summaryrefslogtreecommitdiffstats
path: root/tests/adhoc/dmz01.sh
diff options
context:
space:
mode:
Diffstat (limited to 'tests/adhoc/dmz01.sh')
-rw-r--r--tests/adhoc/dmz01.sh63
1 files changed, 49 insertions, 14 deletions
diff --git a/tests/adhoc/dmz01.sh b/tests/adhoc/dmz01.sh
index 6ed290a..97c22e1 100644
--- a/tests/adhoc/dmz01.sh
+++ b/tests/adhoc/dmz01.sh
@@ -20,10 +20,11 @@
# specifically-named security group)
# 2) Identifying VMs connected per (1), which are by policy not allowed to be
# (currently implemented through an image tag intended to identify images
-# that are "authorized" i.e. tested and secure, to be DMZ-connected)
+# that are "authorized" i.e. tested and secure, to be DMZ-connected)
+# 3) Reactively enforce the dmz placement rule by pausing VMs found to be in
+# violation of the policy.
#
-# Status: this is a work in progress, under test. Test (1) has been verified,
-# Test (2) is still in development.
+# Status: this is a work in progress, under test.
#
# How to use:
# Install test server per https://wiki.opnfv.org/copper/academy/congress/test
@@ -54,6 +55,9 @@ openstack congress policy create test
echo "Create dmz_server rule in policy 'test'"
openstack congress policy rule create test "dmz_server(x) :- nova:servers(id=x,status='ACTIVE'), neutronv2:ports(id, device_id, status='ACTIVE'), neutronv2:security_group_port_bindings(pid, sg), neutronv2:security_groups(sg,name='dmz')" --name dmz_server
+echo "Create dmz_placement_error rule in policy 'test'"
+openstack congress policy rule create test "dmz_placement_error(id) :- nova:servers(id,name,hostId,status,tenant_id,user_id,image), not glancev2:tags(image,'dmz'), dmz_server(id)" --name dmz_placement_error
+
echo "Create image cirros1 with non-dmz image"
image=$(openstack image list | awk "/ cirros-0.3.3-x86_64 / { print \$2 }")
if [ "$image" == "" ]; then glance --os-image-api-version 1 image-create --name cirros-0.3.3-x86_64 --disk-format qcow2 --location http://download.cirros-cloud.net/0.3.3/cirros-0.3.3-x86_64-disk.img --container-format bare
@@ -91,12 +95,18 @@ neutron router-gateway-set test_router test_public
echo "Add router internal for internal network"
neutron router-interface-add test_router subnet=test_internal
-echo "Wait 30 seconds as the previous command interrupts the neutron-api for some time..."
+echo "Wait up to a minute for as 'neutron router-interface-add' blocks the neutron-api for some time..."
# add a delay since the previous command takes the neutron-api offline for a while (?)
-sleep 30
-
-echo "Get the internal network ID"
-test_internal_NET=$(neutron net-list | awk "/ test_internal / { print \$2 }")
+COUNTER=1
+RESULT="Failed!"
+until [[ $COUNTER -gt 6 || $RESULT == "Success!" ]]; do
+ echo "Get the internal network ID: try" $COUNTER
+ test_internal_NET=$(neutron net-list | awk "/ test_internal / { print \$2 }")
+ if [ "$test_internal_NET" != "" ]; then RESULT="Success!"
+ fi
+ let COUNTER+=1
+ sleep 10
+done
echo "Create a security group 'dmz'"
neutron security-group-create dmz
@@ -110,8 +120,8 @@ nova boot --flavor m1.tiny --image cirros-0.3.3-x86_64 --nic net-id=$test_intern
echo "Boot cirros2 with non-dmz image"
nova boot --flavor m1.tiny --image cirros-0.3.3-x86_64-dmz --nic net-id=$test_internal_NET --security-groups dmz cirros2
-echo "Wait 30 seconds for Congress polling to occur at least once"
-sleep 30
+echo "Wait 5 seconds for Congress polling to occur at least once"
+sleep 5
echo "Get cirros1 instance ID"
test_cirros1_ID=$(openstack server list | awk "/ cirros1 / { print \$2 }")
@@ -123,15 +133,40 @@ echo "Verify cirros1 and cirros2 IDs are in the Congress policy 'test' table 'dm
COUNTER=5
RESULT="Test Failed!"
until [[ $COUNTER -eq 0 || $RESULT == "Test Success!" ]]; do
- echo "Check for presence of cirros1 ID in Congress policy 'test' table 'dmz_server'"
dmz_cirros1=$(openstack congress policy row list test dmz_server | awk "/ $test_cirros1_ID / { print \$2 }")
- echo "Check for presence of cirros2 ID in Congress policy 'test' table 'dmz_server'"
dmz_cirros2=$(openstack congress policy row list test dmz_server | awk "/ $test_cirros2_ID / { print \$2 }")
if [ "$dmz_cirros1" == "$test_cirros1_ID" ] && [ "$dmz_cirros2" == "$test_cirros2_ID" ]; then RESULT="Test Success!"
fi
let COUNTER-=1
- sleep 10
+ sleep 5
+done
+echo "dmz_server table entries present for cirros1, cirros2:" $RESULT
+
+echo "Verify cirros1 ID is in the Congress policy 'test' table 'dmz_placement_error'"
+COUNTER=5
+RESULT="Test Failed!"
+until [[ $COUNTER -eq 0 || $RESULT == "Test Success!" ]]; do
+ dmz_cirros1=$(openstack congress policy row list test dmz_placement_error | awk "/ $test_cirros1_ID / { print \$2 }")
+ if [ "$dmz_cirros1" == "$test_cirros1_ID" ]; then RESULT="Test Success!"
+ fi
+ let COUNTER-=1
+ sleep 5
+done
+echo "dmz_placement_error table entry present for cirros2:" $RESULT
+
+echo "Create reactive 'paused_dmz_placement_error' rule in policy 'test'"
+openstack congress policy rule create test "execute[nova:servers.pause(id)] :- dmz_placement_error(id), nova:servers(id,status='ACTIVE')" --name paused_dmz_placement_error
+
+echo "Verify cirros1 is paused"
+COUNTER=5
+RESULT="Test Failed!"
+until [[ $COUNTER -eq 0 || $RESULT == "Test Success!" ]]; do
+ cirros1_status=$(nova list | awk "/ cirros1 / { print \$6 }")
+ if [ "$cirros1_status" == "PAUSED" ]; then RESULT="Test Success!"
+ fi
+ let COUNTER-=1
+ sleep 5
done
-echo $RESULT
+echo "Verify cirros1 is paused:" $RESULT
set +x #echo off