mirror of
https://github.com/linux-system-roles/network.git
synced 2026-01-23 02:15:17 +00:00
f3dcba4350
Simplify the cumbersome assertion. Drop the ancient Fedora releases from the __NM_capath_ignored_NVRs list. Signed-off-by: Martin Pitt <mpitt@redhat.com>
120 lines
3.7 KiB
YAML
120 lines
3.7 KiB
YAML
---
|
|
- name: >-
|
|
TEST: 802.1x profile with unencrypted private key and ca_path
|
|
debug:
|
|
msg: "##################################################"
|
|
- name: Set __NM_capath_ignored_NVRs
|
|
set_fact:
|
|
# Fixed versions/NVRs:
|
|
# 1.25.2
|
|
# NetworkManager-1.24.2-1.fc33
|
|
# NetworkManager-1.22.14-1.fc32
|
|
# NetworkManager-1.20.12-1.fc31
|
|
# 1.18.8
|
|
__NM_capath_ignored_NVRs:
|
|
- NetworkManager-1.18.0-5.el7.x86_64
|
|
- NetworkManager-1.18.4-3.el7.x86_64
|
|
- NetworkManager-1.20.0-3.el8.x86_64
|
|
- NetworkManager-1.22.8-4.el8.x86_64
|
|
- name: Create directory for ca_path test
|
|
file:
|
|
path: "/etc/pki/tls/my_ca_certs"
|
|
state: directory
|
|
mode: "0755"
|
|
- name: Copy cacert to ca_path
|
|
copy:
|
|
src: "cacert.pem"
|
|
dest: "/etc/pki/tls/my_ca_certs/cacert.pem"
|
|
mode: "0644"
|
|
- name: Install openssl (test dependency)
|
|
package:
|
|
name: openssl
|
|
state: present
|
|
use: "{{ (__network_is_ostree | d(false)) |
|
|
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
|
|
- name: Hash cacert
|
|
command: openssl x509 -hash -noout
|
|
-in /etc/pki/tls/my_ca_certs/cacert.pem
|
|
register: cacert_hash
|
|
changed_when: false
|
|
- name: Add symlink for cacert
|
|
file:
|
|
state: link
|
|
path: "/etc/pki/tls/my_ca_certs/{{ cacert_hash.stdout }}.0"
|
|
src: cacert.pem
|
|
- name: Get NetworkManager version
|
|
command:
|
|
cmd: rpm -qa NetworkManager
|
|
# noqa command-instead-of-module
|
|
register: __network_nm_nvr
|
|
changed_when: false
|
|
- name: Test configuring 802.1x authentication
|
|
block:
|
|
- name: Import network role
|
|
import_role:
|
|
name: linux-system-roles.network
|
|
vars:
|
|
network_connections:
|
|
- name: "{{ interface | default('802-1x-test') }}"
|
|
interface_name: veth2
|
|
state: up
|
|
type: ethernet
|
|
ip:
|
|
address:
|
|
- 203.0.113.2/24
|
|
dhcp4: "no"
|
|
auto6: "no"
|
|
ieee802_1x:
|
|
identity: myhost_capath
|
|
eap: tls
|
|
private_key: /etc/pki/tls/client.key.nocrypt
|
|
client_cert: /etc/pki/tls/client.pem
|
|
private_key_password_flags:
|
|
- not-required
|
|
ca_path: /etc/pki/tls/my_ca_certs
|
|
- name: Ensure ping command is present
|
|
package:
|
|
name: iputils
|
|
state: present
|
|
use: "{{ (__network_is_ostree | d(false)) |
|
|
ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
|
|
- name: "TEST: I can ping the EAP server"
|
|
command: ping -c1 203.0.113.1
|
|
changed_when: false
|
|
- name: Trigger failure in case the role did not fail
|
|
fail:
|
|
msg: after test
|
|
rescue:
|
|
- name: Show failed item
|
|
debug:
|
|
msg: item {{ item }}
|
|
loop:
|
|
- "{{ ansible_failed_result }}"
|
|
- "{{ ansible_failed_task }}"
|
|
- "{{ __network_nm_nvr.stdout }}"
|
|
- "{{ __NM_capath_ignored_NVRs }}"
|
|
changed_when: false
|
|
|
|
- name: Assert role behavior
|
|
vars:
|
|
expected_failure: "{{ __network_nm_nvr.stdout in __NM_capath_ignored_NVRs }}"
|
|
failure: "{{ __network_connections_result is failed }}"
|
|
assert:
|
|
that: failure == expected_failure
|
|
msg: "Role {{ failure | ternary('failed', 'did not fail') }} but was expected
|
|
{{ expected_failure | ternary('', 'not') }} to fail.
|
|
NM NVR: {{ __network_nm_nvr.stdout }}"
|
|
- name: Assert role failure
|
|
assert:
|
|
that: "
|
|
'ieee802_1x.ca_path specified but not supported by NetworkManager'
|
|
in __network_connections_result.stderr"
|
|
when:
|
|
- __network_connections_result.failed
|
|
|
|
|
|
- name: Assert ping succeeded
|
|
assert:
|
|
that:
|
|
- "not 'cmd' in ansible_failed_result"
|
|
...
|