Code Review / integration / test.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | review | tree
raw | inline | side by side
Refactor Copy File To Remote System keyword
[integration/test.git] / csit / suites / aaa / tls / 010__aaa_restconf_tls.robot
diff --git a/csit/suites/aaa/tls/010__aaa_restconf_tls.robot b/csit/suites/aaa/tls/010__aaa_restconf_tls.robot
index a12ddb052285a6fde5782e7ada245dc733624b91..9caffd2eabb7e457acf0e554045b0ca9567d7807 100644 (file)
--- a/csit/suites/aaa/tls/010__aaa_restconf_tls.robot
+++ b/csit/suites/aaa/tls/010__aaa_restconf_tls.robot
@@ -13,7 +13,7 @@ Resource          ../../../libraries/ClusterManagement.robot
 Resource          ../../../variables/Variables.robot
 Resource          ../../../libraries/Utils.robot
 Resource          ../../../libraries/KarafKeywords.robot
-Resource          ../../../libraries/SSHKeywordsKeywords.robot
+Resource          ../../../libraries/SSHKeywords.robot
 
 *** Variables ***
 ${RESTCONF_MONITORING_URI}    /restconf/operational/ietf-restconf-monitoring:restconf-state
@@ -105,11 +105,39 @@ TLS on Restconf with Server & Client Certs (Self-signed)
 
 TLS on Restconf with Server & Client Certs (CA signed)
     [Documentation]    Tests HTTPS request with ODL TLS config and client authentication by using CA signed certificates
-    [Tags]    exclude
+    Clean Up Certificates In Server
+    Generate Server CA Signed Certificate
+    Generate Client CA Signed Certificate
+    #TLS Request
+    PycURLLibrary.Set Url    ${RESTCONF_MONITORING_URL}
+    PycURLLibrary.Add Header    "Content-Type:application/json"
+    PycURLLibrary.Add Header    Authorization:Basic YWRtaW46YWRtaW4=
+    PycURLLibrary.Client Certificate File    ${USER_HOME}/client_ca_signed-cert.pem
+    PycURLLibrary.Private Key File    ${USER_HOME}/client_ca_signed-key.pem
+    PycURLLibrary.Request Method    GET
+    PycURLLibrary.Perform
+    PycURLLibrary.Log Response
+    PycURLLibrary.Response Status Should Contain    200
+    ${resp}    PycURLLibrary.Response
+    Should Contain    ${resp}    "restconf-state":{"capabilities":{"capability":["urn:ietf:params:restconf:capability:depth
 
 Restconf HTTPS/TLS Jolokia with server and client certificates CA signed
     [Documentation]    Tests HTTPS request with ODL TLS config and client authentication by using CA signed certificates for Jolokia
-    [Tags]    exclude
+    Clean Up Certificates In Server
+    Generate Server CA Signed Certificate
+    Generate Client CA Signed Certificate
+    #TLS Request
+    PycURLLibrary.Set Url    https://${ODL_SYSTEM_IP}:${RESTCONFPORT_TLS}/${JOLOKIA_CONF_SHARD_MANAGER_URI}
+    PycURLLibrary.Add Header    "Content-Type:application/json"
+    PycURLLibrary.Add Header    Authorization:Basic YWRtaW46YWRtaW4=
+    PycURLLibrary.Client Certificate File    ${USER_HOME}/client_ca_signed-cert.pem
+    PycURLLibrary.Private Key File    ${USER_HOME}/client_ca_signed-key.pem
+    PycURLLibrary.Request Method    GET
+    PycURLLibrary.Perform
+    PycURLLibrary.Log Response
+    PycURLLibrary.Response Status Should Contain    200
+    ${resp}    PycURLLibrary.Response
+    Should Contain    ${resp}    "request":{"mbean":"org.opendaylight.controller:Category=ShardManager,name=shard-manager-config,type=DistributedConfigDatastore"
 
 *** Keywords ***
 Log Certificates in Keystore
@@ -148,7 +176,7 @@ Generate Client Self-Signed Certificate
     # limitation in pycurl library that does not support key pem files with passphrase in automatic mode (it asks for it)
     Run    openssl req -x509 -newkey rsa:4096 -nodes -keyout ${USER_HOME}/clientkey.pem -out ${USER_HOME}/clientcert.pem -days 365 -subj "/C=ES/ST=Madrid/L=Madrid/O=OpenDayLight/OU=AAA/CN=MiguelAngelMunoz/emailAddress=myemail@unknown.com"
     # Import client's cert as trusted
-    Copy File To Remote System    ${ODL_SYSTEM_IP}    ${USER_HOME}/clientcert.pem    .
+    Copy File To Odl System    ${ODL_SYSTEM_IP}    ${USER_HOME}/clientcert.pem
     Run Command On Remote System    ${ODL_SYSTEM_IP}    ${JAVA_HOME}/bin/keytool -import -trustcacerts -file clientcert.pem -keystore ${KEYSTORE_PATH} -storepass 123456 -noprompt
     Log Certificates in Keystore
     Restart Jetty
@@ -166,7 +194,7 @@ Generate Server CA Signed Certificate
     Run    openssl x509 -req -in ${USER_HOME}/server.csr -CA ${USER_HOME}/rootCA.pem -CAkey ${USER_HOME}/rootCA.key -CAcreateserial -out ${USER_HOME}/server.crt -days 500 -sha256
     # Convert to pkcs12 (including public and private key together)
     Run    openssl pkcs12 -export -in ${USER_HOME}/server.crt -inkey ${USER_HOME}/server.key -out ${USER_HOME}/server.p12 -name odl -passin pass:myPass -passout pass:myPass
-    Copy File To Remote System    ${ODL_SYSTEM_IP}    ${USER_HOME}/server.p12    .
+    Copy File To Odl System    ${ODL_SYSTEM_IP}    ${USER_HOME}/server.p12
     # Import Certifcate into keystore
     ${KEYSTORE_DIR}=    Split Path    ${KEYSTORE_PATH}
     Run Command On Remote System    ${ODL_SYSTEM_IP}    mkdir -p ${KEYSTORE_DIR[0]}
@@ -174,6 +202,25 @@ Generate Server CA Signed Certificate
     Log Certificates in Keystore
     Restart Jetty
 
