| # Licensed to the Apache Software Foundation (ASF) under one | |
| # or more contributor license agreements. See the NOTICE file | |
| # distributed with this work for additional information | |
| # regarding copyright ownership. The ASF licenses this file | |
| # to you under the Apache License, Version 2.0 (the | |
| # "License"); you may not use this file except in compliance | |
| # with the License. You may obtain a copy of the License at | |
| # | |
| # http://www.apache.org/licenses/LICENSE-2.0 | |
| # | |
| # Unless required by applicable law or agreed to in writing, | |
| # software distributed under the License is distributed on an | |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY | |
| # KIND, either express or implied. See the License for the | |
| # specific language governing permissions and limitations | |
| # under the License. | |
| """ P1 tests for VPN users | |
| """ | |
| from nose.plugins.attrib import attr | |
| # Import Local Modules | |
| from marvin.cloudstackException import CloudstackAPIException | |
| from marvin.cloudstackTestCase import cloudstackTestCase | |
| from marvin.codes import PASS | |
| from marvin.lib.base import ( | |
| Account, | |
| ServiceOffering, | |
| VirtualMachine, | |
| PublicIPAddress, | |
| Vpn, | |
| VpnUser, | |
| Configurations, | |
| NATRule | |
| ) | |
| from marvin.lib.common import (get_domain, | |
| get_zone, | |
| get_template | |
| ) | |
| from marvin.lib.utils import validateList | |
| class Services: | |
| """Test VPN users Services | |
| """ | |
| def __init__(self): | |
| self.services = { | |
| "account": { | |
| "email": "test@test.com", | |
| "firstname": "Test", | |
| "lastname": "User", | |
| "username": "test", | |
| # Random characters are appended for unique | |
| # username | |
| "password": "password", | |
| }, | |
| "service_offering": { | |
| "name": "Tiny Instance", | |
| "displaytext": "Tiny Instance", | |
| "cpunumber": 1, | |
| "cpuspeed": 100, # in MHz | |
| "memory": 128, # In MBs | |
| }, | |
| "disk_offering": { | |
| "displaytext": "Small Disk Offering", | |
| "name": "Small Disk Offering", | |
| "disksize": 1 | |
| }, | |
| "virtual_machine": { | |
| "displayname": "TestVM", | |
| "username": "root", | |
| "password": "password", | |
| "ssh_port": 22, | |
| "hypervisor": 'KVM', | |
| "privateport": 22, | |
| "publicport": 22, | |
| "protocol": 'TCP', | |
| }, | |
| "vpn_user": { | |
| "username": "test", | |
| "password": "p@as=s.w_o-r+d", | |
| }, | |
| "natrule": { | |
| "privateport": 1701, | |
| "publicport": 1701, | |
| "protocol": "UDP" | |
| }, | |
| "ostype": 'CentOS 5.5 (64-bit)', | |
| "sleep": 60, | |
| "timeout": 10, | |
| # Networking mode: Advanced, Basic | |
| } | |
| class TestVPNUsers(cloudstackTestCase): | |
| @classmethod | |
| def setUpClass(cls): | |
| cls.testClient = super(TestVPNUsers, cls).getClsTestClient() | |
| cls.api_client = cls.testClient.getApiClient() | |
| cls.services = Services().services | |
| # Get Zone, Domain and templates | |
| cls.domain = get_domain(cls.api_client) | |
| cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests()) | |
| cls._cleanup = [] | |
| cls.services["mode"] = cls.zone.networktype | |
| cls.template = get_template( | |
| cls.api_client, | |
| cls.zone.id, | |
| cls.services["ostype"] | |
| ) | |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id | |
| cls.service_offering = ServiceOffering.create( | |
| cls.api_client, | |
| cls.services["service_offering"] | |
| ) | |
| cls._cleanup.append(cls.service_offering) | |
| return | |
| @classmethod | |
| def tearDownClass(cls): | |
| super(TestVPNUsers, cls).tearDownClass() | |
| def setUp(self): | |
| self.cleanup = [] | |
| try: | |
| self.apiclient = self.testClient.getApiClient() | |
| self.dbclient = self.testClient.getDbConnection() | |
| self.account = Account.create( | |
| self.apiclient, | |
| self.services["account"], | |
| domainid=self.domain.id | |
| ) | |
| self.cleanup.append(self.account) | |
| self.virtual_machine = VirtualMachine.create( | |
| self.apiclient, | |
| self.services["virtual_machine"], | |
| templateid=self.template.id, | |
| accountid=self.account.name, | |
| domainid=self.account.domainid, | |
