Tests

Tester dependencies

python3 -m pip install -r requirements_test.txt

Firewall dependencies

The Firewall used for testing should be a dedicated VM for testing. You can use the official ova image.

THE TESTS WILL OVERRIDE THE EXISTING CONFIG!

Most tests fail if some other config is found.

Packages

Some tests need packages to be pre-installed:

• webproxy_* - os-squid
• frr_* - os-frr
• bind_* - os-bind

Interfaces

Some tests benefit from having a second network-interface available.

You need to add a opt1 dummy-interface named TEST. The assigned IPs do not matter.

Add another interface and leave it unassigned (vtnet2).

Internet access

To perform some tests (system, ids) the test firewall needs to reach some public service:

• system - pkg.opnsense.org
• ids - rules.emergingthreats.net

Certificates

These internal certificates need to be created:

• CA: OpenVPN
• Client Certificate: OpenVPN Client
• Server Certificate: OpenVPN Server - SAN DNS:openvpn.intern

Gateways

The gateway tests will not work correctly if the LAN network mismatches.

You can provide your GW IPs via env-vars: TEST_FIREWALL_GW1 and TEST_FIREWALL_GW2

The route module will expect the gateways LAN_GW and TEST-GW to exist.

Rule interface groups

The gateway tests will not work correctly if the LAN interface mismatches.

You can provide your GW lan-if via env-vars: TEST_FIREWALL_RULE_GRP_IF

DHCRelay

The DHCRelay tests will not work correctly if the LAN interface mismatches.

You can provide your lan-if via env-vars: TEST_DHCRELAY_IF

=======

LAGG Interfaces

The LAGG tests will not work correctly if the unassigned interface mismatches.

You can provide your if via env-vars: TEST_FIREWALL_LAGG_IF

And the count of existing LAGGs via TEST_FIREWALL_LAGG_CNT

---

Run

Single module

bash scripts/test_single.sh
> Arguments:
>   1: firewall
>   2: api key file
>   3: path to local collection - set to '0' to clone from github
>   4: name of test to run
>   5: if check-mode should be ran (optional; 0/1; default=1)
>   6: path to virtual environment (optional)

All modules

bash scripts/test.sh
> Arguments:
>   1: firewall
>   2: api key file
>   3: path to local collection - set to '0' to clone from github
>   4: path to virtual environment (optional)

---

Automatic tests

The tests are run automatically using the AnsibleGuy infrastructure!

It is based on some bash scripts and systemd timers.

Logs for those functional tests can be found here: Short, Full