diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-10-04 13:43:40 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-10-04 13:43:40 +0200 |
| commit | 43e9082419e88f59a804eae16e3fc4e848f40fbd (patch) | |
| tree | efab992f298e26dc2a731c3742a383b7fd138a37 /smoketest/scripts | |
| parent | a60cd03068db703d71988788d5486ac22b028d0a (diff) | |
| parent | 34bbc3be98d20b7ce704cc498f070e70bf8f0213 (diff) | |
| download | vyos-1x-43e9082419e88f59a804eae16e3fc4e848f40fbd.tar.gz vyos-1x-43e9082419e88f59a804eae16e3fc4e848f40fbd.zip | |
Merge pull request #4121 from natali-rs1985/T6101-current
ipsec: T6101: Add validation for proposal option used in IKE group
Diffstat (limited to 'smoketest/scripts')
| -rwxr-xr-x | smoketest/scripts/cli/test_vpn_ipsec.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py index 3b8687b93..de18d0427 100755 --- a/smoketest/scripts/cli/test_vpn_ipsec.py +++ b/smoketest/scripts/cli/test_vpn_ipsec.py @@ -947,7 +947,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.cli_set(base_path + ['ike-group', ike_group, 'lifetime', ike_lifetime]) self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '14']) self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes256']) - self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha512']) + # a hash algorithm that cannot be mapped to an equivalent PRF + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'aes192gmac']) # ESP self.cli_set(base_path + ['esp-group', esp_group, 'lifetime', eap_lifetime]) @@ -968,6 +969,11 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase): self.cli_set(base_path + ['remote-access', 'pool', ip_pool_name, 'name-server', name_server]) self.cli_set(base_path + ['remote-access', 'pool', ip_pool_name, 'prefix', prefix]) + # verify() - IKE group use not mapped hash algorithm + with self.assertRaises(ConfigSessionError): + self.cli_commit() + + self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha512']) self.cli_commit() self.assertTrue(os.path.exists(dhcp_interfaces_file)) |