| serviceofferingid=self.service_offering.id | |
| ) | |
| self.cleanup.append(self.virtual_machine) | |
| self.public_ip = PublicIPAddress.create( | |
| self.apiclient, | |
| accountid=self.virtual_machine.account, | |
| zoneid=self.virtual_machine.zoneid, | |
| domainid=self.virtual_machine.domainid, | |
| services=self.services["virtual_machine"] | |
| ) | |
| self.cleanup.append(self.public_ip) | |
| return | |
| except CloudstackAPIException as e: | |
| self.tearDown() | |
| raise e | |
| def tearDown(self): | |
| super(TestVPNUsers, self).tearDown() | |
| def create_VPN(self, public_ip): | |
| """Creates VPN for the network""" | |
| self.debug("Creating VPN with public IP: %s" % public_ip.id) | |
| try: | |
| # Assign VPN to Public IP | |
| vpn = Vpn.create(self.apiclient, | |
| public_ip.id, | |
| account=self.account.name, | |
| domainid=self.account.domainid) | |
| self.cleanup.append(vpn) | |
| self.debug("Verifying the remote VPN access") | |
| vpns = Vpn.list(self.apiclient, | |
| publicipid=public_ip.id, | |
| listall=True) | |
| self.assertEqual( | |
| isinstance(vpns, list), | |
| True, | |
| "List VPNs shall return a valid response" | |
| ) | |
| return vpn | |
| except Exception as e: | |
| self.fail("Failed to create remote VPN access: %s" % e) | |
| def create_VPN_Users(self, rand_name=True, api_client=None): | |
| """Creates VPN users for the network""" | |
| self.debug("Creating VPN users for account: %s" % | |
| self.account.name) | |
| if api_client is None: | |
| api_client = self.apiclient | |
| try: | |
| vpnuser = VpnUser.create( | |
| api_client, | |
| self.services["vpn_user"]["username"], | |
| self.services["vpn_user"]["password"], | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| rand_name=rand_name | |
| ) | |
| self.cleanup.append(vpnuser) | |
| self.debug("Verifying the remote VPN access") | |
| vpn_users = VpnUser.list(self.apiclient, | |
| id=vpnuser.id, | |
| listall=True) | |
| self.assertEqual( | |
| isinstance(vpn_users, list), | |
| True, | |
| "List VPNs shall return a valid response" | |
| ) | |
| return vpnuser | |
| except Exception as e: | |
| self.fail("Failed to create remote VPN users: %s" % e) | |
| @attr(tags=["advanced", "advancedns"]) | |
| @attr(configuration='remote.access.vpn.user.limit') | |
| def test_01_VPN_user_limit(self): | |
| """VPN remote access user limit tests""" | |
| # Validate the following | |
| # prerequisite: change management configuration setting of | |
| # remote.access.vpn.user.limit | |
| # 1. provision more users than is set in the limit | |
| # Provisioning of users after the limit should failProvisioning of | |
| # users after the limit should fail | |
| self.debug("Fetching the limit for remote access VPN users") | |
| configs = Configurations.list( | |
| self.apiclient, | |
| name='remote.access.vpn.user.limit', | |
| listall=True) | |
| self.assertEqual(isinstance(configs, list), | |
| True, | |
| "List configs should return a valid response") | |
| limit = int(configs[0].value) | |
| self.debug("Enabling the VPN access for IP: %s" % | |
| self.public_ip.ipaddress) | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.create_VPN(ip) | |
| self.debug("Creating %s VPN users" % limit) | |
| for x in range(limit): | |
| self.create_VPN_Users() | |
| self.debug("Adding another user exceeding limit for remote VPN users") | |
| with self.assertRaises(Exception): | |
| self.create_VPN_Users() | |
| self.debug("Limit exceeded exception raised!") | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_02_use_vpn_port(self): | |
| """Test create VPN when L2TP port in use""" | |
| # Validate the following | |
| # 1. set a port forward for UDP: 1701 and enable VPN | |
| # 2. set port forward rule for the udp port 1701 over which L2TP works | |
| # 3. port forward should prevent VPN from being enabled | |
| self.debug("Creating a port forwarding rule on port 1701") | |
| # Create NAT rule | |
| nat_rule = NATRule.create( | |
| self.apiclient, | |
| self.virtual_machine, | |
| self.services["natrule"], | |
| self.public_ip.ipaddress.id) | |
| self.cleanup.append(nat_rule) | |
| self.debug("Verifying the NAT rule created") | |
| nat_rules = NATRule.list(self.apiclient, id=nat_rule.id, listall=True) | |
