| # Licensed to the Apache Software Foundation (ASF) under one |
| # or more contributor license agreements. See the NOTICE file |
| # distributed with this work for additional information |
| # regarding copyright ownership. The ASF licenses this file |
| # to you under the Apache License, Version 2.0 (the |
| # "License"); you may not use this file except in compliance |
| # with the License. You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, |
| # software distributed under the License is distributed on an |
| # "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| # KIND, either express or implied. See the License for the |
| # specific language governing permissions and limitations |
| # under the License. |
| |
| from marvin.codes import FAILED |
| from marvin.cloudstackTestCase import cloudstackTestCase |
| from marvin.lib.utils import wait_until |
| from marvin.lib.base import (Account, |
| Project, |
| UserData, |
| SslCertificate, |
| Template, |
| NetworkOffering, |
| ServiceOffering, |
| VirtualMachine, |
| Network, |
| VPC, |
| VpcOffering, |
| PublicIPAddress, |
| LoadBalancerRule) |
| from marvin.lib.common import (get_domain, get_zone, get_test_template) |
| from nose.plugins.attrib import attr |
| |
| import os |
| import subprocess |
| import logging |
| |
| |
| _multiprocess_shared_ = True |
| |
| DOMAIN = "test-ssl-offloading.cloudstack.org" |
| CONTENT = "Test page" |
| FULL_CHAIN = "/tmp/full_chain.crt" |
| |
| CERT = { |
| "privatekey": """-----BEGIN PRIVATE KEY----- |
| MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCph7jsoMCQirRn |
| 3obuvgnnefTXRQYd9tF9k2aCVkTiiisvC39px7MGdgvDXADhD9fmR7oyXVQlfNu0 |
| rXjjgsVT3r4bv+DVi81YGXnuU7h10yCOZJt21i6QGHN1CS0/TAfg0UhlACCEYNRx |
| kB0klwUcj/jk/AKil1DoUGpvAm2gZsek/njb76/AeIfxc+Es4ZOPCVqQOHp6gI0q |
| t6KDMkUwv8fyzrpScygMUPVYrLmm6D0pn8yd3ihW07wGxMjND6UgOnao8t6H3LaM |
| Pe7eqSFzxunF9NFFjnUrKcHZZSledDM/37Kbqb/8T5f+4SwjioS1OdPCh8ApdiXq |
| HNUwYkALAgMBAAECggEAK5JiiQ7X7053B6s96uaVDRVfRGTNKa5iMXBNDHq3wbHZ |
| X4IJAVr+PE7ivxdKco3r45fT11X9ZpUsssdTJsZZiTDak69BTiFcaaRCnmqOIlpd |
| J7vb6TMrTIW8RvxQ0M/txm6DuNHLibqJX5a2pszZ13l5cwECfF9/v/XLJTTukCbu |
| 6D/f3fBVFl1tM8y9saOEYLkdb4dILWY61bVSDNswgprz2EV1SFnk5jxz2FuBrM/Q |
| +7hINvjDcaRvcm59hRb1rkljv7S10VoNw/CFkU451csJkUe4vWZwB8lZK/XxLQG0 |
| HEdS1zU1XY8H8Y1RCrxjGRyiiWsBtUThhWYlPrGCoQKBgQDkP09YAlKqXhT69Kx5 |
| keg2i1jV2hA73zWbWXt9xp5jG5r3pl3m170DvKL93YIDnHtpTC56mlzGrzS7DSTN |
| p0buY9Qb3fkJxunCpPVFo0HMFkpeR77ax0v34NzSohlRLKFo5R2M1cmDfbVbnSSl |
| MB57FfRRMxzjrk+dJvjOeJsxjwKBgQC+JLb4B8CZjpurXYg3ySiRqFsCqkqob+kf |
| 9dR+rWvcR6vMTEyha0hUlDvTikDepU2smYR4oPHfdcXF9lAJ7T02UmQDeizAqR68 |
| u9e+yS0q3tdRnPPZmXJfaDCXG1hKMqF4YA5Vs0XAjleF3zHB+vBLrnlPpShtd/Mu |
| sWTpxICTxQKBgQDSr/n+pE5IQwYczOO0aFGwn5pF9L9NdPHXz5aleETV+TJn7WL6 |
| ZiRsoaDWs7SCvtxQS2kP9RM0t5/2FeDmEMXx4aZ2fsSWGM3IxVo+iL+Aswa81n8/ |
| Ff5y9lb/+29hNdBcsjk/ukwEG3Lf+UNNVAie15oppgPByzJkPwgmFsAy0wKBgHDX |
