def test_01_firewall_rules_port_fw(self): """"Checking firewall rules deletion after static NAT disable""" # Validate the following: #1. Enable static NAT for a VM #2. Open up some ports. At this point there will be new rows in the # firewall_rules table. #3. Disable static NAT for the VM. #4. Check fire wall rules are deleted from firewall_rules table. public_ip = self.public_ip.ipaddress # Enable Static NAT for VM StaticNATRule.enable( self.apiclient, public_ip.id, self.virtual_machine.id ) self.debug("Enabled static NAT for public IP ID: %s" % public_ip.id) #Create Static NAT rule, in fact it's firewall rule nat_rule = StaticNATRule.create( self.apiclient, self.services["firewall_rule"], public_ip.id ) self.debug("Created Static NAT rule for public IP ID: %s" % public_ip.id) self.debug("Checking IP address") ip_response = PublicIPAddress.list( self.apiclient, id = public_ip.id ) self.assertEqual( isinstance(ip_response, list), True, "Check ip response returns a valid list" ) self.assertNotEqual( len(ip_response), 0, "Check static NAT Rule is created" ) self.assertTrue( ip_response[0].isstaticnat, "IP is not static nat enabled" ) self.assertEqual( ip_response[0].virtualmachineid, self.virtual_machine.id, "IP is not binding with the VM" ) self.debug("Checking Firewall rule") firewall_response = FireWallRule.list( self.apiclient, ipaddressid = public_ip.id, listall = True ) self.assertEqual( isinstance(firewall_response, list), True, "Check firewall response returns a valid list" ) self.assertNotEqual( len(firewall_response), 0, "Check firewall rule is created" ) self.assertEqual( firewall_response[0].state, "Active", "Firewall rule is not active" ) self.assertEqual( firewall_response[0].ipaddressid, public_ip.id, "Firewall rule is not static nat related" ) self.assertEqual( firewall_response[0].startport, str(self.services["firewall_rule"]["startport"]), "Firewall rule is not with specific port" ) self.debug("Removed the firewall rule") nat_rule.delete(self.apiclient) self.debug("Checking IP address, it should still existed") ip_response = PublicIPAddress.list( self.apiclient, id = public_ip.id ) self.assertEqual( isinstance(ip_response, list), True, "Check ip response returns a valid list" ) self.assertNotEqual( len(ip_response), 0, "Check static NAT Rule is created" ) self.assertTrue( ip_response[0].isstaticnat, "IP is not static nat enabled" ) self.assertEqual( ip_response[0].virtualmachineid, self.virtual_machine.id, "IP is not binding with the VM" ) self.debug("Checking Firewall rule, it should be removed") firewall_response = FireWallRule.list( self.apiclient, ipaddressid = public_ip.id, listall = True ) self.assertEqual( isinstance(firewall_response, list), True, "Check firewall response returns a valid list" ) if len(firewall_response) != 0 : self.assertEqual( firewall_response[0].state, "Deleting", "Firewall rule should be deleted or in deleting state" ) return
def test_02_network_off_with_conserve_mode(self): """Test Network offering with Conserve mode ON and VR - All services """ # Validate the following # 1. Create a Network from the above network offering and deploy a VM. # 2. On source NAT ipaddress, we should be allowed to add a LB rules # 3. On source NAT ipaddress, we should be allowed to add a PF rules # 4. On source NAT ipaddress, we should be allowed to add a Firewall # rules # 5. On an ipaddress that has Lb rules, we should be allowed to # program PF rules. # 6. We should be allowed to program multiple PF rules on the same Ip # address on different public ports. # 7. We should be allowed to program multiple LB rules on the same Ip # address for different public port ranges. # 8. On source NAT ipaddress, we should be allowed to Enable VPN # access. # Create a network offering with all virtual router services enabled self.debug( "Creating n/w offering with all services in VR & conserve mode:off" ) self.network_offering = NetworkOffering.create( self.api_client, self.services["network_offering"], conservemode=True ) self.cleanup.append(self.network_offering) self.debug("Created n/w offering