T4758: Fix conflicts op-mode-standardized

6 files changed, 141 insertions, 16 deletions

diff --git a/smoketest/scripts/cli/test_component_version.py b/smoketest/scripts/cli/test_component_version.py
index 1355c1f94..7b1b12c53 100755
--- a/smoketest/scripts/cli/test_component_version.py
+++ b/smoketest/scripts/cli/test_component_version.py
@@ -16,7 +16,7 @@
 
 import unittest
 
-from vyos.systemversions import get_system_versions, get_system_component_version
+import vyos.component_version as component_version
 
 # After T3474, component versions should be updated in the files in
 # vyos-1x/interface-definitions/include/version/
@@ -24,8 +24,8 @@ from vyos.systemversions import get_system_versions, get_system_component_versio
 # that in the xml cache.
 class TestComponentVersion(unittest.TestCase):
     def setUp(self):
-        self.legacy_d = get_system_versions()
-        self.xml_d = get_system_component_version()
+        self.legacy_d = component_version.legacy_from_system()
+        self.xml_d = component_version.from_system()
         self.set_legacy_d = set(self.legacy_d)
         self.set_xml_d = set(self.xml_d)
 
diff --git a/smoketest/scripts/cli/test_container.py b/smoketest/scripts/cli/test_container.py
index cc0cdaec0..b9d308ae1 100644..100755
--- a/smoketest/scripts/cli/test_container.py
+++ b/smoketest/scripts/cli/test_container.py
@@ -15,6 +15,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import unittest
+import glob
 import json
 
 from base_vyostest_shim import VyOSUnitTestSHIM
@@ -25,10 +26,13 @@ from vyos.util import process_named_running
 from vyos.util import read_file
 
 base_path = ['container']
-cont_image = 'busybox'
+cont_image = 'busybox:stable' # busybox is included in vyos-build
 prefix = '192.168.205.0/24'
 net_name = 'NET01'
-PROCESS_NAME = 'podman'
+PROCESS_NAME = 'conmon'
+PROCESS_PIDFILE = '/run/vyos-container-{0}.service.pid'
+
+busybox_image_path = '/usr/share/vyos/busybox-stable.tar'
 
 def cmd_to_json(command):
     c = cmd(command + ' --format=json')
@@ -37,7 +41,31 @@ def cmd_to_json(command):
     return data
 
 
-class TesContainer(VyOSUnitTestSHIM.TestCase):
+class TestContainer(VyOSUnitTestSHIM.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        super(TestContainer, cls).setUpClass()
+
+        # Load image for smoketest provided in vyos-build
+        cmd(f'cat {busybox_image_path} | sudo podman load')
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestContainer, cls).tearDownClass()
+
+        # Cleanup podman image
+        cmd(f'sudo podman image rm -f {cont_image}')
+
+    def tearDown(self):
+        self.cli_delete(base_path)
+        self.cli_commit()
+
+        # Ensure no container process remains
+        self.assertIsNone(process_named_running(PROCESS_NAME))
+
+        # Ensure systemd units are removed
+        units = glob.glob('/run/systemd/system/vyos-container-*')
+        self.assertEqual(units, [])
 
     def test_01_basic_container(self):
         cont_name = 'c1'
@@ -53,13 +81,17 @@ class TesContainer(VyOSUnitTestSHIM.TestCase):
         # commit changes
         self.cli_commit()
 
+        pid = 0
+        with open(PROCESS_PIDFILE.format(cont_name), 'r') as f:
+            pid = int(f.read())
+
         # Check for running process
-        self.assertTrue(process_named_running(PROCESS_NAME))
+        self.assertEqual(process_named_running(PROCESS_NAME), pid)
 
     def test_02_container_network(self):
         cont_name = 'c2'
         cont_ip = '192.168.205.25'
-        self.cli_set(base_path + ['network', net_name, 'ipv4-prefix', prefix])
+        self.cli_set(base_path + ['network', net_name, 'prefix', prefix])
         self.cli_set(base_path + ['name', cont_name, 'image', cont_image])
         self.cli_set(base_path + ['name', cont_name, 'network', net_name, 'address', cont_ip])
 
