Merge charm-vpn-strongswan:strongswan-dev into charm-vpn-strongswan:master

[David O Neill]

[Diko Parvanov (dparv)]

some small inline comments added

review: Needs Fixing

[Diko Parvanov (dparv)]

Reviewed code, worked on deployments and testing with values. Seems to me like a minimum viable product that creates a ipsec tunnel and runs firewall rules with the configurations options. What needs to be worked on is unit and functional testing for a complete product.

review: Approve

[Paul Goins (vultaire)]

Old MR, marked as approved but not actually merged.

Do we still desire/need this?

If so, perhaps we need to re-review, considering how long this has been?

I've moved the overall state of the MR from "Approved" to "Needs review", and added to the bootstack reviewers queue.

[Eric Chen (eric-chen)]

No resource to handover it and review it. Mark it WIP as temp solution

Unmerged commits

d8dbf2b... by Alvaro Uria on 2020-10-05

Run black on code

2edc2fb... by Zachary Zehring on 2020-10-02

Add to docstring reasoning for aa complain being set.

68a1af4... by Zachary Zehring on 2020-10-02

Fix lint issues.

- refactored enable and restart calls in config_changed to reduce
complexity
- fix imports
- add test case docstrings
- fix line lengths

b1b76c1... by Zachary Zehring on 2020-10-01

Add docstrings for exceptions.

0856f44... by Zachary Zehring on 2020-10-01

Fix lint issues.

- fix import orderings
- cleanup start-of-doc documentation
- adjust lines for line length

5232a90... by Zachary Zehring on 2020-10-01

Adjust import format for import list.

128624c... by Zachary Zehring on 2020-10-01

Add distro dependency.

6260aa3... by Zachary Zehring on 2020-10-01

Change subprocess.calls to check_outputs. Add error handling.

This commit fixes subprocess calls to allow for error handling
when subprocess commands fail. This also includes error handling
in the charm.py level for setting BlockedStatus and whatnot.
Heavy work was also done in allowing compatibility for focal and
bionic.

NOTE: currently, app armor profile for strongSwan related services
are all set to complain to allow for full functionality but still
get some audit of what needs configuring.