with ID: %s" % self.network_offering.id) # Enable Network offering self.network_offering.update(self.apiclient, state='Enabled') # Creating network using the network offering created self.debug("Creating network with network offering: %s" % self.network_offering.id) self.network = Network.create( self.apiclient, self.services["network"], accountid=self.account.name, domainid=self.account.domainid, networkofferingid=self.network_offering.id, zoneid=self.zone.id ) self.debug("Created network with ID: %s" % self.network.id) self.debug("Deploying VM in account: %s" % self.account.name) # Spawn an instance in that network virtual_machine = VirtualMachine.create( self.apiclient, self.services["virtual_machine"], accountid=self.account.name, domainid=self.account.domainid, serviceofferingid=self.service_offering.id, networkids=[str(self.network.id)] ) self.debug("Deployed VM in network: %s" % self.network.id) src_nat_list = PublicIPAddress.list( self.apiclient, associatednetworkid=self.network.id, account=self.account.name, domainid=self.account.domainid, listall=True, issourcenat=True, ) self.assertEqual( isinstance(src_nat_list, list), True, "List Public IP should return a valid source NAT" ) self.assertNotEqual( len(src_nat_list), 0, "Length of response from listPublicIp should not be 0" ) src_nat = src_nat_list[0] self.debug("Trying to create LB rule on source NAT IP: %s" % src_nat.ipaddress) # Create Load Balancer rule with source NAT lb_rule = LoadBalancerRule.create( self.apiclient, self.services["lbrule"], ipaddressid=src_nat.id, accountid=self.account.name ) self.debug("Created LB rule on source NAT: %s" % src_nat.ipaddress) lb_rules = LoadBalancerRule.list( self.apiclient, id=lb_rule.id ) self.assertEqual( isinstance(lb_rules, list), True, "List lb rules should return a valid lb rules" ) self.assertNotEqual( len(lb_rules), 0, "Length of response from listLbRules should not be 0" ) self.debug( "Trying to create a port forwarding rule in source NAT: %s" % src_nat.ipaddress) #Create NAT rule nat_rule = NATRule.create( self.apiclient, virtual_machine, self.services["natrule"], ipaddressid=src_nat.id ) self.debug("Created PF rule on source NAT: %s" % src_nat.ipaddress) nat_rules = NATRule.list( self.apiclient, id=nat_rule.id ) self.assertEqual( isinstance(nat_rules, list), True, "List NAT should return a valid port forwarding rules" ) self.assertNotEqual( len(nat_rules), 0, "Length of response from listLbRules should not be 0" ) self.debug("Creating firewall rule on source NAT: %s" % src_nat.ipaddress) #Create Firewall rule on source NAT fw_rule = FireWallRule.create( self.apiclient, ipaddressid=src_nat.id, protocol='TCP', cidrlist=[self.services["fw_rule"]["cidr"]], startport=self.services["fw_rule"]["startport"], endport=self.services["fw_rule"]["endport"] ) self.debug("Created firewall rule: %s" % fw_rule.id) fw_rules = FireWallRule.list( self.apiclient, id=fw_rule.id ) self.assertEqual( isinstance(fw_rules, list), True, "List fw rules should return a valid firewall rules" ) self.assertNotEqual( len(fw_rules), 0, "Length of fw rules response should not be zero" ) self.debug("Associating public IP for network: %s" % self.network.id) public_ip = PublicIPAddress.create( self.apiclient, accountid=self.account.name, zoneid=self.zone.id, domainid=self.account.domainid, networkid=self.network.id ) self.debug("Associated %s with network %s" % ( public_ip.ipaddress, self.network.id )) self.debug("Creating PF rule for IP address: %s" % public_ip.ipaddress) NATRule.create( self.apiclient, virtual_machine, self.services["natrule"], ipaddressid=public_ip.ipaddress.id ) self.debug("Trying to create LB rule on IP with NAT: %s" % public_ip.ipaddress) # Create Load Balancer rule on IP already having NAT rule lb_rule = LoadBalancerRule.create( self.apiclient, self.services["lbrule"], ipaddressid=public_ip.ipaddress.id, accountid=self.account.name ) self.debug("Creating PF rule with public port: 66") nat_rule = NATRule.create( self.apiclient, virtual_machine, self.services["natrule_port_66"], ipaddressid=public_ip.ipaddress.id ) # Check if NAT rule created successfully nat_rules = NATRule.list( self.apiclient, id=nat_rule.id ) self.assertEqual( isinstance(nat_rules, list), True, "List NAT rules should return valid list" ) self.debug("Creating LB rule with public port: 2221") lb_rule = LoadBalancerRule.create( self.apiclient, self.services["lbrule_port_2221"], ipaddressid=public_ip.ipaddress.id, accountid=self.account.name ) # Check if NAT rule created successfully lb_rules = LoadBalancerRule.list( self.apiclient, id=lb_rule.id ) self.assertEqual( isinstance(lb_rules, list), True, "List LB rules should return valid list" ) # User should be able to enable VPN on source NAT self.debug("Created VPN with source NAT IP: %s" % src_nat.ipaddress) # Assign VPN to source NAT Vpn.create( self.apiclient, src_nat.id, account=self.account.name, domainid=self.account.domainid ) vpns = Vpn.list( self.apiclient, publicipid=src_nat.id, listall=True, ) self.assertEqual( isinstance(vpns, list), True, "List VPNs should return a valid VPN list" ) self.assertNotEqual( len(vpns), 0, "Length of list VPN response should not be zero" ) return
def test_01_firewall_rules_port_fw(self): """"Checking firewall rules deletion after static NAT disable""" # Validate the following: #1. Enable static NAT for a VM #2. Open up some ports. At this point there will be new rows in the # firewall_rules table. #3. Disable static NAT for the VM. #4. Check fire wall rules are deleted from firewall_rules table. public_ip = self.public_ip.ipaddress # Enable Static NAT for VM StaticNATRule.enable(self.apiclient, public_ip.id, self.virtual_machine.id) self.debug("Enabled static NAT for public IP ID: %s" % public_ip.id) #Create Static NAT rule, in fact it's firewall rule nat_rule = StaticNATRule.create(self.apiclient, self.services["firewall_rule"], public_ip.id) self.debug("Created Static NAT rule for public IP ID: %s" % public_ip.id) self.debug("Checking IP address") ip_response = PublicIPAddress.list(self.apiclient, id=public_ip.id) self.assertEqual(isinstance(ip_response, list), True, "Check ip response returns a valid list") self.assertNotEqual(len(ip_response), 0, "Check static NAT Rule is created") self.assertTrue(ip_response[0].isstaticnat, "IP is not static nat enabled") self.assertEqual(ip_response[0].virtualmachineid, self.virtual_machine.id, "IP is not binding with the VM") self.debug("Checking Firewall rule") firewall_response = FireWallRule.list(self.apiclient, ipaddressid=public_ip.id, listall=True) self.assertEqual(isinstance(firewall_response, list), True, "Check firewall response returns a valid list") self.assertNotEqual(len(firewall_response), 0, "Check firewall rule is created") self.assertEqual(firewall_response[0].state, "Active", "Firewall rule is not active") self.assertEqual(firewall_response[0].ipaddressid, public_ip.id, "Firewall rule is not static nat related") self.assertEqual(firewall_response[0].startport, str(self.services["firewall_rule"]["startport"]), "Firewall rule is not with specific port") self.debug("Removed the firewall rule") nat_rule.delete(self.apiclient) self.debug("Checking IP address, it should still existed") ip_response = PublicIPAddress.list(self.apiclient, id=public_ip.id) self.assertEqual(isinstance(ip_response, list), True, "Check ip response returns a valid list") self.assertNotEqual(len(ip_response), 0, "Check static NAT Rule is created") self.assertTrue(ip_response[0].isstaticnat, "IP is not static nat enabled") self.assertEqual(ip_response[0].virtualmachineid, self.virtual_machine.id, "IP is not binding with the VM") self.debug("Checking Firewall rule, it should be removed") firewall_response = FireWallRule.list(self.apiclient, ipaddressid=public_ip.id, listall=True) self.assertEqual(isinstance(firewall_response, list), True, "Check firewall response returns a valid list") if len(firewall_response) != 0: self.assertEqual( firewall_response[0].state, "Deleting", "Firewall rule should be deleted or in deleting state") return