@@ -67,7 +99,7 @@ class TesContainer(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         n = cmd_to_json(f'sudo podman network inspect {net_name}')
-        json_subnet = n['plugins'][0]['ipam']['ranges'][0][0]['subnet']
+        json_subnet = n['subnets'][0]['subnet']
 
         c = cmd_to_json(f'sudo podman container inspect {cont_name}')
         json_ip = c['NetworkSettings']['Networks'][net_name]['IPAddress']
diff --git a/smoketest/scripts/cli/test_interfaces_wireguard.py b/smoketest/scripts/cli/test_interfaces_wireguard.py
index f3e9670f7..14fc8d109 100755
--- a/smoketest/scripts/cli/test_interfaces_wireguard.py
+++ b/smoketest/scripts/cli/test_interfaces_wireguard.py
@@ -62,10 +62,10 @@ class WireGuardInterfaceTest(VyOSUnitTestSHIM.TestCase):
 
             self.assertTrue(os.path.isdir(f'/sys/class/net/{intf}'))
 
-
     def test_wireguard_add_remove_peer(self):
         # T2939: Create WireGuard interfaces with associated peers.
         # Remove one of the configured peers.
+        # T4774: Test prevention of duplicate peer public keys
         interface = 'wg0'
         port = '12345'
         privkey = '6ISOkASm6VhHOOSz/5iIxw+Q9adq9zA17iMM4X40dlc='
@@ -80,11 +80,17 @@ class WireGuardInterfaceTest(VyOSUnitTestSHIM.TestCase):
         self.cli_set(base_path + [interface, 'peer', 'PEER01', 'allowed-ips', '10.205.212.10/32'])
         self.cli_set(base_path + [interface, 'peer', 'PEER01', 'address', '192.0.2.1'])
 
-        self.cli_set(base_path + [interface, 'peer', 'PEER02', 'public-key', pubkey_2])
+        self.cli_set(base_path + [interface, 'peer', 'PEER02', 'public-key', pubkey_1])
         self.cli_set(base_path + [interface, 'peer', 'PEER02', 'port', port])
         self.cli_set(base_path + [interface, 'peer', 'PEER02', 'allowed-ips', '10.205.212.11/32'])
         self.cli_set(base_path + [interface, 'peer', 'PEER02', 'address', '192.0.2.2'])
 
+        # Duplicate pubkey_1
+        with self.assertRaises(ConfigSessionError):
+            self.cli_commit()
+
+        self.cli_set(base_path + [interface, 'peer', 'PEER02', 'public-key', pubkey_2])
+
         # Commit peers
         self.cli_commit()
 
diff --git a/smoketest/scripts/cli/test_nat.py b/smoketest/scripts/cli/test_nat.py
index f824838c0..2ae90fcaf 100755
--- a/smoketest/scripts/cli/test_nat.py
+++ b/smoketest/scripts/cli/test_nat.py
@@ -16,6 +16,7 @@
 
 import jmespath
 import json
+import os
 import unittest
 
 from base_vyostest_shim import VyOSUnitTestSHIM
@@ -28,6 +29,9 @@ src_path = base_path + ['source']
 dst_path = base_path + ['destination']
 static_path = base_path + ['static']
 
+nftables_nat_config = '/run/nftables_nat.conf'
+nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft'
+
 class TestNAT(VyOSUnitTestSHIM.TestCase):
     @classmethod
     def setUpClass(cls):
@@ -40,6 +44,8 @@ class TestNAT(VyOSUnitTestSHIM.TestCase):
     def tearDown(self):
         self.cli_delete(base_path)
         self.cli_commit()
+        self.assertFalse(os.path.exists(nftables_nat_config))
+        self.assertFalse(os.path.exists(nftables_static_nat_conf))
 
     def verify_nftables(self, nftables_search, table, inverse=False, args=''):
         nftables_output = cmd(f'sudo nft {args} list table {table}')
diff --git a/smoketest/scripts/cli/test_service_https.py b/smoketest/scripts/cli/test_service_https.py
index 72c1d4e43..0f4b1393c 100755
--- a/smoketest/scripts/cli/test_service_https.py
+++ b/smoketest/scripts/cli/test_service_https.py
@@ -143,10 +143,10 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase):
         # caught by the resolver, and returns success 'False', so one must
         # check the return value.
 
