| # Licensed to the Apache Software Foundation (ASF) under one | |
| # or more contributor license agreements. See the NOTICE file | |
| # distributed with this work for additional information | |
| # regarding copyright ownership. The ASF licenses this file | |
| # to you under the Apache License, Version 2.0 (the | |
| # "License"); you may not use this file except in compliance | |
| # with the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, | |
| # software distributed under the License is distributed on an | |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| # KIND, either express or implied. See the License for the | |
| # specific language governing permissions and limitations | |
| # under the License. | |
| """ P1 for Egresss & Ingress rules | |
| """ | |
| #Import Local Modules | |
| from nose.plugins.attrib import attr | |
| from marvin.cloudstackTestCase import cloudstackTestCase | |
| from marvin.lib.utils import (random_gen, | |
| cleanup_resources) | |
| from marvin.lib.base import (SecurityGroup, | |
| VirtualMachine, | |
| Account, | |
| ServiceOffering) | |
| from marvin.lib.common import (get_domain, | |
| get_zone, | |
| get_template, | |
| list_virtual_machines) | |
| class Services: | |
| """Test Security groups Services | |
| """ | |
| def __init__(self): | |
| self.services = { | |
| "disk_offering": { | |
| "displaytext": "Small", | |
| "name": "Small", | |
| "disksize": 1 | |
| }, | |
| "account": { | |
| "email": "test@test.com", | |
| "firstname": "Test", | |
| "lastname": "User", | |
| "username": "test", | |
| # Random characters are appended in create account to | |
| # ensure unique username generated each time | |
| "password": "password", | |
| }, | |
| "virtual_machine": { | |
| # Create a small virtual machine instance with disk offering | |
| "displayname": "Test VM", | |
| "username": "root", # VM creds for SSH | |
| "password": "password", | |
| "ssh_port": 22, | |
| "hypervisor": 'XenServer', | |
| "privateport": 22, | |
| "publicport": 22, | |
| "protocol": 'TCP', | |
| "userdata": 'This is sample data', | |
| }, | |
| "service_offering": { | |
| "name": "Tiny Instance", | |
| "displaytext": "Tiny Instance", | |
| "cpunumber": 1, | |
| "cpuspeed": 100, # in MHz | |
| "memory": 128, # In MBs | |
| }, | |
| "security_group": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": 22, | |
| "endport": 22, | |
| "cidrlist": '0.0.0.0/0', | |
| }, | |
| "egress_icmp": { | |
| "protocol": 'ICMP', | |
| "icmptype": '-1', | |
| "icmpcode": '-1', | |
| "cidrlist": '0.0.0.0/0', | |
| }, | |
| "sg_invalid_port": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": -22, | |
| "endport": -22, | |
| "cidrlist": '0.0.0.0/0', | |
| }, | |
| "sg_invalid_cidr": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": 22, | |
| "endport": 22, | |
| "cidrlist": '0.0.0.10' | |
| }, | |
| "sg_cidr_anywhere": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": 22, | |
| "endport": 22, | |
| "cidrlist": '0.0.0.0/0' | |
| }, | |
| "sg_cidr_restricted": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": 22, | |
| "endport": 22, | |
| "cidrlist": '10.0.0.1/24', | |
| }, | |
| "sg_account": { | |
| "name": 'SSH', | |
| "protocol": 'TCP', | |
| "startport": 22, | |
| "endport": 22, | |
| "cidrlist": '0.0.0.0/0' | |
| }, | |
| "mgmt_server": { | |
| "username": "root", | |
| "password": "password", | |
| "ipaddress": "192.168.100.21" | |
| }, | |
| "ostype": 'CentOS 5.3 (64-bit)', | |
| # CentOS 5.3 (64-bit) | |
| "sleep": 60, | |
| "timeout": 10, | |
| } | |
| class TestDefaultSecurityGroupEgress(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestDefaultSecurityGroupEgress, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| admin=True, | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_deployVM_InDefaultSecurityGroup(self): | |
| """Test deploy VM in default security group with no egress rules | |
| """ | |
| # Validate the following: | |
| # 1. Deploy a VM. | |
| # 2. Deployed VM should be running, verify with listVirtualMachiens | |
| # 3. listSecurityGroups for this account. should list the default | |
| # security group with no egress rules | |
| # 4. listVirtualMachines should show that the VM belongs to default | |
| # security group | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id | |
| ) | |
| self.debug("Deployed VM with ID: %s" % self.virtual_machine.id) | |
| self.cleanup.append(self.virtual_machine) | |
| list_vm_response = list_virtual_machines( | |
| self.apiclient, | |