| /TZp82WuerhSw/rHiSoYjhqg0bnw4Ju1Gy0q4q5SYqTWS0wpDT4U0wSSMjlwRQ6/ |
| 9RxZ9/G0RXFc4tdhUkig0PY3VcPpGnLL0BhL8GBW69ZlnVpwdK4meV/UPKucLLPx |
| 3dACmszSLSMn+LG0qVNg8mHQFJQS8eGuKcOKePw5AoGACuxtefROKdKOALh4lTi2 |
| VOwPZ+1jxsm6lKNccIEvbUpe3UXPgNWpJiDX8mUcob4/NBLzmV3BUVKbG7Exbo5J |
| LoMfp7OsztWUFwt7YAvRfS8fHdhkEsxEf3T72ADieH5ZAuXFF+K0H3r6HtWPD4ws |
| mTJjGP4+Bl/dFakA5FJcjHg= |
| -----END PRIVATE KEY-----""", |
| "certificate": """-----BEGIN CERTIFICATE----- |
| MIIFKjCCAxKgAwIBAgIUJ7BtN56KI8OuzbbM8SdtCLCB2UgwDQYJKoZIhvcNAQEL |
| BQAwXjELMAkGA1UEBhMCWFgxCzAJBgNVBAgMAlhYMQswCQYDVQQHDAJYWDETMBEG |
| A1UECgwKQ2xvdWRTdGFjazEPMA0GA1UECwwGQXBhY2hlMQ8wDQYDVQQDDAZBcGFj |
| aGUwHhcNMjUwNjIzMTMxMzA3WhcNMzUwNjIxMTMxMzA3WjBoMQswCQYDVQQGEwJY |
| WDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMQ8wDQYDVQQKDAZBcGFjaGUxEzAR |
| BgNVBAsMCkNsb3VkU3RhY2sxGTAXBgNVBAMMECouY2xvdWRzdGFjay5vcmcwggEi |
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCph7jsoMCQirRn3obuvgnnefTX |
| RQYd9tF9k2aCVkTiiisvC39px7MGdgvDXADhD9fmR7oyXVQlfNu0rXjjgsVT3r4b |
| v+DVi81YGXnuU7h10yCOZJt21i6QGHN1CS0/TAfg0UhlACCEYNRxkB0klwUcj/jk |
| /AKil1DoUGpvAm2gZsek/njb76/AeIfxc+Es4ZOPCVqQOHp6gI0qt6KDMkUwv8fy |
| zrpScygMUPVYrLmm6D0pn8yd3ihW07wGxMjND6UgOnao8t6H3LaMPe7eqSFzxunF |
| 9NFFjnUrKcHZZSledDM/37Kbqb/8T5f+4SwjioS1OdPCh8ApdiXqHNUwYkALAgMB |
| AAGjgdUwgdIwKwYDVR0RBCQwIoIQKi5jbG91ZHN0YWNrLm9yZ4IOY2xvdWRzdGFj |
| ay5vcmcwHQYDVR0OBBYEFCcq7jrdsqTD+Xi85DCqjYdL1gOqMIGDBgNVHSMEfDB6 |
| oWKkYDBeMQswCQYDVQQGEwJYWDELMAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMRMw |
| EQYDVQQKDApDbG91ZFN0YWNrMQ8wDQYDVQQLDAZBcGFjaGUxDzANBgNVBAMMBkFw |
| YWNoZYIURVB9+qvRJyOnJnqmYOw467vW3vQwDQYJKoZIhvcNAQELBQADggIBACld |
| lEXgn/A4/kZQbLwwMxBvaoPDDaDaYVpPbOoPw7a8YkrL0rmPIc04PyX9GAqxdC+c |
| qaEXvmp3I+BdT13XGcBosXO8uEQ3kses9F3MhOHORPS2mJag7t4eLnNX/0CgKTlR |
| 6yC2Gu7d3xPNJ+CKMxekdoF31StEFNAYI/La/q3D+IGsRCbrVu3xpPaw2XlXI7Ro |
| RU7yebVmQPSNc75bm8Ydo1cdYtz9h8PVnc+6ThhSrdS3jYScj9DrX5ZJaKuZqSlu |
| 0ZqFXoBflme+cYB7nb9HqnIO67r9vzd2dTcErJVAk5jQqG5Y38d1tingDx1A5opU |
| z4BkXEbHNV6VXYUQ5VE0dXO2sNvXVJrstwMPE8d3EvbX/1gWj8kuymbskrCjySE4 |
| 4Yztkb0dsJkVU793lz3EV75DsXvj3gevK049nPv2Grt1+rTgFNa6NJnLvKIKk/mv |
| fWjxbK2b/AAJ1ci6xtw/vKmIWoEu6uEMIJmhfBwuP+VnVJWJbmYXpNW/L5g21B76 |
| Fn8RuQa3mlm5lZrxEcJ/b6fF+2NPJwj7sh6l688VtNXoVSSyXUeV5HwqCv+YMjKn |
| CtwpEN/eNHMbrkJvgYwSoOzqhV/wpmNi28S7MOm66JMECHOXOhk/eX2chIEjiVna |
| MXhvr/Twfj2N4gNVtcgXkrk39HEYjk5+uF7SdNf4 |
| -----END CERTIFICATE-----""", |
| "certchain": """-----BEGIN CERTIFICATE----- |
| MIIFQzCCAysCFEVQffqr0ScjpyZ6pmDsOOu71t70MA0GCSqGSIb3DQEBCwUAMF4x |
| CzAJBgNVBAYTAlhYMQswCQYDVQQIDAJYWDELMAkGA1UEBwwCWFgxEzARBgNVBAoM |
| CkNsb3VkU3RhY2sxDzANBgNVBAsMBkFwYWNoZTEPMA0GA1UEAwwGQXBhY2hlMB4X |
| DTI1MDYxNjEwMjc1NloXDTMwMDYxNTEwMjc1NlowXjELMAkGA1UEBhMCWFgxCzAJ |
| BgNVBAgMAlhYMQswCQYDVQQHDAJYWDETMBEGA1UECgwKQ2xvdWRTdGFjazEPMA0G |
