From 8b85817a716832df959a8fb2e3bc64a148276e0c Mon Sep 17 00:00:00 2001 From: Durand Fabrice Date: Tue, 15 Nov 2022 10:56:57 -0500 Subject: [PATCH 001/103] Rewrite destination address if it's from docker to the management ip address. --- lib/pf/iptables.pm | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/lib/pf/iptables.pm b/lib/pf/iptables.pm index 53b9167bbd07..972883223980 100644 --- a/lib/pf/iptables.pm +++ b/lib/pf/iptables.pm @@ -161,9 +161,7 @@ sub iptables_generate { push @pfconnector_ips, $management_network->{Tip}; @pfconnector_ips = uniq sort @pfconnector_ips; for my $ip (@pfconnector_ips) { - for my $dport (23001..23256) { - $tags{'pfconnector'} .= "-A input-management-if --protocol tcp --match tcp -s $ip --dport $dport --jump ACCEPT\n"; - } + $tags{'pfconnector'} .= "-A input-management-if --protocol tcp --match multiport -s $ip --dports 23001:23256 -j ACCEPT\n"; } # eduroam RADIUS virtual-server @@ -204,6 +202,9 @@ sub iptables_generate { #NAT Intercept Proxy $self->generate_interception_rules(\$tags{'nat_if_src_to_chain'},\$tags{'nat_prerouting_vlan'},\$tags{'input_inter_vlan_if'} ); + #DNAT traffic from docker to mgmt ip + $self->generate_dnat_from_docker(\$tags{'nat_if_src_to_chain'}); + # OAuth my $passthrough_enabled = (isenabled($Config{'fencing'}{'passthrough'}) || isenabled($Config{'fencing'}{'isolation_passthrough'})); @@ -859,6 +860,20 @@ sub generate_netflow_rules { } } +=item generate_dnat_from_docker + +DNAT to 100.64.0.1 the traffic coming from docker image to management ip address. + +=cut + +sub generate_dnat_from_docker { + my ($self, $nat_if_src_to_chain) = @_; + my $logger = get_logger(); + + my $mgmt_ip = (defined($management_network->tag('vip'))) ? $management_network->tag('vip') : $management_network->tag('ip'); + $$nat_if_src_to_chain .= "-A PREROUTING --protocol udp -s 100.64.0.0/10 -d $mgmt_ip --jump DNAT --to 100.64.0.1\n"; +} + =back =head1 AUTHOR From 995726129b4a7a76da19e0d71674e42a057cc3b5 Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Wed, 19 Oct 2022 16:30:44 -0400 Subject: [PATCH 002/103] [Venom] Security test random mac: first commit --- .../scenarios/inline/playbooks/run_tests.yml | 2 + .../00_setup_network.yml | 52 ++++ .../05_setup_packetfence.yml | 288 ++++++++++++++++++ .../07_prepare_security_event_random_mac.yml | 24 ++ .../10_client_start.yml | 37 +++ .../security_event_random_mac/30_tests.yml | 53 ++++ .../security_event_random_mac/Diagram.png | Bin 0 -> 24599 bytes .../security_event_random_mac/TESTSUITE.md | 29 ++ .../teardown/00_client_stop.yml | 17 ++ .../teardown/05_deconfigure_packetfence.yml | 120 ++++++++ .../teardown/10_remove_network.yml | 16 + t/venom/vars/all.yml | 9 + 12 files changed, 647 insertions(+) create mode 100644 t/venom/test_suites/security_event_random_mac/00_setup_network.yml create mode 100644 t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml create mode 100644 t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml create mode 100644 t/venom/test_suites/security_event_random_mac/10_client_start.yml create mode 100644 t/venom/test_suites/security_event_random_mac/30_tests.yml create mode 100644 t/venom/test_suites/security_event_random_mac/Diagram.png create mode 100644 t/venom/test_suites/security_event_random_mac/TESTSUITE.md create mode 100644 t/venom/test_suites/security_event_random_mac/teardown/00_client_stop.yml create mode 100644 t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml create mode 100644 t/venom/test_suites/security_event_random_mac/teardown/10_remove_network.yml diff --git a/t/venom/scenarios/inline/playbooks/run_tests.yml b/t/venom/scenarios/inline/playbooks/run_tests.yml index 1446c6e37a95..ebd5f31d0788 100644 --- a/t/venom/scenarios/inline/playbooks/run_tests.yml +++ b/t/venom/scenarios/inline/playbooks/run_tests.yml @@ -13,6 +13,8 @@ - inline/l2/teardown - security_event_suricata - security_event_suricata/teardown + - security_event_random_mac + - security_event_random_mac/teardown tasks: - name: Run Venom testsuites diff --git a/t/venom/test_suites/security_event_random_mac/00_setup_network.yml b/t/venom/test_suites/security_event_random_mac/00_setup_network.yml new file mode 100644 index 000000000000..66c7653ef0b6 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/00_setup_network.yml @@ -0,0 +1,52 @@ +name: Setup inlinel2 network +testcases: + + - name: create_two_virtual_ethernet_interfaces + steps: + - type: exec + script: ip link add bridgeinlinel2 type veth peer name inlinel2 + + - name: create_tap_interface + steps: + - type: exec + script: ip tuntap add blok-tap1 mode tap + + - name: set_blok-tap1_up + steps: + - type: exec + script: ip link set blok-tap1 up + + - name: create_bridge + steps: + - type: exec + script: ip link add blok-br1 type bridge + + - name: set_bridge_up + steps: + - type: exec + script: ip link set blok-br1 up + + - name: set_blok-vpeer0_up + steps: + - type: exec + script: ip link set inlinel2 up + + - name: set_bridgeinlinel2_up + steps: + - type: exec + script: ip link set bridgeinlinel2 up + + - name: add_ip_to_inlinel2_interface + steps: + - type: exec + script: 'ip addr add {{.security_event_random_mac.pf_portal}}/24 dev inlinel2' + + - name: add_bridgeinlinel2_in_the_blok-br1_bridge + steps: + - type: exec + script: ip link set bridgeinlinel2 master blok-br1 + + - name: add_blok-tap1_in_the_blok-br1_bridge + steps: + - type: exec + script: ip link set blok-tap1 master blok-br1 diff --git a/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml new file mode 100644 index 000000000000..0e6d19976960 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml @@ -0,0 +1,288 @@ +name: Enable Inline l2 configuration in PacketFence +testcases: +- name: get_login_token + steps: + - type: get_login_token + +- name: configure_interface_inlinel2_as_type_inline_l2 + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/interface/inlinel2' + ignore_verify_ssl: true + body: >- + { + "id": "inlinel2", + "isClone": false, + "isNew": false, + "prefixRouteName": "", + "additional_listening_daemons": [], + "coa": null, + "dhcpd_enabled": "enabled", + "dns": "8.8.8.8", + "high_availability": 0, + "hwaddr": "92:ed:ee:36:e9:6a", + "ifindex": "10", + "ipv6_address": null, + "ipv6_prefix": null, + "is_running": true, + "master": null, + "name": "inlinel2", + "nat_enabled": "enabled", + "network": null, + "network_iseditable": false, + "networks": [], + "not_editable": false, + "reg_network": null, + "split_network": null, + "type": "inlinel2", + "vip": null, + "vlan": null, + "ipaddress": "{{.security_event_random_mac.pf_portal}}", + "netmask": "255.255.255.0" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: configure_inline_l2_network + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/l2_network/{{.security_event_random_mac.networks}}' + ignore_verify_ssl: true + body: >- + { + "id": "{{.security_event_random_mac.networks}}", + "isClone": false, + "isNew": false, + "algorithm": 1, + "description": null, + "dhcp_default_lease_time": "30", + "dhcp_end": "{{.security_event_random_mac.node.ipaddress}}", + "dhcp_max_lease_time": "30", + "dhcp_start": "{{.security_event_random_mac.node.ipaddress}}", + "dns": "8.8.8.8", + "ip_assigned": null, + "ip_reserved": null, + "netflow_accounting_enabled": "enabled", + "netmask": "255.255.255.0", + "not_deletable": false, + "not_sortable": false, + "pool_backend": "memory", + "portal_fqdn": null, + "type": "inlinel2" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: create_a_user + steps: + - type: http + method: POST + url: '{{.pfserver_webadmin_url}}/api/v1/users' + ignore_verify_ssl: true + body: >- + { + "valid_from": "2021-12-06 00:00:00", + "expiration": null, + "actions": [ + { + "type": "set_role", + "value": "1" + }, + { + "type": "set_access_duration", + "value": "1h" + } + ], + "pid_overwrite": 0, + "pid": "iastigmate", + "email": "iastigmate@test.ca", + "sponsor": "", + "password": "password", + "login_remaining": null, + "gender": "", + "title": "", + "firstname": "Igmout", + "lastname": "Astigmate", + "nickname": "", + "company": "", + "telephone": "", + "cell_phone": "", + "work_phone": "", + "address": "", + "apartment_number": "", + "building_number": "", + "room_number": "", + "anniversary": "", + "birthday": "", + "psk": "", + "notes": "", + "custom_field_1": "", + "custom_field_2": "", + "custom_field_3": "", + "custom_field_4": "", + "custom_field_5": "", + "custom_field_6": "", + "custom_field_7": "", + "custom_field_8": "", + "custom_field_9": "" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 201 + +- name: assign_a_password_to_the_user + steps: + - type: http + method: POST + url: '{{.pfserver_webadmin_url}}/api/v1/user/iastigmate/password' + ignore_verify_ssl: true + body: >- + { + "quiet": true, + "valid_from": "2021-12-06 00:00:00", + "expiration": "{{.inline_lx_iastigmate.password.expiration}}", + "actions": [ + { + "type": "set_role", + "value": "1" + }, + { + "type": "set_access_duration", + "value": "1h" + } + ], + "pid_overwrite": 