ea3ccd3... by Alvaro Uria on 2020-09-30

Fix StrongSwanManager validation

542d8a7... by Alvaro Uria on 2020-09-30

Fix lib_strongswan.generate_debug_from_level

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2a94471
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,42 @@
+# Juju files
+.unit-state.db
+.go-cookies
+
+layers/*
+interfaces/*
+
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Tests files and dir
+.pytest_cache/
+.coverage
+.tox
+report/
+htmlcov/
+
+# Log files
+*.log
+
+# pycharm
+.idea/
+
+# vi
+.*.swp
+
+# version data
+repo-info
+version
+
+# Python builds
+deb_dist/
+dist/
+
+# Snaps
+*.snap
+
+# Builds
+.build/
+build
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..de18452
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,4 @@
+[submodule "mod/vpncommon"]
+	path = mod/vpncommon
+	url = https://git.launchpad.net/charm-vpn-common
+	branch = dev/common
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..5c5f603
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,81 @@
+PYTHON := /usr/bin/python3
+
+PROJECTPATH=$(dir $(realpath $(MAKEFILE_LIST)))
+ifndef CHARM_BUILD_DIR
+	CHARM_BUILD_DIR=${PROJECTPATH}.build
+endif
+METADATA_FILE="metadata.yaml"
+CHARM_NAME=$(shell cat ${PROJECTPATH}/${METADATA_FILE} | grep -E '^name:' | awk '{print $$2}')
+
+help:
+	@echo "This project supports the following targets"
+	@echo ""
+	@echo " make help - show this text"
+	@echo " make clean - remove unneeded files"
+	@echo " make submodules - make sure that the submodules are up-to-date"
+	@echo " make submodules-update - update submodules to latest changes on remote branch"
+	@echo " make build - build the charm"
+	@echo " make release - run clean, submodules and build targets"
+	@echo " make lint - run flake8 and black --check"
+	@echo " make black - run black and reformat files"
+	@echo " make proof - run charm proof"
+	@echo " make unittests - run the tests defined in the unittest subdirectory"
+	@echo " make functional - run the tests defined in the functional subdirectory"
+	@echo " make test - run lint, proof, unittests and functional targets"
+	@echo ""
+
+clean:
+	@echo "Cleaning files"
+	@git clean -ffXd -e '!.idea' -e '!lib/vpncommon'
+	@echo "Cleaning existing build"
+	@rm -rf ${CHARM_BUILD_DIR}/${CHARM_NAME}
+
+submodules:
+	@echo "Cloning submodules"
+	@git submodule update --init --recursive
+
+submodules-update:
+	@echo "Pulling latest updates for submodules"
+	@git submodule update --init --recursive --remote --merge
+
+build:
+	@echo "Building charm to base directory ${CHARM_BUILD_DIR}/${CHARM_NAME}"
+	@-git rev-parse --abbrev-ref HEAD > ./repo-info
+	@-git describe --always > ./version
+	@mkdir -p ${CHARM_BUILD_DIR}/${CHARM_NAME}
+	@tox -e build
+	@mv ${CHARM_NAME}.charm ${CHARM_BUILD_DIR}/.
+
+release: clean build unpack
+	@echo "Charm is built at ${CHARM_BUILD_DIR}/${CHARM_NAME}"
+
+unpack: build
+	@mkdir -p ${CHARM_BUILD_DIR}/${CHARM_NAME}
+	@echo "Unpacking built .charm into ${CHARM_BUILD_DIR}/${CHARM_NAME}"
+	@cd ${CHARM_BUILD_DIR}/${CHARM_NAME} && unzip -q ${CHARM_BUILD_DIR}/${CHARM_NAME}.charm
+
+lint:
+	@echo "Running lint checks"
+	@tox -e lint
+
+black:
+	@echo "Reformat files with black"
+	@tox -e black
+
+proof: unpack
+	@echo "Running charm proof"
+	@cd ${CHARM_BUILD_DIR}/${CHARM_NAME} && charm proof
+
+unittests:
+	@echo "Running unit tests"
+	@tox -e unit
+
+functional: build
+	@echo "Executing functional tests in ${CHARM_BUILD_DIR}"
+	@CHARM_BUILD_DIR=${CHARM_BUILD_DIR} tox -e func
+
+test: lint proof unittests functional
+	@echo "Tests completed for charm ${CHARM_NAME}."
+
+# The targets below don't depend on a file
+.PHONY: help submodules submodules-update clean build release lint black proof unittests functional test
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..815019b
--- /dev/null
+++ b/README.md
@@ -0,0 +1,22 @@
+# Juju strongswan Charm
+
+Overview
+--------
+
+Creates an ipsec tunnel and exposes ports to
+IP addresses defined in dnat_sockets.
+
+Quickstart
+----------
+
+juju deploy vpn-strongswan --to lxd:0
+
+juju config vpn-strongswan secret="your secret" # default is pre shared key
+juju config vpn-strongswan local_addr="10.0.3.92"
+juju config vpn-strongswan remote_addr="66.198.198.198"
+juju config vpn-strongswan remote_subnet="10.191.0.0/24"
+
+Contact
+-------
+ - Author: bootstack <[e-mail]>
+ - Bug Tracker: [here](https://bugs.launchpad.net/charm-vpn-strongswan)
diff --git a/config.yaml b/config.yaml
new file mode 100644
index 0000000..56748dd
--- /dev/null
+++ b/config.yaml
@@ -0,0 +1,58 @@
+options:
+    allow_inbound_ssh: 
+        type: boolean
+        default: true
+        description: |
+           ip address allowed for inbound access (such as udlap)
+    dnat_sockets:
+        type: string
+        default: ""
+        description: |
+           X.X.X.X:YYYY , X.X.X.X:YYYY , X.X.X.X:YYYY , X.X.X.X:YYYY  
+    debug_level:
+        type: int
+        default: 1
+        description: |
+            The debug level strongSwan service. The levels range from -1 to 4, with -1 being absolutely silent and 4
+            providing sensitive information (e.g. keys) in the logging.
+    version:
+        type: int
+        default: 2
+        description: |
+            Method of key exchange; which protocol should be used to initialize the connection.
+    cipher:
+        type: string
+        default: "aes256gcm16-prfsha384-ecp384"
+        description: |
+            Comma-separated list of ESP encryption/authentication algorithms to be used for the connection, e.g. aes128-sha256.
+    auth:
+        type: string
+        default: "psk"
+        description: |
+            Authentication method to use locally (left) or require from the remote (right) side. 
+    secret:
+        type: string
+        default: ""
+        description: |
+            comma seperated list of secrets corresponding to auth option
+            ot3jooKuph0Ais2g,fenu5328723j5oo3df
+    local_addr:
+        type: string
+        default: ""
+        description: |
+            The IP address of the participant's public-network interface or one of several magic values.
+    remote_addr:
+        type: string
+        default: ""
+        description: |
+            The IP address of the participant's public-network interface or one of several magic values.
+    remote_subnet:
+        type: string
+        default: ""
+        description: |
+            The IP address of the participant's public-network interface or one of several magic values.
+    vip:
+        type: string
+        default: ""
+        description: |
+            The internal source IP to use in a tunnel, also known as virtual IP.
diff --git a/copyright b/copyright
new file mode 100644
index 0000000..2591568
--- /dev/null
+++ b/copyright
@@ -0,0 +1,16 @@
+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0
+
+Files: *
+Copyright: Copyright 2011-2016, Canonical Ltd., All Rights Reserved.
+License: Apache-2.0
+ Licensed under the Apache License, Version 2.0 (the "License"); you may
+ not use this file except in compliance with the License. You may obtain
+ a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ License for the specific language governing permissions and limitations
+ under the License.
\ No newline at end of file
diff --git a/hooks/.empty b/hooks/.empty
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/hooks/.empty
diff --git a/icon.svg b/icon.svg
new file mode 100644
index 0000000..eca73a8
--- /dev/null
+++ b/icon.svg
@@ -0,0 +1,309 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="96"
+   height="96"
+   id="svg6517"
+   version="1.1"
+   inkscape:version="0.92+devel unknown"
+   sodipodi:docname="openstack-cinder_new.svg"
+   viewBox="0 0 96 96">
+  <defs
+     id="defs6519">
+    <linearGradient
+       id="Background">
+      <stop
+         id="stop4178"
+         offset="0"
+         style="stop-color:#22779e" />
+      <stop
+         id="stop4180"
+         offset="1"
+         style="stop-color:#2991c0" />
+    </linearGradient>
+    <filter
+       style="color-interpolation-filters:sRGB"
+       inkscape:label="Inner Shadow"
+       id="filter1121">
+      <feFlood
+         flood-opacity="0.59999999999999998"
+         flood-color="rgb(0,0,0)"
+         result="flood"
+         id="feFlood1123" />
+      <feComposite
+         in="flood"
+         in2="SourceGraphic"
+         operator="out"
+         result="composite1"
+         id="feComposite1125" />
+      <feGaussianBlur
+         in="composite1"
+         stdDeviation="1"
+         result="blur"
+         id="feGaussianBlur1127" />
+      <feOffset
+         dx="0"
+         dy="2"
+         result="offset"
+         id="feOffset1129" />
+      <feComposite
+         in="offset"
+         in2="SourceGraphic"
+         operator="atop"
+         result="composite2"
+         id="feComposite1131" />
+    </filter>
+    <filter
+       style="color-interpolation-filters:sRGB"
+       inkscape:label="Drop Shadow"
+       id="filter950">
+      <feFlood
+         flood-opacity="0.25"
+         flood-color="rgb(0,0,0)"
+         result="flood"
+         id="feFlood952" />
+      <feComposite
+         in="flood"
+         in2="SourceGraphic"
+         operator="in"
+         result="composite1"
+         id="feComposite954" />
+      <feGaussianBlur
+         in="composite1"
+         stdDeviation="1"
+         result="blur"
+         id="feGaussianBlur956" />
+      <feOffset
+         dx="0"
+         dy="1"
+         result="offset"
+         id="feOffset958" />
+      <feComposite
+         in="SourceGraphic"
+         in2="offset"
+         operator="over"
+         result="composite2"