| A1UECwwGQXBhY2hlMQ8wDQYDVQQDDAZBcGFjaGUwggIiMA0GCSqGSIb3DQEBAQUA |
| A4ICDwAwggIKAoICAQCLiQmSjrht15R1F+r79m/LZN5hsfQBGp+dy+yrtsWfOOur |
| RdXAwgbLxxsyKMQKWCQxlRI7wdhqh0L0ZBrIr9MjltYqsqLAoLmgY4eG/f6G8YGr |
| O/rxzfwTLbCeaIseF/OMA6Sz125HXYp1bltYK4LsuC7tihZXbeVa5pUGs3Jwgcfx |
| LYm4eB42Hp7Eg05uL8LbwT/1AjcwoWkTewKAWXA83zgLRDFDbl1t0IPHI4cdVvia |
| BNwNbG49ZCF6OgmokSarQSe4Vbems1u9T9pAySXAVjEYBqFjKWyswpdr782uNLmB |
| lCGm0pDeJ9/WASxbTJr7k9H6ZpnaHr54DG6ZqennWMz8w6r2pf7bp/EGZ3mZQ4s3 |
| 5ylSP4cQt8CSSI8k2CflPGUyytUAiWlDS3qSyIuAOPKXDg7wIpcbwcu4VMeKnH0Z |
| x7Uu9j1UDZEZoSu6UI/VInTl47k1/ECD+AO9yBzZSv+pTQmO3/Im3CcxsTHmVd5s |
| Tl0CJ/jWNpo9DAMtmGvt6CBWBXGRsO2XNk7djRcq2CubiCpvODg+7CcR6CiZK73L |
| 1aOisLiq3+ofiJSSXRRuKtJlkQ4eSPSbYWkNJcKmIhbCoYOdH/Pe3/+RHjvNc1kO |
| OUb+icmfzcMVAs3C5jybpazsfjDNQZXWAFx4FLDcqOVbrCwom+tMukw+hzlZnwID |
| AQABMA0GCSqGSIb3DQEBCwUAA4ICAQAdexoMwn+Ol1A3+NOHk9WJZX+t2Q8/9wWb |
| K+jSVleSfXXWsB1mC3fABVJQdCxtXCH3rpt4w7FK6aUes9VjqAHap4tt9WBq0Wqq |
| vvMURFHfllxEM31Z35kBOCSQY9xwpGV1rRh/zYs4h55YixomR3nXNZ9cI8xzlSCi |
| sMG0mv0y+yxPohKrZj3AzLYz/M11SimSoyRPIANI+cUg1nJXyQoHzVHWEp1Nj0HB |
| M/GW05cxsWea7f5YcAW1JQI3FOkpwb72fIZOtMDa4PO8IYWXJAeAc/chw745/MTi |
| Rvl2NT4RZBAcrSNbhCOzRPG/ZiG+ArQuCluZ9HHAXRBMTtlLk5DO4+XxZlyGpjwf |
| uKniK8dccy9uU0ho73p9SNDhXH0yb9Naj8vd9NWzCUYaaBXt/92cIyhaAHAVFxJu |
| o6jr2FLbnhSGF9EO/tHvF7LxZv1dnbInvlWHwoFQjwmoeB+e17lHBdPMnWnPKBZe |
| jA2VH/IzGCucWuWQhruummO5GT8Z6F4jBwvafBo+QARKPZgEBpx3LycXrpkYI3LT |
| GGOpGCxFt5tVZOEsC/jQ5rIljNSeTzWmzfNRn/yRUW97uWsrzcQIBAUtu/pQnyFQ |
| WCnC1ipCp1zhJsXAFUKuqEfLngXodOvC4tAOr76h11S57o5lN4506Poq2mWgAZe/ |
| JZr9MEn1+w== |
| -----END CERTIFICATE----- |
| -----BEGIN CERTIFICATE----- |
| MIIFnzCCA4egAwIBAgIUcUNMqgWoDLsvMj0YmEudj60EG5swDQYJKoZIhvcNAQEL |
| BQAwXjELMAkGA1UEBhMCWFgxCzAJBgNVBAgMAlhYMQswCQYDVQQHDAJYWDETMBEG |
| A1UECgwKQ2xvdWRTdGFjazEPMA0GA1UECwwGQXBhY2hlMQ8wDQYDVQQDDAZBcGFj |
| aGUwIBcNMjUwNjE2MTAyNzM2WhgPMjEyNTA1MjMxMDI3MzZaMF4xCzAJBgNVBAYT |
| AlhYMQswCQYDVQQIDAJYWDELMAkGA1UEBwwCWFgxEzARBgNVBAoMCkNsb3VkU3Rh |
| Y2sxDzANBgNVBAsMBkFwYWNoZTEPMA0GA1UEAwwGQXBhY2hlMIICIjANBgkqhkiG |
| 9w0BAQEFAAOCAg8AMIICCgKCAgEAwVQaePulUM523gKw168ToYp+gt05bXbu4Gg8 |
| uaRDKhnRAX1sEgYwkQ36Q+iTDEM9sKRma8lMNMIqkZMQdk6sIGX6BL+6wUOb7mL0 |
| 5+I0yO9i8ooaGgNaeNvZftNIRlLsnPMGJaeom2/66XV4CsMqoZKaJ1H/I8N+bAeD |
| GvrBx+B4l9D3G390nQvot9JUzrJgGuLl0KDHapvhlR39cCgEfIii02uX1iy0qXlV |
| b+G1kLvpeC7T+lsJxondPJ69aO3lbDv/izyWw7qqBC57UhT/oKDxJmjQqklqzhgt |
| nM/p3YE7M0nkRi3LnRmsZBz7o1DRf+M29zypKzXVk1aJflL46AtLMmpDIzVrEB2M |
| q7o47rstXusYRYsBCqGTgdI1fV/CkDsZY5XkPZh2dsjZCHIS4P03OqFGsc6PQha2 |
| +y2AhV1pvywkDl48kPKSukHfV1RtaPZUZtcQKztwHH+aFfo9mD8z0H2HcExdXKzd |
| jhRhI9ZSwFj3HEN9f5P8fS3lf5+fV7EEbG4NisieBj/UivW6QiTHpLD7wRLIUt2g |
| XgXNF0lfJzYHbIcxQ6kfC5McU2fu6mUC+p/pNN8G0POS3S2T55tEUqLL4N0SadQy |
| N1TZlTd2xTn+Hb6WlG0f5m97xGcNlGHKBvntFrHvOIfkEQ9ne3MlOO1Gjlintowo |
| fRGf15kCAwEAAaNTMFEwHQYDVR0OBBYEFM4WEQJpN9M07Q8CHq+5owG93Dj8MB8G |
