From 7526e9ab32beb9edd4c19f9c8fed35d051d6bdbf Mon Sep 17 00:00:00 2001 From: catborise Date: Sun, 18 Oct 2026 15:19:58 +0300 Subject: [PATCH] dev: the Vagrant computes accept TLS logins, and the live suite runs over TLS too vagrant up makes a throwaway CA and a client certificate in .vagrant/tls/.pki/libvirt with the host's openssl (Vagrant puts its own first on PATH). Each compute signs its server certificate for its address, asks for SASL over TLS like over TCP, and listens on 16514. libvirt takes a client certificate from $HOME/.pki/libvirt, so the README's second run uses HOME=.vagrant/tls with TEST_LIBVIRT_TYPE=3 and leaves the user's own certificates alone. --- README.md | 3 ++- Vagrantfile | 29 ++++++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 03378931..6d18373d 100644 --- a/README.md +++ b/README.md @@ -697,7 +697,7 @@ python manage.py test `TEST_LIBVIRT_GUEST_IMAGE` enables the tests that need a guest OS (disk and NIC hot-unplug, vCPU hotplug, guest agent, ACPI power off). It must be an installed, BIOS-bootable Linux qcow2 image with qemu-guest-agent, in a storage pool of the host other than `wvc-test`; the tests boot copies of it from overlays and only read the image. Shut down any VM using it first. -Two disposable compute nodes for these tests come from the `Vagrantfile`: AlmaLinux 10 with nested KVM, set up by `dev/libvirt-bootstrap.sh` (with this checkout's gstfsd), a SASL user for TCP (`wvc`, password `wvc-test`) and your `~/.ssh/id_ed25519.pub` for root; migration runs between them, and each has an empty second disk (`/dev/vdb`) for the LVM tests and serves a 1 GiB iSCSI LUN on 127.0.0.1 for the iSCSI test. It needs Vagrant with the `vagrant-libvirt` plugin, a KVM host with `qemu-kvm` and `cyrus-sasl-md5`, and a user in the `libvirt` group. On a host that also runs Docker, let the VMs' network (the bridge of `virsh net-info vagrant-libvirt`, `virbr1` here) through Docker's forward rules (`sudo iptables -I DOCKER-USER -i virbr1 -j ACCEPT` and `sudo iptables -I DOCKER-USER -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`). +Two disposable compute nodes for these tests come from the `Vagrantfile`: AlmaLinux 10 with nested KVM, set up by `dev/libvirt-bootstrap.sh` (with this checkout's gstfsd), a SASL user for TCP (`wvc`, password `wvc-test`) and your `~/.ssh/id_ed25519.pub` for root; migration runs between them, and each has an empty second disk (`/dev/vdb`) for the LVM tests and serves a 1 GiB iSCSI LUN on 127.0.0.1 for the iSCSI test. They accept TLS logins (SASL) with certificates from a throwaway CA that `vagrant up` makes in `.vagrant/tls`; the TLS run takes its client certificate from there through `HOME`. It needs Vagrant with the `vagrant-libvirt` plugin, a KVM host with `qemu-kvm` and `cyrus-sasl-md5`, and a user in the `libvirt` group. On a host that also runs Docker, let the VMs' network (the bridge of `virsh net-info vagrant-libvirt`, `virbr1` here) through Docker's forward rules (`sudo iptables -I DOCKER-USER -i virbr1 -j ACCEPT` and `sudo iptables -I DOCKER-USER -o virbr1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT`). ```bash vagrant up --provider=libvirt @@ -706,6 +706,7 @@ for h in $C1 $C2; do ssh-keygen -R $h; ssh -o StrictHostKeyChecking=accept-new