0, + "pid": "iastigmate", + "email": "iastigmate@test.ca", + "sponsor": "", + "password": "password", + "login_remaining": null, + "gender": "", + "title": "", + "firstname": "Igmout", + "lastname": "Astigmate", + "nickname": "", + "company": "", + "telephone": "", + "cell_phone": "", + "work_phone": "", + "address": "", + "apartment_number": "", + "building_number": "", + "room_number": "", + "anniversary": "", + "birthday": "", + "psk": "", + "notes": "", + "custom_field_1": "", + "custom_field_2": "", + "custom_field_3": "", + "custom_field_4": "", + "custom_field_5": "", + "custom_field_6": "", + "custom_field_7": "", + "custom_field_8": "", + "custom_field_9": "", + "access_duration": "1h", + "access_level": null, + "can_sponsor": null, + "category": "1", + "unregdate": null + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 201 + +- name: configure_snat_interface_for_passthroughs + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/base/network' + ignore_verify_ssl: true + body: >- + { + "interfaceSNAT":"eth0" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + - result.bodyjson.message ShouldEqual "Settings updated" + +- name: configure_snat_interface_for_inline + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/base/inline' + ignore_verify_ssl: true + body: >- + { + "id": "inline", + "interfaceSNAT": "eth0" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: restart_iptables + steps: + - type: systemctl_service_restart + service: packetfence-iptables + time_to_sleep: 5 + +- name: restart_pfdns_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdns + time_to_sleep: 5 + +- name: restart_pfdhcp_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdhcp + time_to_sleep: 5 + +- name: restart_haproxy-portal_service + steps: + - type: systemctl_service_restart + service: packetfence-haproxy-portal + time_to_sleep: 5 + +- name: restart_keepalived_service + steps: + - type: systemctl_service_restart + service: packetfence-keepalived + time_to_sleep: 5 + +- name: restart_pfdhcplistener_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdhcplistener + time_to_sleep: 5 + +- name: restart_pfacct_service + steps: + - type: systemctl_service_restart + service: packetfence-pfacct + time_to_sleep: 5 + +- name: restart_pfqueue_service + steps: + - type: systemctl_service_restart + service: packetfence-pfqueue + time_to_sleep: 5 diff --git a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml new file mode 100644 index 000000000000..282eebdee093 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml @@ -0,0 +1,24 @@ +name: Set Random Mac Security event +testcases: +- name: enable_security_event + steps: + - type: pf_api_action + method: PATCH + url: 'config/security_event/{{.security_event_random_mac.event.id}}' + body: '{"id":"{{.security_event_random_mac.event.id}}","enabled":"Y","quiet":true}' + +# restart pfqueue et pf detect +- name: restart_service_pfqueue + steps: + - type: systemctl_service_restart + service: packetfence-pfqueue + +- name: restart_service_pfdetect + steps: + - type: systemctl_service_restart + service: packetfence-pfdetect + +- name: clear_fingerbank_cache + steps: + - type: pfcmd_run_command + script: 'cache fingerbank clear' diff --git a/t/venom/test_suites/security_event_random_mac/10_client_start.yml b/t/venom/test_suites/security_event_random_mac/10_client_start.yml new file mode 100644 index 000000000000..08202b9670ed --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/10_client_start.yml @@ -0,0 +1,37 @@ +name: Start client +testcases: + - name: download_ulinux + steps: + - type: exec + script: wget http://inverse.ca/downloads/PacketFence/LiveCD/ulinux.qcow2 -O /tmp/ulinux.qcow2 + + - name: install_systemd_script + steps: + - type: exec + script: | + cat > /lib/systemd/system/ulinux.service << EOF + [Unit] + Description=QEMU virtual machine + + [Service] + ExecStart= /usr/bin/qemu-system-x86_64 -boot d -hda /tmp/ulinux.qcow2 -m 128M -device "virtio-net-pci,netdev=network0,mac={{.security_event_random_mac.node.macaddress}}" -netdev tap,id=network0,ifname=blok-tap1,script=no,downscript=no -nographic -serial telnet:localhost:4321,server,nowait + ExecStop=pkill -f qemu + ExecStop=/usr/bin/bash -c 'while nc localhost 7100; do sleep 1; done' + + [Install] + WantedBy=multi-user.target + EOF + + - name: systemctl_daemon-reload + steps: + - type: exec + script: systemctl daemon-reload + + - name: start_the_client + steps: + - type: exec + script: systemctl start ulinux + + # let ulinux start + - type: exec + script: sleep 30 diff --git a/t/venom/test_suites/security_event_random_mac/30_tests.yml b/t/venom/test_suites/security_event_random_mac/30_tests.yml new file mode 100644 index 000000000000..a27ef46d3162 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/30_tests.yml @@ -0,0 +1,53 @@ +name: Test inline l2 violation +testcases: +- name: get_login_token + steps: + - type: get_login_token + +- name: test_if_the_device_is_in_the_isolation_ipset + steps: + - type: exec + script: 'ipset test pfsession_Isol_{{.security_event_random_mac.networks}} {{.security_event_random_mac.node.ipaddress}}' + delay: 5 + retry: 14 + +- name: get_security_event_id + steps: + - type: pf_api_node_security_events + id: "{{.security_event_random_mac.node.macaddress}}" + vars: + all_events: + from: result.pf_api_node_security_event_ + +- name: get_event_id + steps: + - type: + script: echo '{{.get_security_event_id.all_events}}' | jq '.[] | if (.security_event_id == {{.security_event_random_mac.event.id}} and .status == "open") then .id else false end ' | grep -v "false" + vars: + event_id: + from: result.systemout + +- name: release_violation_on_the_node + steps: + - type: http + method: PUT + url: '{{.pfserver_webadmin_url}}/api/v1/node/{{.security_event_random_mac.node.macaddress}}/close_security_event' + ignore_verify_ssl: true + body: >- + { + "security_event_id": "{{.get_event_id.event_id}}", + "mac": "{{.security_event_random_mac.node.macaddress}}" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + + +- name: test_if_the_device_is_back_in_the_register_ipset + steps: + - type: exec + script: 'ipset test pfsession_Unreg_{{.security_event_random_mac.networks}} {{.security_event_random_mac.node.ipaddress}}' + delay: 10 + retry: 15 diff --git a/t/venom/test_suites/security_event_random_mac/Diagram.png b/t/venom/test_suites/security_event_random_mac/Diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..f67e372bf8bfc9e3bed55acc390338787cae44ef GIT binary patch literal 24599 zcmZU)1z1#3_b&{Hf;1>4U83aB3>`yv3=GZC%rMlz&>@XTN{L8`NSB1PgtVX_T`DEr zUHACD|L?o^K6jqy)IMj|+I!V+t%=puRv{*MLV$&ZMXaU@(Z|BVNyfs$=E8pflxU3* z{sJ!8Xnhq0tjZDk4d4OSQC>?P3#%rP@EU#}cz)=vYJ$eXBI)^eV5f1D&|zWWoqH+4 zyimRl&Mx*?972l!z2guBIk};|ID{Y^f`V{&cRo93xT7Z=h30d$_X3K5_b4|zX9s6{ zyZ?S82oeg9%Z z;t)~*p4D8v>|KB>Pz;=P41g01I0Qge0wPvo&w*QccXtbz`)ujtx-fCwL$4;aC}%3gl% z_Wvz)baQib0lF0A5K;mN`ahHdK5>NuBl!T z%PS}f2l0Y!1?+eQgv3Pz#Kpm)Vq)U|ZB)z%VQS-r7FN~;!F9z=9QBPcz9t-k3PMUq zA2mBQB}GLqSEPo98p_z%NXJ=ES;tohF75#JP&f8NiRpQum9%tRMSc8iF<@6$Eg^rf zyr`}N$i-GuObjJ%ujH@qqvtAU<7Ve=A`DVe(gee`Ttq;g&I$s;E(Y=j+Wv5TV{xT_ zv{UlaQqp(v)I%xwiYocRTn)7~#5IL|gXV&{!Tu2-YO=JzS>H_ER<~g)%;bFrv4yD0i?IOsEWU? z09s4SS69eXNmNBtMZitn-`ECb01|QY@w79An}Cf){Y_x{B4`gqQ(ZMLU>7L+r~wVx zD*4HyMHTfSPPUpTaYrpDdqWWcH(hmQQx7dWAwLacX91+2i=i&u84gjiSMoG12fhJR$5tC8#p2D9e}f-urd_5IJjZZ7(rhM zP^6#)7r-dU>w6oj>H4^tsQY<3su_W8^-aZ$^pw<0Tpa8L9h@D7G?9X)_GqB0fdW*> z$W_7DS<_AhW1s@_LK`SMVW5UW@}4>#2Bw~h`cRCmtsO*I(@V@2*9XDvSZ94s%0jYWgUH5QdIGAyh-b$pHg&q~>mF zVj?DjQba=h+?+vVIW{Hsw-sd z>Z|Fb=LT_6ad1Iu%iEjU0@6cS4M6Yc1w0TMP+aWU0H!vQ&~tfcKIj*B;uqK6|0V+;^a)f9%* zvbA$@b5(#k!rgR*#bItHJ}_N%gp$3VjlP$Ss;I4lx~-EKup&Tr%KAonu3|7nB^zZ; zS7UcAJri#QZCzuCua7>;AA~jqsSDaFIVqU9D0&;II*Vull2=(%(Lml*1SW!1MfiDm zxVQ=#nu6gFw7;L8xSFZGfx8eCEa2qghSqmh1XPQHlA)%kzM#0bHwx)!1622MH1u-O z1NN3K+&~|!qi5=-DvI$E@U^is0h!pKVEQ(|)>L-(H?a3L5fSn**4Og0^99*yDQSry zz($%#uz|9tfT6FEmba0OgR+RYu+l$CW$!IuBW|zarsn|2G&MzG7|2xK7~^UTj6hjf z#YtC0%@nC7<_hRPWgjsVLQfc_?q&~$qScWQl!>|m!pGD=UrgUX+0akj(MjXq#)SAQ z+W9G~z(hptP2Alv@-QKNm;%DrPY+NMf&d*9+`Y7w|7~qYCnZ2tDl3@?dIK5;<7g=2 zpy2_iA!Si@W3USt_|nf-#2bTF1r!ia`v2*m|0pEj`G1tWkWv{nZY>s;aj_ai-q6=_ zX93UG5PJDwpHy{^{RP%T4rY1(v`SS2GNYQxw({oF-R50W=Ip!rZ|}zlc3& zXnhv3Yt5AQfwjbq{nUaPf94srxZ4n?4C>pnpsD+r=w?K+O%sjU(rW!JUR zmXd5^eC%?UUm?Y%YKHEixaYpkjbwTjk5g0C5Uwu@*B%d!yrxY_vB+Cs^}Gm$`FV~p z)6O@=W1?bW%p+OG)N*dU-xDPL+S}nE)%nZ$+TSNdZ(+6s4Ow}DOf2kgmF`dD8<$JLxpz>|`?;E7m2HOnIfOaAocW^|YMxqwT87N67)%gS^5w zER9-4{0k+ORsoCP!><*~AD}~2n-b*YU}~T`vs{87vY}iyi!1+D=I|?O*&eYpGFt)p zNw&7Dp7d5LWZIrOy??(_ul7%kGf@fz!uN&Dgj6iJ0oFd}1-tBn43^LJs<~BCa2(Kz@Yi+9Tr(G3U@b>F$u^kFuW^rG*wHbujz*6@ zm#GSUR~Qr152j&d5Dq!>IPvz})86DJ_mdI6#dA?o|5t}fmSj3e(BMJqad;geaZ-=5 z+vJESQ`5!Q!;R6opB`Rw)=igx7B{E$tgf3awAUZ2#Zj@IS;-D>NMCbl-W4w0`M z@??d((PDSj8E?ejs=wamRz^eLlfdpuXiAldFN%$|RLqE#!CjDBCuoP7A-`Qz%n%m?|b4iDVzG^V3Pm9vsdXFA6D( zEdkG(;M}0!76m25#uNtwq)5sti|qe}b&}Tq$XZ7Iu*Cer??C1aIH2W%{hiX?{AR8# zD{CoJlq%li^z@P{Y#GZPp-cGj4U`&cck_?^RJg4}($F?(vTXtod)p1#!YMdE9QTSs$ z#+Z96WQbn9KecLo*RZ>;gJ+RHq+E)fyOA9r+6DzV74z@>$@L-|kAYTb^iKh!U>%u` z7Kw(4zB|MS$xOA7o<(4r*-YR!5s%5M!x>;|q}>%mHnC^_$?} z*qH42G}Y4AT?P6V9kkrg7Dn8+T{dW?^15<`1Ww1HK3P=B(WZ6JP%hPOT4M){`zj$j zCA-x|L^F;s!DF}L4HEjfyzIPZ{BSp8>nDMS`Irv1>K=L)(Ku-lv`Agf-iPcQjV4%L z?{Injv4}s}?QWXG?DT2L5mHlrtQZ{)0$1sHt#XJK)nf?B$&--+5dC+lsp%Rv>Jyt* zhL3o;UlLBz8Q|KMNw`RB1QF;e#w*(V<2{2(NKmA3WqI8C&o%#_g^ z!BpCnLxR3c$PurwC|k(r*!i9Sk!T=f5FkMC-OxQt85#3m_USgS-lkwP`Or9nL|E+*m7 zzJ{K!$_SOU{H3hfzt*3xKHOCr#+fm5vGzY^?t@jxF@kfRmo>2e^qr~Z)@x~8-VU;I zseo~^vK~IZ)>7j8A@Ng3QZQOPpwPi^$Ju<2UWv#(AOL!Eq%}S}3sZ0p+<2dc=p_8* zk=sm2*&lWB(JJE%kk|c>1RyCIhN;HT2WAa*d$}gT@DhyO?jDSe$NI+x%a1HpMej#v z;{mFs;~xXenlPTZPxz_hw~H3$JiPs^VgNdkhr}go*sW4ItFY?