Netconf Public key tests 64/61564/26
authorAtul Gosain <atul.gosain@gmail.com>
Sat, 12 Aug 2017 02:04:07 +0000 (19:04 -0700)
committerAtul Gosain <atul.gosain@gmail.com>
Tue, 22 Aug 2017 21:18:00 +0000 (14:18 -0700)
Integration test for netconf public key based authentication

Change-Id: I02241d7d8ccd48a869cbf539209f43231f3527c0
Signed-off-by: Atul Gosain <atul.gosain@gmail.com>
csit/suites/netconf/KeyAuth/keyauth.robot [new file with mode: 0644]
csit/testplans/netconf-userfeatures.txt
csit/variables/netconf/KeyAuth/datastore.xml [new file with mode: 0644]
csit/variables/netconf/KeyAuth/org.opendaylight.netconf.topology.sb.keypair.cfg [new file with mode: 0644]
csit/variables/netconf/KeyAuth/sb-rsa-key [new file with mode: 0644]
csit/variables/netconf/KeyAuth/sb-rsa-key.pub [new file with mode: 0644]

diff --git a/csit/suites/netconf/KeyAuth/keyauth.robot b/csit/suites/netconf/KeyAuth/keyauth.robot
new file mode 100644 (file)
index 0000000..fbd4d16
--- /dev/null
@@ -0,0 +1,111 @@
+*** Settings ***
+Documentation     Test suite to verify the device mount using public key based auth.
+Suite Setup       Suite Setup
+Suite Teardown    Suite Teardown
+Library           SSHLibrary
+Library           RequestsLibrary
+Resource          ../../../libraries/SSHKeywords.robot
+Resource          ../../../libraries/ClusterManagement.robot
+Resource          ../../../variables/Variables.robot
+Resource          ${CURDIR}/../../../libraries/NetconfKeywords.robot
+Resource          ${CURDIR}/../../../libraries/SetupUtils.robot
+Resource          ${CURDIR}/../../../libraries/TemplatedRequests.robot
+Resource          ${CURDIR}/../../../variables/Variables.robot
+
+*** Variables ***
+${pkPassphrase}    topsecret
+${directory_with_template_folders}    ${CURDIR}/../../../variables/netconf/CRUD
+${device_name}    netconf-test-device
+${device_type}    full-uri-device
+${netopeer_port}    830
+${netopeer_user}    root
+${netopeer_pwd}    wrong
+${USE_NETCONF_CONNECTOR}    ${False}
+
+*** Test Cases ***
+Check_Device_Is_Not_Configured_At_Beginning
+    [Documentation]    Sanity check making sure our device is not there. Fail if found.
+    NetconfKeywords.Check_Device_Has_No_Netconf_Connector    ${device_name}
+
+Configure_Device_On_Netconf
+    [Documentation]    Make request to configure netconf netopeer with wrong password. Correct auth is root/root
+    ...    ODL should connect to device using public key auth as password auth will fail.
+    NetconfKeywords.Configure_Device_In_Netconf    ${device_name}    device_type=${device_type}    http_timeout=2    device_user=${netopeer_user}    device_password=${netopeer_pwd}    device_port=${netopeer_port}
+
+Wait_For_Device_To_Become_Connected
+    [Documentation]    Wait until the device becomes available through Netconf.
+    NetconfKeywords.Wait_Device_Connected    ${device_name}
+
+Deconfigure_Device_From_Netconf
+    [Documentation]    Make request to deconfigure the testtool device on Netconf connector.
+    [Setup]    SetupUtils.Setup_Test_With_Logging_And_Without_Fast_Failing
+    NetconfKeywords.Remove_Device_From_Netconf    ${device_name}
+
+Check_Device_Going_To_Be_Gone_After_Deconfiguring
+    [Documentation]    Check that the device is really going to be gone. Fail
+    ...    if found after one minute. This is an expected behavior as the
+    ...    delete request is sent to the config subsystem which then triggers
+    ...    asynchronous destruction of the netconf connector referring to the
+    ...    device and the device's data. This test makes sure this
+    ...    asynchronous operation does not take unreasonable amount of time
+    ...    by making sure that both the netconf connector and the device's
+    ...    data is gone before reporting success.
