diff --git a/test/integration/component/test_egress_fw_rules.py b/test/integration/component/test_egress_fw_rules.py index e1568bdeea2..8fa8a5ed26b 100644 --- a/test/integration/component/test_egress_fw_rules.py +++ b/test/integration/component/test_egress_fw_rules.py @@ -27,11 +27,13 @@ from marvin.integration.lib.base import (Account, Network, ServiceOffering, NetworkOffering, - VirtualMachine) + VirtualMachine, + FireWallRule, + NATRule, + PublicIPAddress) from marvin.integration.lib.common import (get_domain, get_zone, get_template, - list_hosts, list_routers, wait_for_cleanup, list_virtual_machines @@ -41,7 +43,6 @@ from marvin.cloudstackAPI import rebootRouter from marvin.cloudstackAPI.createEgressFirewallRule import createEgressFirewallRuleCmd from marvin.cloudstackAPI.deleteEgressFirewallRule import deleteEgressFirewallRuleCmd from marvin.codes import PASS -from marvin.sshClient import SshClient import time class Services: @@ -117,6 +118,11 @@ class Services: "name": "Test Network", "displaytext": "Test Network", }, + "natrule" : { + "privateport": 22, + "publicport": 22, + "protocol": "TCP" + }, "sleep" : 30, "ostype": 'CentOS 5.3 (64-bit)', "host_password": 'password', @@ -166,6 +172,8 @@ class TestEgressFWRules(cloudstackTestCase): def setUp(self): self.apiclient = self.api_client self.dbclient = self.testClient.getDbConnection() + self.cleanup_vms = [] + self.cleanup_networks = [] self.cleanup = [] self.snapshot = None self.egressruleid = None @@ -202,11 +210,11 @@ class TestEgressFWRules(cloudstackTestCase): domainid=self.account.domainid, networkofferingid=self.network_offering.id, zoneid=self.zone.id) + self.cleanup_networks.append(self.network) self.debug("Created network with ID: %s" % self.network.id) self.debug("Deploying instance in the account: %s" % self.account.name) project = None - self.virtual_machine = None try: self.virtual_machine = VirtualMachine.create(self.apiclient, self.services["virtual_machine"], @@ -216,8 +224,8 @@ class TestEgressFWRules(cloudstackTestCase): mode=self.zone.networktype if pfrule else 'basic', networkids=[str(self.network.id)], projectid=project.id if project else None) + self.cleanup_vms.append(self.virtual_machine) except Exception as e: - self.virtual_machine = None self.fail("Virtual machine deployment failed with exception: %s" % e) self.debug("Deployed instance %s in account: %s" % (self.virtual_machine.id,self.account.name)) @@ -226,95 +234,48 @@ class TestEgressFWRules(cloudstackTestCase): self.assertEqual(validateList(self.vm_list)[0], PASS, "vm list validation failed, vm list is %s" % self.vm_list) self.assertEqual(str(self.vm_list[0].state).lower(),'running',"VM state should be running, it is %s" % self.vm_list[0].state) + + self.public_ip = PublicIPAddress.create( + self.apiclient, + accountid=self.account.name, + zoneid=self.zone.id, + domainid=self.account.domainid, + networkid=self.network.id + ) + + # Open up firewall port for SSH + FireWallRule.create( + self.apiclient, + ipaddressid=self.public_ip.ipaddress.id, + protocol=self.services["natrule"]["protocol"], + cidrlist=['0.0.0.0/0'], + startport=self.services["natrule"]["publicport"], + endport=self.services["natrule"]["publicport"] + ) + + self.debug("Creating NAT rule for VM ID: %s" % self.virtual_machine.id) + #Create NAT rule + NATRule.create( + self.apiclient, + self.virtual_machine, + self.services["natrule"], + self.public_ip.ipaddress.id + ) return def exec_script_on_user_vm(self, script, exec_cmd_params, expected_result, negative_test=False): try: - - vm_network_id = self.virtual_machine.nic[0].networkid - vm_ipaddress = self.virtual_machine.nic[0].ipaddress - list_routers_response = list_routers(self.apiclient, - account=self.account.name, - domainid=self.account.domainid, - networkid=vm_network_id) - self.assertEqual(isinstance(list_routers_response, list), - True, - "Check