| id=self.virtual_machine.id | |
| ) | |
| self.debug( | |
| "Verify listVirtualMachines response for virtual machine: %s" \ | |
| % self.virtual_machine.id | |
| ) | |
| self.assertEqual( | |
| isinstance(list_vm_response, list), | |
| True, | |
| "Check for list VM response" | |
| ) | |
| vm_response = list_vm_response[0] | |
| self.assertNotEqual( | |
| len(list_vm_response), | |
| 0, | |
| "Check VM available in List Virtual Machines" | |
| ) | |
| self.assertEqual( | |
| vm_response.id, | |
| self.virtual_machine.id, | |
| "Check virtual machine id in listVirtualMachines" | |
| ) | |
| self.assertEqual( | |
| vm_response.state, | |
| 'Running', | |
| "VM state should be running" | |
| ) | |
| self.assertEqual( | |
| hasattr(vm_response, "securitygroup"), | |
| True, | |
| "List VM response should have at least one security group" | |
| ) | |
| # Verify listSecurity groups response | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 1, | |
| "Check List Security groups response" | |
| ) | |
| self.debug("List Security groups response: %s" % | |
| str(security_groups)) | |
| sec_grp = security_groups[0] | |
| self.assertEqual( | |
| sec_grp.name, | |
| 'default', | |
| "List Sec Group should only list default sec. group" | |
| ) | |
| return | |
| class TestAuthorizeIngressRule(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestAuthorizeIngressRule, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_authorizeIngressRule(self): | |
| """Test authorize ingress rule | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupIngress to allow ssh access to the VM | |
| # 4. deployVirtualMachine into this security group (ssh). deployed VM | |
| # should be Running | |
| # 5. listSecurityGroups should show two groups, default and ssh | |
| # 6. verify that ssh-access into the VM is now allowed | |
| # 7. verify from within the VM is able to ping outside world | |
| # (ping www.google.com) | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.debug("Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| ssh = self.virtual_machine.get_ssh_client() | |
| # Ping to outsite world | |
| res = ssh.execute("ping -c 1 www.google.com") | |
| # res = 64 bytes from maa03s17-in-f20.1e100.net (74.125.236.212): | |
| # icmp_req=1 ttl=57 time=25.9 ms | |
| # --- www.l.google.com ping statistics --- | |
| # 1 packets transmitted, 1 received, 0% packet loss, time 0ms | |
| # rtt min/avg/max/mdev = 25.970/25.970/25.970/0.000 ms | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertEqual( | |
| result.count("1 received"), | |
| 1, | |
| "Ping to outside world from VM should be successful" | |
| ) | |
| return | |
| class TestDefaultGroupEgress(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestDefaultGroupEgress, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_01_default_group_with_egress(self): | |
| """Test default group with egress rule before VM deploy and ping, ssh | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupIngress to allow ssh access to the VM | |
| # 4. authorizeSecurityGroupEgress to allow ssh access only out to | |
| # CIDR: 0.0.0.0/0 | |
| # 5. deployVirtualMachine into this security group (ssh) | |
| # 6. deployed VM should be Running, ssh should be allowed into the VM, | |
| # ping out to google.com from the VM should be successful, | |
| # ssh from within VM to mgt server should pass | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug("Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug("Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| egress_rule = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["egress_icmp"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| ssh = self.virtual_machine.get_ssh_client() | |
| self.debug("Ping to google.com from VM") | |
| # Ping to outsite world | |
| res = ssh.execute("ping -c 1 www.google.com") | |
| # res = 64 bytes from maa03s17-in-f20.1e100.net (74.125.236.212): | |
| # icmp_req=1 ttl=57 time=25.9 ms | |
| # --- www.l.google.com ping statistics --- | |
| # 1 packets transmitted, 1 received, 0% packet loss, time 0ms | |
| # rtt min/avg/max/mdev = 25.970/25.970/25.970/0.000 ms | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertEqual( | |
| result.count("1 received"), | |
| 1, | |
| "Ping to outside world from VM should be successful" | |
| ) | |
| try: | |
| self.debug("SSHing into management server from VM") | |
| res = ssh.execute("ssh %s@%s" % ( | |
| self.apiclient.connection.user, | |
| self.apiclient.connection.mgtSvr | |
| )) | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertNotEqual( | |