| A1UdIwQYMBaAFM4WEQJpN9M07Q8CHq+5owG93Dj8MA8GA1UdEwEB/wQFMAMBAf8w |
| DQYJKoZIhvcNAQELBQADggIBABr5RKGc/rKx4fOgyXNJR4aCJCTtPZKs4AUCCBYz |
| cWOjJYGNvThOPSVx51nAD8+YP2BwkOIPfhl2u/+vQSSbz4OlauXLki2DUN8E2OFe |
| gJfxPDzWOfAo/QOJcyHwSlnIQjiZzG2lK3eyf5IFnfQILQzDvXaUYvMBkl2hb5Q7 |
| 44H6tRw78uuf/KsT4rY0bBFMN5DayjiyvoIDUvzCRqcb2KOi9DnZ7pXjduL7tO0j |
| PhlQ24B77LVUUAvydIGUzmbhGC2VvY1qE7uaYgYtgSUZ0zSjJrHjUjVLMzRouNP7 |
| jpbBQRAcP4FDcOFZBHogunA0hxQdm0d8u3LqDYPNS0rpfW0ddU/72nfBX4bnoDEN |
| +anw4wOgFuUcoEThALWZ9ESVKxXQ9Fpvd6FRW8fLLqhXAuli1BqP1c1WRxagldYe |
| nPGm/FGZyJ2xOak9Uigi9NAQ/vX6CEfgcJgFZmCo8EKH0d4Ut72vGUcPqiUhT2EI |
| AFAd6drSyoUdXXniSMWky9Vrt+qtLuAD1nhHTv8ZPdItXokoiD6ea/4xrbUZn0qY |
| lLMDyfY76UVF0ruTR2Q6IdSq/zSggdwgkTooOW4XZcRf5l/ZnoeVQ1QH9C85SIKH |
| IKZwPeGUm+EntmpuCBDmQSHLRCGEThd64iOAjqLR6arLj4TBJzBrZsGHFJbm0OcI |
| dwa9 |
| -----END CERTIFICATE-----""", |
| "enabledrevocationcheck": False |
| } |
| |
| # Install apache2 via userdata |
| USER_DATA="""I2Nsb3VkLWNvbmZpZwpydW5jbWQ6CiAgLSBzdWRvIGFwdC1nZXQgdXBkYXRlCiAgLSBzdWRvIGFw |
| dC1nZXQgaW5zdGFsbCAteSBhcGFjaGUyCiAgLSBzdWRvIHN5c3RlbWN0bCBlbmFibGUgYXBhY2hl |
| MgogIC0gc3VkbyBzeXN0ZW1jdGwgc3RhcnQgYXBhY2hlMgogIC0gZWNobyAiVGVzdCBwYWdlIiB8 |
| c3VkbyB0ZWUgL3Zhci93d3cvaHRtbC90ZXN0Lmh0bWwK""" |
| # #cloud-config |
| # runcmd: |
| # - sudo apt-get update |
| # - sudo apt-get install -y apache2 |
| # - sudo systemctl enable apache2 |
| # - sudo systemctl start apache2 |
| # - echo "Test page" |sudo tee /var/www/html/test.html |
| |
| class TestSslOffloading(cloudstackTestCase): |
| |
| @classmethod |
| def setUpClass(cls): |
| |
| testClient = super(TestSslOffloading, cls).getClsTestClient() |
| cls.apiclient = testClient.getApiClient() |
| cls.services = testClient.getParsedTestDataConfig() |
| cls._cleanup = [] |
| |
| # Get Zone, Domain and templates |
| cls.domain = get_domain(cls.apiclient) |
| cls.zone = get_zone(cls.apiclient, testClient.getZoneForTests()) |
| cls.hypervisor = testClient.getHypervisorInfo() |
| |
| cls.services["virtual_machine"]["zoneid"] = cls.zone.id |
| |
| # Save full chain as a file |
| with open(FULL_CHAIN, "w", encoding="utf-8") as f: |
| f.write(CERT["certchain"]) |
| |
| # Register template if needed |
| if cls.hypervisor.lower() == 'simulator': |
| cls.template = get_test_template( |
| cls.apiclient, |
| cls.zone.id, |
| cls.hypervisor) |
| else: |
| cls.template = Template.register( |
| cls.apiclient, |
| cls.services["test_templates_cloud_init"][cls.hypervisor.lower()], |
| zoneid=cls.zone.id, |
| hypervisor=cls.hypervisor, |
| ) |
| cls.template.download(cls.apiclient) |
| cls._cleanup.append(cls.template) |
| |
| if cls.template == FAILED: |
| assert False, "get_test_template() failed to return template" |
| |
| # Create service offering |
| cls.service_offering = ServiceOffering.create( |
| cls.apiclient, |
| cls.services["service_offerings"]["big"] # 512MB memory |