for list routers response return valid data") - router = list_routers_response[0] - - #Once host or mgt server is reached, SSH to the router connected to VM - # look for Router for Cloudstack VM network. - if self.apiclient.hypervisor.lower() == 'vmware': - #SSH is done via management server for Vmware - sourceip = self.apiclient.connection.mgtSvr - else: - #For others, we will have to get the ipaddress of host connected to vm - hosts = list_hosts(self.apiclient, - id=router.hostid) - self.assertEqual(isinstance(hosts, list), - True, - "Check list response returns a valid list") - host = hosts[0] - sourceip = host.ipaddress - - self.debug("Sleep %s seconds for network on router to be up" - % self.services['sleep']) - time.sleep(self.services['sleep']) - - if self.apiclient.hypervisor.lower() == 'vmware': - key_file = " -i /var/cloudstack/management/.ssh/id_rsa " - else: - key_file = " -i /root/.ssh/id_rsa.cloud " - - ssh_cmd = "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=quiet" - expect_script = "#!/usr/bin/expect\n" + \ - "spawn %s %s -p 3922 root@%s\n" % (ssh_cmd, key_file, router.linklocalip) + \ - "expect \"root@%s:~#\"\n" % (router.name) + \ - "send \"%s root@%s %s; exit $?\r\"\n" % (ssh_cmd, vm_ipaddress, script) + \ - "expect \"root@%s's password: \"\n" % (vm_ipaddress) + \ - "send \"password\r\"\n" + \ - "interact\n" - self.debug("expect_script>>\n%s< 0: + retriesCount = 10 + while True: + vms = list_virtual_machines(self.api_client, id=self.virtual_machine.id) + if vms is None: + break + elif retriesCount == 0: + self.fail("Failed to expunge vm even after 10 minutes") + time.sleep(60) + retriesCount -= 1 + + try: + for network in self.cleanup_networks: + network.delete(self.api_client) + except Exception as e: + self.fail("Warning: Exception during networks cleanup : %s" % e) - self.network.delete(self.apiclient) self.debug("Sleep for Network cleanup to complete.") wait_for_cleanup(self.apiclient, ["network.gc.wait", "network.gc.interval"]) + cleanup_resources(self.apiclient, reversed(self.cleanup)) self.debug("Cleanup complete!") except Exception as e: @@ -479,7 +463,7 @@ class TestEgressFWRules(cloudstackTestCase): negative_test=False) self.createEgressRule() #Egress rule is set for ICMP other traffic is allowed - self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico', + self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico 2>&1', "| grep -oP 'failed:'", "[]", negative_test=False) @@ -500,7 +484,7 @@ class TestEgressFWRules(cloudstackTestCase): negative_test=False) self.createEgressRule() #Egress rule is set for ICMP other traffic is not allowed - self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico', + self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico 2>&1', "| grep -oP 'failed:'", "['failed:']", negative_test=False) @@ -659,7 +643,7 @@ class TestEgressFWRules(cloudstackTestCase): # 4. access to public network should not be successfull. self.create_vm() self.createEgressRule(protocol='tcp', start_port=80) - self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico', + self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico 2>&1', "| grep -oP 'failed:'", "['failed:']", negative_test=False) @@ -675,7 +659,7 @@ class TestEgressFWRules(cloudstackTestCase): # 4. access to public network for tcp port 80 is blocked. self.create_vm() self.createEgressRule(protocol='tcp', start_port=80) - self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico', + self.exec_script_on_user_vm(' wget -t1 http://apache.claz.org/favicon.ico 2>&1', "| grep -oP 'failed:'", "['failed:']", negative_test=False) @@ -797,7 +781,6 @@ class TestEgressFWRules(cloudstackTestCase): # 3. All should work fine. self.create_vm(pfrule=True, egress_policy=False) - @attr(tags = ["advanced"]) def test_12_egress_fr12(self): """Test Reboot Router