testsuite/systemtap.server/client.exp

   1 # Don't attempt these tests if TOOL_OPTS=server has been specified. This is
   2 # because TOOL_OPTS=server starts a server using setup_server which creates
   3 # a dummy stap on the PATH which always specifies --use-server. We don't want
   4 # that here. We want to use the real stap and supply client-side options
   5 # as we see fit.
   6 if {[use_server_p]} then {
   7     untested "Compile-Server Client Tests"
   8     return
   9 }
  10
  11 # There is no server running as part of the test suite. So let's start with
  12 # a clean slate in terms of trust.
  13 exec rm -fr $env(SYSTEMTAP_DIR)/ssl
  14
  15 # Test the --list-servers option and return an array of the servers found.
  16 proc list_servers { TEST_NAME SERVER_SPEC args } {
  17     set failed 0
  18     set n 0
  19     array unset ::servers
  20     set cmd [concat stap --list-servers=$SERVER_SPEC $args]
  21     send_log "executing: $cmd\n"
  22     eval spawn $cmd
  23     expect {
  24         -timeout 150
  25         -re "^Systemtap Compile Server Status for '${SERVER_SPEC}'\r\n" {
  26             exp_continue
  27         }
  28         -re {^No servers found\r\n} {
  29         }
  30         -re {^ host=[^\r]*\r\n} {
  31             set ::servers($n) "$expect_out(0,string)"
  32             incr n
  33             exp_continue
  34         }
  35         -re {^[^\r]*\r\n} {
  36             set failed 1
  37         }
  38         timeout {
  39             exec kill -INT -[exp_pid]
  40             wait
  41             set failed 1
  42         }
  43     }
  44     catch close
  45
  46     if {$failed != 0} {
  47         fail "$TEST_NAME"
  48     } else {
  49         pass "$TEST_NAME"
  50     }
  51 }
  52
  53 # There may be other servers running. Let's keep track of them.
  54 list_servers "List existing online servers" online
  55 array unset existing_online_servers
  56 array set existing_online_servers [array get servers]
  57
  58 # There may be existing trusted servers. Keep track of them.
  59 list_servers "List existing trusted servers" trusted
  60 array unset existing_trusted_servers
  61 array set existing_trusted_servers [array get servers]
  62
  63 # There may be existing trusted signers. Keep track of them.
  64 list_servers "List existing signing servers" signer
  65 array unset existing_signing_servers
  66 array set existing_signing_servers [array get servers]
  67
  68 # If we query all known servers, it should contain exactly the union of the
  69 # above three queries.
  70 list_servers "List all existing servers" all
  71 array unset all_existing_servers
  72 array set all_existing_servers [array get servers]
  73
  74 set test "Verify existing online server list"
  75 set failed 0
  76 foreach idx1 [array names existing_online_servers] {
  77     set found 0
  78     foreach idx2 [array names all_existing_servers] {
  79         if {"$existing_online_servers($idx1)" == "$all_existing_servers($idx2)"} {
  80             set found 1
  81             break
  82         }
  83     }
  84     if {$found == 0} {
  85         set failed 1
  86         fail "$test $idx1"
  87     }
  88 }
  89 if {$failed == 0} {
  90     pass "$test"
  91 }
  92 set test "Verify existing trusted server list"
  93 set failed 0
  94 foreach idx1 [array names existing_trusted_servers] {
  95     set found 0
  96     foreach idx2 [array names all_existing_servers] {
  97         if {"$existing_trusted_servers($idx1)" == "$all_existing_servers($idx2)"} {
  98             set found 1
  99             break
 100         }
 101     }
 102     if {$found == 0} {
 103         set failed 1
 104         fail "$test $idx1"
 105     }
 106 }
 107 if {$failed == 0} {
 108     pass "$test"
 109 }
 110 set test "Verify existing signing server list"
 111 set failed 0
 112 foreach idx1 [array names existing_signing_servers] {
 113     set found 0
 114     foreach idx2 [array names all_existing_servers] {
 115         if {"$existing_signing_servers($idx1)" == "$all_existing_servers($idx2)"} {
 116             set found 1
 117             break
 118         }
 119     }
 120     if {$found == 0} {
 121         set failed 1
 122         fail "$test $idx1"
 123     }
 124 }
 125 if {$failed == 0} {
 126     pass "$test"
 127 }
 128 set test "Verify all existing server list"
 129 set failed 0
 130 foreach idx1 [array names all_existing_servers] {
 131     set found 0
 132     foreach idx2 [array names existing_online_servers] {
 133         if {"$existing_online_servers($idx2)" == "$all_existing_servers($idx1)"} {
 134             set found 1
 135             break
 136         }
 137     }
 138     if {$found == 0} {
 139         foreach idx2 [array names existing_trusted_servers] {
 140             if {"$existing_trusted_servers($idx2)" == "$all_existing_servers($idx1)"} {
 141                 set found 1
 142                 break
 143             }
 144         }
 145         if {$found == 0} {
 146             foreach idx2 [array names existing_signing_servers] {
 147                 if {"$existing_signing_servers($idx2)" == "$all_existing_servers($idx1)"} {
 148                     set found 1
 149                     break
 150                 }
 151             }
 152             if {$found == 0} {
 153                 set failed 1
 154                 fail "$test $idx1"
 155             }
 156         }
 157     }
 158 }
 159 if {$failed == 0} {
 160     pass "$test"
 161 }
 162
 163 # Now start our own server and make sure we can work with it.