| ) |
| cls._cleanup.append(cls.service_offering) |
| |
| # Create network offering |
| cls.services["isolated_network_offering"]["egress_policy"] = "true" |
| cls.network_offering = NetworkOffering.create(cls.apiclient, |
| cls.services["isolated_network_offering"], |
| conservemode=True) |
| cls.network_offering.update(cls.apiclient, state='Enabled') |
| |
| cls._cleanup.append(cls.network_offering) |
| |
| #Create an account, network, VM and IP addresses |
| cls.account = Account.create( |
| cls.apiclient, |
| cls.services["account"], |
| admin=True, |
| domainid=cls.domain.id |
| ) |
| cls._cleanup.append(cls.account) |
| cls.user = cls.account.user[0] |
| cls.userapiclient = cls.testClient.getUserApiClient(cls.user.username, cls.domain.name) |
| |
| cls.logger = logging.getLogger("TestSslOffloading") |
| cls.stream_handler = logging.StreamHandler() |
| cls.logger.setLevel(logging.DEBUG) |
| cls.logger.addHandler(cls.stream_handler) |
| |
| def setUp(self): |
| self.apiclient = self.testClient.getApiClient() |
| self.cleanup = [] |
| |
| def tearDown(self): |
| super(TestSslOffloading, self).tearDown() |
| |
| @classmethod |
| def tearDownClass(cls): |
| super(TestSslOffloading, cls).tearDownClass() |
| # Remove full chain file |
| if os.path.exists(FULL_CHAIN): |
| os.remove(FULL_CHAIN) |
| |
| def wait_for_service_ready(self, command, expected, retries=60): |
| output = None |
| self.logger.debug("======================================") |
| self.logger.debug("Checking output of command '%s', expected result: '%s'" % (command, expected)) |
| def check_output(): |
| try: |
| output = subprocess.check_output(command + ' 2>&1', shell=True).strip().decode('utf-8') |
| except Exception as e: |
| self.logger.debug("Failed to get output of command '%s': '%s'" % (command, e)) |
| if expected is None: |
| self.logger.debug("But it is expected") |
| return True, None |
| return False, None |
| self.logger.debug("Output of command '%s' is '%s'" % (command, output)) |
| if expected is None: |
| self.logger.debug("But it is expected to be None") |
| return False, None |
| return (expected in output), None |
| |
| res, _ = wait_until(10, retries, check_output) |
| if not res: |
| self.fail("Failed to wait for http server to show content '%s'. The output is '%s'" % (expected, output)) |
| |
| @attr(tags = ["advanced", "advancedns", "smoke"], required_hardware="true") |
| def test_01_ssl_offloading_isolated_network(self): |
| """Test to create Load balancing rule with SSL offloading""" |
| |
| # Validate: |
| # 1. Create isolated network and vm instance |
| # 2. create LB with port 80 -> 80, verify the website (should get expected content) |
| # 3. create LB with port 443 -> 80, verify the website (should not work) |
| # 4. add cert to LB with port 443 |
| # 5. verify the website (should get expected content) |
| # 6. remove cert from LB with port 443 |