+         id="feComposite960" />
+    </filter>
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath873">
+      <g
+         transform="matrix(0,-0.66666667,0.66604479,0,-258.25992,677.00001)"
+         id="g875"
+         inkscape:label="Layer 1"
+         style="fill:#ff00ff">
+        <path
+           d="M 46.702703,898.22775 H 97.297297 C 138.16216,898.22775 144,904.06497 144,944.92583 v 50.73846 c 0,40.86071 -5.83784,46.69791 -46.702703,46.69791 H 46.702703 C 5.8378378,1042.3622 0,1036.525 0,995.66429 v -50.73846 c 0,-40.86086 5.8378378,-46.69808 46.702703,-46.69808 z"
+           id="path877"
+           inkscape:connector-curvature="0"
+           sodipodi:nodetypes="sssssssss" />
+      </g>
+    </clipPath>
+    <style
+       id="style867"
+       type="text/css"><![CDATA[
+    .fil0 {fill:#1F1A17}
+   ]]></style>
+    <clipPath
+       id="clipPath16">
+      <path
+         id="path18"
+         d="M -9,-9 H 605 V 222 H -9 Z"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <clipPath
+       id="clipPath116">
+      <path
+         id="path118"
+         d="m 91.7368,146.3253 -9.7039,-1.577 -8.8548,-3.8814 -7.5206,-4.7308 -7.1566,-8.7335 -4.0431,-4.282 -3.9093,-1.4409 -1.034,2.5271 1.8079,2.6096 0.4062,3.6802 1.211,-0.0488 1.3232,-1.2069 -0.3569,3.7488 -1.4667,0.9839 0.0445,1.4286 -3.4744,-1.9655 -3.1462,-3.712 -0.6559,-3.3176 1.3453,-2.6567 1.2549,-4.5133 2.5521,-1.2084 2.6847,0.1318 2.5455,1.4791 -1.698,-8.6122 1.698,-9.5825 -1.8692,-4.4246 -6.1223,-6.5965 1.0885,-3.941 2.9002,-4.5669 5.4688,-3.8486 2.9007,-0.3969 3.225,-0.1094 -2.012,-8.2601 7.3993,-3.0326 9.2188,-1.2129 3.1535,2.0619 0.2427,5.5797 3.5178,5.8224 0.2426,4.6094 8.4909,-0.6066 7.8843,0.7279 -7.8843,-4.7307 1.3343,-5.701 4.9731,-7.763 4.8521,-2.0622 3.8814,1.5769 1.577,3.1538 8.1269,6.1861 1.5769,-1.3343 12.7363,-0.485 2.5473,2.0619 0.2426,3.6391 -0.849,1.5767 -0.6066,9.8251 -4.2454,8.4909 0.7276,3.7605 2.5475,-1.3343 7.1566,-6.6716 3.5175,-0.2424 3.8815,1.5769 3.8818,2.9109 1.9406,6.3077 11.4021,-0.7277 6.914,2.6686 5.5797,5.2157 4.0028,7.5206 0.9706,8.8546 -0.8493,10.3105 -2.1832,9.2185 -2.1836,2.9112 -3.0322,0.9706 -5.3373,-5.8224 -4.8518,-1.6982 -4.2455,7.0353 -4.2454,3.8815 -2.3049,1.4556 -9.2185,7.6419 -7.3993,4.0028 -7.3993,0.6066 -8.6119,-1.4556 -7.5206,-2.7899 -5.2158,-4.2454 -4.1241,-4.9734 -4.2454,-1.2129"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <clipPath
+       id="clipPath128">
+      <path
+         id="path130"
+         d="m 91.7368,146.3253 -9.7039,-1.577 -8.8548,-3.8814 -7.5206,-4.7308 -7.1566,-8.7335 -4.0431,-4.282 -3.9093,-1.4409 -1.034,2.5271 1.8079,2.6096 0.4062,3.6802 1.211,-0.0488 1.3232,-1.2069 -0.3569,3.7488 -1.4667,0.9839 0.0445,1.4286 -3.4744,-1.9655 -3.1462,-3.712 -0.6559,-3.3176 1.3453,-2.6567 1.2549,-4.5133 2.5521,-1.2084 2.6847,0.1318 2.5455,1.4791 -1.698,-8.6122 1.698,-9.5825 -1.8692,-4.4246 -6.1223,-6.5965 1.0885,-3.941 2.9002,-4.5669 5.4688,-3.8486 2.9007,-0.3969 3.225,-0.1094 -2.012,-8.2601 7.3993,-3.0326 9.2188,-1.2129 3.1535,2.0619 0.2427,5.5797 3.5178,5.8224 0.2426,4.6094 8.4909,-0.6066 7.8843,0.7279 -7.8843,-4.7307 1.3343,-5.701 4.9731,-7.763 4.8521,-2.0622 3.8814,1.5769 1.577,3.1538 8.1269,6.1861 1.5769,-1.3343 12.7363,-0.485 2.5473,2.0619 0.2426,3.6391 -0.849,1.5767 -0.6066,9.8251 -4.2454,8.4909 0.7276,3.7605 2.5475,-1.3343 7.1566,-6.6716 3.5175,-0.2424 3.8815,1.5769 3.8818,2.9109 1.9406,6.3077 11.4021,-0.7277 6.914,2.6686 5.5797,5.2157 4.0028,7.5206 0.9706,8.8546 -0.8493,10.3105 -2.1832,9.2185 -2.1836,2.9112 -3.0322,0.9706 -5.3373,-5.8224 -4.8518,-1.6982 -4.2455,7.0353 -4.2454,3.8815 -2.3049,1.4556 -9.2185,7.6419 -7.3993,4.0028 -7.3993,0.6066 -8.6119,-1.4556 -7.5206,-2.7899 -5.2158,-4.2454 -4.1241,-4.9734 -4.2454,-1.2129"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <linearGradient
+       id="linearGradient3850"
+       inkscape:collect="always">
+      <stop
+         id="stop3852"
+         offset="0"
+         style="stop-color:#000000" />
+      <stop
+         id="stop3854"
+         offset="1"
+         style="stop-color:#000000;stop-opacity:0" />
+    </linearGradient>
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath3095">
+      <path
+         d="M 976.648,389.551 H 134.246 V 1229.55 H 976.648 V 389.551"
+         id="path3097"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath3195">
+      <path
+         d="m 611.836,756.738 -106.34,105.207 c -8.473,8.289 -13.617,20.102 -13.598,33.379 L 598.301,790.207 c -0.031,-13.418 5.094,-25.031 13.535,-33.469"
+         id="path3197"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <clipPath
+       clipPathUnits="userSpaceOnUse"
+       id="clipPath3235">
+      <path
+         d="m 1095.64,1501.81 c 35.46,-35.07 70.89,-70.11 106.35,-105.17 4.4,-4.38 7.11,-10.53 7.11,-17.55 l -106.37,105.21 c 0,7 -2.71,13.11 -7.09,17.51"
+         id="path3237"
+         inkscape:connector-curvature="0" />
+    </clipPath>
+    <clipPath
+       id="clipPath4591"
+       clipPathUnits="userSpaceOnUse">
+      <path
+         inkscape:connector-curvature="0"
+         d="m 1106.6009,730.43734 -0.036,21.648 c -0.01,3.50825 -2.8675,6.61375 -6.4037,6.92525 l -83.6503,7.33162 c -3.5205,0.30763 -6.3812,-2.29987 -6.3671,-5.8145 l 0.036,-21.6475 20.1171,-1.76662 -0.011,4.63775 c 0,1.83937 1.4844,3.19925 3.3262,3.0395 l 49.5274,-4.33975 c 1.8425,-0.166 3.3425,-1.78125 3.3538,-3.626 l 0.01,-4.63025 20.1,-1.7575"
+         style="fill:#ff00ff"
+         id="path4593" />
+    </clipPath>
+    <radialGradient
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(-1.4333926,-2.2742838,1.1731823,-0.73941125,-174.08025,98.374394)"
+       r="20.40658"
+       fy="93.399292"
+       fx="-26.508606"
+       cy="93.399292"
+       cx="-26.508606"
+       id="radialGradient3856"
+       xlink:href="#linearGradient3850"
+       inkscape:collect="always" />
+    <linearGradient
+       gradientTransform="translate(-318.48033,212.32022)"
+       gradientUnits="userSpaceOnUse"
+       y2="993.19702"
+       x2="-51.879555"
+       y1="593.11615"
+       x1="348.20132"
+       id="linearGradient3895"
+       xlink:href="#linearGradient3850"
+       inkscape:collect="always" />
+    <clipPath
+       id="clipPath3906"
+       clipPathUnits="userSpaceOnUse">
+      <rect
+         transform="scale(1,-1)"
+         style="color:#000000;opacity:0.8;fill:#ff00ff;stroke-width:4"
+         id="rect3908"
+         width="1019.1371"
+         height="1019.1371"
+         x="357.9816"
+         y="-1725.8152" />
+    </clipPath>
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="6.3664627"
+     inkscape:cx="41.347717"
+     inkscape:cy="47.487328"
+     inkscape:document-units="px"
+     inkscape:current-layer="layer1"
+     showgrid="true"
+     fit-margin-top="0"
+     fit-margin-left="0"
+     fit-margin-right="0"
+     fit-margin-bottom="0"
+     inkscape:window-width="1920"
+     inkscape:window-height="1029"
+     inkscape:window-x="0"
+     inkscape:window-y="24"
+     inkscape:window-maximized="1"
+     showborder="true"
+     showguides="false"
+     inkscape:guide-bbox="true"
+     inkscape:showpageshadow="false"
+     inkscape:snap-global="true"
+     inkscape:snap-bbox="true"
+     inkscape:bbox-paths="true"
+     inkscape:bbox-nodes="true"
+     inkscape:snap-bbox-edge-midpoints="true"
+     inkscape:snap-bbox-midpoints="true"
+     inkscape:object-paths="true"
+     inkscape:snap-intersection-paths="true"
+     inkscape:object-nodes="true"
+     inkscape:snap-smooth-nodes="true"
+     inkscape:snap-midpoints="true"
+     inkscape:snap-object-midpoints="true"
+     inkscape:snap-center="true"
+     inkscape:document-rotation="0">
+    <inkscape:grid
+       type="xygrid"
+       id="grid821" />
+    <sodipodi:guide
+       orientation="1,0"
+       position="16,48"
+       id="guide823"
+       inkscape:locked="false" />
+    <sodipodi:guide
+       orientation="0,1"
+       position="64,80"
+       id="guide825"
+       inkscape:locked="false" />
+    <sodipodi:guide
+       orientation="1,0"
+       position="80,40"
+       id="guide827"
+       inkscape:locked="false" />
+    <sodipodi:guide
+       orientation="0,1"
+       position="64,16"
+       id="guide829"
+       inkscape:locked="false" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata6522">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="BACKGROUND"
+     inkscape:groupmode="layer"
+     id="layer1"
+     transform="translate(268,-635.29076)">
+    <path
+       style="fill:#ed1843"
+       d="M 48 0 A 48 48 0 0 0 0 48 A 48 48 0 0 0 48 96 A 48 48 0 0 0 96 48 A 48 48 0 0 0 48 0 z "
+       transform="translate(-268,635.29076)"
+       id="path6455" />
+    <path
+       style="fill:#ffffff;stroke-width:0.13333333"
+       d="M 25.203125 20 C 22.340895 20 20 22.341395 20 25.203125 L 20 32 L 20 36 L 76 36 L 76 32 L 76 25.203125 C 76 22.341395 73.658635 20 70.796875 20 L 25.203125 20 z M 20 40 L 20 42 L 20 54 L 20 56 L 76 56 L 76 54 L 76 42 L 76 40 L 20 40 z M 20 60 L 20 64 L 20 70.796875 C 20 73.658605 22.341375 76 25.203125 76 L 70.796875 76 C 73.659105 76 76 73.658605 76 70.796875 L 76 64 L 76 60 L 20 60 z "
+       transform="translate(-268,635.29076)"
+       id="path38" />
+  </g>
+</svg>
diff --git a/lib/__init__.py b/lib/__init__.py
new file mode 100644
index 0000000..7106537
--- /dev/null
+++ b/lib/__init__.py
@@ -0,0 +1 @@
+"""Lib module."""
diff --git a/lib/lib_strongswan.py b/lib/lib_strongswan.py
new file mode 100644
index 0000000..ff34832
--- /dev/null
+++ b/lib/lib_strongswan.py
@@ -0,0 +1,426 @@
+"""Class for the management of swantctl."""
+
+# Copyright © 2020 bootstack [e-mail]
+
+import hashlib
+import logging
+import os
+import subprocess