| result.count("No route to host"), | |
| 1, | |
| "SSH into management server from VM should be successful" | |
| ) | |
| return | |
| class TestDefaultGroupEgressAfterDeploy(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestDefaultGroupEgressAfterDeploy, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_01_default_group_with_egress(self): | |
| """ Test default group with egress rule added after vm deploy and ping, | |
| ssh test | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupIngress to allow ssh access to the VM | |
| # 4. deployVirtualMachine into this security group (ssh) | |
| # 5. authorizeSecurityGroupEgress to allow ssh access only out to | |
| # CIDR: 0.0.0.0/0 | |
| # 6. deployed VM should be Running, ssh should be allowed into the VM, | |
| # ping out to google.com from the VM should be successful | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug("Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| egress_rule = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["egress_icmp"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| ssh = self.virtual_machine.get_ssh_client() | |
| self.debug("Ping to google.com from VM") | |
| # Ping to outsite world | |
| res = ssh.execute("ping -c 1 www.google.com") | |
| # res = 64 bytes from maa03s17-in-f20.1e100.net (74.125.236.212): | |
| # icmp_req=1 ttl=57 time=25.9 ms | |
| # --- www.l.google.com ping statistics --- | |
| # 1 packets transmitted, 1 received, 0% packet loss, time 0ms | |
| # rtt min/avg/max/mdev = 25.970/25.970/25.970/0.000 ms | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertEqual( | |
| result.count("1 received"), | |
| 1, | |
| "Ping to outside world from VM should be successful" | |
| ) | |
| return | |
| class TestRevokeEgressRule(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestRevokeEgressRule, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_revoke_egress_rule(self): | |
| """Test revoke security group egress rule | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupIngress to allow ssh access to the VM | |
| # 4. authorizeSecurityGroupEgress to allow ssh access only out to | |
| # CIDR: 0.0.0.0/0 | |
| # 5. deployVirtualMachine into this security group (ssh) | |
| # 6. deployed VM should be Running, ssh should be allowed into the VM, | |
| # ping out to google.com from the VM should be successful, | |
| # ssh from within VM to mgt server should pass | |
| # 7. Revoke egress rule. Verify ping and SSH access to management server | |
| # is restored | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| # Authorize Security group to ping outside world | |
| self.debug( | |
| "Authorizing egress rule with ICMP protocol for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| egress_rule_icmp = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["egress_icmp"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule_icmp, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| ssh_egress_rule_icmp = (egress_rule_icmp["egressrule"][0]).__dict__ | |
| # Authorize Security group to SSH to other VM | |
| self.debug( | |
| "Authorizing egress rule with TCP protocol for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| egress_rule_tcp = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule_tcp, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| ssh_egress_rule_tcp = (egress_rule_tcp["egressrule"][0]).__dict__ | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| ssh = self.virtual_machine.get_ssh_client() | |
| self.debug("Ping to google.com from VM") | |
| # Ping to outsite world | |
| res = ssh.execute("ping -c 1 www.google.com") | |
| # res = 64 bytes from maa03s17-in-f20.1e100.net (74.125.236.212): | |
| # icmp_req=1 ttl=57 time=25.9 ms | |
| # --- www.l.google.com ping statistics --- | |
| # 1 packets transmitted, 1 received, 0% packet loss, time 0ms | |
| # rtt min/avg/max/mdev = 25.970/25.970/25.970/0.000 ms | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertEqual( | |
| result.count("1 received"), | |
| 1, | |
| "Ping to outside world from VM should be successful" | |
| ) | |
| try: | |
| self.debug("SSHing into management server from VM") | |
| res = ssh.execute("ssh %s@%s" % ( | |
| self.services["mgmt_server"]["username"], | |
| self.apiclient.connection.mgtSvr | |
| )) | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertNotEqual( | |
| result.count("No route to host"), | |
| 1, | |
| "SSH into management server from VM should be successful" | |
| ) | |