| self.assertEqual(isinstance(nat_rules, list), | |
| True, | |
| "List NAT rules should return a valid response") | |
| self.debug("Enabling the VPN connection for IP: %s" % | |
| self.public_ip.ipaddress) | |
| with self.assertRaises(Exception): | |
| self.create_VPN(self.public_ip) | |
| self.debug("Create VPN connection failed! Test successful!") | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_03_enable_vpn_use_port(self): | |
| """Test create NAT rule when VPN when L2TP enabled""" | |
| # Validate the following | |
| # 1. Enable a VPN connection on source NAT | |
| # 2. Add a VPN user | |
| # 3. add a port forward rule for UDP port 1701. Should result in error | |
| # saying that VPN is enabled over port 1701 | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.debug("Enabling the VPN connection for IP: %s" % | |
| ip.address) | |
| self.create_VPN(ip) | |
| self.debug("Creating a port forwarding rule on port 1701") | |
| # Create NAT rule | |
| with self.assertRaises(Exception): | |
| NATRule.create( | |
| self.apiclient, | |
| self.virtual_machine, | |
| self.services["natrule"], | |
| ip.id) | |
| self.debug("Create NAT rule failed! Test successful!") | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_04_add_new_users(self): | |
| """Test add new users to existing VPN""" | |
| # Validate the following | |
| # 1. Enable a VPN connection on source NAT | |
| # 2. Add new user to VPN when there are already existing users. | |
| # 3. We should be able to successfully establish a VPN connection using | |
| # the newly added user credential. | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.debug("Enabling the VPN connection for IP: %s" % | |
| ip.address) | |
| self.create_VPN(ip) | |
| try: | |
| self.debug("Adding new VPN user to account: %s" % | |
| self.account.name) | |
| self.create_VPN_Users() | |
| # TODO: Verify the VPN connection | |
| self.debug("Adding another user to account") | |
| self.create_VPN_Users() | |
| # TODO: Verify the VPN connection with new user | |
| except Exception as e: | |
| self.fail("Failed to create new VPN user: %s" % e) | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_05_add_duplicate_user(self): | |
| """Test add duplicate user to existing VPN""" | |
| # Validate the following | |
| # 1. Enable a VPN connection on source NAT | |
| # 2. Add a VPN user say "abc" that already an added user to the VPN. | |
| # 3. Adding this VPN user should fail. | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.debug("Enabling the VPN connection for IP: %s" % | |
| ip.address) | |
| self.create_VPN(ip) | |
| self.debug("Adding new VPN user to account: %s" % | |
| self.account.name) | |
| self.create_VPN_Users(rand_name=False) | |
| # TODO: Verify the VPN connection | |
| self.debug("Adding another user to account with same username") | |
| with self.assertRaises(Exception): | |
| self.create_VPN_Users(rand_name=False) | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_06_add_VPN_user_global_admin(self): | |
| """Test as global admin, add a new VPN user to an existing VPN entry | |
| that was created by another account.""" | |
| # Steps for verification | |
| # 1. Create a new user and deploy few Vms. | |
| # 2. Enable VPN access. Add few VPN users. | |
| # 3. Make sure that VPN access works as expected. | |
| # 4. As global Admin , add VPN user to this user's existing VPN entry. | |
| # Validate the following | |
| # 1. The newly added VPN user should get configured to the router of | |
| # user account. | |
| # 2. We should be able to use this newly created user credential to | |
| # establish VPN connection that will give access all VMs of this user | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.debug("Enabling VPN connection to account: %s" % | |
| self.account.name) | |
| self.create_VPN(ip) | |
| self.debug("Creating VPN user for the account: %s" % | |
| self.account.name) | |
| self.create_VPN_Users() | |
| self.debug("Creating a global admin account") | |
| admin = Account.create(self.apiclient, | |
| self.services["account"], | |
| admin=True, | |
| domainid=self.account.domainid) | |
| self.cleanup.append(admin) | |
| self.debug("Creating API client for newly created user") | |
