blob: 6e5e506a7d9230b83f07e1e7525e15b589eefee1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
|
#!/usr/bin/env bash
set -e
gitroot=$(git rev-parse --show-toplevel)
cert_file=$gitroot/modules/http/test_tls/test.crt
key_file=$gitroot/modules/http/test_tls/test.key
tls_certificate_conf=$(cat <<EOF
{
"cert-file": "$cert_file",
"key-file": "$key_file"
}
EOF
)
# configure TLS certificate files
kresctl config set -p /network/tls "$tls_certificate_conf"
if [ "$?" -ne "0" ]; then
echo "Could not set TLS certificate files."
exit 1
fi
function count_errors(){
echo "$(journalctl -u knot-resolver.service | grep -c error)"
}
function count_reloads(){
echo "$(journalctl -u knot-resolver.service | grep -c "Reloading of TLS certificate files has finished")"
}
# test modification
# {{
# modify certificate files with '-', it will trigger reload
err_count=$(count_errors)
rel_count=$(count_reloads)
echo "-----------" >> $cert_file
echo "-----------" >> $key_file
# wait for files reload to finish
sleep 6
if [ $(count_errors) -ne $err_count ] || [ $(count_reloads) -eq $rel_count ]; then
echo "Could not reload modified TLS certificate files."
exit 1
fi
# }}
# test replacement
# {{
rel_count=$(count_reloads)
# copy cert files
cp $cert_file test.crt.new
cp $key_file test.key.new
# edit new files
echo "-----------" >> test.crt.new
echo "-----------" >> test.key.new
# replace files
mv -f test.crt.new $cert_file
mv -f test.key.new $key_file
# wait for files reload to finish
sleep 6
if [ $(count_errors) -ne $err_count ] || [ $(count_reloads) -eq $rel_count ]; then
echo "Could not reload replaced TLS certificate files."
exit 1
fi
# }}
# test recovery from deletion and creation
# {{
rel_count=$(count_reloads)
# backup cert files
cp $cert_file test.crt.backup
cp $key_file test.key.backup
# delete cert files
rm $cert_file $key_file
# create cert files
mv test.crt.backup $cert_file
mv test.key.backup $key_file
# wait for files reload to finish
sleep 6
if [ $(count_errors) -ne $err_count ] || [ $(count_reloads) -eq $rel_count ]; then
echo "Could not reload created TLS certificate files."
exit 1
fi
# }}
|