+    [Tags]    critical
+    NetconfKeywords.Wait_Device_Fully_Removed    ${device_name}
+
+*** Keywords ***
+Run Netopeer Docker Container
+    [Documentation]    Start a new docker container for netopeer server.
+    ${netopeer_conn_id} =    SSHKeywords.Open_Connection_To_Tools_System
+    SSHLibrary.Put File    ${CURDIR}/../../../variables/netconf/KeyAuth/datastore.xml    .
+    SSHLibrary.Put File    ${CURDIR}/../../../variables/netconf/KeyAuth/sb-rsa-key.pub    .
+    Builtin.Set Suite Variable    ${netopeer_conn_id}
+    ${stdout}    ${stderr}    ${rc}=    SSHLibrary.Execute Command    docker run -dt -p ${netopeer_port}:830 -v ${USER_HOME}/datastore.xml:/usr/local/etc/netopeer/cfgnetopeer/datastore.xml -v ${USER_HOME}/sb-rsa-key.pub:/root/RSA.pub sdnhub/netopeer netopeer-server -v 3    return_stdout=True    return_stderr=True
+    ...    return_rc=True
+    ${stdout}    ${stderr}    ${rc}=    SSHLibrary.Execute Command    docker ps    return_stdout=True    return_stderr=True
+    ...    return_rc=True
+    Log    ${stdout}
+
+Configure ODL with Key config
+    [Documentation]    Configure the ODL with the Southbound key configuration file containing details about private key path and passphrase
+    SSHKeywords.Open_Connection_To_ODL_System
+    Log    Bundle folder ${WORKSPACE}/${BUNDLEFOLDER}/etc
+    SSHLibrary.Put File    ${CURDIR}/../../../variables/netconf/KeyAuth/org.opendaylight.netconf.topology.sb.keypair.cfg    ${WORKSPACE}/${BUNDLEFOLDER}/etc/
+    SSHLibrary.Put File    ${CURDIR}/../../../variables/netconf/KeyAuth/sb-rsa-key    ${WORKSPACE}/${BUNDLEFOLDER}/etc/    400
+    ${stdout}=    SSHLibrary.Execute Command    ls -l ${WORKSPACE}/${BUNDLEFOLDER}/etc/    return_stdout=True
+    Log    ${stdout}
+    Restart Controller
+
+Restart Controller
+    [Documentation]    Controller restart is needed in order the new shiro.ini config takes effect
+    ClusterManagement.ClusterManagement_Setup
+    Wait Until Keyword Succeeds    5x    20    Stop_Single_Member    1
+    Start_Single_Member    1    wait_for_sync=False    timeout=120
+    Wait Until Keyword Succeeds    30x    5s    Get Controller Modules
+
+Get Controller Modules
+    [Documentation]    Get the restconf modules, check 200 status and ietf-restconf presence
+    ${resp} =    RequestsLibrary.Get_Request    default    ${MODULES_API}
+    BuiltIn.Log    ${resp.content}
+    BuiltIn.Should_Be_Equal    ${resp.status_code}    ${200}
+    BuiltIn.Should_Contain    ${resp.content}    ietf-restconf
+
+Prepare for public key auth
+    [Documentation]    Mount the netopeer server which trusts the ODL SB's public key using key based auth.
+    # Create the configuration file for netconf sb keypair
+    # Place the public key so it can be mounted to netopeer docker container
+    Run Netopeer Docker Container
+    Configure ODL with Key config
+
+Suite Teardown
+    [Documentation]    Tearing down the setup.
+    RequestsLibrary.Delete_All_Sessions
+    SSHLibrary.Close_All_Connections
+
+Suite Setup
+    [Documentation]    Get the suite ready for callhome test cases.