+from ipaddress import AddressValueError, IPv4Address, ip_network
+from pathlib import Path
+
+import distro
+
+from jinja2 import Environment, FileSystemLoader
+
+from charmhelpers.fetch import apt_install  # noqa:E402
+
+import netifaces
+
+from strongswan_constants import (
+    AVAILABLE_CIPHERS,
+    CHARON_DEBUG_KEYS,
+    OPTION_VALIDATORS,
+)
+
+
+logger = logging.getLogger()
+
+
+def get_default_route_subnet():
+    """Get the CIDR notation of the default network.
+
+    Returns
+        CIDR: eg. 192.168.0.0/16
+    """
+    gateways = netifaces.gateways()
+    interface = gateways["default"][netifaces.AF_INET][1]
+    addresses = netifaces.ifaddresses(interface)
+    ipaddress = addresses[netifaces.AF_INET][0]["addr"]
+    mask = addresses[netifaces.AF_INET][0]["netmask"]
+    net = ip_network(ipaddress + "/" + mask, strict=False)
+    return net
+
+
+def file_get_contents(filename):
+    """Create file or return its content.
+
+    @param filename: path to file to be read or created empty
+    @type filename: str
+    @return Text file content or an empty string
+    @rtype str
+    """
+    if os.path.exists(filename) is False:
+        with open(filename, "a"):
+            os.utime(filename, None)
+            return "".encode("utf-8")
+
+    with open(filename) as f:
+        return f.read().encode("utf-8")
+
+
+def is_string_in_file(str_to_check, file):
+    """Look up for a string in a text file."""
+    with open(file) as f:
+        return str_to_check in f.read()
+
+
+class StrongSwanError(Exception):
+    """Base strongSwan error class."""
+
+    def __init__(self, workload_status):
+        """Init StrongSwanError with a workload_status."""
+        super().__init__()
+        self.workload_status = workload_status
+
+    def __repr__(self):
+        """Return the canonical string representation of the object."""
+        return "{}: {}".format(type(self).__name__, self.workload_status)
+
+    def __str__(self):
+        """Return the error message raised."""
+        return self.workload_status
+
+
+class StrongSwanValidationError(StrongSwanError):
+    """Raised when juju config validation fails."""
+
+    pass
+
+
+class StrongSwanServiceError(StrongSwanError):
+    """Raised when service-related command fails."""
+
+    pass
+
+
+class StrongSwanManager:
+    """StrongSwanManager install and manage swantctl."""
+
+    STRONGSWAN_PACKAGES = (
+        "libstrongswan",
+        "libstrongswan-standard-plugins",
+        "strongswan",
+        "strongswan-charon",
+        "strongswan-libcharon",
+        "charon-systemd",
+        "strongswan-swanctl",
+        "apparmor-utils",
+    )
+    SWANCTL_CONF_PATH = "/etc/swanctl.conf"
+    STRONGSWAN_CONF_PATH = "/etc/strongswan.conf"
+    IPTABLES_SAVE_PATH = "/etc/iptables.save"
+    swanctl_restart_required = False
+    _strongswan_service = None
+
+    def __init__(self, unit):
+        """Install and manage swanctl.
+
+        Args:
+            unit: A reference to the charm application unit
+        Returns:
+            Boolean: true or false
+        """
+        self.unit = unit
+
+    @property
+    def strongswan_service(self):
+        """Return strongSwan service string based on distro."""
+        if self._strongswan_service:
+            return self._strongswan_service
+        codename = distro.codename()
+        if codename == "focal":
+            self._strongswan_service = "strongswan.service"
+        else:
+            self._strongswan_service = "strongswan-swanctl.service"
+        return self._strongswan_service
+
+    @staticmethod
+    def modify_app_armor_profile():
+        """Modify related strongSwan app armor profiles, setting to complain mode.
+
+        NOTE: currently, app armor profile for strongSwan related services
+        are all set to complain to allow for full functionality but still
+        get some audit of what needs configuring. ideally, these services
+        would have profiles that dictate access to things as needed.
+        """
+        app_armor_profile = "/etc/apparmor.d/usr.sbin.swanctl"
+
+        if not os.path.exists(app_armor_profile):
+            return
+
+        app_armor_profiles = [
+            "usr.lib.ipsec.charon",
+            "usr.lib.ipsec.stroke",
+            "usr.sbin.charon-systemd",
+            "usr.sbin.swanctl",
+        ]
+        app_armor_profile_path = Path("/etc/apparmor.d")
+        for app_armor_profile in app_armor_profiles:
+            cmd = "aa-complain {}".format(
+                app_armor_profile_path / app_armor_profile
+            ).split()
+            subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+
+    def install_strongswan(self):
+        """Install the strongswan packages."""
+        if os.path.exists("/usr/sbin/swanctl"):
+            return True
+        try:
+            apt_install(self.STRONGSWAN_PACKAGES)
+        except subprocess.CalledProcessError as apt_install_error:
+            logger.error("apt_install call failed: {}".format(apt_install_error))
+            raise StrongSwanServiceError(
+                workload_status="Failed to apt install packages."
+            )
+        self.modify_app_armor_profile()
+
+    def enable_strongswan(self):
+        """Enable the systemd swanctl service."""
+        cmd = "systemctl enable {}".format(self.strongswan_service).split()
+        try:
+            subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+        except subprocess.CalledProcessError as e:
+            logger.error("enable strongswan cmd {} failed: {}".format(cmd, e))
+            msg = "Failed to enable {}. Check juju logs to troubleshoot".format(
+                self.strongswan_service
+            )
+            raise StrongSwanServiceError(workload_status=msg)
+
+    def restart_strongswan(self):
+        """Restart the systemd swanctl service."""
+        try:
+            if self.swanctl_restart_required:
+                cmd = "systemctl restart {}".format(self.strongswan_service).split()
+                subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+                self.swanctl_restart_required = False
+        except subprocess.CalledProcessError as e:
+            logger.error(
+                "Failed to restart {}: {}".format(self.strongswan_service, e.output)
+            )
+            msg = "Failed to restart {}. Check juju logs to troubleshoot.".format(
+                self.strongswan_service
+            )
+            raise StrongSwanServiceError(workload_status=msg)
+
+    def validate_proposals(self, key):
+        """Validate a comma-separated list of ESP encryption/authentication algorithms.
+
+        https://wiki.strongswan.org/projects/strongswan/wiki/SecurityRecommendations
+        Args:
+            key: the lvalue to lookup in the application model
+        Returns:
+            The validated or modified value
+        """
+        ciphers = set()
+        for value in self.unit.model.config.get(key, "").split(","):
+            ciphers.add(value.strip())
+
+        invalid_ciphers = ciphers - AVAILABLE_CIPHERS
+        if invalid_ciphers:
+            raise StrongSwanValidationError(
+                workload_status="Unsupported encryption algorithm: {}".format(
+                    invalid_ciphers
+                )
+            )
+
+        return self.unit.model.config[key]
+
+    @staticmethod
+    def generate_debug_from_level(debug_level):
+        """Generate debug level for each daemon.
+
+        @param debug_level: integer between -1 and 4
+        @type debug_devel: int
+        @return dict mapping charon_key to debug_level
+        @rtype dict
+        """
+        return {charon_key: debug_level for charon_key in CHARON_DEBUG_KEYS}
+
+    def validate_charon_debug(self, key):
+        """Validate the charon debug level.
+
+        https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration
+
+        Args:
+            key: the lvalue to lookup in the application model.
+                if the value is integer, create the associated log levels
+                    the user can set level (-1..4)
+                if the value is string of levels, parse it to confirm valid config
+                    app=1 asn=4 imc=2
+        Returns:
+            The validated value
+        """
+        debug_level = self.unit.model.config.get(key)
+        min_level, max_level = -1, 4
+        if min_level <= debug_level <= max_level:
+            return self.generate_debug_from_level(debug_level)
+        else:
+            msg = (
+                "Supported debug levels for charon_debug are between -1 and 4. "
+                "Level {} is invalid".format(debug_level)
+            )
+            raise StrongSwanValidationError(workload_status=msg)
+
+    def validate_ip(self, key):
+        """Validate an ip address.
+
+        Args:
+            key: the config option to lookup in the application model
+        Returns:
+            The validated value
+        """
+        ip_addr = self.unit.model.config[key]
+        try:
+            IPv4Address(ip_addr)
+            return self.unit.model.config[key]
+        except AddressValueError as ipv4_error:
+            raise StrongSwanValidationError(
+                workload_status='Invalid IP address "{}" for option "{}": {}'.format(
+                    ip_addr, key, ipv4_error
+                )
+            )
+
+    def validate_cidr(self, key):
+        """Validate CIDR address representation.
+
+        Args:
+            key: the config option to lookup in the application model
+        Returns:
+            The validated or modified value
+        """
+        config_value = self.unit.model.config[key]
+        try:
+            return str(ip_network(config_value))
+        except ValueError as ip_network_value_error:
+            raise StrongSwanValidationError(
+                workload_status='Invalid CIDR "{}" for "{}": {}'.format(
+                    config_value, key, ip_network_value_error
+                )
+            )
+
+    def validate_secrets(self, key):
+        """Validate secrets.
+
+        Args:
+            key: the config option to lookup in the application model
+        Returns:
+            list of secrets
+        """
+        config_value = self.unit.model.config[key]
+        cleaned_secrets = [
+            secret.strip() for secret in config_value.split(",") if secret
+        ]
+        if cleaned_secrets:
+            return cleaned_secrets
+        else:
+            raise StrongSwanValidationError(
+                workload_status="No valid secrets found. "
+                '"secret" requires at least 1 secret set'
+            )
+
+    def generate_jinja_context(self):
+        """Generate the context to be passed to jinja for config generation.
+
+        strongswan.org/testing/testresults/swanctl/net2net-psk/sun.swanctl.conf
+
+        Here we lookup the juju config item and apply the associated validation
+           Rvalues:
+              None (juju types, or handled elsewhere)
+              array (accepted values)
+              string (function pointer ofr complex validation)
+        """
+        context = {}
+        context["charm_name"] = self.unit.model.app.name
+
+        config_options_to_check = (
+            option
+            for option in self.unit.model.config
+            if option and option in OPTION_VALIDATORS
+        )
+        # check option against its validator
+        for key in config_options_to_check:
+            validator = OPTION_VALIDATORS.get(key)
+
+            # option has known list of accepted values
+            if isinstance(validator, list):
+                logger.debug("Validating set value is available option.")
+                if self.unit.model.config[key] not in validator:
+                    raise StrongSwanValidationError(
+                        workload_status="Valid values for {} are: {}".format(
+                            key, ", ".join(validator)
+                        )
+                    )
+
+            # validator is a function pointer
+            if isinstance(validator, str):
+                validator_func = getattr(self, validator)
+                if self.unit.model.config[key]:
+                    context[key] = validator_func(key)
+
+        context["local_subnet"] = get_default_route_subnet()
+
+        return context
+
+    def generate_strongswan_config(self):
+        """Create config files from jinja templates and update files on disk.
+
+        if changes have occured
+        """
+        swanctl_old_file_contents = file_get_contents(self.SWANCTL_CONF_PATH)
+        swanctl_old_file_contents_md5sum = hashlib.md5(
+            swanctl_old_file_contents
+        ).hexdigest()
+        strongswan_old_file_contents = file_get_contents(self.STRONGSWAN_CONF_PATH)
+        strongswan_old_file_contents_md5sum = hashlib.md5(
+            strongswan_old_file_contents
+        ).hexdigest()
+
+        context = self.generate_jinja_context()
+
+        # Update swanctl.conf if the file has changed
+        env = Environment(loader=FileSystemLoader("templates"))
+        swanctl_new_config_template = env.get_template("swanctl.conf.j2")
+        swanctl_new_config = swanctl_new_config_template.render({"conf": context})
+
+        # remove blank files
+        swanctl_new_config = os.linesep.join(
+            [s for s in swanctl_new_config.splitlines() if s.strip() != ""]
+        )
+        swanctl_new_file_contents_md5sum = hashlib.md5(
+            swanctl_new_config.encode("utf-8")
+        ).hexdigest()
+
+        # sometimes its handy to see the mtime of a file
+        # we dont actually need to write the file unless its actually changed
+        if swanctl_new_file_contents_md5sum == swanctl_old_file_contents_md5sum:
+            logger.info("Swanctl config unchanged")
+        else:
+            # secrets changed
+            with open(self.SWANCTL_CONF_PATH, "w", encoding="utf-8") as f_out:
+                f_out.write(swanctl_new_config)
+                self.swanctl_restart_required = True
+                logger.info("Swanctl config file changed")
+
+        # Update strongswan.conf if the file has changed
+        strongswan_new_config_template = env.get_template("strongswan.conf.j2")
+        strongswan_new_config = strongswan_new_config_template.render({"conf": context})
+
+        # remove blank files
+        strongswan_new_config = os.linesep.join(
+            [s for s in strongswan_new_config.splitlines() if s.strip() != ""]
+        )
+        strongswan_new_file_contents_md5sum = hashlib.md5(
+            strongswan_new_config.encode("utf-8")
+        ).hexdigest()
+
+        # sometimes its handy to see the mtime of a file
+        # we dont actually need to write the file unless its actually changed
+        if strongswan_new_file_contents_md5sum == strongswan_old_file_contents_md5sum:
+            logger.info("Strongswan config unchanged")
+        else:
+            # secrets changed
+            with open(self.STRONGSWAN_CONF_PATH, "w", encoding="utf-8") as f_out:
+                f_out.write(strongswan_new_config)
+                self.swanctl_restart_required = True
+                logger.info("Strongswan config file changed")
diff --git a/lib/strongswan_constants.py b/lib/strongswan_constants.py
new file mode 100644
index 0000000..493526a
--- /dev/null
+++ b/lib/strongswan_constants.py
@@ -0,0 +1,49 @@
+"""Constants used by the StrongswanManager class."""
+
+OPTION_VALIDATORS = {
+    "debug_level": "validate_charon_debug",
+    "version": [0, 1, 2],
+    "cipher": "validate_proposals",
+    "auth": ["pubkey", "psk", "eap", "xauth"],
+    "secret": "validate_secrets",
+    "local_addr": "validate_ip",
+    "remote_addr": "validate_ip",
+    "remote_subnet": "validate_cidr",
+    "vip": "validate_ip",
+}
+
+CHARON_DEBUG_KEYS = (
+    "app",
+    "asn",
+    "cfg",
+    "chd",
+    "dmn",
+    "enc",
+    "esp",
+    "ike",
+    "imc",
+    "imv",
+    "job",
+    "knl",
+    "lib",
+    "mgr",
+    "net",
+    "pts",
+    "tls",
+    "tnc",
+)
+
+AVAILABLE_CIPHERS = {
+    "aes128-sha256-modp2048",
+    "aes256gcm16-ecp384",
+    "aes256gcm16-prfsha384-ecp384",
+    "aes256-sha2_256-modp1536",
+    "aes256-sha256",
+    "aes256-sha256-modp1536",
+    "aes256-sha256-modp2048",
+    "aes256-sha512",
+    "aes256-sha512-modp1536",
+    "aes256-sha512-modp2048",
+    "aes-sha256-ecp256",
+    "aes-sha256-ecp256",
+}
diff --git a/lib/vpncommon b/lib/vpncommon
new file mode 120000
index 0000000..8555a68
--- /dev/null
+++ b/lib/vpncommon
@@ -0,0 +1 @@
+../mod/vpncommon/
\ No newline at end of file
diff --git a/metadata.yaml b/metadata.yaml
new file mode 100644
index 0000000..8c0dc91
--- /dev/null
+++ b/metadata.yaml
@@ -0,0 +1,22 @@
+name: vpn-strongswan
+display-name: strongSwan VPN
+summary: Installs and configures strongSwan ipsec client
+maintainers:
+    - bootstack <[e-mail]>
+    - david.o.neill <[e-mail]>
+    - Zachary Zehring <[e-mail]>
+description: |
+    This charm is meant to be deployed into a container on physical host or VM.
+    The charm installs and configures strongSwan to the minimum spec and provides
+    the ability to do port forwarding via the container in the forward of iptables 
+    rules.
+tags:
+    - misc
+series:
+    - bionic
+    - focal
+provides:
+    vpn:
+        interface: vpn
+extra-bindings:
+    default:
diff --git a/mod/vpncommon b/mod/vpncommon
new file mode 160000
index 0000000..9a74b6b
--- /dev/null
+++ b/mod/vpncommon
@@ -0,0 +1 @@
+Subproject commit 9a74b6b8176f81c0bfc46c7d63b26e6a00e55b3a
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..6b12403
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,4 @@
+charmhelpers
+jinja2
+ops
+distro
\ No newline at end of file
diff --git a/src/charm.py b/src/charm.py
new file mode 100755
index 0000000..d957daf
--- /dev/null
+++ b/src/charm.py
@@ -0,0 +1,168 @@
+#! /usr/bin/env python3
+# -*- coding: utf-8 -*-
+# vim:fenc=utf-8
+# Copyright © 2020 bootstack [e-mail]
+"""Strong swan vpn charm, installs and configure strongswan."""
+import logging
+
+from charmhelpers.fetch import apt_install
+from charmhelpers.fetch.python.packages import pip_install
+
+from ops.charm import CharmBase
+from ops.framework import StoredState
+from ops.main import main
+from ops.model import ActiveStatus, BlockedStatus, MaintenanceStatus
+
+# ugly hack needed for installing apt packages until operator framework figures
+# out how to handle it
+# https://github.com/canonical/operator/issues/156
+try:
+    from lib_strongswan import (
+        StrongSwanManager,
+        StrongSwanValidationError,
+        StrongSwanServiceError,
+    )
+    from vpncommon.VPNProvides import VPNProvides  # noqa:E402
+    from vpncommon.NetFilterManager import NetFilterManager
+except (ImportError, AttributeError):
+    apt_install(["python3-distutils", "python3-numpy"])
+    pip_install(["python-iptables"])
+    from lib_strongswan import StrongSwanManager
+    from vpncommon.VPNProvides import VPNProvides  # noqa:E402
+    from vpncommon.NetFilterManager import NetFilterManager
+
+
+REQUIRED_OPTIONS = ["secret", "local_addr", "remote_addr", "remote_subnet"]
+
+
+class VpnStrongswanCharm(CharmBase):
+    """Install and configures swanctl and associated netfilter rules.
+
+    Inherits:
+        CharmBase: Operator framework
+    """
+
+    state = StoredState()
+
