"
26+
# configure push attestation
27+
if [ "${AGENT_SERVICE}" == "PushAgent" ]; then
28+
# Set the verifier to run in PUSH mode
29+
rlRun "limeUpdateConf verifier mode 'push'"
30+
rlRun "limeUpdateConf verifier challenge_lifetime 1800"
31+
rlRun "limeUpdateConf agent attestation_interval_seconds 20"
32+
fi
33+
# if TPM emulator is present
34+
if limeTPMEmulated; then
35+
# start tpm emulator
36+
rlRun "limeStartTPMEmulator"
37+
rlRun "limeWaitForTPMEmulator"
38+
rlRun "limeCondStartAbrmd"
39+
# start ima emulator
40+
rlRun "limeInstallIMAConfig"
41+
rlRun "limeStartIMAEmulator"
42+
fi
43+
sleep 5
44+
# Need to start verifier for generating
45+
rlRun "limeStartVerifier"
46+
rlRun "limeWaitForVerifier"
47+
rlRun "limeStopVerifier"
48+
49+
rlRun "limeStart${AGENT_SERVICE}"
50+
rlRun -s "limeWaitForAgentRegistration ${AGENT_ID}" 1
51+
rlAssertGrep "ERROR - Agent $AGENT_ID does not exist on Registrar" $rlRun_LOG -E
52+
rlRun "limeCreateTestPolicy"
53+
#check agent status in logs
54+
rlAssertGrep "Error.*Connection refused" $(limeAgentLogfile)
55+
rlPhaseEnd
56+
57+
rlPhaseStartTest "Try register agent after startup registrar, without running verifier, should succeed"
58+
rlRun "limeStartRegistrar"
59+
rlRun "limeWaitForRegistrar"
60+
# Cannot setup exponential backoff, missing in agent config, still we want to have agent running
61+
sleep ${REGISTRATION_RETRY_WAIT}
62+
rlRun -s "limeWaitForAgentRegistration ${AGENT_ID}" 0
63+
rlAssertGrep "SUCCESS: Agent $AGENT_ID registered" $(limeAgentLogfile)
64+
rlAssertGrep "SUCCESS: Agent $AGENT_ID activated" $(limeAgentLogfile)
65+
rlPhaseEnd
66+
67+
rlPhaseStartTest "Verify that adding agent fails when verifier is unreachable"
68+
rlRun -s "keylime_tenant -v 127.0.0.1 -t 127.0.0.1 -u $AGENT_ID --runtime-policy policy.json -c add ${TENANT_ARGS}" 1
69+
rlAssertGrep "Failed to establish a new connection.*Connection refused" $rlRun_LOG -E
70+
rlRun "limeWaitForAgentStatus $AGENT_ID 'Connection Refused'" 1
71+
rlAssertGrep "GET invoked from" $(limeAgentLogfile)
72+
rlPhaseEnd
73+
74+
rlPhaseStartTest "Start again verifier and check adding keylime agent"
75+
rlRun "limeStartVerifier"
76+
rlRun "limeWaitForVerifier"
77+
rlRun "keylime_tenant -v 127.0.0.1 -t 127.0.0.1 -u $AGENT_ID --runtime-policy policy.json -c add ${TENANT_ARGS}"
78+
rlRun "limeWaitForAgentStatus $AGENT_ID 'Get Quote'"
79+
rlRun -s "keylime_tenant -c cvlist"
80+
rlAssertGrep "{'code': 200, 'status': 'Success', 'results': {'uuids':.*'$AGENT_ID'" $rlRun_LOG -E
81+
rlPhaseEnd
82+
83+
rlPhaseStartCleanup "Do the keylime cleanup"
84+
rlRun "limeStop${AGENT_SERVICE}"
85+
rlRun "limeStopRegistrar"
86+
rlRun "limeStopVerifier"
87+
rlAssertNotGrep "Traceback" "$(limeRegistrarLogfile)"
88+
rlAssertNotGrep "Traceback" "$(limeVerifierLogfile)"
89+
if limeTPMEmulated; then
90+
rlRun "limeStopIMAEmulator"
91+
rlRun "limeStopTPMEmulator"
92+
rlRun "limeCondStopAbrmd"
93+
fi
94+
limeSubmitCommonLogs
95+
limeClearData
96+
limeRestoreConfig
97+
limeExtendNextExcludelist $TESTDIR
98+
rlPhaseEnd
99+
100+
rlJournalEnd

‎plans/distribution-fedora-keylime.fmf‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,6 @@ context:
77
agent: rust
88
faked_measured_boot_log: no
99

10-
adjust+:
11-
- when: target_PR_branch is defined and target_PR_branch != fedora
12-
enabled: false
13-
because: we want to run this plan only for PRs targeting the respective Fedora branch
14-
1510
discover:
1611
how: fmf
1712
test:
@@ -20,15 +15,7 @@ discover:
2015
# this is to utilize also a different parser
2116
- /setup/configure_kernel_ima_module/ima_policy_simple
2217
- /setup/enable_keylime_debug_messages
23-
- "^/functional/basic-attestation-on-localhost"
24-
# now change IMA policy to signing and run all tests
25-
- /setup/configure_kernel_ima_module/ima_policy_signing
26-
- /setup/inject_SELinux_AVC_check
27-
- "^/functional/.*"
28-
- "^/regression/.*"
29-
- "^/compatibility/.*"
30-
- "^/sanity/.*"
31-
- /update/basic-attestation-on-localhost/all
18+
- /functional/verifier_registrar_unreachable
3219

3320
execute:
3421
how: tmt

0 commit comments

Comments
 (0)