summaryrefslogtreecommitdiff
path: root/smoketest
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2021-07-01 21:42:44 +0200
committerChristian Poessinger <christian@poessinger.com>2021-07-02 18:15:59 +0200
commit7f97e165a8f3ece96943a7656c88c1d1fc562d42 (patch)
treec2e1522f3f5e8adae2809b60a36e48f0d6bb080b /smoketest
parent15d8cc3ad93b69bcda98c8644a6e10e02cbeaf44 (diff)
downloadvyos-1x-7f97e165a8f3ece96943a7656c88c1d1fc562d42.tar.gz
vyos-1x-7f97e165a8f3ece96943a7656c88c1d1fc562d42.zip
smoketest: ipsec: IKE and ESP settings can be done one time in setUp()
Diffstat (limited to 'smoketest')
-rwxr-xr-xsmoketest/scripts/cli/test_vpn_ipsec.py99
1 files changed, 37 insertions, 62 deletions
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index fee4d6ade..ec1c2765e 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -41,7 +41,17 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
def setUp(self):
self.cli_set(base_path + ['ipsec-interfaces', 'interface', f'{interface}.{vif}'])
+ # Set IKE/ESP Groups
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes128'])
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha1'])
+ self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '2'])
+ self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes128'])
+ self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha1'])
+
def tearDown(self):
+ # Check for running process
+ self.assertTrue(process_named_running('charon'))
+
self.cli_delete(base_path)
self.cli_delete(nhrp_path)
self.cli_delete(tunnel_path)
@@ -49,17 +59,13 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
self.cli_delete(ethernet_path)
self.cli_commit()
- def test_dhcp_fail_handling(self):
+ # Check for no longer running process
+ self.assertFalse(process_named_running('charon'))
+
+ def test_01_dhcp_fail_handling(self):
# Interface for dhcp-interface
self.cli_set(ethernet_path + [interface, 'vif', vif, 'address', 'dhcp']) # Use VLAN to avoid getting IP from qemu dhcp server
- # Set IKE/ESP Groups
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha1'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '2'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha1'])
-
# Site to site
peer_base_path = base_path + ['site-to-site', 'peer', peer_ip]
self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
@@ -76,17 +82,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
dhcp_waiting = read_file(dhcp_waiting_file)
self.assertIn(f'{interface}.{vif}', dhcp_waiting) # Ensure dhcp-failed interface was added for dhclient hook
- self.assertTrue(process_named_running('charon')) # Commit should've still succeeded and launched charon
-
- def test_site_to_site(self):
- self.cli_delete(base_path)
-
- # IKE/ESP Groups
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha1'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '2'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha1'])
+ def test_02_site_to_site(self):
self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2'])
# Site to site
@@ -106,6 +102,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
self.cli_commit()
+ # Verify strongSwan configuration
+ swanctl_conf = read_file(swanctl_file)
swanctl_conf_lines = [
f'version = 2',
f'auth = psk',
@@ -117,36 +115,23 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
f'local_ts = 172.16.10.0/24[tcp/443],172.16.11.0/24[tcp/443]',
f'remote_ts = 172.17.10.0/24[tcp/443],172.17.11.0/24[tcp/443]'
]
+ for line in swanctl_conf_lines:
+ self.assertIn(line, swanctl_conf)
swanctl_secrets_lines = [
f'id-local = 192.0.2.10 # dhcp:no',
f'id-remote = {peer_ip}',
f'secret = "{secret}"'
]
-
- tmp_swanctl_conf = read_file(swanctl_file)
-
- for line in swanctl_conf_lines:
- self.assertIn(line, tmp_swanctl_conf)
-
for line in swanctl_secrets_lines:
- self.assertIn(line, tmp_swanctl_conf)
+ self.assertIn(line, swanctl_conf)
- # Check for running process
- self.assertTrue(process_named_running('charon'))
-
- def test_site_to_site_vti(self):