+    def __init__(self, *args):
+        """Initialize charm and configure states and events to observe.
+
+        Args:
+            args (tuple): addtional partmaters used in setup
+        """
+        super().__init__(*args)
+        self.logger = logging.getLogger()
+
+        # Instantiate helpers
+        self.vpn = VPNProvides(self, "vpn")
+        # delayed import due to c-bindings and apt install above of python libraries
+
+        self.strongSwanManager = StrongSwanManager(self)
+        self.netFilterManager = NetFilterManager()
+
+        # subscribe to observer events
+        self.framework.observe(self.on.install, self.on_install)
+        self.framework.observe(self.on.upgrade_charm, self.on_install)
+        self.framework.observe(self.on.config_changed, self.on_config_changed)
+        self.framework.observe(self.on.update_status, self.on_update_status)
+
+        # initialize states
+        self.state.set_default(installed=False)
+        self.state.set_default(configured=False)
+        self.state.set_default(started=False)
+        self.state.set_default(enabled=False)
+
+    def on_update_status(self, event):
+        """Handle update status event."""
+        return
+
+    def on_install(self, event):
+        """Handle the install event.
+
+        Args:
+            event (event): Operator framework event
+        """
+        self.unit.status = MaintenanceStatus("Installing charm software")
+        try:
+            self.strongSwanManager.install_strongswan()
+        except StrongSwanServiceError as install_error:
+            self.unit.status = BlockedStatus(install_error.workload_status)
+            return
+        self.state.installed = True
+        self.unit.status = MaintenanceStatus("Install complete")
+
+    def on_config_changed(self, event):
+        """Handle config changed event.
+
+        Args:
+            event (event): Operator framework event
+        """
+        self.unit.status = MaintenanceStatus("Configuring charm software")
+
+        missing_required_options = self._get_missing_required_options()
+        if missing_required_options:
+            self.unit.status = BlockedStatus(
+                "Following options need to be set: {}".format(missing_required_options)
+            )
+            return
+
+        try:
+            self.strongSwanManager.generate_strongswan_config()
+        except StrongSwanValidationError as validation_error:
+            self.logger.warning(
+                "Encountered validation exception: {}".format(
+                    validation_error.workload_status
+                )
+            )
+            self.unit.status = BlockedStatus(validation_error.workload_status)
+            return
+
+        self.unit.status = MaintenanceStatus("Configuring iptables")
+        result = self.netFilterManager.generate_iptables_config(
+            self.model.config["dnat_sockets"],
+            self.model.config["remote_subnet"],
+            self.model.config["allow_inbound_ssh"],
+        )
+        if isinstance(result, str):
+            self.unit.status = BlockedStatus(result)
+            return
+        self.unit.status = MaintenanceStatus("Iptables configured")
+
+        try:
+            self._enable_strongswan_if_required()
+            self._restart_strongswan_if_required()
+        except StrongSwanServiceError as enable_error:
+            self.unit.status = BlockedStatus(enable_error.workload_status)
+            return
+
+        self.state.configured = True
+        self.unit.status = ActiveStatus("Unit is ready")
+
+    def _enable_strongswan_if_required(self):
+        if self.state.enabled:
+            return
+
+        self.unit.status = MaintenanceStatus("Enabling strongSwan service")
+        self.strongSwanManager.enable_strongswan()
+        self.unit.status = MaintenanceStatus("Enabled strongSwan service")
+        self.state.enabled = True
+
+    def _restart_strongswan_if_required(self):
+        if not self.strongSwanManager.swanctl_restart_required:
+            return
+
+        self.unit.status = MaintenanceStatus("Restarting strongSwan service")
+        self.strongSwanManager.restart_strongswan()
+        self.unit.status = MaintenanceStatus("Restarted strongSwan service")
+
+    def _get_missing_required_options(self):
+        """Return list of config options not set in config that are required."""
+        missing_required_options = []
+        for option in REQUIRED_OPTIONS:
+            if not self.model.config.get(option):
+                missing_required_options.append(option)
+        return missing_required_options
+
+
+if __name__ == "__main__":
+    main(VpnStrongswanCharm)
diff --git a/templates/strongswan.conf.j2 b/templates/strongswan.conf.j2
new file mode 100644
index 0000000..37cd4db
--- /dev/null
+++ b/templates/strongswan.conf.j2
@@ -0,0 +1,27 @@
+charon {
+    filelog {
+        charon {
+            path = /var/log/ipsec-{{ conf.charm_name }}.log
+            time_format = %b %e %T
+            ike_name = yes
+            append = no
+            default = 0
+            flush_line = yes
+        }
+        stderr {
+        {% for charon_debug_key, charon_debug_level in conf.debug_level.items() %}
+            {{ charon_debug_key }}={{ charon_debug_level }}
+        {% endfor %}
+        }
+    }
+    syslog {
+        identifier = {{ conf.charm_name }}
+        daemon {
+        }
+        auth {
+        {% for charon_debug_key, charon_debug_level in conf.debug_level.items() %}
+            {{ charon_debug_key }}={{ charon_debug_level }}
+        {% endfor %}
+        }
+    }
+}
\ No newline at end of file
diff --git a/templates/swanctl.conf.j2 b/templates/swanctl.conf.j2
new file mode 100644
index 0000000..872340f
--- /dev/null
+++ b/templates/swanctl.conf.j2
@@ -0,0 +1,57 @@
+{# https://www.strongswan.org/testing/testresults/swanctl/net2net-psk/sun.swanctl.conf #}
+connections {
+    {{ conf.charm_name }} {
+        {% if conf.local_addr is defined %}
+        local_addrs = {{ conf.local_addr }}
+        {% endif %}
+        {% if conf.remote_addr is defined %}
+        remote_addrs = {{ conf.remote_addr }}
+        {% endif %}
+        {% if conf.version is defined %}
+        version = {{ conf.version }}
+        {% endif %}
+        {% if conf.cipher is defined %}
+        proposals = {{ conf.cipher }}
+        {% endif %}
+
+        local-1 {
+            id = local
+            {% if conf.auth is defined %}
+            auth = {{ conf.auth }}
+            {% endif %}
+        }
+        remote-1 {
+            id = remote
+            {% if conf.auth is defined %}
+            auth = {{ conf.auth }}
+            {% endif %}
+        }
+
+        children {
+            net-net {
+                {% if conf.local_subnet is defined %}
+                local_ts = {{ conf.local_subnet }}
+                {% endif %}
+                {% if conf.remote_subnet is defined %}
+                remote_ts = {{ conf.remote_subnet }}
+                {% endif %}
+                {% if conf.cipher is defined %}
+                esp_proposals = {{ conf.cipher }}
+                {% endif %}
+                {% if conf.vip is defined %}
+                vips = {{ conf.vip }}
+                {% endif %}
+            }
+        }
+    }
+}
+
+secrets {
+    {% for secret in conf.secret %}
+    {{ conf.charm_name }}-{{ loop.index }} {
+        id-local = local
+        id-remote = remote
+        secret = "{{ secret }}"
+    }
+    {% endfor %}
+}
diff --git a/tests/functional/requirements.txt b/tests/functional/requirements.txt
new file mode 100644
index 0000000..a0f417d
--- /dev/null
+++ b/tests/functional/requirements.txt
@@ -0,0 +1,2 @@
+git+https://github.com/openstack-charmers/zaza.git#egg=zaza
+ops
diff --git a/tests/functional/tests/bundles/bionic.yaml b/tests/functional/tests/bundles/bionic.yaml
new file mode 100644
index 0000000..e1fd9c0
--- /dev/null
+++ b/tests/functional/tests/bundles/bionic.yaml
@@ -0,0 +1,11 @@
+series: bionic
+
+applications:
+    vpn-strongswan:
+        charm: ../../../../.build/vpn-strongswan.charm
+        num_units: 1
+        options:
+          secret: "your secret"
+          local_addr: "10.0.3.92"
+          remote_addr: "66.198.198.198"
+          remote_subnet: "10.191.0.0/24"
diff --git a/tests/functional/tests/bundles/focal.yaml b/tests/functional/tests/bundles/focal.yaml
new file mode 100644
index 0000000..f9d5a27
--- /dev/null
+++ b/tests/functional/tests/bundles/focal.yaml
@@ -0,0 +1,11 @@
+series: focal
+
+applications:
+    vpn-strongswan:
+        charm: ../../../../.build/vpn-strongswan.charm
+        num_units: 1
+        options:
+          secret: "your secret"
+          local_addr: "10.0.3.92"
+          remote_addr: "66.198.198.198"
+          remote_subnet: "10.191.0.0/24"
diff --git a/tests/functional/tests/test_vpn_strongswan.py b/tests/functional/tests/test_vpn_strongswan.py
new file mode 100644
index 0000000..6c01e58
--- /dev/null
+++ b/tests/functional/tests/test_vpn_strongswan.py
@@ -0,0 +1,239 @@
+"""Zaza func tests."""
+import concurrent.futures
+import unittest
+
+from ops.model import Network
+
+from tests import utils
+
+import zaza.model
+
+
+class BaseStrongSwanTest(unittest.TestCase):
+    """Base class for strongSwan VPN charm tests."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Run setup for strongSwan VPN tests."""
+        cls.model_name = zaza.model.get_juju_model()
+        cls.application_name = "vpn-strongswan"
+
+    def setUp(self):
+        """Run setup per test."""
+        self._ensure_app_active()
+
+    def _ensure_app_active(self):
+        """Wait until the Juju application is active."""