*ele@}tzgbbYp_Hp-j zufEfKpoQvZA3hkpfY=^vx7v8S5O-y^>j<~wmAyfAs&5!G=IEk6(rmMjlLgUi{qO3{ zD+WyyPh2Hy|l426R9v_f+mG0H2lODNCcM0=F^$$w_^BucgP(Kh_1QH*-f=Lj>jSz`k8k$DVG(WjAPWJr>J>{0@H&RRmrU*7dlK6i z_J8lA|KI8>RJk{;T8lTHZLMb$51cjM)@P)q4;@!cmQCGG>`B%Gb|$2UOwF|hWmQWb zqmvP&qBHP@;H;;=(V;R;#p-PpU)&_aj}eKY&xM+&Oj^cOK|?w0J3PQ3fR%rpmi~r6 z@~i!(r$mdcqz2H`$d~_rM1@bcewZl_K59%f%Fy7886N>=mMjG9_;Bjv zK}H@H(~irxeN(QHpLdi{ap%R4LYDs&33r{iZ2^M;uVrS7iDl*|lbm;gkeqiC5J`UUoqqxv1j}=8)#<=;quHk;ug2NU-}v zk0k{IWx<-{E;zf0s>9BKS{>jabD7`fu^{QmloJ*E#tqR-(OvV6c@|9uvo70fP)H-7 z@(mMTBt|qEYdF&}KI_KwO1_tjIg2!zi2JGiKiz3=y@ zxY2!d(de#F(J1JjZN;6ug2}zB)v~85 z==~A5`}W{O0?=s|w9MGplvO(!99LXcfc{RvAiX*DYbTH< zb_7G>lT3Jf#FleK3!JO5jZ}lXifh)I5XjFYK&R~J){NIX{ZI&OHFKUCChKvyX|`x_ zSokRGmX@oDT_w}qiyyl;Z2Hk(epB~_%Ol2TEb{G}^)t&m{F4JY-D_NI#ifWXEN5!k z!qSY>FGxRtJqNg-=}jF-H2aWbkl#qE1D4PM!v40Hbw2p~=IL`DF6b1%9#04q*+uYi z3pUTWU;+4&v0QI~xGFjp(q)SFir-6t2q1lUmT%!NuCH^x+yNjKT`l3#2# z%;tF(D>?=I?freYD9fKrz01U1B`xvexcTY81oheEE}Q}90ATi=tp0v%hSen<3s!y^ zkakYXnS#jmO`_yz#=dUI4&!9d;W*Wf>dJg&^5Nw&bxEYWnAM~eW0PM*>*Zfu5q6UE znU1XP-gSUZ)&Jo;Y zIu+%x_KxBQ#X0Mp*%{GYiRaHZ)_!A#g95)C-@=SQ2eTZnbv_4ZYfkL;80P)T?;ETT-*Id*x5foZ-^iX3hrG@veBe-mFL~( z2g|GDIymrBvB+emc5 zo}(BxKQe&%xIb=YaN=+nIm|WFNP4bP8{JoDRk^sh7CcXHN%QeN9rJ=^>|EUR=RZFbBOnF<+ToC%0+Q{zPTQe@TrZAG1q_d z`NfviUFka(RuvE=MMXe#s&~JkEHxEMe1C2(W%5l{E=>dCf#*6-2yiLEO=vIEHFs13pTtHgt2gg2WK+`C8 zKQEJ9{0b+v+n%o31T*>m!hX)rpW&F}r;OR1FJZiwh}^pHSjtz79$e22;cE*xOYdU} zF;C~W;uCThPRb3rH4zjPT&Zl?)lZc6KmLoTa-6EP*fdvFjWPFG@J^eUPECCb)%tp7 z?)5{d7Bwg8om1Qd?7l=#iN1L;3We}3%Z0LdkKgL)zrhSI7(BdYnnaAX;wd3Ry#C*r zEzZ`}f>zub<7>CZ+T(Y=N)FsJpU$yz^Ones|s{TZd%bnyShWuY(Kj>TQaU%@1=7~t+Z$5YSZ!^@+ zmEpAtxv3{84}Uk8P-OReY|FMw!bham8;Zzg+Q451otKPXq)8r%m!f

*D>DC#Wom)yuO0HIxq~F)y#FolS(~6I2Sz6)GBsn=% zpfm#I*ZbY1$i~^IJ|(A~pi#*^DJVJQGa&&%N{)1Zy05Qq#pvB)z+TBz{1<9+a+dX+ zfXXKYxuU47;cT#hG#^)5=&xp%89_A-jn@FHEp0mH$OJWKsl@(9N9Y?0k_%b|U)Vd( zHB|7J)Ix&z_0WLwXS{bqn&Bos*unrwc5 z=F2L;+o?Z)elpXC|D{gT3|we*%Y8);)^GXRp#4t5S)~An&B%yu=IFXRig-Ms6ggA- z!Q5{(4YA9~^-97}arw_5cIGeFORuJX>a&H*suNrTH0@HGo&s~ZNMm)l&$k-q(|D3?2m@^cl?tx=EC8j7t3MNhkubr z^+J%5AEnTfckdClJGc0+_vhR?O5j%Jy5Fuk?yh9LEu-PKL{_$ze|qETpd#NHEiFa% zuV*!E4jbfv@A?^B!Stp&1*KfrsdqCmz>$|zNAlyNWWvtHWIT*6Lh2%q6oa!70z zA>imp;^yfD&vFfk_Lkk`)l?mik7tzHE@ah< z{;ZS}=vWiDztcM?lhj}iu5qltFE@R5IdhgV5Y9jP+NZ;upIeO6FqhO>Nj0x(!^0oY z{$=gCzR2Xj(<9M(S#g}*ax0&HLZ(Vkn-8JgM$|bX&Lc)j$=W(E%PQu#GmkqMvz_^5 z^D7Q58_`4CTUM@Mnv`B$Ukful>@JS3+_q7-hjCH0pFTljAmZ15;`rIc#EgkY6Q78v z-yckry@l0-yUcZmvA?>D=Z(d#_f?BUb?L>kBl!O5+V9T-h8Ecktmoc`jdh8rltMQj zWY1}jFwL8^tVuL#(dqJHJ!Q9l6SgBT)4*?1i~bgeLYT4a?yXl~W=l#`*q^+iqwYLE z&$j5K72`2dCN6(c+PyEXAaaVQ^2MTYIbs(6u|ZCKNL>ZwZP%O7eEuCs2*iK@`*M4qOPxF8fvF#VkX5L38O0|`@ zqYHy&n*NaXJG5*1^O9RL*O;mPC4Jcdxjs4bkCbPEg8B=4ZXs81&o3_rf0h_bw5kTl zaOk1GcO7fQcBE||cg=r0?8^RjxSh&!xc!r5)}*#Coc}Jri>*gFTCFu-uaV@%&g?*t z%Y*-z_1%5n2z7Sb9b%5fBEMy6-XYqyWwR<1?mWMKLA3n-3p&2ObVRaO{o4M$+}S44 zPx&Zd&|v)Aqt%+1mld3RMt$iZqBfgx0kEBa5McQl&gCWSC_s;nS=uD~>2j-*-*al0 zUD=GfyIeRChy4KnsEP)T_vEGzPXHjIH)l#Ih~w)2GI^UwqJs5IdcvrA@;vYiS@o29 zKmiuHOo=Z_*-cM>8MBqX6n|jIqF3Rv)ZW%y*$u)32DU;}RLXv-+eIu9I~OepIn!RG zWFt|C36FYDPjYm=HiLX;|Ok#cBP~%I5-0>jVaw z4uIcvP2jxF+6u0GoeX8Z(tPmZK8zfYa7*QSH$KnAwQOYIklOY@jfaLLEHl zb@5gd&F+`qE(o$rycqRA0IJwOonKRmn9{|jVC}-OJI>Pv(I=!Q1K4SnwFPO-$ z?M=)=ait{JTu3%2EQ!(YH~X3R>8L7k~ z%H3Xh?UHf*E|Pmm7Q=E_Kd0Tl{o#sxT~M3h5vPGBwWn+wMeHb_OgG@&)t>b~H)*_y za9Mm^_)Y+cBzR>}5Xd3iuVIQ8prIPN!-vmd@5o+NZ9eu%ePw?@L2a;D<{QC%lE;!! zC+N|~~ zsbPtRleAp{?6LZw1(hTU9m*kcgG{MxL#NB2f_K8SvaMyC)_)#~XYXL$ZgK{gJm}wj z*S*?w)eFP`$VJFuJTLPdY(u3uXRV%+5@y7W5>^?9Mr4Y%3p&VUntKG(Z7lJsn$`>6 z-O6n>`Z!b^#b|K?i@3RQOBYoNC;|&sLvE(>>h1(_>6Qk)iU7uT=g(69L#hvn4=38g z`_b^+4Ln9)xfX}01(V(8ExtFx&M8uWhE7RN&R<|Htsprq=oJm0_GvD9=UP2`k)pw; z$Net;JNABd{DLC+0(}M^v(Y}9a$&|gX+)KiPlf+T-*Vm@Et5)qt6s-P4epGqeIsR8{UR(uvy!%|(eZrsUo149m3}dSxXp55J731~1(@eN@Ez)1A z?s#LizHIiJGHIsSDSL_QquntXLDdImyLlFDJ__yuJL40xBIE1tZ9`xEWni^5{qTK) z3MIq)uw>1$*Zn57-F2hFh4?=LAodA=RDTvPV6Zq0XXb}J!C3!LWLKcWVO20vRaLbQ zRbc8pTMDt-Av)^BV=BJ-vqi|?>ON^XGtIT1tiqT){!u5FlC?%-81O1AOm2F11*cga zTp`%xD$N?TcNE@tkVvK17{6Z}I#?NaJ(jPCS0BmJ4n!3fUz@qLL0d9tE%~#u-_O2$ zu+mEw%e6UW6~fB|taf~2w7cK$Nb1r#%=UD?!b+d4YjVX^O1+9_uDtZz&^u$&$;xC& z>pqZ+beUw8O7*d9-wm&C1LI&?1zy>$Q`64j3&Fa*nYJX0`0g19q%g|0W&^BHM8~) zpq;UgI7@HpYY2%Io;EPoxtubPkuf7D%k@UFqe&R_&8ST0u-9*|_Kd5#XOWN-^lY7T zy$oZR zW}jbYph{z#TK>US$y#hG35MOnI?^Yp1hJ!1N3SFj2kojX+kPg1z+kXvAA?V^beRA> ziXYbyx2}&dKvVe@O@0{L8ix%&Z4?o00S-e{+5zPpn`u|2uy1^5z6Wm4bAuw)j^LZ0 z;DEd=iGWj=`XC#v#OPe6qvwEuw4pdH-GW*C8h#lPQZFQrG$YY;E{IJ&z& z1ib3NRKV*<4pZnjvwRH0rew`{?Po{acf0-}T%vHg&QX~wOOX zB-)lz2F6a7GWL)Ni4lIDH2#pK{Dg%_mXs`!>)PVII_vF_(mTPz=I%i7p%lJ)CZXR- zKlzE<4d5miPIRM3z$&NPGw->)X*?G{d%T}ehimEjMF4j33FT}(@*`CZb1`;Q6MX)& zM=9&eYQ#pmnQQVynQ_@gHjQOpwzkSOu=)s(#F5$M-;QTTM+R`J?mu@Iqai;7hh=Zi z6|eXZrR~?KX!du5(7v6npr2BzI%A8+S;{8@qXLVcw+e?%JaidafG~>)66XES$Joh2 z!7N@r_yg0lei%otD_z1}r&(i;W&Mzaax_ux`gFeIsZ*NgxRzLnt<>&TRYzqM8NgPS z^?$#Z7Bfow*ZuQYS{y7C6v7Yzf1X9CNXe|dNnY>lz~c#iBj%QaSPBmbp;=U_&IUXf z)B2!|4;iJS4{n1tbCc_lQ-h65!DR_Z&*gZr!Dy!7Vya>0)ZnuPpUtB}V~Lt4^ysHG z6!iJTiX-QZr@JkCrEn+u_nsH?=+Tm^WszTDA;!H|Ghw-;cdiFQFDm*JMIKk_bmSpk zPWkQuOM9g^Ugy8%VbXFFAwhDCkd}S8iCkMTs6MX4hKaJgy8F02+(S>6)YT6|Qn*aE;n0{i_ z8xAAuj!ozGFMp}<64Y2yVE(hG6Z`Vmr(%QPuIm(6X}sO zV@s1AZ{{yg_8cSDr>ySX-oOQjZ}TFu7!#k64#Vf0#Y_O#K}F`;_4RelX41AyYSE?S zEVqD&O0Y$t2Rc%B=NSq-D(Ls#c^erW;hq~ZHGLRGJB@i-MzW;FRVKyW5OE}5|A8t zJx*oPAOHkuG}D$c7?Mca7oO>8S+S0`cWAcfd@=yy!N?`&g-zZ*j;b%_Um0BqoZh|P zY`hm=Rxf;GA$)9pq${a#e5f_~_DJ#(z?uR0%$a8qR=Ve3qw{&M$ENF?UlSPPD*)gj z*Kl6J0f4m>Z!!eW{K-i5$fQntH2l7c>j>CUWMfn5@(WI{#d); zQAqBj$I-=qo0Y=^|MivH%5aY`N|3yvM)zJP1%Nk6oCMphlNpBY%Pb%4o9e}Ov65bw z;}7Fk;cxuCh+bETBxq1Lvx3FBeep6vcFU*sm}NU@6n7&1+I@A%=x zbn?B#Xt2d!bhMv&adF`FL7$-eFS&_I-29Ik8GKxi;Z9_)j|7Nb9Zi3`hrXv*KYouA zhe3hL@}4CrmmrN%*$zN6rm*$JwgBko@qB`aQf97LUy`ABGW$~arT9O6nRJPjLVIus z4buRY`5290r?Sq&fsP-&S0doj#K+Hk{W2%u(p_{>cKAn+JDdO6Z*P`X+hT?^wHrqz z1E;#o&ZOsE+*}2rWETK*_72Kn^U1^WK99{8dSRD?;ms%MVZv>xe7iICC zd`PqwZm4em=M{WjtELw>s;A^!<7;?$WJK*EA5(#YCLH7dya7+GjN@{BuzSJfjN{?PVeoExZYccDGp&Wa5;uU+{K6xE%%}KZIw9Hiw(f<@3TBvy5)!x($ z?~Za-fr93v{LCcUK0L&s;q$M5kWb33j=hdurc0hcmZLi(B$GkX9Uu__7PhL4t-q2y z3@k1zP$IMx!^yD^tt+zaOW5S*im|?Uf(*EQ_~>addeV9j%aXLKr2RAY{;dD$c8P@$ zX$vcim8U>GcD?gHoEkf={~g)i2F4yf*4?IG7n_7Z`~pn0`_aOuDvb|9aQ_HJIX}$| zwm~5@6=Bu{iFddDiuR$97CNGJOR@F}g5aB$`z3?sWk67hr(eTn_FR2b8{0FuL-&mo zk2#dayI9kPQq-C+pOIOhuUg=~Y7AnBZ9yV409HAh!mOfgS88i)9aHE)ny(bC{=R0E zK_Ql7IKNA`oMh?VWdb9owqeD~?%vwB@z#$TINi&sv;%Kj*c_CGwPdC{gjs+m zE}b1#9mZv%MHT@{eZ^v3cljlW+xjzAi_fnE5H%U4jI{M8w-NbIvP&{g&`SJfHuv;Z zV6lvKC)TNgvJxq^tu7juD{lG)Zk*}n4jFONk7UMTKgWma%t;0yB!~o%YOMxLt>zQJh}`3 zwS}`F7FC-OA!V9s@sj)=&Kx5&t+y>+)WH241r9^P@PxmNJ5}wn{Y%%;0$fS{lw+_T zNS9ZXhPb;6(H2K7QGg*P9l=EO?oX9V`DbB1o|+q^zu5+7vw9PE4sWywm-Mv|R9knPN-&@sz>b4bopm>OnhG2S~TR zo1e^<`;pn)q)9uq@@HZLY^+iE=+TzDg;jjq8O6D4sd>;8fc+hjOqRcKx9!iN9ZvbgCei?1gr*~;gw z#x~xm8Hp4jai8eQ>XpcEdfu5NO4Y?2F?}y&z*ZbDi0#DhMJQP;=p_N|8iaMl`m<`T zS?q5k9#MJKTA#n4W#(@JeXT%56&;-3LBX02<;YZGAl7|KOAEN2)SddIIiYv2^3{ab z99Tb_5w@Dc6f5)i%V{4+!yV3c>}pTQ)|A&KnyVjJP`L0)b!#i0x3UTsD8w%KRvVD! zt#ivn|AoC6eO$EvH^@^U2$zMzKz$z7oA}m#uKlt1{KR9%K4RfJpH5osLdu~6-j5#& z{=CZ40HeGLF&fJv0p87pjv4B(nB3Mw_iyiAygStk@#NyDh^S%VRDzk`%^%fC`u&OJ ztV1^Z&Tz57Ja#4_gKZNhg|e6)#|l4Cl?%5opX?1Ot|_HC+nQ@c*wZVJmuBqZd;Qv7 z?;b@4>TF(KXZl3$-8W=E!FpIM@#G#mv#<@N_^oUW6?1GBw+dAbt(iF7>jC!o(vo@n zcyt5ygj$dai;o0Zt|cvV&7ptl>$f4c`QMy&1eR@{_)zLk$-g~KN;6=;O2}!eu5G7b zrF${^^6O`dr5A-yy%+R)##&o6?*yKRSd1)UC0PcYK*n=(CP$e6hQzSE zavm=#nfw0!dn@5r_#2th$l=|SO2Z1Pr))&F?{Q*fVw|Gl;q0shQTpRuLJ_^k$64X` zm2p6h6jz085d|GQmpuif<&tp1t`o^&77Fe%i>3e~Dn7pek$7_AIuV5>O*xLK85&k; z+^9F4+S$cf0{j4CQ4uNx*qFj;z29+WYpgTKHD8KWV!l@2_h+<$GVCHFKu+^|xGp|4nL%JihOK{+HdsK%u{X{K*k5rS zfzU3ItThb|ijwSc4U)i`RX8t=i0e)9lRq9mN{a-@g266zo)u+KyL+KypZrV)Zh=I6Z!HYKt@o3diwM=pPv|N>jU* z`A)rr^^*86+e4Uc_#d3$(Y!3@vhZ*r4tDziw;__^q0)*zZbiE}<$27qvDOR0K6bj~h+$VD7M_UAl{a1Jxc z@X$s72i4Z_i^Ek%UI%7Y)=^_%@vhITmY(H5J(sy||4!Z7Gz+9%3c5|Ocy~5LT|}-i z`1^~)J2k%2CjS{D@b2_5h|a%D=lyoqu?Nn6`oW&E=?6-jyZtPbLG^nW_M?ItK^p2|RHxFC zUSZKYd8{M5eN#}#gBAvB-?>qKJ>GKXA2)E5mQ(n~qD`viIt2>I?8zU~M<3u$)FokY z9vf7CSXMK5{0o^7FypuO9NB!?PDzx^h(l-wG7M$GBeGutV$8F=Yj9lQ%3vUl_45yP zor_$5AmFibn+g7XlqbMM0qp^>B?}8N!QE&2<0H)9+k*m5Ox-29(wr=8UzQ@^#HD#_ zLr?sQODkxAY@2aPBnt($K2thJ-}zNmw~yruKhw}p03&0$@YZ`QD^pH_F8r=ecer}6 zsYdd^Jl5y56(QAqLQ%y6>*Qqn$KPX$Mx6S>sif0E;3sjmqHc@jVH??CwBa7VA!p4j zNt(*GIhIpqJmTpH3JA)1e#8N?m3+AP#S)Vyj3RlSRVJOUu+}Ta3H?hoUwK6V_A7-A z4l?jBq@^15AN*uh16d&SO)<(lS!lsFnDj?BPr{*z<=hbwH$3M7t1?KK(E1C{IYqqB zh&e?a^r-Y%F=bG3AcY9!{ArST=Xj&Ei{?x9LA#Um5DjhU=l-IHRGnt&i#UC~KYu%!DwT|FjuXPLpWfzlS zE?(_zzb}(w_-v@bzQh(8brP3s_L2B|16?SH)VPA?fFOE!;y0D zS`1xtVrIA@;7>)|hl*S)i=YPg@gI_&PL3GLQ<5m)wAsN%$-D(b300;gavT_ydl#n_ zM~TxhQIw11EQ_1;T-g%ki;E$x0PMcV;^?)cOFO|?XF95cD~_vXc03hT`m8i|huDm4 zb4>fKA|s~1Qya{tH42}P$5Wg)(`1>!&-WN3(QM@;m(-Qpg1bS3%I z^(-8&sLv;nB4odePh<*k{4OGL1TjwKm|lVZWa6zD{nZm+?)z5j?N*CXE>w(2e6sjX zR6<{Zt}83iM`NNu+0DTAA@*h#;ao9RvsPWsx(+1?u=SzGRnfrD z{;bt_1%pnE;ZJ;(jeqqx_sQw+Ua0}KB6sH|<3<69Y1B`PD3-%G%{@AW26C>~_$?AV zqK5~y3}>f(AImmy?*e^duh-||xnQ$#EGhk1W+CuZ34X1;!};8i*N2I_$?HWqK*Y$> zw`6G5%9N9cl9kk^CN6-_Kc?r%EWjeiy)#6I_k+XAkjj!cJy%+54>hLp?mEm zT^L2wXYb7QkI_z)a>OsRqa!&wDg^d$9WQPq6ITY5QT@$2E_ptrCWgx_9Y5F5UzbNcSZ$#Dffho3g0Bc$phE6J7#^ z-tJOYIjG0L)M|7QF9PtD> z?R^caN~B5F$caW{l)dUBm5|%7S>`KCa0 zs?g$70!!_~^X*TghDRR2|2TX*J3A5K4+1$pNk@;{EtV>7(%g_npAwabzS?|lN~=#E zRW4v|Irkx?