- vti = 'vti10'
+ def test_03_site_to_site_vti(self):
# VTI interface
+ vti = 'vti10'
self.cli_set(vti_path + [vti, 'address', '10.1.1.1/24'])
- # IKE/ESP Groups
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha1'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '2'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes128'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha1'])
self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev2'])
# Site to site
@@ -165,6 +150,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
self.cli_commit()
+ swanctl_conf = read_file(swanctl_file)
swanctl_conf_lines = [
f'version = 2',
f'auth = psk',
@@ -179,25 +165,19 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
f'if_id_out = {vti.lstrip("vti")}',
f'updown = "/etc/ipsec.d/vti-up-down {vti} no"'
]
+ for line in swanctl_conf_lines:
+ self.assertIn(line, swanctl_conf)
swanctl_secrets_lines = [
f'id-local = 192.0.2.10 # dhcp:no',
f'id-remote = {peer_ip}',
f'secret = "{secret}"'
]
-
- tmp_swanctl_conf = read_file(swanctl_file)
-
- for line in swanctl_conf_lines:
- self.assertIn(line, tmp_swanctl_conf)
-
for line in swanctl_secrets_lines:
- self.assertIn(line, tmp_swanctl_conf)
+ self.assertIn(line, swanctl_conf)
- # Check for running process
- self.assertTrue(process_named_running('charon'))
- def test_dmvpn(self):
+ def test_04_dmvpn(self):
tunnel_if = 'tun100'
nhrp_secret = 'secret'
@@ -220,18 +200,16 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
self.cli_set(base_path + ['esp-group', esp_group, 'lifetime', '1800'])
self.cli_set(base_path + ['esp-group', esp_group, 'mode', 'transport'])
self.cli_set(base_path + ['esp-group', esp_group, 'pfs', 'dh-group2'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'encryption', 'aes256'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '1', 'hash', 'sha1'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '2', 'encryption', '3des'])
- self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '2', 'hash', 'md5'])
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '2', 'encryption', 'aes256'])
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '2', 'hash', 'sha1'])
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '3', 'encryption', '3des'])
+ self.cli_set(base_path + ['esp-group', esp_group, 'proposal', '3', 'hash', 'md5'])
+
self.cli_set(base_path + ['ike-group', ike_group, 'ikev2-reauth', 'no'])
self.cli_set(base_path + ['ike-group', ike_group, 'key-exchange', 'ikev1'])
self.cli_set(base_path + ['ike-group', ike_group, 'lifetime', '3600'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'dh-group', '2'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'encryption', 'aes256'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '1', 'hash', 'sha1'])
self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '2', 'dh-group', '2'])
- self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '2', 'encryption', 'aes128'])
+ self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '2', 'encryption', 'aes256'])
self.cli_set(base_path + ['ike-group', ike_group, 'proposal', '2', 'hash', 'sha1'])
# Profile
@@ -243,23 +221,20 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
self.cli_commit()
+ swanctl_conf = read_file(swanctl_file)
swanctl_lines = [
- f'proposals = aes256-sha1-modp1024,aes128-sha1-modp1024',
+ f'proposals = aes128-sha1-modp1024,aes256-sha1-modp1024',
f'version = 1',
f'rekey_time = 3600s',
- f'esp_proposals = aes256-sha1-modp1024,3des-md5-modp1024',
+ f'esp_proposals = aes128-sha1-modp1024,aes256-sha1-modp1024,3des-md5-modp1024',
f'local_ts = dynamic[gre]',
f'remote_ts = dynamic[gre]',
f'mode = transport',
f'secret = {nhrp_secret}'
]
-
- tmp_swanctl_conf = read_file('/etc/swanctl/swanctl.conf')
-
for line in swanctl_lines:
- self.assertIn(line, tmp_swanctl_conf)
+ self.assertIn(line, swanctl_conf)
- self.assertTrue(process_named_running('charon'))
if __name__ == '__main__':
unittest.main(verbosity=2)