+        strongswan_workload_checker = utils.get_workload_application_status_checker(
+            self.application_name, "active"
+        )
+        zaza.model.block_until(strongswan_workload_checker, timeout=15)
+
+
+class StrongSwanConfigValidationTest(BaseStrongSwanTest):
+    """Tests validating charm correctly validates config data."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Initialize test class."""
+        super().setUpClass()
+
+    @utils.config_restore("vpn-strongswan")
+    def test_required_configs_block_app(self):
+        """Verify unit gets blocked when no configuration is applied."""
+        new_config = dict(local_addr="", remote_addr="", remote_subnet="", secret="")
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            a_unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn("local_addr", a_unit.workload_status_message)
+            self.assertIn("remote_addr", a_unit.workload_status_message)
+            self.assertIn("remote_subnet", a_unit.workload_status_message)
+            self.assertIn("secret", a_unit.workload_status_message)
+        except concurrent.futures._base.TimeoutError:
+            self.fail("Failed to enter blocked state when required options not set")
+
+    @utils.config_restore("vpn-strongswan")
+    def test_out_of_range_debug_level_blocks(self):
+        """Verify Juju workload status message is applied per config."""
+        new_config = dict(debug_level="5")
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn(
+                "Supported debug levels for charon_debug are between -1 and 4",
+                unit.workload_status_message,
+            )
+        except concurrent.futures._base.TimeoutError:
+            self.fail("Failed to enter blocked state when debug_level invalid")
+
+    @utils.config_restore("vpn-strongswan")
+    def test_invalid_cipher(self):
+        """Verify unit workload status when a wrong cipher is configured."""
+        invalid_cipher = "bad-cipher"
+        new_config = dict(cipher=invalid_cipher)
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn(
+                "Unsupported encryption algorithm", unit.workload_status_message
+            )
+            self.assertIn(invalid_cipher, unit.workload_status_message)
+        except concurrent.futures._base.TimeoutError:
+            self.fail("Failed to enter blocked state when cipher invalid")
+
+    @utils.config_restore("vpn-strongswan")
+    def test_invalid_local_addr_ip(self):
+        """Verify invalid local IPs are properly handled."""
+        invalid_ip = "1.1.1.1.1"
+        new_config = dict(local_addr=invalid_ip)
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn("Invalid IP address", unit.workload_status_message)
+            self.assertIn(invalid_ip, unit.workload_status_message)
+            self.assertIn("local_addr", unit.workload_status_message)
+        except concurrent.futures._base.TimeoutError:
+            self.fail("Failed to enter blocked state when local_addr IP invalid")
+
+    @utils.config_restore("vpn-strongswan")
+    def test_invalid_remote_subnet_cidr(self):
+        """Verify invalid remote CIDRs are properly handled."""
+        invalid_cidr = "10.0.0.0/33"
+        new_config = dict(remote_subnet=invalid_cidr)
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn("Invalid CIDR", unit.workload_status_message)
+            self.assertIn(invalid_cidr, unit.workload_status_message)
+            self.assertIn("remote_subnet", unit.workload_status_message)
+        except concurrent.futures._base.TimeoutError:
+            self.fail("Failed to enter blocked state when remote_ip CIDR invalid")
+
+    @utils.config_restore("vpn-strongswan")
+    def test_invalid_secret_blocks(self):
+        """Verify invalid secrets are properly handled."""
+        invalid_secret = ",,"
+        new_config = dict(secret=invalid_secret)
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        try:
+            strongswan_workload_checker = utils.get_workload_application_status_checker(
+                self.application_name, "blocked"
+            )
+            zaza.model.block_until(strongswan_workload_checker, timeout=15)
+            unit = zaza.model.get_units(self.application_name)[0]
+            self.assertIn("No valid secrets found", unit.workload_status_message)
+        except concurrent.futures._base.TimeoutError:
+            self.fail('Failed to enter blocked state when "secret" invalid')
+
+
+class StrongSwanConfigFileTest(BaseStrongSwanTest):
+    """Test files contain expected configurations."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Initialize test class."""
+        super().setUpClass()
+
+    def _get_expected_swanctl_conf(self):
+        """Generate expected configuration file."""
+        a_unit = zaza.model.get_units(self.application_name)[0]
+        default_network_binding = utils.get_unit_binding_network_config(
+            a_unit, "default"
+        )
+        network = Network(default_network_binding)
+        unit_local_subnet = network.interfaces[0].subnet
+        return utils.generate_swanctl_from_template(unit_local_subnet)
+
+    def test_strongswan_swanctl_config_correct(self):
+        """Verify config file is correct."""
+        expected_swanctl_conf = self._get_expected_swanctl_conf()
+        zaza.model.block_until_file_has_contents(
+            self.application_name,
+            "/etc/swanctl.conf",
+            expected_swanctl_conf,
+            timeout=15,
+        )
+
+    @utils.config_restore("vpn-strongswan")
+    def test_strongswan_swanctl_config_correct_after_change(self):
+        """Verify config file contains the expected secret."""
+        new_secret = "new-secret123"
+        new_config = dict(secret=new_secret)
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        zaza.model.block_until_file_has_contents(
+            self.application_name, "/etc/swanctl.conf", new_secret, timeout=15
+        )
+
+    def test_strongswan_conf_config_correct_max_debug_val(self):
+        """Verify Juju config change updates the config file (max value)."""
+        new_debug_level = "4"
+        new_config = dict(debug_level=new_debug_level)
+        expected_strongswan_conf = utils.generate_strongswan_conf_from_template(
+            new_debug_level
+        )
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        zaza.model.block_until_file_has_contents(
+            self.application_name,
+            "/etc/strongswan.conf",
+            expected_strongswan_conf,
+            timeout=15,
+        )
+
+    def test_strongswan_conf_config_correct_min_debug_val(self):
+        """Verify Juju config change updates the config file (min value)."""
+        new_debug_level = "-1"
+        new_config = dict(debug_level=new_debug_level)
+        expected_strongswan_conf = utils.generate_strongswan_conf_from_template(
+            new_debug_level
+        )
+        zaza.model.set_application_config(
+            self.application_name, new_config, self.model_name
+        )
+        zaza.model.block_until_file_has_contents(
+            self.application_name,
+            "/etc/strongswan.conf",
+            expected_strongswan_conf,
+            timeout=15,
+        )
+
+
+class StrongSwanIptablesTest(BaseStrongSwanTest):
+    """Test iptables changes."""
+
+    pass
diff --git a/tests/functional/tests/tests.yaml b/tests/functional/tests/tests.yaml
new file mode 100644
index 0000000..e224fcc
--- /dev/null
+++ b/tests/functional/tests/tests.yaml
@@ -0,0 +1,11 @@
+tests:
+  - tests.test_vpn_strongswan.StrongSwanConfigValidationTest
+  - tests.test_vpn_strongswan.StrongSwanConfigFileTest
+gate_bundles:
+  - bionic
+  - focal
+dev_bundles:
+  - bionic
+  - focal
+smoke_bundles:
+  - bionic
\ No newline at end of file
diff --git a/tests/functional/tests/utils.py b/tests/functional/tests/utils.py
new file mode 100644
index 0000000..2b913ce
--- /dev/null
+++ b/tests/functional/tests/utils.py
@@ -0,0 +1,182 @@
+"""Zaza func tests utils."""
+import json
+import logging
+from collections import namedtuple
+from functools import wraps
+
+import zaza.model
+
+logger = logging.getLogger()
+
+
+def get_app_config(app_name):
+    """Return app config."""
+    return _convert_config(zaza.model.get_application_config(app_name))
+
+
+def get_workload_application_status_checker(application_name, target_status):
+    """Return a function for checking the status of all units of an application."""
+    # inner function.
+    async def checker():
+        units = await zaza.model.async_get_units(application_name)
+        unit_statuses_blocked = [
+            unit.workload_status == target_status for unit in units
+        ]
+        return all(unit_statuses_blocked)
+
+    return checker
+
+
+def config_restore(*applications):
+    """Return a function to reset application config."""
+
+    def config_restore_wrap(f):
+        AppConfigPair = namedtuple("AppConfigPair", ["app_name", "config"])
+
+        @wraps(f)
+        def wrapped_f(*args):
+            original_configs = [
+                AppConfigPair(app, get_app_config(app)) for app in applications
+            ]
+            try:
+                f(*args)
+            finally:
+                logger.info(original_configs)
+                for app_config_pair in original_configs:
+                    zaza.model.set_application_config(
+                        app_config_pair.app_name, app_config_pair.config
+                    )
+                zaza.model.block_until_all_units_idle(timeout=60)
+
+        return wrapped_f
+
+    return config_restore_wrap
+
+
+def set_config_and_wait(application_name, config, model_name=None):
+    """Set app config and wait for idle units."""