| self.debug( | |
| "Revoke Egress Rules for Security Group %s for account: %s" \ | |
| % ( | |
| security_group.id, | |
| self.account.name | |
| )) | |
| result = security_group.revokeEgress( | |
| self.apiclient, | |
| id=ssh_egress_rule_icmp["ruleid"] | |
| ) | |
| self.debug("Revoked egress rule result: %s" % result) | |
| result = security_group.revokeEgress( | |
| self.apiclient, | |
| id=ssh_egress_rule_tcp["ruleid"] | |
| ) | |
| self.debug("Revoked egress rule result: %s" % result) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| ssh = self.virtual_machine.get_ssh_client(reconnect=True) | |
| self.debug("Ping to google.com from VM") | |
| # Ping to outsite world | |
| res = ssh.execute("ping -c 1 www.google.com") | |
| # res = 64 bytes from maa03s17-in-f20.1e100.net (74.125.236.212): | |
| # icmp_req=1 ttl=57 time=25.9 ms | |
| # --- www.l.google.com ping statistics --- | |
| # 1 packets transmitted, 1 received, 0% packet loss, time 0ms | |
| # rtt min/avg/max/mdev = 25.970/25.970/25.970/0.000 ms | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertEqual( | |
| result.count("1 received"), | |
| 1, | |
| "Ping to outside world from VM should be successful" | |
| ) | |
| try: | |
| self.debug("SSHing into management server from VM") | |
| res = ssh.execute("ssh %s@%s" % ( | |
| self.services["mgmt_server"]["username"], | |
| self.apiclient.connection.mgtSvr | |
| )) | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertNotEqual( | |
| result.count("No route to host"), | |
| 1, | |
| "SSH into management server from VM should be successful" | |
| ) | |
| return | |
| class TestInvalidAccountAuthroize(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestInvalidAccountAuthroize, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_invalid_account_authorize(self): | |
| """Test invalid account authorize | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupEgress to allow ssh access only out to | |
| # non-existent random account and default security group | |
| # 4. listSecurityGroups should show ssh and default security groups | |
| # 5. authorizeSecurityGroupEgress API should fail since there is no | |
| # account | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| with self.assertRaises(Exception): | |
| security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=random_gen(), | |
| domainid=self.account.domainid | |
| ) | |
| return | |
| class TestMultipleAccountsEgressRuleNeg(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestMultipleAccountsEgressRuleNeg, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.accountA = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.accountB = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.accountA.name | |
| cls._cleanup = [ | |
| cls.accountA, | |
| cls.accountB, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_multiple_account_egress_rule_negative(self): | |
| """Test multiple account egress rules negative case | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user A | |
| # 2. createaccount of type user B | |
| # 3. createsecuritygroup (SSH-A) for account A | |
| # 4. authorizeSecurityGroupEgress in account A to allow ssh access | |
| # only out to VMs in account B's default security group | |
| # 5. authorizeSecurityGroupIngress in account A to allow ssh incoming | |
| # access from anywhere into Vm's of account A. listSecurityGroups | |
| # for account A should show two groups (default and ssh-a) and ssh | |
| # ingress rule and account based egress rule | |
| # 6. deployVM in account A into security group SSH-A. deployed VM | |
| # should be Running | |
| # 7. deployVM in account B. deployed VM should be Running | |
| # 8. ssh into VM in account A and from there ssh to VM in account B. | |
| # ssh should fail | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| # Authorize to only account not CIDR | |
| user_secgrp_list = {self.accountB.name: 'default'} | |
| egress_rule = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_account"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid, | |
| user_secgrp_list=user_secgrp_list | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.virtual_machineA = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.accountA.name, | |
| domainid=self.accountA.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.cleanup.append(self.virtual_machineA) | |
| self.debug("Deploying VM in account: %s" % self.accountA.name) | |
| vms = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machineA.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| isinstance(vms, list), | |