+    SetupUtils.Setup_Utils_For_Setup_And_Teardown
+    NetconfKeywords.Setup_Netconf_Keywords
+    ${device_type}=    BuiltIn.Set_Variable_If    """${USE_NETCONF_CONNECTOR}""" == """True"""    default    ${device_type}
+    BuiltIn.Set_Suite_Variable    ${device_type}
+    Prepare for public key auth
index d977472deb228afe82eb2dbf5e447a81b0b0535d..55f7482a7ed864aa3d0a50180d5635f1418006eb 100644 (file)
@@ -10,6 +10,7 @@ integration/test/csit/suites/netconf/apidocs
 integration/test/csit/suites/netconf/MDSAL
 integration/test/csit/suites/netconf/CRUD
 integration/test/csit/suites/netconf/notifications
+integration/test/csit/suites/netconf/KeyAuth
 # The following suite only works on Centos 6 right now,
 # due to the way netopeer is installed.
 # integration/test/csit/suites/controller/NETCONF
diff --git a/csit/variables/netconf/KeyAuth/datastore.xml b/csit/variables/netconf/KeyAuth/datastore.xml
new file mode 100644 (file)
index 0000000..9cb04e5
--- /dev/null
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<datastores xmlns="urn:cesnet:tmc:datastores:file">
+  <running lock="">
+    <netopeer xmlns="urn:cesnet:tmc:netopeer:1.0">
+      <ssh>
+        <client-auth-keys>
+          <client-auth-key>
+            <path>/root/RSA.pub</path>
+            <username>root</username>
+          </client-auth-key>
+        </client-auth-keys>
+      </ssh>
+    </netopeer>
+  </running>
+  <startup lock="">
+    <netopeer xmlns="urn:cesnet:tmc:netopeer:1.0">
+      <ssh>
+        <client-auth-keys>
+          <client-auth-key>
+            <path>/root/RSA.pub</path>
+            <username>root</username>
+          </client-auth-key>
+        </client-auth-keys>
+      </ssh>
+    </netopeer>
+  </startup>
+  <candidate modified="false" lock=""/>
+</datastores>
diff --git a/csit/variables/netconf/KeyAuth/org.opendaylight.netconf.topology.sb.keypair.cfg b/csit/variables/netconf/KeyAuth/org.opendaylight.netconf.topology.sb.keypair.cfg
new file mode 100644 (file)
index 0000000..16e0300
--- /dev/null
@@ -0,0 +1,2 @@
+private-key-path=etc/sb-rsa-key
+private-key-passphrase=topsecret
diff --git a/csit/variables/netconf/KeyAuth/sb-rsa-key b/csit/variables/netconf/KeyAuth/sb-rsa-key
new file mode 100644 (file)
index 0000000..67d7925
--- /dev/null
