ocserv: T4231: Added OTP support for Openconnect 2FA

4 files changed, 85 insertions, 7 deletions

diff --git a/smoketest/scripts/cli/test_protocols_bgp.py b/smoketest/scripts/cli/test_protocols_bgp.py
index d7230baf4..db1587ba7 100755
--- a/smoketest/scripts/cli/test_protocols_bgp.py
+++ b/smoketest/scripts/cli/test_protocols_bgp.py
@@ -274,6 +274,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.cli_set(base_path + ['parameters', 'conditional-advertisement', 'timer', cond_adv_timer])
         self.cli_set(base_path + ['parameters', 'fast-convergence'])
         self.cli_set(base_path + ['parameters', 'minimum-holdtime', min_hold_time])
+        self.cli_set(base_path + ['parameters', 'no-suppress-duplicates'])
         self.cli_set(base_path + ['parameters', 'reject-as-sets'])
         self.cli_set(base_path + ['parameters', 'shutdown'])
         self.cli_set(base_path + ['parameters', 'suppress-fib-pending'])
@@ -305,6 +306,7 @@ class TestProtocolsBGP(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f' bgp shutdown', frrconfig)
         self.assertIn(f' bgp suppress-fib-pending', frrconfig)
         self.assertNotIn(f'bgp ebgp-requires-policy', frrconfig)
+        self.assertIn(f' no bgp suppress-duplicates', frrconfig)
 
         afiv4_config = self.getFRRconfig(' address-family ipv4 unicast')
         self.assertIn(f'  maximum-paths {max_path_v4}', afiv4_config)
diff --git a/smoketest/scripts/cli/test_system_ipv6.py b/smoketest/scripts/cli/test_system_ipv6.py
index 3112d2e46..837d1dc12 100755
--- a/smoketest/scripts/cli/test_system_ipv6.py
+++ b/smoketest/scripts/cli/test_system_ipv6.py
@@ -17,7 +17,12 @@
 import unittest
 
 from base_vyostest_shim import VyOSUnitTestSHIM
+
+from vyos.template import is_ipv4
 from vyos.util import read_file
+from vyos.util import is_ipv6_enabled
+from vyos.util import get_interface_config
+from vyos.validate import is_intf_addr_assigned
 
 base_path = ['system', 'ipv6']
 
@@ -42,6 +47,14 @@ class TestSystemIPv6(VyOSUnitTestSHIM.TestCase):
         self.assertEqual(read_file(file_forwarding), '0')
 
     def test_system_ipv6_disable(self):
+        # Verify previous "enable" state
+        self.assertEqual(read_file(file_disable), '0')
+        self.assertTrue(is_ipv6_enabled())
+
+        loopbacks = ['127.0.0.1', '::1']
+        for addr in loopbacks:
+            self.assertTrue(is_intf_addr_assigned('lo', addr))
+
         # Do not assign any IPv6 address on interfaces, this requires a reboot
         # which can not be tested, but we can read the config file :)
         self.cli_set(base_path + ['disable'])
@@ -49,6 +62,24 @@ class TestSystemIPv6(VyOSUnitTestSHIM.TestCase):
 
         # Verify configuration file
         self.assertEqual(read_file(file_disable), '1')
+        self.assertFalse(is_ipv6_enabled())
+
+        for addr in loopbacks:
+            if is_ipv4(addr):
+                self.assertTrue(is_intf_addr_assigned('lo', addr))
+            else:
+                self.assertFalse(is_intf_addr_assigned('lo', addr))
+
+        # T4330: Verify MTU can be changed with IPv6 disabled
+        mtu = '1600'
+        eth_if = 'eth0'
+        self.cli_set(['interfaces', 'ethernet', eth_if, 'mtu', mtu])
+        self.cli_commit()
+
+        tmp = get_interface_config(eth_if)
+        self.assertEqual(tmp['mtu'], int(mtu))
+
+        self.cli_delete(['interfaces', 'ethernet', eth_if, 'mtu'])
 
     def test_system_ipv6_strict_dad(self):
         # This defaults to 1
diff --git a/smoketest/scripts/cli/test_vpn_openconnect.py b/smoketest/scripts/cli/test_vpn_openconnect.py
index b0e859b5c..1f2c36f0d 100755
--- a/smoketest/scripts/cli/test_vpn_openconnect.py
+++ b/smoketest/scripts/cli/test_vpn_openconnect.py
@@ -37,6 +37,8 @@ class TestVpnOpenconnect(VyOSUnitTestSHIM.TestCase):
     def test_vpn(self):
         user = 'vyos_user'
         password = 'vyos_pass'
+        otp = '37500000026900000000200000000000'
+
         self.cli_delete(pki_path)
         self.cli_delete(base_path)
 