@za&k?9dONFXDIP-M=O+6YDiT$HUz;f^6?Wz4fcy*H);9(0lv_eUl)F zC^ismNd|JJNxs?n zSw5KF4xf`+;gQgNX=GL3>{p|1Po(Z@`$j?Wpx+1QHy4N9*V3EQ6pD6iVs494GXP9B zyQ{nOAQ?zejIwvK1MEFpPWCrG8l8VgmIrNhY`1m%glA4gBVqH$GfV@UwR&%t{*sWh zK&$wxisv7Hui$^8aCBlqsQ+{8D$r8hzS~>n+Sv|bkIb{DTeb(X*}YwQ$Y%QU2_8XA_vV7BQZ!w%eUI*Yj z)S%`X2HZMso?2R3dIF{f(h*2(&Sw^8l=9V0dHs4~YK@WAhed*- z9CFDc>lz(@Ov&(4rU|N#L6})gP@7}An%_7fi}4)0=RJ7S%gboC<8~H0UHTCEAJ$9G5+yaJtwZ+0O6l_8~)!}^U{gd=7Z;le{CXtX(hpEvH+5$KVA+)4&?<8Y?+@tZaY3ku>O z?f{>MsZJI3iIvE!QUo&LxfI_*I>%ey1|#83svUl5iL6}GtL)_h+ZdNZeSLkq-dD7n znTkL}ZpB&f6QTW7r=j<&iU;w;bx2$D&nWQYxiR-HUl+UU;31`7_#rSo6f%ao`|FfW zOld=31BW3~75#Y8EGF!G*S;MuZ!XL>&~o{P7rJP(8flZbb5K-`+yYm7(sBQa4+z^L z<6=OOQ#v}ewtHJm7^S(0?qca6L~jAtq-+7JvU!v1;-HTS$oIA*d>ao4sc*eCkNTO# zM$YE^@g=8L{JcILL?RRV`89?mbFJxQmihQ|u;v~*tfW3v(1lcI%wqTIyUI7Q+dtNr z-OzWQD20eq>yB>lDuXTe~&4JwZL&zLyW^`?hPu<7+s$W zd60%(A^vK3j7tQFT9B7lOF5B|ceyWd>RO|pMHH65y|o#Xc+x}$2{aJM-4c;ci_JL@V~5F#r0$#FEDK@y`1q*ty0 z5&ZA}X_KUl;9+{4PVoVvB2xAG?rm0bAKA=wH31-Ca!9y8c@rgTsl2T&EqQnlYeJM9 zKM+MsXV)2a|9>@d<>64a@wz^hQdzT=b!=JULu8386C*nzd$MLLBSeN0B3Z_oJxh!+ z_I0e4Z7h+o?_m(aXGtNP=cVsl=Q`&)*E#c-%gp<}&-*;T=lA@U`@U(JmTL2w>8zfXn^bKt=u<}} zirZtYDQ)R!(0u19FqgN5uGz~jwX9+r$* z-Rg0P-InHs4doezUcXz2S)YCE$=VWlI(}%vb{hb_B<355KzLq2dL>~} z`97zQeH(;mhWH3kxZNDyi-HN?{jl#a!M^+gGs8?9^L`dSA51%s+ zcjpXUdQ`BunG|i#;ihXv%vG-Tj1Mt;_yNDtKScL%euXM;U0v2ZlQp!twcIY`Nq@F{ zYX8vAvxxkn!gA!?9pg&p#B$e(B+h6I+x)}yA;87O7QsnAJ|RNF1yQ6o*nbqmjeI-} z4toICBN(Box!7lnLV2xgNyjaZ;?b@6sL9Fs`7}6*$yaOLJ4k&u=~g4ST&@Q0s0!oj zGY)sA5OeR+r~7LkmF-R*jCiH_jhQQfDkSa`QOw)pKyn4Q$qF24!~V9ZN0$J%?!>hF z>mEV*D!T6Q-fmiSzE!tbPoYb{+YEm&p|!BM`qL%Y=Qx6JuhkOB)md*!KaARyK`m+} zmI*4d$|hR`)vZ*HWm~IKexw;_G3#5POV|H$s|rq%2Lr+sF`Wt5=GSZMmtvJSzK0hx zr9xlpev9Ek68ailV~rLb#p(F78}IzOzPQrdzKh4>Y3b>Cf`WodK_)1@R<~Jh8bYuD zOx(GE8}{m+R-qJ8BIc5JYl8^hmEYB(wGXNcexpq8^a!6EH69xC!YNRw3y>lN$=kn9 zvX+;nEj&e5)*UQ5@)t>Qf!46i(ph&*cI(1|!6KG+5l}0%Cp=!jD=F`X;3BWwG8Y1* zW1)R(nC+m;YzhPS)YI9EP?gPQgVeqOK*$dEp#+PwQ8)Y>?s{_PbXF{+a#`-%26&!F zZ=!zBGK|!S0KA|4OP|UF*&;Ta`KB3^95EEhVk1<4oQq3KonWkNm(~d~YmifCjg&45 zGn2(f%GibA$bZ{P%omK59ynmJi0&GfIt{l^&HJtsHSN7ws&gQ1NHuL(@--q`gYRR&6T9(ipUEa-zc(m?L0HEDs~I>>JIM`%wz9Taaqc+Tzk7_cqlN7T3TXBFKP#W2r`Wq5n4 ze%@=qO~hnHkpEob@G>)yXiV{^=%@2jM0xB5I)=H_$p5IgxjCjX@O4<%Sy+q2bp4=h z;bOY%EbOwcFf(98Hvy~~?ZhApOBGvJOseYUfT*|RU3O5VY}z$idkpHJbS`RA?-|Da z<)~j**uAZa+4so`Amjefrd~VetQx_l8%Oy1j>G$VNgH$q-PO_K&BLE|6mfP|e9fBu z1kkHbNLQEP3(nGbQ=(|1BR09@Of9VNzE#&XYk85Kwq!O^%Gt};Cetw{VO>)wGs^e2 zAOIoI7t`~5Mt@Q{@on}FJk4pPl5S&eO%_1B87a@kxMwa)?uVI?%W*bZq+reI@Y~Vy zVs;3|6%+bk1mhSWVQbmVL02zi;VOS!D!x|VUmW0h9_DhhxiD*|)XH*z zS~3R)u}(Y-WP%Y?ZVnrv-E6Og6Z&s2#4`Lo-|!JP z5_fGc!bp>5X`mqd=HsTn0ha^REfsuxYRa94v^qLFZ9y4^*y!)S!T{al;oSTw;~Gv2 zJ#nlF*X>{*^}E%POzacEwH?2H~1A1cW+?*ANh+GDB&jv{oM=@KC6b%V;$4}IY zCoOyydA#Qn?QH;l2Vl_}!Db2}7_1&{SNj(Kj`jRJ{%|(BA!DOsu9ui!pYA#6mzZPO zKohwdReobnJ^B9F`K#fSx%8c{mGQ_u48o&+PrPI%<-hx}Is3>1-x ziviZ^)0~qt%b$ta`8IQLc{`CRqAN-yi0?vQDhWzk9K5_LT4^`=Hy3&m!bBSGL0qyz zWI8`wcs!X)kZn1mFn2z_BYW{xwxz~%A)o46nT4}*@SG$i8&g?j(hX3)nS2zXK3Gcz z3V#H&`AbrILb?8sN3WGUEorP=5Q$NNX{^eD+*jM^Vs7-_h3_L4-QnS}8K|t5o}mW+ zrVHqc-($4p(Ex|14-RNvKoEc;2DBh2yig{VPd0t!eJYLjVx-N^&|16RM!I6O9Yvg% zKgw)=tsVV#a1uGR<3d^w%k1BmaA|pX_Vp!8CoL}ZE3UtB`s+b!^ zGPRuwZX?X}QioMP%1`Z8MCWQMZWf*&MJTETZTY%J-jpgVsB7T3J+Zc^KAJ!D`t#px z2M2+^HN477zfC$&jFoZrxs^tdH&ALxb#^tk8V-Z4rp5MqSmknx906-O1<{Re?stYD ztt~AE$~cml;tP4~i(hziE}joPrm{}Af(d6NZ3xsOrM6)Z&c+o##{f|P@w7@L;y%7~ zFxqcYw#hMnOBw-Jm;TYJmzHp{< z-&!-{dlh#m#d@@e>q=&KZe6c7+aABJ-$WYESo$K5ITz}E=PfTajK84wdMV|`UWBtg zMm-_WXt(2;dS8Fk?u=?pK1V2MCHd@s!A6j=n(h%|8#0i4xKs2TQw=gI8=4>26#JGF z-4CV3c!lo;u#fZ7ys!|P&FS9Q8GVviCT_ZMD5oQLAl}H^ZdBEF$HyY^@~5dorAH%f znK}o~yE|!z`s9o3vm!T83?fzGZ(@IHSiL3Cq?C+42kf8xzia^54LHY;acBQKXo~yQ z?*xWrKB!yNe=<8=XLT>It06bp?28=YjF)7U*_d~!&iraed?t}%XSKUfEYB;%cPBxZ zmfpD%~ z2T?@Tc&Kj7Esm(gF`nvvEe=ahY&e)Ici8E~AiO_ZvJhFa^;!MFJn9wNbvlolU^TkitX~0 zA#rNe(tBrT)iwHQ4SXW_4vdYAv1>u2J@4}TiX#P%n&HbG)HR{JsBE0x;#3J1{qq)Y zRZKfd$sh_|q34fl^V7K7v~)CB4va!~qPVIr3dIcAvzJc<-0#`;TOxAeuu1n^DPAyj zxB9B$D!UWqi;)fY(lIOu!&Lki=nl*ykx-*7|6 z+)#c}*_D+!qkAl?g5g4AgIwi?sOQZ-b@}Q-$6xrkxT*QG@lR1TB7?RV?{}OB1wcZ} zANMO^ucNfh(REJA=AyC~}V-;|uN+a+G7zf42Hm(*v&FPQO;)m?vIkdzN+paxXx$%LlvJJ>XpynDD^ww1{DJ7naBUD zLZ`>T#A1_pN+?@#;7Kd?N#DL8Nyh~J#s}5dB`RmAS;#zYB5xX#G5^F>&Vu9K_dc28 zxLy3;_M3tH_vbIg=YM#EPd%Er6AlY64Msi)aMPgo2FfX=Kjgl@Y}jCJ81QSd*1)b% zGvNg*8ENT|&A^@M@R13*x8t^&L;_M>=|!EdclmbeeB14>O-l}^#D&aL-K_1sZ7p8^ zny4~3UD?K~lD8ApWc~SM+5VI#wnzdP|GhrrBRz;&Y}} z-%_1py3>}Tjhk2Dp)YDQ$5d_k_(j4GQMnZ5XB*%VGfUskJa3(G_}lNZ#1H|Xbc=v+ z4oo{b-ZTdr*lRT@aDg}R6GOyF147?vTgM;ea>%fbIR(cOlYJLwm58>U8*=gT2_?MM zYm+3{Kq0x}fW`V^3z4%+_4IvKKeoHqbeAV<-JZX#@$_EY)2drM#W-!IT2lqgtXWosoq%YW)=hV^ zlbQ0PE<{1k8!n+;JhQ&OPONY;^6=gIrW+bA@hA#ZIpF>Gps#%BH*%6)LF5Mp!uui) z!6+ys6bm4uYFb(mIO8%El?ax+KO+Y}e}DmX60H;|^ht<5o^%03LDr`1pcUiznh9q9 z4UmuGUXoMYNtZ{FUJDi;<+n5veizWfTT_PzMkrhQqsuM}NixC|R zYeT^AJ@@=vi5H}FRILnpwbL1Lz*^x{DY4~LyT3g)2MDDxs%+lyNxwZ853PmoLzS*= z=i0jj`U_JpM)uabSDQ!P2G1l3Nh*_A^ovXR%;b=pXG521GtA3Y(irC*R4YB!SU4jm z#guC8OqCley*KCcZc99>TMq{NAkSUKzOfR>&)6GXMJ;}GgH)d2BuNQF7}Y3^h03t8 zu5vY2GmtEfFuyUX6WWEzpiKlsbvFB@w@X$)h$(~+C&l+i@&MG?p^HHh4yN*dN+Jx- zDERI&mq#g{zhZjLzN1snX7AvVwC_!Q*;$hYc?+?xHMbWZ} z-+BgD8JZ{Mu5z%x{h+;FWU#xsr`oCn`J<)2!s+OV{EipVW7|BPZ`i94wU60DUDo&t zOe(*)x}|>qEj9uQ@1FwpNpY&YP#6tHtlxhb=5JDM6pyoN0_OiU}E*+|h#q`h;vRUb{iSth5I?(O`e&y5Z9TH)ZlbEl*FNp4}vVW*5 zA)98%&GX(q+tMud*N)Fa`*Q(gs5xvHVBTSiX(0<;o!O?Aex#g}qTzK2OU<$Q{ZHXh zgCS>&8J)D}XkI{ZUD zQeb*xg`qSDhtr^?rR^6z5})v1cQ5_$KoF&=AkSjvTz@dbNyfz>nV2A!McXLc0h8I%7sEfjh}iQ3iUe z1#6ztbBd4OEYp5Ga&5v3k3+WB*U?ak8bGJ&oaaCtjlA4`Hoq>=8LruJUy=Wp-m&}&OfOa#q;6_nLCb;U`Cs<^zpJ_#LTwCcnqlG4*@5PBT;JOuv!5@Nx_UfiEky0}KRY1B51Tb= zkhAN^ntE+Y+H|yUJ@~T-f3`vAsGPKz-%}&}Ql`b|h`_x#b5MbV#@bDUJWL`m0NNpG zrI{MILvDVx7<_lHriePpRHu+t+UT)@;0obKH0X66Z|W(=%~cRg z@Q~Fa)U1SxJy3Y_=G&C+k?0D^*Odyrz3V;4Pu~w|R6tT1sRgxr7Ab=E8i%#}(c7bm zHJu%TG3kaW(cduC-n)h8kE4>$M3z0&&g#EFRx6UiJk>`DG%^ zo}S7cs&n-5ov&GqX-8yqTpP+knLt!jmvaUXY0bI7dO4bz;3oWjcL7eMSY6|f$pFAu z>j14&o}BQat?!pO3QQ`12W2h)V%&H`^)C(1Wr$(AAXZ92I<&*-DVFkwJYAk(uS-f&-OW8nG}Sx+LL0jcd!!GmTSWbJGOKD{QR<6*hWb0qqf2ixC)&^c8{tO zDxi2sgDxAUhg~7c=9~z9Y{Sek9fNNl)opTOpXSmJPJU^MR0;k3Jb#Kx(S5b%Lhc#0 z)l^MjQ>!z*oXEi<*?zw-@)p-f8z8qY_Wxn!94MhZJv*Ufz?_j?{^=5JXMYLL?0%P` zSl=aXK@!kd>I5g$lCSxZ><_y3sdLEnGX#Dvn7~WMr^LT2(Qb$<1JjuB;v*O4ZuauIWa=K#L<+08u3rIl{43Dl;p5D?qWAZ^s)aI zW@CiuqTuwj!r$0=-9!(Th6ypjCE;(B2kx&GOESGA>HF6!RGdIwIx=^Bm}(H>*UgiY%drde zS`VS#*=AfGA0*V3D2}n0AC{2+JEB0ub-G&w>W2f**;c-%T?yT95ih0SfptwiId>fA zN~fy^9z_(6W;gAQosR_D(d+-uSmQe`NMg9GrWm79@J|KL_>*M0Jz49De}IjTN{rQb zMMPB#8$8n*3t)8-E298GRz{1aOH!W`v>%X_j-0g9bBjOYA%T#m-r&>%*LHby`}(sduPbP+esHoqBlZ>)m9SHvPbtM zp?!m%O)}%5H5VcCHR)idO5sZ7@;#14NgCn8@CKW!Ux<&CC!fJP8b^F!D@>WOB~ zC%y+2#5tSz9lyxK*sF{U9y$WU@lalYc=&{Klao)!xVh_zbV^@c0^Qs8_aQZwR!6=$bYruK#u9mka@o#d{<>J z|F+B{OV%tXSB1eGVmV94qfS!g8eDW4BVvQo_56i|2x^_z#4SaQy{~F}rV3puioZr0 znTkI4(5Jv0dxmeJD^xc~pp1eOMNLqr7fsAm-|MqRHA?G?ZFG`WTJlDX@80Mk3>?bA z`pyKlYkPS~Oe~ZOjVEVK0L@X5eG0=Zo>^2wf@SXM6I?Ml?0TE5;U-KBjl(A7eR{Qh zO|w}x6TQBnzE563wO{xtpS(@&&+`0D~a7dfjh`2p|40B=tJ@> Y-;dhJ67&=h^FN_>TMJ&ObU)xf0Bxsxc>n+a literal 0 HcmV?d00001 diff --git a/t/venom/test_suites/security_event_random_mac/TESTSUITE.md b/t/venom/test_suites/security_event_random_mac/TESTSUITE.md new file mode 100644 index 000000000000..d13eed932fec --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/TESTSUITE.md @@ -0,0 +1,29 @@ +# Security Event Random Mac Address + +Create a Inline L2 network, start a client on this network apply a security suricata event, tests. + +## Requirements + +### Global config steps +1. Create a Inline l2 network (virtual ethernet interfaces, bridge and tap) + +## Scenario steps +1. Enable the interface inlinel2 as a inlinel2 interface +1. Configure the network 192.168.4.0 to lower the lease time +1. Create a user to use to authenticate on the portal +1. Configure interfaceSNAT (network and inline) to allow internet access for the client once registered +1. Restart services associated to inline configuration +1. Set Random Mac Security event configuration +1. Download ulinux image, install systemd service and start the client on the inline l2 network +1. Test if the device is in the Isolation ipset set +1. Release the security event on the node +1. Test if the device is in the unregistered ipset set + +## Teardown steps +1. Stop the client and remove the systemd script +1. Set inlinel2 interface as none +1. Delete user in db +1. Deconfigure interfaceSNAT (network and inline) +1. Restart services related to inline setup +1. Remove Inline L2 network (remove virtual ethernet interfaces, bridge and tap) +1. Disable Random Mac security configuration diff --git a/t/venom/test_suites/security_event_random_mac/teardown/00_client_stop.yml b/t/venom/test_suites/security_event_random_mac/teardown/00_client_stop.yml new file mode 100644 index 000000000000..05dbf9d94d72 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/teardown/00_client_stop.yml @@ -0,0 +1,17 @@ +name: Stop client +testcases: +- name: stop_the_client + steps: + - type: systemctl_service + service: ulinux + unit_command: stop + +- name: delete_systemd_script + steps: + - type: file_delete + file: /lib/systemd/system/ulinux.service + +- name: systemctl_daemon-reload + steps: + - type: systemctl_service + service: daemon-reload diff --git a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml new file mode 100644 index 000000000000..be9aa838949a --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml @@ -0,0 +1,120 @@ +name: Delete configuration in PacketFence +testcases: +- name: get_login_token + steps: + - type: get_login_token + +- name: configure_inlinel2_as_other + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/interface/inlinel2' + ignore_verify_ssl: true + body: >- + { + "id": "inlinel2", + "isClone": false, + "isNew": false, + "type": "none", + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: delete_user_in_db + steps: + - type: http + method: DELETE + url: '{{.pfserver_webadmin_url}}/api/v1/user/iastigmate' + ignore_verify_ssl: true + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: deconfigure_snat_interface_for_passthroughs + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/base/network' + ignore_verify_ssl: true + body: >- + { + "interfaceSNAT":"" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + - result.bodyjson.message ShouldEqual "Settings updated" + +- name: deconfigure_snat_interface_for_inline + steps: + - type: http + method: PATCH + url: '{{.pfserver_webadmin_url}}/api/v1/config/base/inline' + ignore_verify_ssl: true + body: >- + { + "id": "inline", + "interfaceSNAT": "" + } + headers: + "Authorization": "{{.get_login_token.result.token}}" + "Content-Type": "application/json" + assertions: + - result.statuscode ShouldEqual 200 + +- name: desable_security_event + steps: + - type: pf_api_action + method: PATCH + url: 'config/security_event/{{.security_event_random_mac.event.id}}' + body: '{"id":"{{.security_event_random_mac.event.id}}","enabled":"N","quiet":true}' + + +- name: restart_iptables + steps: + - type: systemctl_service_restart + service: packetfence-iptables + time_to_sleep: 5 + +- name: restart_pfdns_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdns + time_to_sleep: 5 + +- name: restart_pfdhcp_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdhcp + time_to_sleep: 5 + +- name: restart_haproxy-portal_service + steps: + - type: systemctl_service_restart + service: packetfence-haproxy-portal + time_to_sleep: 5 + +- name: restart_keepalived_service + steps: + - type: systemctl_service_restart + service: packetfence-keepalived + time_to_sleep: 5 + +- name: restart_pfdhcplistener_service + steps: + - type: systemctl_service_restart + service: packetfence-pfdhcplistener + time_to_sleep: 5 + +- name: restart_pfacct_service + steps: + - type: systemctl_service_restart + service: packetfence-pfacct + time_to_sleep: 5 diff --git a/t/venom/test_suites/security_event_random_mac/teardown/10_remove_network.yml b/t/venom/test_suites/security_event_random_mac/teardown/10_remove_network.yml new file mode 100644 index 000000000000..66d123c61e35 --- /dev/null +++ b/t/venom/test_suites/security_event_random_mac/teardown/10_remove_network.yml @@ -0,0 +1,16 @@ +name: Remove inlinel2 network +testcases: +- name: Delete bridgeinline2 interface + steps: + - type: exec + script: ip link del bridgeinlinel2 + +- name: Delete blok-tap1 interface + steps: + - type: exec + script: ip link del blok-tap1 + +- name: Delete blok-br1 bridge + steps: + - type: exec + script: ip link del blok-br1 diff --git a/t/venom/vars/all.yml b/t/venom/vars/all.yml index 76b315a8be0b..b16b003b8921 100644 --- a/t/venom/vars/all.yml +++ b/t/venom/vars/all.yml @@ -609,6 +609,15 @@ security_event_suricata.node.ipaddress: 192.168.3.10 security_event_suricata.pf_portal: 192.168.3.1 security_event_suricata.networks: 192.168.3.0 +################################################################################ +## Security event random_mac test suite specific variables +################################################################################# +security_event_random_mac.event.id: '3000007' +security_event_random_mac.node.macaddress: 02:06:19:98:00:04 +security_event_random_mac.node.ipaddress: 192.168.4.10 +security_event_random_mac.pf_portal: 192.168.4.1 +security_event_random_mac.networks: 192.168.4.0 + ################################################################################# ## inline_l2_and_radius test suite specific variables ################################################################################# From 8f7a61320a11f51817558a1bba9a3763567554cf Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Thu, 17 Nov 2022 15:58:10 -0500 Subject: [PATCH 003/103] [Venom] Security test random mac: add async restart services --- .../05_setup_packetfence.yml | 32 +++++++++---------- .../07_prepare_security_event_random_mac.yml | 9 +++--- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml index 0e6d19976960..1661e358f94f 100644 --- a/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml +++ b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml @@ -241,48 +241,48 @@ testcases: - name: restart_iptables steps: - - type: systemctl_service_restart - service: packetfence-iptables + - type: pf_api_service_restart_async + service: "packetfence-iptables" time_to_sleep: 5 - name: restart_pfdns_service steps: - - type: systemctl_service_restart - service: packetfence-pfdns + - type: pf_api_service_restart_async + service: "packetfence-pfdns" time_to_sleep: 5 - name: restart_pfdhcp_service steps: - - type: systemctl_service_restart - service: packetfence-pfdhcp + - type: pf_api_service_restart_async + service: "packetfence-pfdhcp" time_to_sleep: 5 - name: restart_haproxy-portal_service steps: - - type: systemctl_service_restart - service: packetfence-haproxy-portal + - type: pf_api_service_restart_async + service: "packetfence-haproxy-portal" time_to_sleep: 5 - name: restart_keepalived_service steps: - - type: systemctl_service_restart - service: packetfence-keepalived + - type: pf_api_service_restart_async + service: "packetfence-keepalived" time_to_sleep: 5 - name: restart_pfdhcplistener_service steps: - - type: systemctl_service_restart - service: packetfence-pfdhcplistener + - type: pf_api_service_restart_async + service: "packetfence-pfdhcplistener" time_to_sleep: 5 - name: restart_pfacct_service steps: - - type: systemctl_service_restart - service: packetfence-pfacct + - type: pf_api_service_restart_async + service: "packetfence-pfacct" time_to_sleep: 5 - name: restart_pfqueue_service steps: - - type: systemctl_service_restart - service: packetfence-pfqueue + - type: pf_api_system_service_restart_async + service: "packetfence-pfqueue" time_to_sleep: 5 diff --git a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml index 282eebdee093..13707d81d5f1 100644 --- a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml +++ b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml @@ -10,13 +10,14 @@ testcases: # restart pfqueue et pf detect - name: restart_service_pfqueue steps: - - type: systemctl_service_restart - service: packetfence-pfqueue + - type: pf_api_system_service_restart_async + service: "packetfence-pfqueue" + time_to_sleep: 5 - name: restart_service_pfdetect steps: - - type: systemctl_service_restart - service: packetfence-pfdetect + - type: pf_api_service_restart_async + service: "packetfence-pfdetect" - name: clear_fingerbank_cache steps: From ad5dcd2dcd1d984c1b7600e75e700e935bd78b02 Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Thu, 17 Nov 2022 16:11:27 -0500 Subject: [PATCH 004/103] [Venom] Security test random mac: add async restart services on teardown --- .../teardown/05_deconfigure_packetfence.yml | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml index be9aa838949a..11b733a12e03 100644 --- a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml +++ b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml @@ -79,42 +79,42 @@ testcases: - name: restart_iptables steps: - - type: systemctl_service_restart - service: packetfence-iptables + - type: pf_api_service_restart_async + service: "packetfence-iptables" time_to_sleep: 5 - name: restart_pfdns_service steps: - - type: systemctl_service_restart - service: packetfence-pfdns + - type: pf_api_service_restart_async + service: "packetfence-pfdns" time_to_sleep: 5 - name: restart_pfdhcp_service steps: - - type: systemctl_service_restart - service: packetfence-pfdhcp + - type: pf_api_service_restart_async + service: "packetfence-pfdhcp" time_to_sleep: 5 - name: restart_haproxy-portal_service steps: - - type: systemctl_service_restart - service: packetfence-haproxy-portal + - type: pf_api_service_restart_async + service: "packetfence-haproxy-portal" time_to_sleep: 5 - name: restart_keepalived_service steps: - - type: systemctl_service_restart - service: packetfence-keepalived + - type: pf_api_service_restart_async + service: "packetfence-keepalived" time_to_sleep: 5 - name: restart_pfdhcplistener_service steps: - - type: systemctl_service_restart - service: packetfence-pfdhcplistener + - type: pf_api_service_restart_async + service: "packetfence-pfdhcplistener" time_to_sleep: 5 - name: restart_pfacct_service steps: - - type: systemctl_service_restart - service: packetfence-pfacct + - type: pf_api_service_restart_async + service: "packetfence-pfacct" time_to_sleep: 5 From bff317690d9c589bca798bb8664dcda48385f9f5 Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Mon, 21 Nov 2022 09:38:37 -0500 Subject: [PATCH 005/103] [Venom] Security Event Mac random: fix step names --- t/venom/test_suites/security_event_random_mac/30_tests.yml | 2 +- .../teardown/05_deconfigure_packetfence.