| True, | |
| "List VM should return a valid list" | |
| ) | |
| vm = vms[0] | |
| self.assertEqual( | |
| vm.state, | |
| "Running", | |
| "VM state after deployment should be running" | |
| ) | |
| self.debug("VM: %s state: %s" % (vm.id, vm.state)) | |
| self.virtual_machineB = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.accountB.name, | |
| domainid=self.accountB.domainid, | |
| serviceofferingid=self.service_offering.id | |
| ) | |
| self.cleanup.append(self.virtual_machineB) | |
| self.debug("Deploying VM in account: %s" % self.accountB.name) | |
| vms = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machineB.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| isinstance(vms, list), | |
| True, | |
| "List VM should return a valid list" | |
| ) | |
| vm = vms[0] | |
| self.assertEqual( | |
| vm.state, | |
| "Running", | |
| "VM state after deployment should be running" | |
| ) | |
| self.debug("VM: %s state: %s" % (vm.id, vm.state)) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machineA.ssh_ip) | |
| ssh = self.virtual_machineA.get_ssh_client() | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machineA.ipaddress, e) | |
| ) | |
| try: | |
| self.debug("SSHing into VM type B from VM A") | |
| self.debug("VM IP: %s" % self.virtual_machineB.ssh_ip) | |
| res = ssh.execute("ssh -o 'BatchMode=yes' %s" % ( | |
| self.virtual_machineB.ssh_ip | |
| )) | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machineA.ipaddress, e) | |
| ) | |
| # SSH failure may result in one of the following three error messages | |
| ssh_failure_result_set = ["ssh: connect to host %s port 22: No route to host" % self.virtual_machineB.ssh_ip, | |
| "ssh: connect to host %s port 22: Connection timed out" % self.virtual_machineB.ssh_ip, | |
| "Host key verification failed."] | |
| self.assertFalse(set(res).isdisjoint(ssh_failure_result_set), | |
| "SSH into VM of other account should not be successful" | |
| ) | |
| return | |
| class TestMultipleAccountsEgressRule(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestMultipleAccountsEgressRule, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.accountA = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.accountB = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.accountA.name | |
| cls._cleanup = [ | |
| cls.accountA, | |
| cls.accountB, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_multiple_account_egress_rule_positive(self): | |
| """Test multiple account egress rules positive case | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user A | |
| # 2. createaccount of type user B | |
| # 3. createsecuritygroup (SSH-A) for account A | |
| # 4. authorizeSecurityGroupEgress in account A to allow ssh access | |
| # only out to VMs in account B's default security group | |
| # 5. authorizeSecurityGroupIngress in account A to allow ssh incoming | |
| # access from anywhere into Vm's of account A. listSecurityGroups | |
| # for account A should show two groups (default and ssh-a) and ssh | |
| # ingress rule and account based egress rule | |
| # 6. deployVM in account A into security group SSH-A. deployed VM | |
| # should be Running | |
| # 7. deployVM in account B. deployed VM should be Running | |
| # 8. ssh into VM in account A and from there ssh to VM in account B. | |
| # ssh should fail | |
| security_groupA = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_groupA.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| security_groupB = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountB.name, | |
| domainid=self.accountB.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_groupB.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.accountB.name, | |
| domainid=self.accountB.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_groupA.id) | |
| # Authorize to only account not CIDR | |
| user_secgrp_list = {self.accountB.name: security_groupB.name} | |
| egress_rule = security_groupA.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_account"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid, | |
| user_secgrp_list=user_secgrp_list | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_groupA.id) | |
| ingress_ruleA = security_groupA.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountA.name, | |
| domainid=self.accountA.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_ruleA, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.virtual_machineA = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.accountA.name, | |