 164 if {! [start_server]} {
 165     untested "Compile-server client tests against a server"
 166     return;
 167 }
 168
 169 # Our server should now appear online, separate from the previously discovered
 170 # online servers. Note that our server could generate serveral listings
 171 # because it could appear at more than one ip address,
 172 list_servers "List current online servers" online
 173 array unset current_online_servers
 174 array set current_online_servers [array get servers]
 175
 176 set test "New online servers"
 177 set n 0
 178 foreach idx1 [array names current_online_servers] {
 179     set found 0
 180     foreach idx2 [array names existing_online_servers] {
 181         if {"$existing_online_servers($idx2)" == "$current_online_servers($idx1)"} {
 182             set found 1
 183             break
 184         }
 185     }
 186     if {$found == 0} {
 187         set new_online_servers($n) "$current_online_servers($idx1)"
 188         incr n
 189     }
 190 }
 191 if {$n == 0} {
 192     fail "$test"
 193 } else {
 194     pass "$test"
 195 }
 196
 197 # Our server should now be trusted, separate from the previously discovered
 198 # trusted servers.
 199 list_servers "List current trusted servers" online,trusted
 200 array unset current_trusted_servers
 201 array set current_trusted_servers [array get servers]
 202
 203 set test "New trusted servers"
 204 set n 0
 205 foreach idx1 [array names current_trusted_servers] {
 206     set found 0
 207     foreach idx2 [array names existing_trusted_servers] {
 208         if {"$existing_trusted_servers($idx2)" == "$current_trusted_servers($idx1)"} {
 209             set found 1
 210             break
 211         }
 212     }
 213     if {$found == 0} {
 214         set new_trusted_servers($n) "$current_trusted_servers($idx1)"
 215         incr n
 216     }
 217 }
 218 if {$n == 0} {
 219     fail "$test"
 220 } else {
 221     pass "$test"
 222 }
 223
 224 # The new servers should automatically be trusted, so the new_trusted_servers
 225 # array should be a subset of the new_online_servers
 226 # array, but not necessarilty vice-versa, since new servers may have come
 227 # online independently of our testing.
 228 set test "Verify new trusted server list"
 229 set failed 0
 230 foreach idx1 [array names new_trusted_servers] {
 231     set found 0
 232     foreach idx2 [array names new_online_servers] {
 233         if {"$new_trusted_servers($idx1)" == "$new_online_servers($idx2)"} {
 234             set found 1
 235             break
 236         }
 237     }
 238     if {$found == 0} {
 239         set failed 1
 240         fail "$test $idx1"
 241     }
 242 }
 243 if {$failed == 0} {
 244     pass "$test"
 245 }
 246
 247 # The newly trusted servers represent the server we just started.
 248 array unset our_servers
 249 array set our_servers [array get new_trusted_servers]
 250
 251 # The new servers should not be trusted as signers so there should be no new
 252 # signing servers.