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/t/venom/test_suites/security_event_random_mac/30_tests.yml b/t/venom/test_suites/security_event_random_mac/30_tests.yml index a27ef46d3162..f156d7454a20 100644 --- a/t/venom/test_suites/security_event_random_mac/30_tests.yml +++ b/t/venom/test_suites/security_event_random_mac/30_tests.yml @@ -45,7 +45,7 @@ testcases: - result.statuscode ShouldEqual 200 -- name: test_if_the_device_is_back_in_the_register_ipset +- name: test_if_the_device_is_back_in_the_unregister_ipset steps: - type: exec script: 'ipset test pfsession_Unreg_{{.security_event_random_mac.networks}} {{.security_event_random_mac.node.ipaddress}}' diff --git a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml index 11b733a12e03..2756278a5b6a 100644 --- a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml +++ b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml @@ -69,7 +69,7 @@ testcases: assertions: - result.statuscode ShouldEqual 200 -- name: desable_security_event +- name: disable_security_event steps: - type: pf_api_action method: PATCH From 59bfe0bf7eacc90a8bcc481d8fc386451f6e457b Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Mon, 21 Nov 2022 09:54:47 -0500 Subject: [PATCH 006/103] [Venom] EAP TLS: fix cron restart --- t/venom/test_suites/common/restart_pfcron_service.yml | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/t/venom/test_suites/common/restart_pfcron_service.yml b/t/venom/test_suites/common/restart_pfcron_service.yml index e76a57483714..0fa0cb9a7ed9 100644 --- a/t/venom/test_suites/common/restart_pfcron_service.yml +++ b/t/venom/test_suites/common/restart_pfcron_service.yml @@ -6,12 +6,5 @@ testcases: - name: restart_pfcron_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfcron/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'pfcron' From 371d7eb7dd3403102ff9006e32fa3692172076c4 Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Mon, 21 Nov 2022 10:06:23 -0500 Subject: [PATCH 007/103] [Venom] Common test suite: fix restart services --- .../common/restart_iptables_service.yml | 15 ++--------- .../common/restart_pfdhcp_service.yml | 15 ++--------- .../common/restart_pfdhcplistener_service.yml | 15 ++--------- t/venom/test_suites/common/restart_pfdns.yml | 15 ++--------- .../common/restart_pfdns_service.yml | 15 ++--------- .../common/restart_radius_services.yml | 25 +++---------------- 6 files changed, 14 insertions(+), 86 deletions(-) diff --git a/t/venom/test_suites/common/restart_iptables_service.yml b/t/venom/test_suites/common/restart_iptables_service.yml index b608c6e2234c..b7ea61e77907 100644 --- a/t/venom/test_suites/common/restart_iptables_service.yml +++ b/t/venom/test_suites/common/restart_iptables_service.yml @@ -1,17 +1,6 @@ name: Restart iptables service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_iptables_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/iptables/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'iptables' diff --git a/t/venom/test_suites/common/restart_pfdhcp_service.yml b/t/venom/test_suites/common/restart_pfdhcp_service.yml index 8b3cec82804f..57336c16611c 100644 --- a/t/venom/test_suites/common/restart_pfdhcp_service.yml +++ b/t/venom/test_suites/common/restart_pfdhcp_service.yml @@ -1,17 +1,6 @@ name: Restart pfdhcp service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_pfdhcp_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfdhcp/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'pfdhcp' diff --git a/t/venom/test_suites/common/restart_pfdhcplistener_service.yml b/t/venom/test_suites/common/restart_pfdhcplistener_service.yml index d9c00b1f15ea..5e1d57b8c4b3 100644 --- a/t/venom/test_suites/common/restart_pfdhcplistener_service.yml +++ b/t/venom/test_suites/common/restart_pfdhcplistener_service.yml @@ -1,17 +1,6 @@ name: Restart pfdhcplistener service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_pfdhcplistener_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfdhcplistener/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'pfdhcplistener' diff --git a/t/venom/test_suites/common/restart_pfdns.yml b/t/venom/test_suites/common/restart_pfdns.yml index 2475b9cc96ab..0f465e469c63 100644 --- a/t/venom/test_suites/common/restart_pfdns.yml +++ b/t/venom/test_suites/common/restart_pfdns.yml @@ -1,17 +1,6 @@ name: Restart pfdns service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_pfdns_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfdns/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'pfdns' diff --git a/t/venom/test_suites/common/restart_pfdns_service.yml b/t/venom/test_suites/common/restart_pfdns_service.yml index 2475b9cc96ab..0f465e469c63 100644 --- a/t/venom/test_suites/common/restart_pfdns_service.yml +++ b/t/venom/test_suites/common/restart_pfdns_service.yml @@ -1,17 +1,6 @@ name: Restart pfdns service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_pfdns_service steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfdns/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'pfdns' diff --git a/t/venom/test_suites/common/restart_radius_services.yml b/t/venom/test_suites/common/restart_radius_services.yml index 8dbc968ab0b1..bb6bc7b22d55 100644 --- a/t/venom/test_suites/common/restart_radius_services.yml +++ b/t/venom/test_suites/common/restart_radius_services.yml @@ -1,27 +1,10 @@ name: Restart RADIUS services testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_radius_services steps: - - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/radiusd-auth/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + - type: pf_api_service_restart_async + service: 'radiusd-auth' - type: http - method: POST - url: '{{.pfserver_webadmin_url}}/api/v1/service/pfacct/restart' - ignore_verify_ssl: true - headers: - "Authorization": "{{.get_login_token.result.token}}" - "Content-Type": "application/json" - assertions: - - result.statuscode ShouldEqual 200 + method: pf_api_service_restart_async + service: 'pfacct' From 1adbcf0e71ce9c18bb4f79744d70f25835e364bd Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Tue, 22 Nov 2022 16:07:29 -0500 Subject: [PATCH 008/103] [Venom] Test suite common: Remove extra steps --- t/venom/test_suites/common/restart_pfcron_service.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/t/venom/test_suites/common/restart_pfcron_service.yml b/t/venom/test_suites/common/restart_pfcron_service.yml index 0fa0cb9a7ed9..4e7740510bdb 100644 --- a/t/venom/test_suites/common/restart_pfcron_service.yml +++ b/t/venom/test_suites/common/restart_pfcron_service.yml @@ -1,9 +1,5 @@ name: Restart pfcron service testcases: -- name: get_login_token - steps: - - type: get_login_token - - name: restart_pfcron_service steps: - type: pf_api_service_restart_async From 10c0460ef8ace33a73c295205f8459d2c9ae191e Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Tue, 22 Nov 2022 16:08:50 -0500 Subject: [PATCH 009/103] [Venom] Security random: remove packetfence- for services to restart and remove time to sleep since async --- .../05_setup_packetfence.yml | 24 +++++++------------ .../teardown/05_deconfigure_packetfence.yml | 22 ++++++----------- 2 files changed, 15 insertions(+), 31 deletions(-) diff --git a/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml index 1661e358f94f..c9949c957299 100644 --- a/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml +++ b/t/venom/test_suites/security_event_random_mac/05_setup_packetfence.yml @@ -242,47 +242,39 @@ testcases: - name: restart_iptables steps: - type: pf_api_service_restart_async - service: "packetfence-iptables" - time_to_sleep: 5 + service: "iptables" - name: restart_pfdns_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdns" - time_to_sleep: 5 + service: "pfdns" - name: restart_pfdhcp_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdhcp" - time_to_sleep: 5 + service: "pfdhcp" - name: restart_haproxy-portal_service steps: - type: pf_api_service_restart_async - service: "packetfence-haproxy-portal" - time_to_sleep: 5 + service: "haproxy-portal" - name: restart_keepalived_service steps: - type: pf_api_service_restart_async - service: "packetfence-keepalived" - time_to_sleep: 5 + service: "keepalived" - name: restart_pfdhcplistener_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdhcplistener" - time_to_sleep: 5 + service: "pfdhcplistener" - name: restart_pfacct_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfacct" - time_to_sleep: 5 + service: "pfacct" - name: restart_pfqueue_service steps: - type: pf_api_system_service_restart_async - service: "packetfence-pfqueue" - time_to_sleep: 5 + service: "pfqueue" diff --git a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml index 2756278a5b6a..285a25e682fc 100644 --- a/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml +++ b/t/venom/test_suites/security_event_random_mac/teardown/05_deconfigure_packetfence.yml @@ -76,45 +76,37 @@ testcases: url: 'config/security_event/{{.security_event_random_mac.event.id}}' body: '{"id":"{{.security_event_random_mac.event.id}}","enabled":"N","quiet":true}' - - name: restart_iptables steps: - type: pf_api_service_restart_async - service: "packetfence-iptables" - time_to_sleep: 5 + service: "iptables" - name: restart_pfdns_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdns" - time_to_sleep: 5 + service: "pfdns" - name: restart_pfdhcp_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdhcp" - time_to_sleep: 5 + service: "pfdhcp" - name: restart_haproxy-portal_service steps: - type: pf_api_service_restart_async - service: "packetfence-haproxy-portal" - time_to_sleep: 5 + service: "haproxy-portal" - name: restart_keepalived_service steps: - type: pf_api_service_restart_async - service: "packetfence-keepalived" - time_to_sleep: 5 + service: "keepalived" - name: restart_pfdhcplistener_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfdhcplistener" - time_to_sleep: 5 + service: "pfdhcplistener" - name: restart_pfacct_service steps: - type: pf_api_service_restart_async - service: "packetfence-pfacct" - time_to_sleep: 5 + service: "pfacct" From b987c1da31bfb109d792ba9c4470d4ec3cf2958d Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Wed, 23 Nov 2022 16:29:57 -0500 Subject: [PATCH 010/103] [Venom] Security Random Mac: fix restart service name --- .../07_prepare_security_event_random_mac.