| domainid=self.accountA.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_groupA.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.cleanup.append(self.virtual_machineA) | |
| self.debug("Deploying VM in account: %s" % self.accountA.name) | |
| vms = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machineA.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| isinstance(vms, list), | |
| True, | |
| "List VM should return a valid list" | |
| ) | |
| vm = vms[0] | |
| self.assertEqual( | |
| vm.state, | |
| "Running", | |
| "VM state after deployment should be running" | |
| ) | |
| self.debug("VM: %s state: %s" % (vm.id, vm.state)) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_groupB.id) | |
| ingress_ruleB = security_groupB.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.accountB.name, | |
| domainid=self.accountB.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_ruleB, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.virtual_machineB = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.accountB.name, | |
| domainid=self.accountB.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_groupB.id] | |
| ) | |
| self.cleanup.append(self.virtual_machineB) | |
| self.debug("Deploying VM in account: %s" % self.accountB.name) | |
| vms = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machineB.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| isinstance(vms, list), | |
| True, | |
| "List VM should return a valid list" | |
| ) | |
| vm = vms[0] | |
| self.assertEqual( | |
| vm.state, | |
| "Running", | |
| "VM state after deployment should be running" | |
| ) | |
| self.debug("VM: %s state: %s" % (vm.id, vm.state)) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machineA.ssh_ip) | |
| ssh = self.virtual_machineA.get_ssh_client() | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machineA.ipaddress, e) | |
| ) | |
| try: | |
| self.debug("SSHing into VB type B from VM A") | |
| self.debug("VM IP: %s" % self.virtual_machineB.ssh_ip) | |
| res = ssh.execute("ssh %s@%s" % ( | |
| self.services["virtual_machine"]["username"], | |
| self.virtual_machineB.ssh_ip | |
| )) | |
| self.debug("SSH result: %s" % str(res)) | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machineA.ipaddress, e) | |
| ) | |
| result = str(res) | |
| self.assertNotEqual( | |
| result.count("Connection timed out"), | |
| 1, | |
| "SSH into management server from VM should be successful" | |
| ) | |
| return | |
| class TestStartStopVMWithEgressRule(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestStartStopVMWithEgressRule, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_start_stop_vm_egress(self): | |
| """ Test stop start Vm with egress rules | |
| """ | |
| # Validate the following: | |
| # 1. createaccount of type user | |
| # 2. createsecuritygroup (ssh) for this account | |
| # 3. authorizeSecurityGroupIngress to allow ssh access to the VM | |
| # 4. authorizeSecurityGroupEgress to allow ssh access only out to | |
| # CIDR: 0.0.0.0/0 | |
| # 5. deployVirtualMachine into this security group (ssh) | |
| # 6. stopVirtualMachine | |
| # 7. startVirtualMachine | |
| # 8. ssh in to VM | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing ingress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| ingress_rule = security_group.authorize( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(ingress_rule, dict), | |
| True, | |
| "Check ingress rule created properly" | |
| ) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id, | |
| securitygroupids=[security_group.id], | |
| mode=self.services['mode'] | |
| ) | |
| self.debug("Deploying VM in account: %s" % self.account.name) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s for ssh access" | |
| % security_group.id) | |
| egress_rule = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| try: | |
| # Stop virtual machine | |
| self.virtual_machine.stop(self.apiclient) | |
| except Exception as e: | |
| self.fail("Failed to stop instance: %s" % e) | |
| # Start virtual machine | |
| self.debug("Starting virtual machine: %s" % self.virtual_machine.id) | |
| self.virtual_machine.start(self.apiclient) | |
| vms = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machine.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| isinstance(vms, list), | |
| True, | |
| "List VM should return a valid list" | |
| ) | |
| vm = vms[0] | |
| self.assertEqual( | |
| vm.state, | |
| "Running", | |
| "VM state should be stopped" | |
| ) | |