 253 list_servers "List current signing servers" signer
 254 array unset current_signing_servers
 255 array set current_signing_servers [array get servers]
 256
 257 set test "No new signing servers"
 258 set failed 0
 259 foreach idx1 [array names current_signing_servers] {
 260     set found 0
 261     foreach idx2 [array names existing_signing_servers] {
 262         if {"$existing_signing_servers($idx2)" == "$current_signing_servers($idx1)"} {
 263             set found 1
 264             break
 265         }
 266     }
 267     if {$found == 0} {
 268         set failed 1
 269         fail "$test $idx1"
 270     }
 271 }
 272 if {$failed == 0} {
 273     pass "$test"
 274 }
 275
 276 # Revoke trust in our server. Specify the server by host name.
 277 set test "Server has host name"
 278 if {[regexp {^ host=([^ ]*).*} $our_servers(0) match host_name]} {
 279     pass $test
 280 } else {
 281     fail $test
 282 }
 283 set cmd [concat stap --trust-servers=ssl,revoke,no-prompt --use-server=$host_name]
 284 send_log "executing: $cmd\n"
 285 eval spawn $cmd
 286 expect {
 287     -timeout 150
 288     timeout {
 289         exec kill -INT -[exp_pid]
 290         wait
 291         set failed 1
 292     }
 293 }
 294 catch close
 295
 296 # Our server should no longer be trusted.
 297 list_servers "List current trusted servers after revokation by host name" trusted
 298 array unset current_trusted_servers
 299 array set current_trusted_servers [array get servers]
 300
 301 set test "No longer trusted after revokation by host name"
 302 set failed 0
 303 foreach idx1 [array names current_trusted_servers] {
 304     set found 0
 305     foreach idx2 [array names existing_trusted_servers] {
 306         if {"$existing_trusted_servers($idx2)" == "$current_trusted_servers($idx1)"} {
 307             set found 1
 308             break
 309         }
 310     }
 311     if {$found == 0} {
 312         set failed 1
 313         fail "$test $idx1"
 314     }
 315 }
 316 if {$failed == 0} {
 317     pass "$test"
 318 }
 319
 320 # Reinstate trust in our server. Specify the server by ip address.
 321 # The default for --trusted servers is 'ssl'.
 322 set test "Server has ip address"
 323 if {[regexp {^.*ip=([^ ]*).*} $our_servers(0) match ip_address]} {
 324     pass $test
 325 } else {
 326     fail $test
 327 }
 328 set cmd [concat stap --trust-servers=no-prompt --use-server=$ip_address]
 329 send_log "executing: $cmd\n"
 330 eval spawn $cmd
 331 expect {
 332     -timeout 150
 333     timeout {
 334         exec kill -INT -[exp_pid]
 335         wait
 336         set failed 1
 337     }
 338 }
 339 catch close
 340
 341 # Our server should be trusted again, separate from the previously discovered
 342 # trusted servers.
 343 list_servers "List current trusted servers after reinstatement by ip address" online,trusted
 344 array unset current_trusted_servers
 345 array set current_trusted_servers [array get servers]
 346
 347 set test "New trusted servers after reinstatement by ip address"
 348 array unset new_trusted_servers
 349 set n 0
 350 foreach idx1 [array names current_trusted_servers] {
 351     set found 0
 352     foreach idx2 [array names existing_trusted_servers] {
 353         if {"$existing_trusted_servers($idx2)" == "$current_trusted_servers($idx1)"} {
 354             set found 1
 355             break
 356         }
 357     }
 358     if {$found == 0} {
 359         set new_trusted_servers($n) "$current_trusted_servers($idx1)"
 360         incr n
 361     }
 362 }
 363 if {$n == 0} {
 364     fail "$test"
 365 } else {
 366     pass "$test"
 367 }
 368
 369 # The new_trusted_servers array should now match the our_servers array, since
 370 # the our_servers array is a copy of the original new_trusted_servers array.
 371 set test "Number of new trusted servers matches after reinstatement by ip address"
 372 if {[array size new_trusted_servers] == [array size our_servers]} {
 373     pass "$test"
 374 } else {
 375     fail "$test"
 376 }
 377 set test "New trusted servers matches after reinstatement by ip address"
 378 set n 0
 379 foreach idx1 [array names new_trusted_servers] {
 380     set found 0
 381     foreach idx2 [array names our_servers] {
 382         if {"$our_servers($idx2)" == "$new_trusted_servers($idx1)"} {
 383             set found 1
 384             break
 385         }
 386     }
 387     if {$found == 1} {
 388         incr n
 389     }
 390 }
 391 if {$n != [array size new_trusted_servers]} {
 392     fail "$test"
 393 } else {
 394     pass "$test"
 395 }
 396
 397 # Trust our server as a module signer. This must be done as root. Specify
 398 # the server by certificate serial number.
