Commit 1098ba6f authored by Killian Lufau's avatar Killian Lufau Committed by Thomas Gambier

demo: Add testing of HMAC

/reviewed-on !19
parent d0233199
import argparse, math, nemu, os, re, signal
import socket, subprocess, sys, time, weakref
import socket, sqlite3, subprocess, sys, time, weakref
from collections import defaultdict
from contextlib import contextmanager
from threading import Thread
IPTABLES = 'iptables'
SCREEN = 'screen'
......@@ -60,6 +61,8 @@ parser.add_argument('-d', '--duration', type = int,
help = 'time of the demo execution in seconds')
parser.add_argument('-p', '--ping', action = 'store_true',
help = 'execute ping utility')
parser.add_argument('-m', '--hmac', action = 'store_true',
help = 'execute HMAC test')
args = parser.parse_args()
def handler(signum, frame):
......@@ -243,7 +246,8 @@ def new_network(registry, reg_addr, serial, ca):
db = sqlite3.connect(db_path, isolation_level=None)
def new_node(node, folder, args='', prefix_len=None, registry=registry_url):
if node not in nodes:
if not os.path.exists(folder + '/cert.crt'):
dh_path = folder + '/dh2048.pem'
if not os.path.exists(dh_path):
......@@ -297,6 +301,46 @@ if
name = if machine.short[0] == 'R' else 'm' + machine.short
machine.screen('python {} {}'.format(name, ' '.join(ips)))
class testHMAC(Thread):
def run(self):
reg1_db = sqlite3.connect('registry/registry.db', isolation_level=None,
reg2_db = sqlite3.connect('registry2/registry.db', isolation_level=None,
reg1_db.text_factory = reg2_db.text_factory = str
m_net1 = ['registry', 'm1', 'm2', 'm3', 'm4', 'm5', 'm6', 'm7', 'm8']
m_net2 = ['registry2', 'm10']
print 'Testing HMAC, letting the time to machines to create tunnels...'
print 'Check that the initial HMAC config is deployed on network 1'
test_hmac.checkHMAC(reg1_db, m_net1)
print 'Test that a HMAC update works with nodes that are up'
print 'Updated HMAC (config = hmac0 & hmac1), waiting...'
print 'Checking HMAC on machines connected to registry 1...'
test_hmac.checkHMAC(reg1_db, m_net1)
print ('Test that machines can update upon reboot ' +
'when they were off during a HMAC update.')
print 'Re6st on machine 1 is stopped'
print 'Updated HMAC on registry (config = hmac1 & hmac2), waiting...'
new_node(machine1, 'm1', '-I%s' %,
None, 'http://%s/' % REGISTRY)
print 'Started re6st on machine 1, waiting for it to get new conf'
print 'Checking HMAC on machines connected to registry 1...'
test_hmac.checkHMAC(reg1_db, m_net1)
print 'Testing of HMAC done!'
if args.hmac:
import test_hmac
_ll = {}
def node_by_ll(addr):
import sqlite3, subprocess
def getConfig(db, name):
r, = next(db.execute(
"SELECT value FROM config WHERE name=?", (name,)), (None,))
if r is not None:
r = str(r).encode('hex')
return r
def killRe6st(machine):
p = subprocess.Popen(['pgrep', '-f', 'set ./py re6stnet @%s' %machine],
ps_id = p.communicate()[0].split('\n', 1)[0]
if ps_id:
subprocess.Popen(['kill', ps_id])
def checkHMAC(db, machines):
hmac = dict([(k, getConfig(db, k))
for k in 'babel_hmac0', 'babel_hmac1', 'babel_hmac2'])
rc = True
ps = subprocess.Popen(['pgrep', '-a', 'babel'], stdout=subprocess.PIPE)
for p in (p for p in ps.communicate()[0].split('\n') if p):
if p.split('/',1)[0].split()[-1] in machines:
if hmac['babel_hmac0'] and not hmac['babel_hmac1']: # state = hmac0
if ('sign' not in p or
'accept' in p or
p.split('sign value ',1)[1].split()[0]\
!= hmac['babel_hmac0']):
rc = False
print 'HMAC config wrong for in %s' % p
if hmac['babel_hmac0']: # state = hmac0 and hmac1
sign = 'babel_hmac0'
accept = 'babel_hmac1'
else: # state = hmac1 and hmac2
sign = 'babel_hmac1'
accept = 'babel_hmac2'
if ('accept' not in p or
'sign' not in p or
p.split('sign value ',1)[1].split()[0] != hmac[sign] or
p.split('accept value ',1)[1].split()[0] != hmac[accept]):
rc = False
print 'HMAC config wrong in %s' % p
if rc:
print('All nodes use Babel with the correct HMAC configuration')
print('Correct config: %s' % hmac)
return rc
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment