From 417ba510e2229ede0a49c2e6e72a68183918067d Mon Sep 17 00:00:00 2001 From: Boris Glimcher Date: Thu, 13 Jun 2024 22:54:42 +0300 Subject: [PATCH] fix: switch agent to curl images And remove code dup Signed-off-by: Boris Glimcher --- scripts/tests.sh | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/scripts/tests.sh b/scripts/tests.sh index 8c264c0a..7229be99 100755 --- a/scripts/tests.sh +++ b/scripts/tests.sh @@ -33,17 +33,18 @@ CERTIFICATES=(--key /certs/private_key.pem --cert /certs/my_cert.pem --cacert /c SERIAL_NUMBER=third-serial-number SBI_CREDENTIALS=(--user "${SERIAL_NUMBER}":my-secret) NBI_CREDENTIALS=(--user my-admin@example.com:my-secret) +CURL=(docker run --rm --user 0 --network sztp_opi -v sztp_client-certs:/certs docker.io/curlimages/curl:8.5.0 --fail-with-body) # TODO: remove --insecure -docker-compose run -T agent curl --insecure --fail-with-body "${CERTIFICATES[@]}" --output /tmp/first-boot-image.tst "https://web:443/first-boot-image.img" -docker-compose run -T agent curl --insecure --fail-with-body "${CERTIFICATES[@]}" --output /tmp/second-boot-image.tst "https://web:443/second-boot-image.img" -docker-compose run -T agent curl --insecure --fail-with-body "${CERTIFICATES[@]}" --output /tmp/third-boot-image.tst "https://web:443/third-boot-image.img" +"${CURL[@]}" --insecure "${CERTIFICATES[@]}" --output /tmp/first-boot-image.tst "https://web:443/first-boot-image.img" +"${CURL[@]}" --insecure "${CERTIFICATES[@]}" --output /tmp/second-boot-image.tst "https://web:443/second-boot-image.img" +"${CURL[@]}" --insecure "${CERTIFICATES[@]}" --output /tmp/third-boot-image.tst "https://web:443/third-boot-image.img" # read back to check configuration was set docker-compose exec -T redirecter curl --include --fail "${NBI_CREDENTIALS[@]}" -H "Accept:application/yang-data+json" http://redirecter:7070/restconf/ds/ietf-datastores:running # request onboarding info (like a DPU or IPU device would) and see it is redirect -docker-compose run -T agent curl --request POST --fail-with-body --data '{"ietf-sztp-bootstrap-server:input":{"hw-model":"model-x","os-name":"vendor-os","os-version":"17.3R2.1","signed-data-preferred":[null],"nonce":"BASE64VALUE="}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${REDIRECT}" | tee /tmp/post_rpc_input.json +"${CURL[@]}" --request POST --data '{"ietf-sztp-bootstrap-server:input":{"hw-model":"model-x","os-name":"vendor-os","os-version":"17.3R2.1","signed-data-preferred":[null],"nonce":"BASE64VALUE="}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${REDIRECT}" | tee /tmp/post_rpc_input.json # parse the redirect reply jq -r .\"ietf-sztp-bootstrap-server:output\".\"conveyed-information\" /tmp/post_rpc_input.json | base64 --decode | tail -n +2 | sed '1i {' | jq . | tee /tmp/post_rpc_fixed.json @@ -58,13 +59,13 @@ BOOTSTRAP="${REDIRECT//redirecter:8080/$addr:$port}" docker-compose exec -T bootstrap curl --include --fail "${NBI_CREDENTIALS[@]}" -H "Accept:application/yang-data+json" http://bootstrap:7080/restconf/ds/ietf-datastores:running # request onboarding info (like a DPU or IPU device would) -docker-compose run -T agent curl --request POST --fail-with-body --data '{"ietf-sztp-bootstrap-server:input":{"hw-model":"model-x","os-name":"vendor-os","os-version":"17.3R2.1","signed-data-preferred":[null],"nonce":"BASE64VALUE="}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP}" | tee /tmp/post_rpc_input.json +"${CURL[@]}" --request POST --data '{"ietf-sztp-bootstrap-server:input":{"hw-model":"model-x","os-name":"vendor-os","os-version":"17.3R2.1","signed-data-preferred":[null],"nonce":"BASE64VALUE="}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP}" | tee /tmp/post_rpc_input.json # parse the reply jq -r .\"ietf-sztp-bootstrap-server:output\".\"conveyed-information\" /tmp/post_rpc_input.json | base64 --decode | tail -n +2 | sed '1i {' | jq . | tee /tmp/post_rpc_fixed.json # send progress -docker-compose run -T agent curl --request POST --fail-with-body --data '{"ietf-sztp-bootstrap-server:input":{"progress-type":"bootstrap-initiated","message":"message sent via JSON"}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP//get-bootstrapping-data/report-progress}" +"${CURL[@]}" --request POST --data '{"ietf-sztp-bootstrap-server:input":{"progress-type":"bootstrap-initiated","message":"message sent via JSON"}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP//get-bootstrapping-data/report-progress}" # check audit log docker-compose exec -T bootstrap curl --include --fail -X GET "${NBI_CREDENTIALS[@]}" -H "Accept:application/yang-data+json" http://bootstrap:7080/restconf/ds/ietf-datastores:operational/wn-sztpd-1:audit-log @@ -90,14 +91,14 @@ jq -r .\"ietf-sztp-conveyed-info:onboarding-information\".\"boot-image\".\"image # actually go and download the image from the web server URL=$(jq -r .\"ietf-sztp-conveyed-info:onboarding-information\".\"boot-image\".\"download-uri\"[0] /tmp/post_rpc_fixed.json) BASENAME=$(basename "${URL}") -docker-compose run -T agent curl --insecure --fail-with-body "${CERTIFICATES[@]}" --output "/tmp/${BASENAME}" "${URL}" +"${CURL[@]}" --insecure "${CERTIFICATES[@]}" --output "/tmp/${BASENAME}" "${URL}" # Validate signature SIGNATURE=$(docker-compose run -T agent ash -c "openssl dgst -sha256 -c \"/tmp/${BASENAME}\" | awk '{print \$2}'") jq -r .\"ietf-sztp-conveyed-info:onboarding-information\".\"boot-image\".\"image-verification\"[] /tmp/post_rpc_fixed.json | grep "${SIGNATURE}" # send progress -docker-compose run -T agent curl --request POST --fail-with-body --data '{"ietf-sztp-bootstrap-server:input":{"progress-type":"bootstrap-complete","message":"message sent via JSON"}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP//get-bootstrapping-data/report-progress}" +"${CURL[@]}" --request POST --data '{"ietf-sztp-bootstrap-server:input":{"progress-type":"bootstrap-complete","message":"message sent via JSON"}}' -H "Content-Type:application/yang-data+json" "${SBI_CREDENTIALS[@]}" "${CERTIFICATES[@]}" "${BOOTSTRAP//get-bootstrapping-data/report-progress}" # print for debug docker-compose ps