 399 set test "Server has certificate serial number"
 400 if {[regexp {^.*certinfo="([^ ]*)".*} $our_servers(0) match cert_info]} {
 401     pass $test
 402 } else {
 403     fail $test
 404 }
 405
 406 # Even though this action must be performed as root, Do not perform it if we
 407 # are already root, since it alters the state of the install tree. See PR 11442.
 408 # The related tests should then be expected failures.
 409 set effective_pid [exec /usr/bin/id -u]
 410 if {$effective_pid != 0} {
 411     set cmd [concat [exec which stap] --trust-servers=signer,no-prompt --use-server=$cert_info]
 412     eval as_root { $cmd }
 413 }
 414
 415 # Our server should now be trusted as a signer, separate from the previously
 416 # discovered trusted signing servers.
 417 list_servers "List current signing servers" signer
 418 array unset current_signing_servers
 419 array set current_signing_servers [array get servers]
 420
 421 set test "New signing servers"
 422 set n 0
 423 foreach idx1 [array names current_signing_servers] {
 424     set found 0
 425     foreach idx2 [array names existing_signing_servers] {
 426         if {"$existing_signing_servers($idx2)" == "$current_signing_servers($idx1)"} {
 427             set found 1
 428             break
 429         }
 430     }
 431     if {$found == 0} {
 432         set new_signing_servers($n) "$current_signing_servers($idx1)"
 433         incr n
 434     }
 435 }
 436 if {$effective_pid == 0} {
 437     setup_xfail *-*-*
 438 }
 439 if {$n == 0} {
 440     fail "$test"
 441 } else {
 442     pass "$test"
 443 }
 444
 445 # The new_signing_servers array should now match the our_servers array, since
 446 # the we specified our server by certificate serial number so that we don't
 447 # accidentally trust another server on the same host.
 448 set test "Number of new signing servers matches"
 449 if {$effective_pid == 0} {
 450     setup_xfail *-*-*
 451 }
 452 if {[array size new_signing_servers] == [array size our_servers]} {
 453     pass "$test"
 454     set test "New signing servers matches"
 455     set n 0
 456     foreach idx1 [array names new_signing_servers] {
 457         set found 0
 458         foreach idx2 [array names our_servers] {
 459             if {"$our_servers($idx2)" == "$new_signing_servers($idx1)"} {
 460                 set found 1
 461                 break
 462             }
 463         }
 464         if {$found == 1} {
 465             incr n
 466         }
 467     }
 468     if {$effective_pid == 0} {
 469         setup_xfail *-*-*
 470     }
 471     if {$n != [array size new_signing_servers]} {
 472         fail "$test"
 473     } else {
 474         pass "$test"
 475     }
 476 } else {
 477     fail "$test"
 478     set test "New signing servers matches"
 479     if {$effective_pid == 0} {
 480         setup_xfail *-*-*
 481     }
 482     fail "$test"
 483 }
 484
 485 # Compile a simple test using --unprivileged. This will ask the server to
 486 # check and sign the module. Specify the server using host name and port.
 487 set test "Server has port number"
 488 if {[regexp {^.*port=([^ ]*).*} $our_servers(0) match port_num]} {
 489     pass $test
 490 } else {
 491     fail $test
 492 }
 493 set test "Compile module using server"
 494 set failed 0
 495 set module_name ""
 496 set cmd [concat stap -p4 --unprivileged $srcdir/systemtap.server/hello.stp --use-server=$host_name:$port_num]
 497 send_log "executing: $cmd\n"
 498 eval spawn $cmd
 499 expect {
 500     -timeout 150
 501     -re {^stap_[0-9]*\.ko\r\n} {
 502         set module_name [string trim "$expect_out(0,string)" \r\n]
 503     }
 504     timeout {
 505         exec kill -INT -[exp_pid]
 506         wait
 507         set failed 1
 508     }
 509 }
 510 catch close
 511 if {$failed == 0} {
 512     pass "$test"
 513 }
 514 send_log "'$module_name'\n"
 515
 516 # Make sure that the module was returned
 517 set test "Module was created"
 518 if {[file exists $module_name]} {
 519     pass "$test"
 520 } else {
 521     fail "$test"
 522 }
 523
 524 # Make sure that the module was signed
 525 set test "Module was signed"
 526 if {[file exists $module_name.sgn]} {
 527     pass "$test"
 528 } else {
 529     fail "$test"
 530 }
 531
 532 # Make sure we can load the module. This will verify that the signature
 533 # is correct and trusted. If we are not root or a member of either
 534 # the group stapdev or stapusr, then we still won't be able to load
 535 # the module.