r export TEST_LIBVIRT_HOST=$C1 TEST_LIBVIRT_TYPE=1 TEST_LIBVIRT_LOGIN=wvc TEST_LIBVIRT_PASSWORD=wvc-test export TEST_LIBVIRT_SSH_HOST=$C2 TEST_LIBVIRT_SSH_LOGIN=root TEST_LIBVIRT_MIGRATE_ADDRESS=$C2 TEST_LIBVIRT_LVM_DEVICE=/dev/vdb TEST_LIBVIRT_ISCSI_TARGET=iqn.2026-10.test.wvc:lun python manage.py test +HOME=$PWD/.vagrant/tls TEST_LIBVIRT_TYPE=3 TEST_LIBVIRT_SSH_HOST= python manage.py test # compute1 again, over TLS vagrant destroy -f ``` diff --git a/Vagrantfile b/Vagrantfile index beb02ca2..586df600 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -3,7 +3,23 @@ # dev/libvirt-bootstrap.sh, with a SASL user for TCP and the host user's SSH # key for root (SASL user wvc, password wvc-test). The empty second disk # /dev/vdb is for the LVM tests (TEST_LIBVIRT_LVM_DEVICE); each also serves a -# 1 GiB iSCSI LUN on 127.0.0.1 for the iSCSI tests (TEST_LIBVIRT_ISCSI_TARGET). +# 1 GiB iSCSI LUN on 127.0.0.1 for the iSCSI tests (TEST_LIBVIRT_ISCSI_TARGET), +# and accepts TLS logins (SASL) with a certificate from a throwaway CA. + +# The CA is made here once; each compute signs its own certificate with it. +# The client certificate sits where libvirt looks with HOME=.vagrant/tls. +pki = File.join(__dir__, ".vagrant/tls/.pki/libvirt") +unless File.exist?(File.join(pki, "clientcert.pem")) + # the host's openssl, not the one Vagrant puts first on PATH + Vagrant::Util::Env.with_original_env do + system("sh", "-ec", <<-SH, pki, exception: true) + mkdir -p "$0" && cd "$0" + openssl req -x509 -newkey rsa:3072 -nodes -keyout cakey.pem -out cacert.pem -days 365 -subj /CN=wvc-test-ca + openssl req -new -newkey rsa:3072 -nodes -keyout clientkey.pem -subj /CN=wvc-test-client | + openssl x509 -req -CA cacert.pem -CAkey cakey.pem -days 365 -out clientcert.pem + SH + end +end Vagrant.configure(2) do |config| config.vm.box = "almalinux/10" @@ -23,6 +39,8 @@ Vagrant.configure(2) do |config| config.vm.provision "file", source: "dev", destination: "/tmp/wvc/dev" config.vm.provision "file", source: "conf", destination: "/tmp/wvc/conf" config.vm.provision "file", source: "~/.ssh/id_ed25519.pub", destination: "/tmp/wvc/key.pub" + config.vm.provision "file", source: "#{pki}/cacert.pem", destination: "/tmp/wvc/cacert.pem" + config.vm.provision "file", source: "#{pki}/cakey.pem", destination: "/tmp/wvc/cakey.pem" config.vm.provision "shell", inline: <<-SHELL set -e sh /tmp/wvc/dev/libvirt-bootstrap.sh @@ -42,5 +60,14 @@ Vagrant.configure(2) do |config| targetcli /iscsi/$T/tpg1 set attribute generate_node_acls=1 demo_mode_write_protect=0 targetcli saveconfig } + install -D -m 644 /tmp/wvc/cacert.pem /etc/pki/CA/cacert.pem + install -d /etc/pki/libvirt/private + echo "subjectAltName=IP:$(hostname -I | cut -d' ' -f1)" > /tmp/wvc/ext + openssl req -new -newkey rsa:3072 -nodes -keyout /etc/pki/libvirt/private/serverkey.pem -subj /CN=$(hostname) | + openssl x509 -req -CA /tmp/wvc/cacert.pem -CAkey /tmp/wvc/cakey.pem -days 365 -extfile /tmp/wvc/ext -out /etc/pki/libvirt/servercert.pem + sed -i 's/^#auth_tls = "none"/auth_tls = "sasl"/' /etc/libvirt/virtproxyd.conf + # a running service would keep the old settings and refuse a new socket + systemctl stop virtproxyd.service + systemctl enable --now virtproxyd-tls.socket SHELL end