+Generate Client CA Signed Certificate
+    [Documentation]    Generates a client certificate and signs it with own root CA
+    #Generates Root CA key and certificate (note this has to be self-signed)
+    Log Certificates in Keystore
+    Run    openssl genrsa -out ${USER_HOME}/rootCA_for_clients-key.pem 2048
+    Run    openssl req -x509 -new -nodes -key ${USER_HOME}/rootCA_for_clients-key.pem -sha256 -days 1024 -out ${USER_HOME}/rootCA_for_clients-cert.pem -subj "/C=ES/ST=Madrid/L=Madrid/O=FakeCA_ForClient/OU=FakeCA_ForClient/CN=www.fakecaforclients.com/emailAddress=unknown@fakecaforclients.com"
+    #Generate client CSR
+    Run    openssl genrsa -out ${USER_HOME}/client_ca_signed-key.pem 2048
+    Run    openssl req -new -key ${USER_HOME}/client_ca_signed-key.pem -out ${USER_HOME}/client_ca_signed.csr -subj "/C=ES/ST=Madrid/L=Madrid/O=OpenDayLight/OU=RestClient/CN=RestClient/emailAddress=unknown@unknownclient.com"
+    #Sign CSR
+    Run    openssl x509 -req -in ${USER_HOME}/client_ca_signed.csr -CA ${USER_HOME}/rootCA_for_clients-cert.pem -CAkey ${USER_HOME}/rootCA_for_clients-key.pem -CAcreateserial -out ${USER_HOME}/client_ca_signed-cert.pem -days 500 -sha256
+    Copy File To Odl System    ${ODL_SYSTEM_IP}    ${USER_HOME}/rootCA_for_clients-cert.pem
+    # Import RootCA Certifcate into keystore
+    ${KEYSTORE_DIR}=    Split Path    ${KEYSTORE_PATH}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    mkdir -p ${KEYSTORE_DIR[0]}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    ${JAVA_HOME}/bin/keytool -import -trustcacerts -file rootCA_for_clients-cert.pem -keystore ${KEYSTORE_PATH} -storepass 123456 -noprompt
+    Log Certificates in Keystore
+    Restart Jetty
+
 Disable TLS in ODL
     [Documentation]    Remove TLS configuration in custom.properties
     Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.osgi.service.http.secure.enabled=/d' ${CUSTOMPROP}
@@ -185,6 +232,11 @@ Disable TLS in ODL
 
 Enable TLS in ODL
     [Documentation]    Add new secure configuration in custom.properties
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.osgi.service.http.secure.enabled=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.keystore=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.password=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.keypassword=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.clientauthneeded=/d' ${CUSTOMPROP}
     Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.osgi.service.http.secure.enabled=true">> ${CUSTOMPROP}
     Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.keystore=${KEYSTORE_RELATIVE_PATH}">> ${CUSTOMPROP}
     Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.password=myPass">> ${CUSTOMPROP}
@@ -193,6 +245,15 @@ Enable TLS in ODL
 
 Enable Client TLS Authentication in ODL
     [Documentation]    Add custom.properties configuration to enable client auth
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.osgi.service.http.secure.enabled=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.keystore=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.password=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.keypassword=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    sed -i '/org.ops4j.pax.web.ssl.clientauthneeded=/d' ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.osgi.service.http.secure.enabled=true">> ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.keystore=${KEYSTORE_RELATIVE_PATH}">> ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.password=myPass">> ${CUSTOMPROP}
+    Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.keypassword=123456">> ${CUSTOMPROP}
     Run Command On Remote System    ${ODL_SYSTEM_IP}    echo "org.ops4j.pax.web.ssl.clientauthneeded=true">> ${CUSTOMPROP}
     Restart Karaf
 
@@ -201,6 +262,7 @@ Init Suite
     ClusterManagement_Setup
     Clean Up Certificates In Server
     Disable TLS in ODL
+    Install a Feature    odl-jolokia
 
 Cleanup Suite
     [Documentation]    Deletes pending sessions in case there were any
Integration test