| self.debug("VM: %s state: %s" % (vm.id, vm.state)) | |
| # Should be able to SSH VM | |
| try: | |
| self.debug("SSH into VM: %s" % self.virtual_machine.ssh_ip) | |
| self.virtual_machine.get_ssh_client() | |
| except Exception as e: | |
| self.fail("SSH Access failed for %s: %s" % \ | |
| (self.virtual_machine.ipaddress, e) | |
| ) | |
| return | |
| class TestInvalidParametersForEgress(cloudstackTestCase): | |
| def setUp(self): | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.cleanup = [] | |
| return | |
| def tearDown(self): | |
| try: | |
| #Clean up, terminate the created templates | |
| cleanup_resources(self.apiclient, self.cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestInvalidParametersForEgress, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls.services['mode'] = cls.zone.networktype | |
| template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["domainid"] = cls.domain.id | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.services["virtual_machine"]["template"] = template.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls.account = Account.create( | |
| cls.api_client, | |
| cls.services["account"], | |
| domainid=cls.domain.id | |
| ) | |
| cls.services["account"] = cls.account.name | |
| cls._cleanup = [ | |
| cls.account, | |
| cls.service_offering | |
| ] | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| try: | |
| #Cleanup resources used | |
| cleanup_resources(cls.api_client, cls._cleanup) | |
| except Exception as e: | |
| raise Exception("Warning: Exception during cleanup : %s" % e) | |
| return | |
| @attr(tags = ["sg", "eip", "advancedsg"]) | |
| def test_invalid_parameters(self): | |
| """ Test invalid parameters for egress rules | |
| """ | |
| # Validate the following: | |
| # 1. createUserAccount | |
| # 2. createSecurityGroup (test) | |
| # 3. authorizeEgressRule (negative port) - Should fail | |
| # 4. authorizeEgressRule (invalid CIDR) - Should fail | |
| # 5. authorizeEgressRule (invalid account) - Should fail | |
| # 6. authorizeEgressRule (22, cidr: anywhere) and | |
| # authorizeEgressRule (22, cidr: restricted) - Should pass | |
| # 7. authorizeEgressRule (21, cidr : 10.1.1.0/24) and | |
| # authorizeEgressRule (21, cidr: 10.1.1.0/24) - Should fail | |
| security_group = SecurityGroup.create( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug("Created security group with ID: %s" % security_group.id) | |
| # Default Security group should not have any ingress rule | |
| security_groups = SecurityGroup.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(security_groups, list), | |
| True, | |
| "Check for list security groups response" | |
| ) | |
| self.assertEqual( | |
| len(security_groups), | |
| 2, | |
| "Check List Security groups response" | |
| ) | |
| # Authorize Security group to SSH to VM | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s with invalid port" | |
| % security_group.id) | |
| with self.assertRaises(Exception): | |
| security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_invalid_port"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s with invalid cidr" | |
| % security_group.id) | |
| with self.assertRaises(Exception): | |
| security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_invalid_cidr"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s with invalid account" | |
| % security_group.id) | |
| with self.assertRaises(Exception): | |
| security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["security_group"], | |
| account=random_gen(), | |
| domainid=self.account.domainid | |
| ) | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s with cidr: anywhere and port: 22" | |
| % security_group.id) | |
| egress_rule_A = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_cidr_anywhere"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule_A, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| egress_rule_R = security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_cidr_restricted"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| self.assertEqual( | |
| isinstance(egress_rule_R, dict), | |
| True, | |
| "Check egress rule created properly" | |
| ) | |
| self.debug( | |
| "Authorizing egress rule for sec group ID: %s with duplicate port" | |
| % security_group.id) | |
| with self.assertRaises(Exception): | |
| security_group.authorizeEgress( | |
| self.apiclient, | |
| self.services["sg_cidr_restricted"], | |
| account=self.account.name, | |
| domainid=self.account.domainid | |
| ) | |
| return |