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml index 13707d81d5f1..77e0b75f03a1 100644 --- a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml +++ b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml @@ -11,13 +11,13 @@ testcases: - name: restart_service_pfqueue steps: - type: pf_api_system_service_restart_async - service: "packetfence-pfqueue" + service: "pfqueue" time_to_sleep: 5 - name: restart_service_pfdetect steps: - type: pf_api_service_restart_async - service: "packetfence-pfdetect" + service: "pfdetect" - name: clear_fingerbank_cache steps: From b5cb35d4f12fadffc2f29179c307c6ebdbe94452 Mon Sep 17 00:00:00 2001 From: jegoi <13801368+JeGoi@users.noreply.github.com> Date: Wed, 23 Nov 2022 16:30:37 -0500 Subject: [PATCH 011/103] [Venom] Security Random Mac: test pf queue with classic restart --- .../07_prepare_security_event_random_mac.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml index 77e0b75f03a1..058a56083c6b 100644 --- a/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml +++ b/t/venom/test_suites/security_event_random_mac/07_prepare_security_event_random_mac.yml @@ -10,7 +10,7 @@ testcases: # restart pfqueue et pf detect - name: restart_service_pfqueue steps: - - type: pf_api_system_service_restart_async + - type: pf_api_service_restart_async service: "pfqueue" time_to_sleep: 5 From 49ef0912ad6a0bedbcfee15a215ecd9a1660fe82 Mon Sep 17 00:00:00 2001 From: nqb Date: Fri, 25 Nov 2022 06:54:58 +0100 Subject: [PATCH 012/103] [Venom]: remove duplicate file --- t/venom/test_suites/common/restart_pfdns.yml | 6 ------ 1 file changed, 6 deletions(-) delete mode 100644 t/venom/test_suites/common/restart_pfdns.yml diff --git a/t/venom/test_suites/common/restart_pfdns.yml b/t/venom/test_suites/common/restart_pfdns.yml deleted file mode 100644 index 0f465e469c63..000000000000 --- a/t/venom/test_suites/common/restart_pfdns.yml +++ /dev/null @@ -1,6 +0,0 @@ -name: Restart pfdns service -testcases: -- name: restart_pfdns_service - steps: - - type: pf_api_service_restart_async - service: 'pfdns' From 24ee9e1ddf32854edc194405c6c64e059219a3ef Mon Sep 17 00:00:00 2001 From: nqb Date: Fri, 25 Nov 2022 13:22:34 +0100 Subject: [PATCH 013/103] build kaniko-build img before all other images using upstream/debug image exclude new image from pull --- .gitlab-ci.yml | 53 ++++++++++++++++++++++++++---- containers/kaniko-build/Dockerfile | 6 ++++ containers/manage-images.sh | 1 + 3 files changed, 53 insertions(+), 7 deletions(-) create mode 100644 containers/kaniko-build/Dockerfile diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 60515ff2eb1f..194327c3efb0 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -30,6 +30,7 @@ variables: PFBUILD_CENTOS_8_IMG: ghcr.io/inverse-inc/packetfence/pfbuild-centos-8 PFBUILD_DEB_BULLSEYE_IMG: ghcr.io/inverse-inc/packetfence/pfbuild-debian-bullseye KANIKO_DEBUG_IMG: gcr.io/kaniko-project/executor:debug + KANIKOBUILD_IMG: ghcr.io/inverse-inc/packetfence/kaniko-build KNK_REGISTRY: ghcr.io KNK_REGISTRY_URL: ${KNK_REGISTRY}/inverse-inc/packetfence KNK_CACHE: "true" @@ -279,6 +280,14 @@ variables: - shell .build_img_container_job: + stage: build_img_container + dependencies: [] + image: + name: ${KANIKOBUILD_IMG} + tags: + - docker + +.build_img_container_kanikobuild_job: stage: build_img_container dependencies: [] image: @@ -528,10 +537,19 @@ run_pipeline_if_necessary: # BUILD_IMG_CONTAINER JOBS ######################################## # devel +kaniko_dev: + extends: + - .build_img_container_kanikobuild_job + - .build_img_container_devel_rules + variables: + IMAGE_NAME: "kaniko-build" + IMAGE_TAGS: "${CI_COMMIT_REF_SLUG},latest" + pfdeb_dev: extends: - .build_img_container_job - .build_img_container_devel_rules + needs: ["kaniko_dev"] variables: IMAGE_NAME: "pfdebian" IMAGE_TAGS: "${CI_COMMIT_REF_SLUG},latest" @@ -569,6 +587,7 @@ img_dev: extends: - .build_img_container_job - .build_img_container_devel_rules + needs: ["kaniko_dev"] variables: IMAGE_TAGS: "${CI_COMMIT_REF_SLUG},latest" parallel: @@ -593,10 +612,19 @@ rad_based_dev: - "radiusd-eduroam" # branches and maintenance +kaniko_br_maint: + extends: + - .build_img_container_kanikobuild_job + - .build_img_container_branches_and_maintenance_rules + variables: + IMAGE_NAME: "kaniko-build" + IMAGE_TAGS: ${CI_COMMIT_REF_SLUG} + pfdeb_br_maint: extends: - .build_img_container_job - .build_img_container_branches_and_maintenance_rules + needs: ["kaniko_br_maint"] variables: IMAGE_NAME: "pfdebian" IMAGE_TAGS: ${CI_COMMIT_REF_SLUG} @@ -634,6 +662,7 @@ img_br_maint: extends: - .build_img_container_job - .build_img_container_branches_and_maintenance_rules + needs: ["kaniko_br_maint"] variables: IMAGE_TAGS: ${CI_COMMIT_REF_SLUG} parallel: @@ -658,10 +687,19 @@ rad_based_br_maint: - "radiusd-eduroam" # release +kaniko_rel: + extends: + - .build_img_container_kanikobuild_job + - .release_only_rules + variables: + IMAGE_NAME: "kaniko-build" + IMAGE_TAGS: ${CI_COMMIT_TAG} + pfdeb_rel: extends: - .build_img_container_job - .release_only_rules + needs: ["kaniko_rel"] variables: IMAGE_NAME: "pfdebian" IMAGE_TAGS: ${CI_COMMIT_TAG} @@ -696,14 +734,15 @@ pfdeb_based_rel: - "proxysql" img_rel: - extends: - - .build_img_container_job - - .release_only_rules - variables: + extends: + - .build_img_container_job + - .release_only_rules + needs: ["kaniko_rel"] + variables: IMAGE_TAGS: ${CI_COMMIT_TAG} - parallel: - matrix: - - IMAGE_NAME: + parallel: + matrix: + - IMAGE_NAME: - "fingerbank-db" rad_based_rel: diff --git a/containers/kaniko-build/Dockerfile b/containers/kaniko-build/Dockerfile new file mode 100644 index 000000000000..01425635e0f9 --- /dev/null +++ b/containers/kaniko-build/Dockerfile @@ -0,0 +1,6 @@ +FROM gcr.io/kaniko-project/executor:debug + +COPY containers/kanikobuild /bin/kanikobuild +RUN chmod +x /bin/kanikobuild + +ENTRYPOINT /bin/kanikobuild diff --git a/containers/manage-images.sh b/containers/manage-images.sh index 8264da632a7b..84fdc850e61e 100755 --- a/containers/manage-images.sh +++ b/containers/manage-images.sh @@ -24,6 +24,7 @@ configure_and_check() { -not -path "*/pfdebian/*" \ -not -path "*/radiusd/*" \ -not -path "*/pfconnector-*/*" \ + -not -path "*/kaniko-build/*" \ -printf "%P\n") for file in ${DOCKERFILE_DIRS}; do From b39c9d5823b2bf832b9e30929bf2c7b0442edaa6 Mon Sep 17 00:00:00 2001 From: nqb Date: Fri, 25 Nov 2022 13:39:04 +0100 Subject: [PATCH 014/103] move specific variables in a dedicated file define default value for KNK_CACHE build_img_docker=no --- .gitlab-ci.yml | 1 - containers/kaniko_vars | 10 ++++++++++ containers/kanikobuild | 40 +++++++++++++++++++++------------------- 3 files changed, 31 insertions(+), 20 deletions(-) create mode 100644 containers/kaniko_vars diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 194327c3efb0..a35dc9497caf 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -33,7 +33,6 @@ variables: KANIKOBUILD_IMG: ghcr.io/inverse-inc/packetfence/kaniko-build KNK_REGISTRY: ghcr.io KNK_REGISTRY_URL: ${KNK_REGISTRY}/inverse-inc/packetfence - KNK_CACHE: "true" PFBUILD_DEFAULT_DEV_TAG: latest CIDIR: ci CILIBDIR: ci/lib diff --git a/containers/kaniko_vars b/containers/kaniko_vars new file mode 100644 index 000000000000..4d8027db8b43 --- /dev/null +++ b/containers/kaniko_vars @@ -0,0 +1,10 @@ +### collect variables needed inside Dockerfile + +# returns X.Y +export PF_VERSION=$(egrep -o '[0-9]+\.[0-9]+' $CI_PROJECT_DIR/conf/pf-release) + +# only used for pfdebian build +export PKGS_TO_EXCLUDE="packetfence|freeradius" + +# variables to pass during build +DOCKFILE_VARS='PF_VERSION KNK_REGISTRY_URL IMAGE_TAG FINGERBANK_BUILD_API_KEY BUILD_PFAPPSERVER_VUE PKGS_TO_EXCLUDE' \ No newline at end of file diff --git a/containers/kanikobuild b/containers/kanikobuild index 64e6c1cf36f7..921e2e8b0a02 100755 --- a/containers/kanikobuild +++ b/containers/kanikobuild @@ -6,22 +6,22 @@ set -o nounset -o pipefail -o errexit # CI_PROJECT_DIR must be equal to root of PF source tree (full path) setup_vars() { - DOCKFILE_PATH=$CI_PROJECT_DIR/containers/$IMAGE_NAME/Dockerfile + # all specific variables need to be defined in kaniko_vars + if [ -f "$CI_PROJECT_DIR/containers/kaniko_vars" ]; then + source $CI_PROJECT_DIR/containers/kaniko_vars + else + echo "No specific variables added to build" + fi - ### collect variables needed inside Dockerfile - # returns X.Y - export PF_VERSION=$(egrep -o '[0-9]+\.