@@ -45,7 +47,8 @@ class TestVpnOpenconnect(VyOSUnitTestSHIM.TestCase):
         self.cli_set(pki_path + ['certificate', 'openconnect', 'private', 'key', key_data])
 
         self.cli_set(base_path + ["authentication", "local-users", "username", user, "password", password])
-        self.cli_set(base_path + ["authentication", "mode", "local"])
+        self.cli_set(base_path + ["authentication", "local-users", "username", user, "otp", "key", otp])
+        self.cli_set(base_path + ["authentication", "mode", "local", "password-otp"])
         self.cli_set(base_path + ["network-settings", "client-ip-settings", "subnet", "192.0.2.0/24"])
         self.cli_set(base_path + ["ssl", "ca-certificate", 'openconnect'])
         self.cli_set(base_path + ["ssl", "certificate", 'openconnect'])
diff --git a/smoketest/scripts/cli/test_vrf.py b/smoketest/scripts/cli/test_vrf.py
index 5ffa9c086..5daea589c 100755
--- a/smoketest/scripts/cli/test_vrf.py
+++ b/smoketest/scripts/cli/test_vrf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
+# Copyright (C) 2020-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -25,9 +25,10 @@ from base_vyostest_shim import VyOSUnitTestSHIM
 from vyos.configsession import ConfigSessionError
 from vyos.ifconfig import Interface
 from vyos.ifconfig import Section
-from vyos.template import is_ipv6
+from vyos.template import is_ipv4
 from vyos.util import cmd
 from vyos.util import read_file
+from vyos.util import get_interface_config
 from vyos.validate import is_intf_addr_assigned
 
 base_path = ['vrf']
@@ -105,10 +106,13 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
             frrconfig = self.getFRRconfig(f'vrf {vrf}')
             self.assertIn(f' vni {table}', frrconfig)
 
+            tmp = get_interface_config(vrf)
+            self.assertEqual(int(table), tmp['linkinfo']['info_data']['table'])
+
             # Increment table ID for the next run
             table = str(int(table) + 1)
 
-    def test_vrf_loopback_ips(self):
+    def test_vrf_loopbacks_ips(self):
         table = '2000'
         for vrf in vrfs:
             base = base_path + ['name', vrf]
@@ -119,10 +123,48 @@ class VRFTest(VyOSUnitTestSHIM.TestCase):
         self.cli_commit()
 
         # Verify VRF configuration
+        loopbacks = ['127.0.0.1', '::1']
         for vrf in vrfs:
-            self.assertTrue(vrf in interfaces())
-            self.assertTrue(is_intf_addr_assigned(vrf, '127.0.0.1'))
-            self.assertTrue(is_intf_addr_assigned(vrf, '::1'))
+            # Ensure VRF was created
+            self.assertIn(vrf, interfaces())
+            # Test for proper loopback IP assignment
+            for addr in loopbacks:
+                self.assertTrue(is_intf_addr_assigned(vrf, addr))
+
+    def test_vrf_loopbacks_no_ipv6(self):
+        table = '2002'
+        for vrf in vrfs:
+            base = base_path + ['name', vrf]
+            self.cli_set(base + ['table', str(table)])
+            table = str(int(table) + 1)
+
+        # Globally disable IPv6 - this will remove all IPv6 interface addresses
+        self.cli_set(['system', 'ipv6', 'disable'])
+
+        # commit changes
+        self.cli_commit()
+
+        # Verify VRF configuration
+        table = '2002'
+        loopbacks = ['127.0.0.1', '::1']
+        for vrf in vrfs:
+            # Ensure VRF was created
+            self.assertIn(vrf, interfaces())
+
+            # Verify VRF table ID
+            tmp = get_interface_config(vrf)
+            self.assertEqual(int(table), tmp['linkinfo']['info_data']['table'])
+
+            # Test for proper loopback IP assignment
+            for addr in loopbacks:
+                if is_ipv4(addr):
+                    self.assertTrue(is_intf_addr_assigned(vrf, addr))
+                else:
+                    self.assertFalse(is_intf_addr_assigned(vrf, addr))
+
+            table = str(int(table) + 1)
+
+        self.cli_delete(['system', 'ipv6'])
 
     def test_vrf_bind_all(self):
         table = '2000'