| # 7. delete SSL certificate |
| |
| # Register Userdata |
| self.userdata = UserData.register(self.apiclient, |
| name="test-userdata", |
| userdata=USER_DATA, |
| account=self.account.name, |
| domainid=self.account.domainid |
| ) |
| |
| # Upload SSL Certificate |
| self.sslcert = SslCertificate.create(self.apiclient, |
| CERT, |
| name="test-ssl-certificate", |
| account=self.account.name, |
| domainid=self.account.domainid) |
| |
| # 1. Create network |
| self.network = Network.create(self.apiclient, |
| zoneid=self.zone.id, |
| services=self.services["network"], |
| domainid=self.domain.id, |
| account=self.account.name, |
| networkofferingid=self.network_offering.id) |
| self.cleanup.append(self.network) |
| |
| self.services["virtual_machine"]["networkids"] = [str(self.network.id)] |
| |
| # Create vm instance |
| self.vm_1 = VirtualMachine.create( |
| self.apiclient, |
| self.services["virtual_machine"], |
| templateid=self.template.id, |
| accountid=self.account.name, |
| domainid=self.account.domainid, |
| userdataid=self.userdata.userdata.id, |
| serviceofferingid=self.service_offering.id |
| ) |
| self.cleanup.append(self.vm_1) |
| |
| self.public_ip = PublicIPAddress.create( |
| self.apiclient, |
| self.account.name, |
| self.zone.id, |
| self.account.domainid, |
| self.services["virtual_machine"], |
| self.network.id) |
| |
| # 2. create LB with port 80 -> 80, verify the website (should get expected content). |
| # firewall is open by default |
| lb_http = { |
| "name": "http", |
| "alg": "roundrobin", |
| "privateport": 80, |
| "publicport": 80, |
| "protocol": "tcp" |
| } |
| lb_rule_http = LoadBalancerRule.create( |
| self.apiclient, |
| lb_http, |
| self.public_ip.ipaddress.id, |
| accountid=self.account.name, |
| domainid=self.domain.id, |
| networkid=self.network.id |
| ) |
| lb_rule_http.assign(self.apiclient, [self.vm_1]) |
| command = "curl -sL --connect-timeout 3 http://%s/test.html" % self.public_ip.ipaddress.ipaddress |
| # wait 10 minutes until the webpage is available. it returns "503 Service Unavailable" if not available |
| self.wait_for_service_ready(command, CONTENT, 60) |
| |
| # 3. create LB with port 443 -> 80, verify the website (should not work) |
| # firewall is open by default |
| lb_https = { |
| "name": "https", |
| "alg": "roundrobin", |
| "privateport": 80, |
| "publicport": 443, |
| "protocol": "ssl" |
| } |
| lb_rule_https = LoadBalancerRule.create( |
| self.apiclient, |
| lb_https, |
| self.public_ip.ipaddress.id, |
| accountid=self.account.name, |
| domainid=self.domain.id, |
| networkid=self.network.id |
| ) |
| lb_rule_https.assign(self.apiclient, [self.vm_1]) |
| |
| command = "curl -L --connect-timeout 3 -k --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| command = "curl -L --connect-timeout 3 --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| # 4. add cert to LB with port 443 |
