From a6d2bb25cf945cd16f29a575055c6f1a1f9cf6c9 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 4 Aug 2021 19:03:30 +0100 Subject: [PATCH] tests: filter out TLS distinguished name in certificate checks MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit The version of GNUTLS in Fedora 34 has changed the order in which encodes fields when generating new TLS certificates. This in turn changes the order seen when querying the distinguished name. This ultimately breaks the expected output in the NBD TLS iotests. We don't need to be comparing the exact distinguished name text for the purpose of the test though, so it is fine to filter it out. Reported-by: Eric Blake Signed-off-by: Daniel P. Berrangé Message-Id: <20210804180330.3469683-1-berrange@redhat.com> Reviewed-by: Eric Blake Tested-by: Eric Blake Signed-off-by: Hanna Reitz --- tests/qemu-iotests/233 | 2 +- tests/qemu-iotests/233.out | 4 ++-- tests/qemu-iotests/common.filter | 5 +++++ 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/tests/qemu-iotests/233 b/tests/qemu-iotests/233 index da150cd27bb..9ca7b68f42c 100755 --- a/tests/qemu-iotests/233 +++ b/tests/qemu-iotests/233 @@ -148,7 +148,7 @@ $QEMU_IMG info --image-opts \ echo echo "== final server log ==" -cat "$TEST_DIR/server.log" +cat "$TEST_DIR/server.log" | _filter_authz_check_tls rm -f "$TEST_DIR/server.log" # success, all done diff --git a/tests/qemu-iotests/233.out b/tests/qemu-iotests/233.out index c3c344811b2..4b1f6a0e151 100644 --- a/tests/qemu-iotests/233.out +++ b/tests/qemu-iotests/233.out @@ -65,6 +65,6 @@ qemu-img: Could not open 'driver=nbd,host=127.0.0.1,port=PORT,tls-creds=tls0': F == final server log == qemu-nbd: option negotiation failed: Verify failed: No certificate was found. qemu-nbd: option negotiation failed: Verify failed: No certificate was found. -qemu-nbd: option negotiation failed: TLS x509 authz check for CN=localhost,O=Cthulhu Dark Lord Enterprises client1,L=R'lyeh,C=South Pacific is denied -qemu-nbd: option negotiation failed: TLS x509 authz check for CN=localhost,O=Cthulhu Dark Lord Enterprises client3,L=R'lyeh,C=South Pacific is denied +qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME is denied +qemu-nbd: option negotiation failed: TLS x509 authz check for DISTINGUISHED-NAME is denied *** done diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter index 268b749e2fa..2b2b53946c6 100644 --- a/tests/qemu-iotests/common.filter +++ b/tests/qemu-iotests/common.filter @@ -332,5 +332,10 @@ for fname in fnames: sys.stdout.write(result)' } +_filter_authz_check_tls() +{ + $SED -e 's/TLS x509 authz check for .* is denied/TLS x509 authz check for DISTINGUISHED-NAME is denied/' +} + # make sure this script returns success true -- 2.39.5