maple/prplos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: cram: Update firewall service test

Browse Source 
* Add a new test that will test toggling the instance instead of removing/adding it
* Replace the aliassed instance with a search expression to make it more robust

Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
This commit is contained in:
sah0447 2024-06-20 12:03:35 +02:00 committed by Petr Štetiar
parent dda2876608
commit 046126da14
No known key found for this signature in database
GPG Key ID: 58EE120F30CC02D3
2 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp.t
View File

@ -12,7 +12,7 @@ Check that client is able to get new lease:
Remove cpe-dhcpv4s-lan rule:
$ script --command "ssh -t root@$TARGET_LAN_IP ubus-cli Firewall.Service.cpe-dhcpv4s-lan-" > /dev/null; sleep .5
$ script --command "ssh -t root@$TARGET_LAN_IP ubus-cli Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface]-" > /dev/null; sleep .5
Check that the firewall rule was actually removed:

47
.gitlab/tests/cram/generic/acceleration-plan-components/010-firewall-dhcp_toggle.t Normal file
View File

@ -0,0 +1,47 @@
Create R alias:
$ alias R="${CRAM_REMOTE_COMMAND:-}"
Check that client is able to get new lease:
$ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)' | sort
| Router: 192.168.1.1
| Server Identifier: 192.168.1.1
| Subnet Mask: 255.255.255.0
|_ Domain Name Server: 192.168.1.1
Disable the dhcpv4s lan rule:
$ R "ba-cli 'Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface].Enable=0'" >/dev/null
$ sleep .5
Check that the firewall rule was actually removed:
$ R "iptables -vnL INPUT_Services | grep :67 | awk '/ACCEPT.*udp/ {print \$3, \$4, \$6, \$11}' | sort"
ACCEPT udp br-guest dpt:67
ACCEPT udp br-lcm dpt:67
Check that client is unable to get new lease:
$ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)'
[1]
Enable back firewall rule for dhcpv4s lan access from LAN:
$ R "ba-cli 'Firewall.Service.[DestPort==67 && \"IP.Interface.3\" in Interface].Enable=1'" >/dev/null
$ sleep .5
Check that the firewall rule was actually created:
$ R "iptables -vnL INPUT_Services | grep :67 | cut -d ' ' -f 11,16,20,53 | sort"
ACCEPT udp br-guest dpt:67
ACCEPT udp br-lan dpt:67
ACCEPT udp br-lcm dpt:67
Check that client is able to get new lease again:
$ sudo nmap --script broadcast-dhcp-discover -e $TESTBED_LAN_INTERFACE 2>&1 | egrep '(Server|Router|Subnet)' | sort
| Router: 192.168.1.1
| Server Identifier: 192.168.1.1
| Subnet Mask: 255.255.255.0
|_ Domain Name Server: 192.168.1.1