[0-9]+' $CI_PROJECT_DIR/conf/pf-release) + # necessary if variables are not defined in kaniko_vars or in environment + DOCKFILE_PATH=${DOCKFILE_PATH:-"$CI_PROJECT_DIR/containers/$IMAGE_NAME/Dockerfile"} + DOCKFILE_VARS=${DOCKFILE_VARS:-} + KNK_CACHE=${KNK_CACHE:-true} # IMAGE_TAG is used inside DockerFile to reference other image # only one tag can be used in Dockerfile export IMAGE_TAG=$(echo $IMAGE_TAGS | cut -d ',' -f 1) - # only used for pfdebian build - export PKGS_TO_EXCLUDE="packetfence|freeradius" - - # variables to pass during build - DOCKFILE_VARS='PF_VERSION KNK_REGISTRY_URL IMAGE_TAG FINGERBANK_BUILD_API_KEY BUILD_PFAPPSERVER_VUE PKGS_TO_EXCLUDE' - echo "Building ${IMAGE_NAME} using ${DOCKFILE_PATH}" } @@ -35,15 +35,17 @@ generate_knk_config() { # already in the environment generate_build_args() { local build_args='' - for var in ${DOCKFILE_VARS}; do - # just to handle case of first iteration - if [ -z "$build_args" ]; then - build_args="--build-arg ${var}" - else - build_args="$build_args --build-arg ${var}" - fi - done - echo "$build_args" + if [ -n "${DOCKFILE_VARS}" ]; then + for var in ${DOCKFILE_VARS}; do + # just to handle case of first iteration + if [ -z "$build_args" ]; then + build_args="--build-arg ${var}" + else + build_args="$build_args --build-arg ${var}" + fi + done + echo "$build_args" + fi } detect_multi_tags() { From bcac401e431f4f424978899a546aa956655864c3 Mon Sep 17 00:00:00 2001 From: nqb Date: Fri, 25 Nov 2022 14:39:42 +0000 Subject: [PATCH 015/103] use kaniko-build img just built to build PF images --- .gitlab-ci.yml | 44 ++++++++++++++++++++++++++++++-------------- 1 file changed, 30 insertions(+), 14 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a35dc9497caf..effd8bf7b358 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -278,11 +278,27 @@ variables: tags: - shell -.build_img_container_job: +.build_img_container_job_dev: stage: build_img_container dependencies: [] image: - name: ${KANIKOBUILD_IMG} + name: ${KANIKOBUILD_IMG}:${CI_COMMIT_REF_SLUG} + tags: + - docker + +.build_img_container_job_br_maint: + stage: build_img_container + dependencies: [] + image: + name: ${KANIKOBUILD_IMG}:${CI_COMMIT_REF_SLUG} + tags: + - docker + +.build_img_container_job_rel: + stage: build_img_container + dependencies: [] + image: + name: ${KANIKOBUILD_IMG}:${CI_COMMIT_TAG} tags: - docker @@ -546,7 +562,7 @@ kaniko_dev: pfdeb_dev: extends: - - .build_img_container_job + - .build_img_container_job_dev - .build_img_container_devel_rules needs: ["kaniko_dev"] variables: @@ -555,7 +571,7 @@ pfdeb_dev: pfdeb_based_dev: extends: - - .build_img_container_job + - .build_img_container_job_dev - .build_img_container_devel_rules needs: ["pfdeb_dev"] variables: @@ -584,7 +600,7 @@ pfdeb_based_dev: img_dev: extends: - - .build_img_container_job + - .build_img_container_job_dev - .build_img_container_devel_rules needs: ["kaniko_dev"] variables: @@ -596,7 +612,7 @@ img_dev: rad_based_dev: extends: - - .build_img_container_job + - .build_img_container_job_dev - .build_img_container_devel_rules needs: ["pfdeb_based_dev"] variables: @@ -621,7 +637,7 @@ kaniko_br_maint: pfdeb_br_maint: extends: - - .build_img_container_job + - .build_img_container_job_br_maint - .build_img_container_branches_and_maintenance_rules needs: ["kaniko_br_maint"] variables: @@ -630,7 +646,7 @@ pfdeb_br_maint: pfdeb_based_br_maint: extends: - - .build_img_container_job + - .build_img_container_job_br_maint - .build_img_container_branches_and_maintenance_rules needs: ["pfdeb_br_maint"] variables: @@ -659,7 +675,7 @@ pfdeb_based_br_maint: img_br_maint: extends: - - .build_img_container_job + - .build_img_container_job_br_maint - .build_img_container_branches_and_maintenance_rules needs: ["kaniko_br_maint"] variables: @@ -671,7 +687,7 @@ img_br_maint: rad_based_br_maint: extends: - - .build_img_container_job + - .build_img_container_job_br_maint - .build_img_container_branches_and_maintenance_rules needs: ["pfdeb_based_br_maint"] variables: @@ -696,7 +712,7 @@ kaniko_rel: pfdeb_rel: extends: - - .build_img_container_job + - .build_img_container_job_rel - .release_only_rules needs: ["kaniko_rel"] variables: @@ -705,7 +721,7 @@ pfdeb_rel: pfdeb_based_rel: extends: - - .build_img_container_job + - .build_img_container_job_rel - .release_only_rules needs: ["pfdeb_rel"] variables: @@ -734,7 +750,7 @@ pfdeb_based_rel: img_rel: extends: - - .build_img_container_job + - .build_img_container_job_rel - .release_only_rules needs: ["kaniko_rel"] variables: @@ -746,7 +762,7 @@ img_rel: rad_based_rel: extends: - - .build_img_container_job + - .build_img_container_job_rel - .release_only_rules needs: ["pfdeb_based_rel"] variables: From a617c20c7a45b64811d50da0c6893c50175e1671 Mon Sep 17 00:00:00 2001 From: nqb Date: Fri, 25 Nov 2022 14:42:53 +0000 Subject: [PATCH 016/103] update targets used for tests --- containers/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/containers/Makefile b/containers/Makefile index b2e7e8d7dc4d..1e7313b2de71 100644 --- a/containers/Makefile +++ b/containers/Makefile @@ -22,8 +22,8 @@ endif .PHONY: run_kaniko run_kaniko: - docker pull gcr.io/kaniko-project/executor:debug - docker container run --entrypoint '/busybox/sh' --rm --name "kaniko" --volume="$(SRC_ROOT_DIR)":/workspace -it gcr.io/kaniko-project/executor:debug + docker pull ghcr.io/inverse-inc/packetfence/kaniko-build:devel + docker container run --entrypoint '/busybox/sh' --rm --name "kaniko" --volume="$(SRC_ROOT_DIR)":/workspace -it ghcr.io/inverse-inc/packetfence/kaniko-build:devel ### Targets for localdev DOCKERFILE_DIRS = $(shell find -type f -name "Dockerfile" -printf "%P\n") @@ -43,4 +43,4 @@ $(CONTAINER_IMAGES): -e "KNK_REGISTRY_URL=$(KNK_REGISTRY_URL)" \ -e "KNK_REGISTRY_USER" -e "KNK_REGISTRY_PASSWORD" \ --volume="$(SRC_ROOT_DIR)":/workspace \ - -it gcr.io/kaniko-project/executor:debug + -it ghcr.io/inverse-inc/packetfence/kaniko-build:devel From d97af677ad64c7981285ab2e191e144af89f9863 Mon Sep 17 00:00:00 2001 From: Darren Satkunas Date: Fri, 25 Nov 2022 12:07:00 -0500 Subject: [PATCH 017/103] add rename --- .../Configuration/connectionProfiles/_api.js | 13 +- .../_components/InlineName.vue | 134 ++++++++++++++++++ .../_components/ModalFile.vue | 5 +- .../_components/TheFilesList.vue | 72 ++++++---- .../connectionProfiles/_components/index.js | 2 + .../connectionProfiles/_store.js | 17 +++ .../connectionProfiles/schema.js | 4 +- 7 files changed, 212 insertions(+), 35 deletions(-) create mode 100644 html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/InlineName.vue diff --git a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_api.js b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_api.js index af0b39aa3546..606709548269 100644 --- a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_api.js +++ b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_api.js @@ -51,22 +51,25 @@ export default { }) }, file: params => { - const get = params.quiet ? 'getQuiet' : 'get' - return apiCall[get](['config', 'connection_profile', params.id, 'files', ...params.filename.split('/').filter(p => p)], { nocache: true }).then(response => { + const method = params.quiet ? 'getQuiet' : 'get' + return apiCall[method](['config', 'connection_profile', params.id, 'files', ...params.filename.split('/').filter(p => p)], { nocache: true }).then(response => { return response.data }) }, createFile: params => { - return apiCall.put(['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')], params.content).then(response => { + const method = params.quiet ? 'putQuiet' : 'put' + return apiCall[method](['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')], params.content).then(response => { return response.data }) }, updateFile: params => { - return apiCall.patch(['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')], params.content).then(response => { + const method = params.quiet ? 'patchQuiet' : 'patch' + return apiCall[method](['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')], params.content).then(response => { return response.data }) }, deleteFile: params => { - return apiCall.delete(['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')]) + const method = params.quiet ? 'deleteQuiet' : 'delete' + return apiCall[method](['config', 'connection_profile', params.id, 'files', ...params.filename.split('/')]) } } diff --git a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/InlineName.vue b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/InlineName.vue new file mode 100644 index 000000000000..26f251eb0bc7 --- /dev/null +++ b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/InlineName.vue @@ -0,0 +1,134 @@ + + diff --git a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/ModalFile.vue b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/ModalFile.vue index e8f3d53e29a7..1bdb79f19c54 100644 --- a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/ModalFile.vue +++ b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/ModalFile.vue @@ -74,7 +74,10 @@ reverse @click="onDelete" >{{ $t('Revert') }} - {{ $t('Cancel') }} + {{ $t('Cancel') }} + {{ $t('Close') }} diff --git a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/TheFilesList.vue b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/TheFilesList.vue index 5b309dca14e0..05db3e5b9d55 100644 --- a/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/TheFilesList.vue +++ b/html/pfappserver/root/src/views/Configuration/connectionProfiles/_components/TheFilesList.vue @@ -11,7 +11,7 @@ /> @@ -22,7 +22,7 @@ :disabled="false" > + :name="name" class="nav-icon" /> @@ -32,13 +32,18 @@

+ :name="name" class="nav-icon" /> - - - {{ item.name }} + + + + + {{ item.name }}