-        self.cli_set(base_path + ['api', 'gql'])
+        self.cli_set(base_path + ['api', 'graphql'])
         self.cli_commit()
 
-        gql_url = f'https://{address}/graphql'
+        graphql_url = f'https://{address}/graphql'
 
         query_valid_key = f"""
         {{
@@ -160,7 +160,7 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase):
         }}
         """
 
-        r = request('POST', gql_url, verify=False, headers=headers, json={'query': query_valid_key})
+        r = request('POST', graphql_url, verify=False, headers=headers, json={'query': query_valid_key})
         success = r.json()['data']['SystemStatus']['success']
         self.assertTrue(success)
 
@@ -176,7 +176,7 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase):
         }
         """
 
-        r = request('POST', gql_url, verify=False, headers=headers, json={'query': query_invalid_key})
+        r = request('POST', graphql_url, verify=False, headers=headers, json={'query': query_invalid_key})
         success = r.json()['data']['SystemStatus']['success']
         self.assertFalse(success)
 
@@ -192,8 +192,52 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase):
         }
         """
 
-        r = request('POST', gql_url, verify=False, headers=headers, json={'query': query_no_key})
+        r = request('POST', graphql_url, verify=False, headers=headers, json={'query': query_no_key})
         self.assertEqual(r.status_code, 400)
 
+        # GraphQL token authentication test: request token; pass in header
+        # of query.
+
+        self.cli_set(base_path + ['api', 'graphql', 'authentication', 'type', 'token'])
+        self.cli_commit()
+
+        mutation = """
+        mutation {
+          AuthToken (data: {username: "vyos", password: "vyos"}) {
+            success
+            errors
+            data {
+              result
+            }
+          }
+        }
+        """
+        r = request('POST', graphql_url, verify=False, headers=headers, json={'query': mutation})
+
+        token = r.json()['data']['AuthToken']['data']['result']['token']
+
+        headers = {'Authorization': f'Bearer {token}'}
+
+        query = """
+        {
+          ShowVersion (data: {}) {
+            success
+            errors
+            op_mode_error {
+              name
+              message
+              vyos_code
+            }
+            data {
+              result
+            }
+          }
+        }
+        """
+
+        r = request('POST', graphql_url, verify=False, headers=headers, json={'query': query})
+        success = r.json()['data']['ShowVersion']['success']
+        self.assertTrue(success)
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/smoketest/scripts/cli/test_service_ssh.py b/smoketest/scripts/cli/test_service_ssh.py
index 0b029dd00..8de98f34f 100755
--- a/smoketest/scripts/cli/test_service_ssh.py
+++ b/smoketest/scripts/cli/test_service_ssh.py
@@ -262,5 +262,42 @@ class TestServiceSSH(VyOSUnitTestSHIM.TestCase):
 
         self.assertFalse(process_named_running(SSHGUARD_PROCESS))
 
+
+    # Network Device Collaborative Protection Profile
+    def test_ssh_ndcpp(self):
+        ciphers = ['aes128-cbc', 'aes128-ctr', 'aes256-cbc', 'aes256-ctr']
+        host_key_algs = ['sk-ssh-ed25519@openssh.com', 'ssh-rsa', 'ssh-ed25519']
+        kexes = ['diffie-hellman-group14-sha1', 'ecdh-sha2-nistp256', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp521']
+        macs = ['hmac-sha1', 'hmac-sha2-256', 'hmac-sha2-512']
+        rekey_time = '60'
+        rekey_data = '1024'
+
+        for cipher in ciphers:
+            self.cli_set(base_path + ['ciphers', cipher])
+        for host_key in host_key_algs:
+            self.cli_set(base_path + ['hostkey-algorithm', host_key])
+        for kex in kexes:
+            self.cli_set(base_path + ['key-exchange', kex])
+        for mac in macs:
+            self.cli_set(base_path + ['mac', mac])
+        # Optional rekey parameters
+        self.cli_set(base_path + ['rekey', 'data', rekey_data])
+        self.cli_set(base_path + ['rekey', 'time', rekey_time])
+
+        # commit changes
+        self.cli_commit()
+
+        ssh_lines = ['Ciphers aes128-cbc,aes128-ctr,aes256-cbc,aes256-ctr',
+                     'HostKeyAlgorithms sk-ssh-ed25519@openssh.com,ssh-rsa,ssh-ed25519',
+                     'MACs hmac-sha1,hmac-sha2-256,hmac-sha2-512',
+                     'KexAlgorithms diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521',
+                     'RekeyLimit 1024M 60M'
+                     ]
+        tmp_sshd_conf = read_file(SSHD_CONF)
+
+        for line in ssh_lines:
+            self.assertIn(line, tmp_sshd_conf)
+
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)