Add EAP-TLS integration tests (Manual and SCEP)

addons/vagrant/playbooks/nodes/pre_prov/packages.yml

@@ -34,6 +34,7 @@
       - packetfence-test
       - wpasupplicant
       - sscep
+      - rsync
 
   roles:
     - role: inverse_inc.gitlab_buildpkg_tools

t/venom/nodes/wired_dot1x_eap_tls/run_sscep_on_node01.yml

@@ -0,0 +1,69 @@
+name: Run SSCEP on node01
+testcases:
+- name: create_temp_directory
+  steps:
+    - type: exec
+      script: "mktemp -d"
+      info: '{{.result.systemout}}'
+      vars:
+        temp_dir:
+          from: result.systemout
+
+- name: generate_private_key_without_passphrase
+  steps:
+    - type: exec
+      script: |
+        ( _fd="{{.create_temp_directory.temp_dir}}/client.key" ; _len="2048" ; \
+        openssl genrsa -out ${_fd} ${_len} )
+
+- name: generate_csr_config
+  steps:
+    - type: exec
+      script: |
+        cat > {{.create_temp_directory.temp_dir}}/client.cnf << EOF
+        [req]
+        default_bits = 2048
+        prompt = no
+        default_md = sha256
+        distinguished_name = dn
+        attributes = req_attributes
+
+        [ req_attributes ]
+        challengePassword = {{.wired_dot1x_eap_tls_manual.certs.user.scep_challenge_password}}
+
+        # only CN is kept by pfpki
+        [ dn ]
+        C=FR
+        ST=Radius
+        L=Somewhere
+        O=Example Inc.
+        CN={{.wired_dot1x_eap_tls_scep.certs.user.cn}}
+        EOF
+
+- name: generate_csr_with_challenge
+  steps:
+    - type: exec
+      script: |
+        ( _fd="{{.create_temp_directory.temp_dir}}/client.key" ; _fd_csr="{{.create_temp_directory.temp_dir}}/client.csr" ; \
+        openssl req -out ${_fd_csr} -new -key ${_fd} -config {{.create_temp_directory.temp_dir}}/client.cnf )
+
+- name: get_ca_cert_using_sscep
+  steps:
+    - type: exec
+      script: |
+        sscep getca -u http://{{.pfserver_mgmt_ip}}/scep/{{.wired_dot1x_eap_tls_scep.templates.user.name}} \
+        -c {{.create_temp_directory.temp_dir}}/ca.pem -i {{.wired_dot1x_eap_tls_scep.certs.ca.cn}} -v -d
+
+- name: get_client_cert_using_sscep
+  steps:
+    - type: exec
+      script: |
+        sscep enroll -c {{.create_temp_directory.temp_dir}}/ca.pem  -k {{.create_temp_directory.temp_dir}}/client.key \
+        -r {{.create_temp_directory.temp_dir}}/client.csr \
+        -u http://{{.pfserver_mgmt_ip}}/scep/{{.wired_dot1x_eap_tls_scep.templates.user.name}} -l {{.create_temp_directory.temp_dir}}/client.pem -v -d -S sha1 -E aes
+
+- name: move_certificates
+  steps:
+    - type: exec
+      script: |
+        sudo cp -v {{.create_temp_directory.temp_dir}}/* /etc/wpa_supplicant/eap_tls/

t/venom/nodes/wired_dot1x_eap_tls/run_wpasupplicant.yml

@@ -0,0 +1,9 @@
+name: Run wpasupplicant for EAP-TLS
+testcases:
+- name: run_wpasupplicant_eap_peap
+  steps:
+  - type: exec
+    script: "sudo wpa_supplicant -c /etc/wpa_supplicant/eap_tls/eap_tls.conf -D wired -i ens7 -B"
+    timeout: 10
+    assertions:
+      - result.systemout ShouldContainSubstring "Successfully initialized wpa_supplicant"

t/venom/pfservers/global_config_multi_tenant/10_create_roles.yml

@@ -61,17 +61,17 @@ testcases:
     assertions:
       - result.statuscode ShouldEqual 201
 
-- name: create_dot1x_eap_tls_pfpki_role
+- name: create_wired_dot1x_eap_tls_manual.role
   steps:
   - type: http
     method: POST
     url: '{{.pfserver_webadmin_url}}/api/v1/config/roles'
     ignore_verify_ssl: true
     body: >-
       {
-        "id":"{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.id}}",
+        "id":"{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id}}",
         "max_nodes_per_pid":0,
-        "notes":"{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.notes}}"
+        "notes":"{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.notes}}"
       }
     headers:
       "Authorization": "{{.get_login_token.json.result.token}}"

t/venom/pfservers/global_config_multi_tenant/15_create_network_devices.yml

@@ -107,10 +107,10 @@ testcases:
         "{{.wired_mac_auth.roles.headless_device.id}}Role": null,
         "{{.wired_mac_auth.roles.headless_device.id}}Url": null,
         "{{.wired_mac_auth.roles.headless_device.id}}Vlan": "{{.wired_mac_auth.roles.headless_device.vlan_id}}",
-        "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.id}}AccessList": null,
-        "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.id}}Role": null,
-        "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.id}}Url": null,
-        "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.id}}Vlan": "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.vlan_id}}",
+        "{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id}}AccessList": null,
+        "{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id}}Role": null,
+        "{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id}}Url": null,
+        "{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id}}Vlan": "{{.dot1x_eap_tls_pfpki.roles.dot1x_eap_tls.vlan_id}}",
         "voiceAccessList": null,
         "voiceRole": null,
         "voiceUrl": null,

t/venom/scenarios/dot1x_eap_tls/playbooks/run_tests.yml

@@ -7,8 +7,10 @@
     test_suites:
       - configurator
       - global_config
-      - dot1x_eap_tls_pfpki
-      - dot1x_eap_tls_pfpki/teardown
+      - wired_dot1x_eap_tls_manual
+      - wired_dot1x_eap_tls_manual/teardown
+      - wired_dot1x_eap_tls_scep
+      - wired_dot1x_eap_tls_scep/teardown
       - global_teardown
 
   tasks:

t/venom/switches/common/check_dot1x_int_status.yml

@@ -16,8 +16,7 @@ testcases:
       "Content-Type": "application/json"
     assertions:
       # we didn't check MAC address on port to make this testcase reusable
-      - result.body ShouldContainSubstring "{{.dot1x_eap_peap.roles.ad_user.vlan_id}}"
-      - result.body ShouldContainSubstring PEAP
-      - result.body ShouldContainSubstring "{{.ad_domain_user}}"
+      - result.body ShouldContainSubstring "{{.wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.vlan_id}}"
+      - result.body ShouldContainSubstring TLS
       - result.body ShouldContainSubstring AUTHORIZED
       - result.statuscode ShouldEqual 200