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,EA61FA90F5252AA4DB801B1A95907E08
+
+tKdknMpuxmKIwoD6KOlsChbRszafdHN7+Vzzn3gErAMnktW9NSeCTpWeHbgdIYsK
+8Wh2FH978JxdS9hCqzrLQ0e73zr1pMRYPLaVg4zJRLJhemk9LXLQ2xFgtE86kvnl
+SADbu9JooDyDTYRdRC3+ekU2t1J6mUord7FM8T3fFpQ9XBxL2DPrctqlQgLtxZ9e
+6JPN5H7ftxo4x8RxLtXLyvTiO1inKPkuqok+Q5QhKedEQZIUqmeCjhnbfgRP/cxF
+zP97luGP4qSsbieQVt4g0DjNteLu128a0VYHK1wX/UUvLkpWNaX2XZMSZzCiY5bW
+FFMIaq0nOdQvn4UImYMcK/hxlj2Qk0LR5GrY4fjuhsFHNnICx14FNY1GSoAuYS16
+/P9wNbcT7DG/10JxjjQz25RIjhLkqoFPenj6/HPPVih7Brm5Sfjhg+mSGF2lq+cc
+TKsq/XlaZ0MwtuqpuhQzvwNDjINBXQlnjLQVtYDImmz8qPOwRFvvuap6oAhErTeT
+dLNHUIO1eMFgRCUObN/B0VhgAWKqLCAj4fsbKQNQI55qD++YGhH0h+JmIsA8QbTa
+pq+2108amdt7Cy9EtFJCXDka6VzgPEIZgoEnUkiYu9LXp2twPbZ+B4+Ls6ukbemS
+EgOMcWmFLCXs7dY5nVWiie8x7xHPiExKNqAK/HoY7K5WQaaANaA8XYq8xcg2zOlj
+pXV3n0/Y5J0svLnf4nmdSEwso1UnanzV0fagMaGLxYz8jGt2Xpbzv7uUw7w2qL/D
+FNvVSUXj3yu/FulU/TuFM3KnNDHgHAidA/SFzvltvX+2rs+ZUYKbpsooR3vlWPDM
+XPnQm9mZ5MKei4KRom4DbEFEyVALua7QktRTkK2/TpD0euX6zV7PwAOHEAiJbCcr
+5EWkaAsZGAns9mh0iNEwz6tTuZeaM6ipEAUlZdAbtx/Cd3k+Il6SuehDWjyGHIgu
+VCGfW6VrwCUepna/cNpt8PHLXTC0TQgonyyBi29N0Ha/ReC1MPOe0Xq/G62gojbU
+3IUh1NkzkAMw6ShDuIUdm0fjes8Lok7FnLBIhNHHCPHnr9cKDyKdSolgnxdDuEUd
+LJyeq9TQLPSCZAZKAuihHDLKyHPBh/8N/nAOLnEJvdKA1ledQt378GRg/GTALWwg
+7LTAuz4iwwbEWnfwZv+s/R2RQHsR38wzknMzsfBHBxiwe0Hg2a9wgBJKhQyXJYBI
+HJVqElrMEHWyg1Wwfvf34EYwMkDLg6Os54h2zj7bPKg+c5AUrir0ptuhPFPpqY9y
+vTBYrOPHH9/Y7kc4NRVfcWGeiThrHcAEpNFStWzvDY4c4GtIIdj5l2mQKG10r+pO
+oiCSzGlP1WPrqHA4jDhpOPkrqTsXwhQQH3k1hpRoiFoKMXw2bR3WU+0SC2SvZXlN
+NozdxjzvIDAsMHXqiPdq94XXgZWROulm1XI7dLE3oecBRorvs1M1EOQMLrNCCcck
+pzx6KP+P5tNjwCfj5CP+vLo+PcBPd8plbLv9MPtRtOYysR5g1L8DRFpkykV8DfQd
+l1xPWE37KRMCj66/OYQCU+WhlDqp1YZHrZ5FahmIm+dX9p7npvyDDd//9L+EfA7S
+-----END RSA PRIVATE KEY-----
diff --git a/csit/variables/netconf/KeyAuth/sb-rsa-key.pub b/csit/variables/netconf/KeyAuth/sb-rsa-key.pub
new file mode 100644 (file)
index 0000000..026cd44
--- /dev/null
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8VkGePpje+89bbVy2NXjcpZFe6bBitlZcqQp48iueGmrY6T1j9bO1CRothvM8Sl5q3arzXUIribh9rfDtgQZKLqBD2JySqrhyHd1rT3vd8Qvs7iA3Nr0OMC0OcHBxLPTE1KBKs+exnvkuctEnVORjX+qXSi1kJzVoGAGJpVsDRBLu8l144S3KjPW7G3iZotggQAEncfc7YEWGXIJpBKfVbTprnnvS4BitWmHnW1l9dFvAWm2yZhjf7PayFXtYBdD6S3G4wn4WxqKBYTgQ5LgBiYOzhvXh9kvA/odt7TFH/HNz8Vlpn8kRQert9Yos8dIXX9nHHSkxKm7vagcE8kXB lumina@atul-test-vm