def test_07_associate_public_ip(self): """Test associate public IP within the project """ # Validate the following # 1. Create a project # 2. Add some public Ips to the project # 3. Verify public IP assigned can only used to create PF/LB rules # inside project networks = Network.list(self.apiclient, projectid=self.project.id, listall=True) self.assertEqual(isinstance(networks, list), True, "Check list networks response returns a valid response") self.assertNotEqual(len(networks), 0, "Check list networks response returns a valid network") network = networks[0] self.debug("Associating public IP for project: %s" % self.project.id) public_ip = PublicIPAddress.create( self.apiclient, zoneid=self.virtual_machine.zoneid, services=self.services["server"], networkid=network.id, projectid=self.project.id, ) self.cleanup.append(public_ip) # Create NAT rule self.debug("Creating a NAT rule within project, VM ID: %s" % self.virtual_machine.id) nat_rule = NATRule.create( self.apiclient, self.virtual_machine, self.services["natrule"], public_ip.ipaddress.id, projectid=self.project.id, ) self.debug("created a NAT rule with ID: %s" % nat_rule.id) nat_rule_response = NATRule.list(self.apiclient, id=nat_rule.id) self.assertEqual(isinstance(nat_rule_response, list), True, "Check list response returns a valid list") self.assertNotEqual(len(nat_rule_response), 0, "Check Port Forwarding Rule is created") self.assertEqual(nat_rule_response[0].id, nat_rule.id, "Check Correct Port forwarding Rule is returned") # Create Load Balancer rule and assign VMs to rule self.debug("Created LB rule for public IP: %s" % public_ip.ipaddress) lb_rule = LoadBalancerRule.create( self.apiclient, self.services["lbrule"], public_ip.ipaddress.id, projectid=self.project.id ) self.debug("Assigning VM: %s to LB rule: %s" % (self.virtual_machine.name, lb_rule.id)) lb_rule.assign(self.apiclient, [self.virtual_machine]) lb_rules = list_lb_rules(self.apiclient, id=lb_rule.id) self.assertEqual(isinstance(lb_rules, list), True, "Check list response returns a valid list") # verify listLoadBalancerRules lists the added load balancing rule self.assertNotEqual(len(lb_rules), 0, "Check Load Balancer Rule in its List") self.assertEqual(lb_rules[0].id, lb_rule.id, "Check List Load Balancer Rules returns valid Rule") # Create Firewall rule with configurations from settings file fw_rule = FireWallRule.create( self.apiclient, ipaddressid=public_ip.ipaddress.id, protocol="TCP", cidrlist=[self.services["fw_rule"]["cidr"]], startport=self.services["fw_rule"]["startport"], endport=self.services["fw_rule"]["endport"], projectid=self.project.id, ) self.debug("Created firewall rule: %s" % fw_rule.id) # After Router start, FW rule should be in Active state fw_rules = FireWallRule.list(self.apiclient, id=fw_rule.id) self.assertEqual(isinstance(fw_rules, list), True, "Check for list FW rules response return valid data") self.assertEqual(fw_rules[0].state, "Active", "Check list load balancing rules") self.assertEqual( fw_rules[0].startport, str(self.services["fw_rule"]["startport"]), "Check start port of firewall rule" ) self.assertEqual( fw_rules[0].endport, str(self.services["fw_rule"]["endport"]), "Check end port of firewall rule" ) self.debug("Deploying VM for account: %s" % self.account.name) virtual_machine_1 = VirtualMachine.create( self.apiclient, self.services["server"], templateid=self.template.id, accountid=self.account.name, domainid=self.account.domainid, serviceofferingid=self.service_offering.id, ) self.cleanup.append(virtual_machine_1) self.debug("VM state after deploy: %s" % virtual_machine_1.state) # Verify VM state self.assertEqual(virtual_machine_1.state, "Running", "Check VM state is Running or not") self.debug("Creating NAT rule for VM (ID: %s) outside project" % virtual_machine_1.id) with self.assertRaises(Exception): NATRule.create(self.apiclient, virtual_machine_1, self.services["natrule"], public_ip.ipaddress.id) self.debug("Creating LB rule for public IP: %s outside project" % public_ip.ipaddress) with self.assertRaises(Exception): LoadBalancerRule.create( self.apiclient, self.services["lbrule"], public_ip.ipaddress.id, accountid=self.account.name ) return