b980fdb3a2
This patch adds IPSet CRUD operations under the security module. This patch also adds a util method for IPSets to return reference dict for IPSet objects. Change-Id: Ie5157055e80ec1976159cabc172d8285314570c4
140 lines
5.2 KiB
Python
140 lines
5.2 KiB
Python
# Copyright (c) 2015 OpenStack Foundation.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
# implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import mock
|
|
|
|
from oslo_utils import uuidutils
|
|
|
|
from vmware_nsxlib.tests.unit.v3 import nsxlib_testcase
|
|
from vmware_nsxlib.tests.unit.v3 import test_constants
|
|
from vmware_nsxlib.v3 import nsx_constants as const
|
|
|
|
|
|
class TestNsxLibFirewallSection(nsxlib_testcase.NsxLibTestCase):
|
|
"""Tests for vmware_nsxlib.v3.security.NsxLibFirewallSection"""
|
|
|
|
def test_get_logicalport_reference(self):
|
|
mock_port = '3ed55c9f-f879-4048-bdd3-eded92465252'
|
|
result = self.nsxlib.firewall_section.get_logicalport_reference(
|
|
mock_port)
|
|
expected = {
|
|
'target_id': '3ed55c9f-f879-4048-bdd3-eded92465252',
|
|
'target_type': 'LogicalPort'
|
|
}
|
|
self.assertEqual(expected, result)
|
|
|
|
def test_get_rule_address(self):
|
|
result = self.nsxlib.firewall_section.get_rule_address(
|
|
'target-id', 'display-name')
|
|
expected = {
|
|
'target_display_name': 'display-name',
|
|
'target_id': 'target-id',
|
|
'is_valid': True,
|
|
'target_type': 'IPv4Address'
|
|
}
|
|
self.assertEqual(expected, result)
|
|
|
|
def test_get_l4portset_nsservice(self):
|
|
result = self.nsxlib.firewall_section.get_l4portset_nsservice()
|
|
expected = {
|
|
'service': {
|
|
'resource_type': 'L4PortSetNSService',
|
|
'source_ports': [],
|
|
'destination_ports': [],
|
|
'l4_protocol': 'TCP'
|
|
}
|
|
}
|
|
self.assertEqual(expected, result)
|
|
|
|
def test_create_with_rules(self):
|
|
expected_body = {
|
|
'display_name': 'display-name',
|
|
'description': 'section-description',
|
|
'stateful': True,
|
|
'section_type': "LAYER3",
|
|
'applied_tos': [],
|
|
'rules': [{
|
|
'display_name': 'rule-name',
|
|
'direction': 'IN_OUT',
|
|
'ip_protocol': "IPV4_IPV6",
|
|
'action': "ALLOW",
|
|
'logged': False,
|
|
'disabled': False,
|
|
'sources': [],
|
|
'destinations': [],
|
|
'services': []
|
|
}],
|
|
'tags': []
|
|
}
|
|
with mock.patch.object(self.nsxlib.client, 'create') as create:
|
|
rule = self.nsxlib.firewall_section.get_rule_dict('rule-name')
|
|
self.nsxlib.firewall_section.create_with_rules(
|
|
'display-name', 'section-description', rules=[rule])
|
|
resource = 'firewall/sections?operation=insert_bottom' \
|
|
'&action=create_with_rules'
|
|
create.assert_called_with(resource, expected_body)
|
|
|
|
|
|
class TestNsxLibIPSet(nsxlib_testcase.NsxClientTestCase):
|
|
"""Tests for vmware_nsxlib.v3.security.NsxLibIPSet"""
|
|
|
|
def test_get_ipset_reference(self):
|
|
mock_ip_set = uuidutils.generate_uuid()
|
|
result = self.nsxlib.ip_set.get_ipset_reference(
|
|
mock_ip_set)
|
|
expected = {
|
|
'target_id': mock_ip_set,
|
|
'target_type': const.IP_SET
|
|
}
|
|
self.assertEqual(expected, result)
|
|
|
|
def test_create_ip_set(self):
|
|
fake_ip_set = test_constants.FAKE_IP_SET.copy()
|
|
data = {
|
|
'display_name': fake_ip_set['display_name'],
|
|
'ip_addresses': fake_ip_set['ip_addresses'],
|
|
'description': 'ipset-desc',
|
|
'tags': []
|
|
}
|
|
with mock.patch.object(self.nsxlib.client, 'create') as create:
|
|
self.nsxlib.ip_set.create(
|
|
fake_ip_set['display_name'], 'ipset-desc',
|
|
ip_addresses=fake_ip_set['ip_addresses'])
|
|
resource = 'ip-sets'
|
|
create.assert_called_with(resource, data)
|
|
|
|
def test_delete_ip_set(self):
|
|
with mock.patch.object(self.nsxlib.client, 'delete') as delete:
|
|
fake_ip_set = test_constants.FAKE_IP_SET.copy()
|
|
self.nsxlib.ip_set.delete(fake_ip_set['id'])
|
|
delete.assert_called_with('ip-sets/%s' % fake_ip_set['id'])
|
|
|
|
def test_update_ip_set(self):
|
|
fake_ip_set = test_constants.FAKE_IP_SET.copy()
|
|
new_ip_addresses = ['10.0.0.0']
|
|
data = {
|
|
'id': fake_ip_set['id'],
|
|
'display_name': fake_ip_set['display_name'],
|
|
'ip_addresses': new_ip_addresses,
|
|
'resource_type': 'IPSet'
|
|
}
|
|
with mock.patch.object(self.nsxlib.client, 'get',
|
|
return_value=fake_ip_set):
|
|
with mock.patch.object(self.nsxlib.client, 'update') as update:
|
|
self.nsxlib.ip_set.update(
|
|
fake_ip_set['id'], ip_addresses=new_ip_addresses)
|
|
resource = 'ip-sets/%s' % fake_ip_set['id']
|
|
update.assert_called_with(resource, data)
|