| api_client = self.testClient.getUserApiClient( | |
| UserName=self.account.name, | |
| DomainName=self.account.domain) | |
| self.debug("Adding new user to VPN as a global admin: %s" % | |
| admin.name) | |
| try: | |
| self.create_VPN_Users(api_client=api_client) | |
| except Exception as e: | |
| self.fail("Global admin should be allowed to create VPN user: %s" % | |
| e) | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_07_add_VPN_user_domain_admin(self): | |
| """Test as domain admin, add a new VPN user to an existing VPN entry | |
| that was created by another account.""" | |
| # Steps for verification | |
| # 1. Create a new user and deploy few Vms. | |
| # 2. Enable VPN access. Add few VPN users. | |
| # 3. Make sure that VPN access works as expected. | |
| # 4. As domain Admin , add VPN user to this user's existing VPN entry. | |
| # Validate the following | |
| # 1. The newly added VPN user should get configured to the router of | |
| # user account. | |
| # 2. We should be able to use this newly created user credential to | |
| # establish VPN connection that will give access all VMs of this user | |
| network_id = self.virtual_machine.nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| self.debug("Enabling VPN connection to account: %s" % | |
| self.account.name) | |
| self.create_VPN(ip) | |
| self.debug("Creating VPN user for the account: %s" % | |
| self.account.name) | |
| self.create_VPN_Users() | |
| self.debug("Creating a domain admin account") | |
| admin = Account.create(self.apiclient, | |
| self.services["account"], | |
| domainid=self.account.domainid) | |
| self.cleanup.append(admin) | |
| self.debug("Creating API client for newly created user") | |
| api_client = self.testClient.getUserApiClient( | |
| UserName=self.account.name, | |
| DomainName=self.account.domain) | |
| self.debug("Adding new user to VPN as a domain admin: %s" % | |
| admin.name) | |
| try: | |
| self.create_VPN_Users(api_client=api_client) | |
| except Exception as e: | |
| self.fail("Domain admin should be allowed to create VPN user: %s" % | |
| e) | |
| return | |
| @attr(tags=["advanced", "advancedns"], required_hardware="false") | |
| def test_08_add_TCP_PF_Rule_In_VPN(self): | |
| """ | |
| Test to add TCP Port Forwarding rule for specific ports(500,1701 and 4500) in VPN | |
| """ | |
| # Steps for verification | |
| # 1. Enable vpn on SourceNAT IP address | |
| # 2. Configure PF with TCP ports 500,1701 and 4500. It should be allowed | |
| # Should not conflict with UPD ports used for VPN | |
| vm_res = VirtualMachine.list( | |
| self.apiclient, | |
| id=self.virtual_machine.id, | |
| listall=True | |
| ) | |
| self.assertEqual( | |
| validateList(vm_res)[0], | |
| PASS, | |
| "Failed to list virtual machine" | |
| ) | |
| network_id = vm_res[0].nic[0].networkid | |
| src_nat_list = PublicIPAddress.list( | |
| self.apiclient, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| listall=True, | |
| issourcenat=True, | |
| associatednetworkid=network_id | |
| ) | |
| self.assertEqual( | |
| validateList(src_nat_list)[0], | |
| PASS, | |
| "Failed to list source nat ip address" | |
| ) | |
| ip = src_nat_list[0] | |
| try: | |
| vpn = Vpn.create( | |
| self.apiclient, | |
| publicipid=ip.id, | |
| account=self.account.name, | |
| domainid=self.account.domainid, | |
| ) | |
| self.assertIsNotNone( | |
| vpn, | |
| "Failed to create remote access vpn" | |
| ) | |
| self.cleanup.append(vpn) | |
| except Exception as e: | |
| self.fail("Failed to enable vpn on SourceNAT IP with error: %s" % e) | |
| # Create PF rule with TCP ports 500,4500 and 1701 | |
| self.services['natrule']['protocol'] = "TCP" | |
| for port in [500, 4500, 1701]: | |
| self.services['natrule']['privateport'] = port | |
| self.services['natrule']['publicport'] = port | |
| try: | |
| nat = NATRule.create( | |
| self.apiclient, | |
| self.virtual_machine, | |
| self.services["natrule"], | |
| ip.id | |
| ) | |
| self.assertIsNotNone( | |
| nat, | |
| "Failed to add PF rule with tcp parts matching vpn" | |
| ) | |
| self.cleanup.append(nat) | |
| except Exception as e: | |
| self.fail("Creating PF rule for TCP port %s in VPN failed : %s" % (port, e)) | |
| return |