| lb_rule_https.assignCert(self.apiclient, self.sslcert.id) |
| |
| # 5. verify the website (should get expected content) |
| command = "curl -L --connect-timeout 3 --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| command = "curl -sL --connect-timeout 3 -k --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, CONTENT, 1) |
| |
| command = "curl -sL --connect-timeout 3 --cacert %s --resolve %s:443:%s https://%s/test.html" % (FULL_CHAIN, DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, CONTENT, 1) |
| |
| # 6. remove cert from LB with port 443 |
| lb_rule_https.removeCert(self.apiclient) |
| |
| # 7. delete SSL certificate |
| self.sslcert.delete(self.apiclient) |
| |
| @attr(tags = ["advanced", "advancedns", "smoke"], required_hardware="true") |
| def test_02_ssl_offloading_project_vpc(self): |
| """Test to create Load balancing rule with SSL offloading in VPC in user project""" |
| |
| # Validate: |
| # 1. Create VPC, VPC tier and vm instance |
| # 2. create LB with port 80 -> 80, verify the website (should get expected content) |
| # 3. create LB with port 443 -> 80, verify the website (should not work) |
| # 4. add cert to LB with port 443 |
| # 5. verify the website (should get expected content) |
| # 6. remove cert from LB with port 443 |
| # 7. delete SSL certificate |
| |
| # Create project by user |
| self.project = Project.create( |
| self.userapiclient, |
| self.services["project"] |
| ) |
| self.cleanup.append(self.project) |
| |
| # Register Userdata by user |
| self.userdata = UserData.register(self.userapiclient, |
| name="test-user-userdata", |
| userdata=USER_DATA, |
| projectid=self.project.id |
| ) |
| |
| # Upload SSL Certificate by user |
| self.sslcert = SslCertificate.create(self.userapiclient, |
| CERT, |
| name="test-user-ssl-certificate", |
| projectid=self.project.id |
| ) |
| |
| # 1. Create VPC and VPC tier |
| vpcOffering = VpcOffering.list(self.userapiclient, name="Default VPC offering") |
| self.assertTrue(vpcOffering is not None and len( |
| vpcOffering) > 0, "No VPC offerings found") |
| |
| self.vpc = VPC.create( |
| apiclient=self.userapiclient, |
| services=self.services["vpc_vpn"]["vpc"], |
| vpcofferingid=vpcOffering[0].id, |
| zoneid=self.zone.id, |
| projectid=self.project.id |
| ) |
| self.cleanup.append(self.vpc) |
| |
| networkOffering = NetworkOffering.list( |
| self.userapiclient, name="DefaultIsolatedNetworkOfferingForVpcNetworks") |
| self.assertTrue(networkOffering is not None and len( |
| networkOffering) > 0, "No VPC based network offering") |
| |
| self.network = Network.create( |
| apiclient=self.userapiclient, |
| services=self.services["vpc_vpn"]["network_1"], |
| networkofferingid=networkOffering[0].id, |
| zoneid=self.zone.id, |
| vpcid=self.vpc.id, |
| projectid=self.project.id |
| ) |
| self.cleanup.append(self.network) |
| |