 536 set expect_failure 1
 537 if {$effective_pid == 0} {
 538     set expect_failure 0
 539 } else {
 540     set id_info [exec /usr/bin/id]
 541     if {[regexp {.*\(stapdev\).*} "$id_info"]} {
 542         set expect_failure 0
 543     } elseif {[regexp {.*\(stapusr\).*} "$id_info"]} {
 544         if {$effective_pid != 0} {
 545             set expect_failure 0
 546         }
 547     }
 548 }
 549 if {$expect_failure} {
 550     setup_xfail *-*-*
 551 }
 552 set test "Load and run signed module when trusted"
 553 set failed 1
 554 set cmd [concat staprun $module_name]
 555 send_log "executing: $cmd\n"
 556 eval spawn $cmd
 557 expect {
 558     -timeout 150
 559     -re {^Hello From Server\r\n} {
 560         set failed 0
 561     }
 562     timeout {
 563         exec kill -INT -[exp_pid]
 564         wait
 565         set failed 1
 566     }
 567 }
 568 catch close
 569 if {$failed == 0} {
 570     pass "$test"
 571 } else {
 572     fail "$test"
 573 }
 574
 575
 576 # Revoke trust in our server as a module signer. This must be done as root.
 577 # Specify the server by certificate serial number so that we don't accidentally
 578 # revoke trust in a previously trusted server.
 579 # Even though this action must be performed as root, Do not perform it if we
 580 # are already root, since it alters the state of the install tree. See PR 11442.
 581 if {$effective_pid != 0} {
 582     set cmd [concat [exec which stap] --trust-servers=revoke,signer,no-prompt --use-server=$cert_info]
 583     eval as_root { $cmd }
 584 }
 585
 586 # Our server should no longer be trusted as a signed
 587 list_servers "List current signing servers after revokation" signer
 588 array unset current_signing_servers
 589 array set current_signing_servers [array get servers]
 590
 591 set test "No longer trusted as a signer after revokation"
 592 set failed 0
 593 foreach idx1 [array names current_signing_servers] {
 594     set found 0
 595     foreach idx2 [array names existing_signing_servers] {
 596         if {"$existing_signing_servers($idx2)" == "$current_signing_servers($idx1)"} {
 597             set found 1
 598             break
 599         }
 600     }
 601     if {$found == 0} {
 602         set failed 1
 603         fail "$test $idx1"
 604     }
 605 }
 606 if {$failed == 0} {
 607     pass "$test"
 608 }
 609
 610 # Since our server is no longer a trusted signer, attempting
 611 # to load and run the module now should fail unless we
 612 # are root or a member of the group stapdev.
 613 set expect_failure 1
 614 if {[exec /usr/bin/id -u] == 0} {
 615     set expect_failure 0
 616 } else {
 617     if {[regexp {.*\(stapdev\).*} "$id_info"]} {
 618         set expect_failure 0
 619     }
 620 }
 621 if {$expect_failure} {
 622     setup_xfail *-*-*
 623 }
 624 set test "Load and run signed module when not trusted"
 625 set failed 1
 626 set cmd [concat staprun $module_name]
 627 send_log "executing: $cmd\n"
 628 eval spawn $cmd
 629 expect {
 630     -timeout 150
 631     -re {^Hello From Server\r\n} {
 632         set failed 0
 633     }
 634     timeout {
 635         exec kill -INT -[exp_pid]
 636         wait
 637         set failed 1
 638     }
 639 }
 640 catch close
 641 if {$failed == 0} {
 642     pass "$test"
 643 } else {
 644     fail "$test"
 645 }
 646
 647 # Shutdown the server we started
 648 shutdown_server