diff --git a/test/case/firewall/basic/test.py b/test/case/firewall/basic/test.py index eeb934dc..d25d0b11 100755 --- a/test/case/firewall/basic/test.py +++ b/test/case/firewall/basic/test.py @@ -22,10 +22,12 @@ with infamy.Test() as test: target = env.attach("target", "mgmt") _, data_if = env.ltop.xlate("target", "data") _, mgmt_if = env.ltop.xlate("target", "mgmt") - _, unused_if = env.ltop.xlate("target", "unused") _, host_data = env.ltop.xlate("host", "data") TARGET_IP = "192.168.1.1" HOST_IP = "192.168.1.42" + # A dummy interface stands in for an unused port: it is not placed + # in any zone, so it must fall back to the default zone. + UNUSED_IF = "dummy0" with test.step("Configure basic end-device firewall"): target.put_config_dicts({ @@ -41,6 +43,11 @@ with infamy.Test() as test: "prefix-length": 24 }] } + }, + { + "name": UNUSED_IF, + "type": "infix-if-type:dummy", + "enabled": True } ] } @@ -119,16 +126,14 @@ with infamy.Test() as test: assert "http" in public_zone["service"] with test.step("Verify unused interface assigned to default zone"): - data = target.get_data("/infix-firewall:firewall") - fw = data["firewall"] + def unused_in_default_zone(): + data = target.get_data("/infix-firewall:firewall") + fw = data["firewall"] + assert fw["default"] == "public-untrusted-net", "Default zone should be 'public-untrusted-net'" + zones = {zone["name"]: zone for zone in fw["zone"]} + return UNUSED_IF in zones["public-untrusted-net"].get("interface", []) - assert fw["default"] == "public-untrusted-net", "Default zone should be 'public-untrusted-net'" - - zones = {zone["name"]: zone for zone in fw["zone"]} - public_zone = zones["public-untrusted-net"] - - assert unused_if in public_zone["interface"], \ - f"Unused interface {unused_if} should be in default zone 'public-untrusted-net', got interfaces: {public_zone['interface']}" + until(unused_in_default_zone, attempts=10) with infamy.IsolatedMacVlan(host_data) as ns: ns.addip(HOST_IP) diff --git a/test/case/firewall/basic/topology.dot b/test/case/firewall/basic/topology.dot index 52174355..84948360 100644 --- a/test/case/firewall/basic/topology.dot +++ b/test/case/firewall/basic/topology.dot @@ -1,4 +1,4 @@ -graph "1x3" { +graph "1x2" { layout = "neato"; overlap = false; esep = "+30"; @@ -8,23 +8,16 @@ graph "1x3" { host [ label="host | { mgmt | data }", - pos="10,10.95!", + pos="10,10!", requires="controller" ]; target [ - label="{ mgmt | data | unused } | target", - pos="30,10!", - requires="infix", - ]; - - dummy [ - label="{ link } | dummy", - pos="29.8,00!", + label="{ mgmt | data } | target", + pos="40,10!", requires="infix", ]; host:mgmt -- target:mgmt [requires="mgmt", color="lightgray"] - host:data -- target:data [color=black, fontcolor=black, taillabel="192.168.1.42/24"] - target:unused -- dummy:link [color="gray", style="dashed"] + host:data -- target:data [color=black] } diff --git a/test/case/firewall/basic/topology.svg b/test/case/firewall/basic/topology.svg index 984e42c5..a65d5300 100644 --- a/test/case/firewall/basic/topology.svg +++ b/test/case/firewall/basic/topology.svg @@ -1,58 +1,43 @@ - - - - -1x3 - + + + + +1x2 + host - -host - -mgmt - -data + +host + +mgmt + +data target - -mgmt - -data - -unused - -target + +mgmt + +data + +target host:mgmt--target:mgmt - + host:data--target:data - -192.168.1.42/24 - - - -dummy - -link - -dummy - - - -target:unused--dummy:link - +