| self.services["virtual_machine"]["networkids"] = [str(self.network.id)] |
| |
| # Create vm instance |
| self.vm_2 = VirtualMachine.create( |
| self.userapiclient, |
| self.services["virtual_machine"], |
| templateid=self.template.id, |
| userdataid=self.userdata.userdata.id, |
| serviceofferingid=self.service_offering.id, |
| projectid=self.project.id |
| ) |
| self.cleanup.append(self.vm_2) |
| |
| self.public_ip = PublicIPAddress.create( |
| self.userapiclient, |
| zoneid=self.zone.id, |
| services=self.services["virtual_machine"], |
| networkid=self.network.id, |
| vpcid=self.vpc.id, |
| projectid=self.project.id |
| ) |
| |
| # 2. create LB with port 80 -> 80, verify the website (should get expected content). |
| # firewall is open by default |
| lb_http = { |
| "name": "http", |
| "alg": "roundrobin", |
| "privateport": 80, |
| "publicport": 80, |
| "protocol": "tcp" |
| } |
| lb_rule_http = LoadBalancerRule.create( |
| self.userapiclient, |
| lb_http, |
| self.public_ip.ipaddress.id, |
| networkid=self.network.id, |
| projectid=self.project.id |
| ) |
| lb_rule_http.assign(self.userapiclient, [self.vm_2]) |
| command = "curl -sL --connect-timeout 3 http://%s/test.html" % self.public_ip.ipaddress.ipaddress |
| # wait 10 minutes until the webpage is available. it returns "503 Service Unavailable" if not available |
| self.wait_for_service_ready(command, CONTENT, 60) |
| |
| # 3. create LB with port 443 -> 80, verify the website (should not work) |
| # firewall is open by default |
| lb_https = { |
| "name": "https", |
| "alg": "roundrobin", |
| "privateport": 80, |
| "publicport": 443, |
| "protocol": "ssl" |
| } |
| lb_rule_https = LoadBalancerRule.create( |
| self.userapiclient, |
| lb_https, |
| self.public_ip.ipaddress.id, |
| networkid=self.network.id, |
| projectid=self.project.id |
| ) |
| lb_rule_https.assign(self.userapiclient, [self.vm_2]) |
| |
| command = "curl -L --connect-timeout 3 -k --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| command = "curl -L --connect-timeout 3 --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| # 4. add cert to LB with port 443 |
| lb_rule_https.assignCert(self.userapiclient, self.sslcert.id) |
| |
| # 5. verify the website (should get expected content) |
| command = "curl -L --connect-timeout 3 --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, None, 1) |
| |
| command = "curl -sL --connect-timeout 3 -k --resolve %s:443:%s https://%s/test.html" % (DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, CONTENT, 1) |
| |
| command = "curl -sL --connect-timeout 3 --cacert %s --resolve %s:443:%s https://%s/test.html" % (FULL_CHAIN, DOMAIN, self.public_ip.ipaddress.ipaddress, DOMAIN) |
| self.wait_for_service_ready(command, CONTENT, 1) |
| |
| # 6. remove cert from LB with port 443 |
| lb_rule_https.removeCert(self.userapiclient) |
| |
| # 7. delete SSL certificate |
| self.sslcert.delete(self.userapiclient) |