+    zaza.model.set_application_config(
+        application_name=application_name, configuration=config, model_name=model_name
+    )
+    zaza.model.block_until_all_units_idle()
+
+
+def get_unit_binding_network_config(unit, binding_name):
+    """Return the network details for a Juju binding."""
+    command = "network-get {} --format json".format(binding_name)
+    network_config_dict = json.loads(
+        zaza.model.run_on_unit(unit.name, command).get("Stdout", {})
+    )
+    return network_config_dict
+
+
+def generate_swanctl_from_template(local_subnet):
+    """Return config file with tweaked local subnet."""
+    expected_swanctl_conf = _EXPECTED_SWANCTL_TEMPLATE.replace(
+        "{local_subnet}", str(local_subnet)
+    )
+    return expected_swanctl_conf
+
+
+def generate_strongswan_conf_from_template(debug_level):
+    """Return config file with tweaked debug level."""
+    expected_strongswan_conf = _EXPECTED_STRONGSWAN_CONF.replace(
+        "{debug_level}", str(debug_level)
+    )
+    return expected_strongswan_conf
+
+
+def _convert_config(config):
+    """Convert config dictionary from get_config to one valid for set_config."""
+    clean_config = dict()
+    for key, value in config.items():
+        clean_config[key] = "{}".format(value["value"])
+    return clean_config
+
+
+_EXPECTED_STRONGSWAN_CONF = """charon {
+    filelog {
+        charon {
+            path = /var/log/ipsec-vpn-strongswan.log
+            time_format = %b %e %T
+            ike_name = yes
+            append = no
+            default = 0
+            flush_line = yes
+        }
+        stderr {
+            app={debug_level}
+            asn={debug_level}
+            cfg={debug_level}
+            chd={debug_level}
+            dmn={debug_level}
+            enc={debug_level}
+            esp={debug_level}
+            ike={debug_level}
+            imc={debug_level}
+            imv={debug_level}
+            job={debug_level}
+            knl={debug_level}
+            lib={debug_level}
+            mgr={debug_level}
+            net={debug_level}
+            pts={debug_level}
+            tls={debug_level}
+            tnc={debug_level}
+        }
+    }
+    syslog {
+        identifier = vpn-strongswan
+        daemon {
+        }
+        auth {
+            app={debug_level}
+            asn={debug_level}
+            cfg={debug_level}
+            chd={debug_level}
+            dmn={debug_level}
+            enc={debug_level}
+            esp={debug_level}
+            ike={debug_level}
+            imc={debug_level}
+            imv={debug_level}
+            job={debug_level}
+            knl={debug_level}
+            lib={debug_level}
+            mgr={debug_level}
+            net={debug_level}
+            pts={debug_level}
+            tls={debug_level}
+            tnc={debug_level}
+        }
+    }
+}"""
+
+
+_EXPECTED_SWANCTL_TEMPLATE = """connections {
+    vpn-strongswan {
+        local_addrs = 10.0.3.92
+        remote_addrs = 66.198.198.198
+        proposals = aes256gcm16-prfsha384-ecp384
+        local-1 {
+            id = local
+        }
+        remote-1 {
+            id = remote
+        }
+        children {
+            net-net {
+                local_ts = {local_subnet}
+                remote_ts = 10.191.0.0/24
+                esp_proposals = aes256gcm16-prfsha384-ecp384
+            }
+        }
+    }
+}
+secrets {
+    vpn-strongswan-1 {
+        id-local = local
+        id-remote = remote
+        secret = "your secret"
+    }
+}"""
diff --git a/tests/unit/requirements.txt b/tests/unit/requirements.txt
new file mode 100644
index 0000000..dd1cfd0
--- /dev/null
+++ b/tests/unit/requirements.txt
@@ -0,0 +1,7 @@
+pyyaml
+six
+jinja2
+coverage
+netifaces
+python-iptables
+numpy
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
new file mode 100644
index 0000000..bc06e7d
--- /dev/null
+++ b/tests/unit/test_charm.py
@@ -0,0 +1,179 @@
+"""Define unit test of strongswan charm."""
+import tempfile
+import unittest
+from copy import deepcopy
+from pathlib import Path
+from unittest.mock import patch
+
+from charm import VpnStrongswanCharm
+
+from lib_strongswan import StrongSwanServiceError, StrongSwanValidationError
+
+from ops.model import ActiveStatus, BlockedStatus
+from ops.testing import Harness
+
+import yaml
+
+
+class TestCharm(unittest.TestCase):
+    """Define TestCharm class."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Set up class fixture."""
+        # Setup a tmpdir
+        cls.tmpdir = tempfile.TemporaryDirectory()
+
+        # Make default config available
+        with open(Path("./config.yaml"), "r") as config_file:
+            config = yaml.safe_load(config_file)
+        cls.charm_config = {}
+
+        for key, _ in config["options"].items():
+            cls.charm_config[key] = config["options"][key]["default"]
+
+        additional_config = dict(
+            secret="mysecret",
+            local_addr="10.0.0.1",
+            remote_addr="10.0.1.1",
+            remote_subnet="10.0.1.0/24",
+        )
+
+        cls.charm_config.update(additional_config)
+
+    @classmethod
+    def tearDownClass(cls):
+        """Tear down class fixture."""
+        cls.tmpdir.cleanup()
+
+    def setUp(self):
+        """Set up tests."""
+        self.harness = Harness(VpnStrongswanCharm)
+
+    def test_initialization(self):
+        """Verify harness."""
+        self.harness.begin()
+        self.assertFalse(self.harness.charm.state.installed)
+        self.assertFalse(self.harness.charm.state.configured)
+        self.assertFalse(self.harness.charm.state.started)
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_install(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test install."""
+        # TODO: Change this to self.harness.begin_with_initial_hooks() on next
+        # release of ops (after 0.9.0 release)
+        self.harness.begin()
+        self.harness.charm.on.install.emit()
+        self.assertTrue(self.harness.charm.state.installed)
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_config_changed_success(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test config changed."""
+        self.harness.begin()
+        new_secret = "new-secret"
+        local_config = deepcopy(self.charm_config)
+        local_config["secret"] = new_secret
+        self.harness.update_config(local_config)
+        self.assertTrue(self.harness.charm.state.configured)
+        self.assertIsInstance(self.harness.charm.unit.status, ActiveStatus)
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_config_changed_missing_secret(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test config changed."""
+        self.harness.begin()
+        new_bad_secret = ""
+        local_config = deepcopy(self.charm_config)
+        local_config.update(dict(secret=new_bad_secret))
+        self.harness.update_config(local_config)
+        self.assertFalse(self.harness.charm.state.configured)
+        self.assertIsInstance(self.harness.charm.unit.status, BlockedStatus)
+        self.assertIn("secret", self.harness.charm.unit.status.message)
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_config_changed_enable_fails(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test config changed fails when exception raised on enable fail."""
+        self.harness.begin()
+        expected_workload_status = "expected message"
+        mock_strong_swan_manager.return_value.enable_strongswan.side_effect = (
+            StrongSwanServiceError(workload_status=expected_workload_status)
+        )
+        self.harness.update_config(self.charm_config)
+        self.assertIsInstance(self.harness.charm.unit.status, BlockedStatus)
+        self.assertEqual(
+            self.harness.charm.unit.status.message, expected_workload_status
+        )
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_config_changed_restart_fails(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test config changed fails when exception raised on restart fail."""
+        self.harness.begin()
+        expected_workload_status = "expected message"
+        mock_strong_swan_manager.return_value.restart_strongswan.side_effect = (
+            StrongSwanServiceError(workload_status=expected_workload_status)
+        )
+        self.harness.update_config(self.charm_config)
+        self.assertIsInstance(self.harness.charm.unit.status, BlockedStatus)
+        self.assertEqual(
+            self.harness.charm.unit.status.message, expected_workload_status
+        )
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_on_config_changed_generate_config_fails(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test config changed fails when exception raised on generate_config fail."""
+        self.harness.begin()
+        expected_workload_status = "expected message"
+        mock_strong_swan_manager.return_value.generate_strongswan_config.side_effect = (
+            StrongSwanValidationError(workload_status=expected_workload_status)
+        )
+        self.harness.update_config(self.charm_config)
+        self.assertIsInstance(self.harness.charm.unit.status, BlockedStatus)
+        self.assertEqual(
+            self.harness.charm.unit.status.message, expected_workload_status
+        )
+
+    @patch("charm.VPNProvides")
+    @patch("charm.NetFilterManager")
+    @patch("charm.StrongSwanManager")
+    def test_install_fails(
+        self, mock_strong_swan_manager, mock_net_filter_manager, mock_vpn_provides
+    ):
+        """Test installation failure."""
+        self.harness.begin()
+        expected_workload_status = "expected message"
+        mock_strong_swan_manager.return_value.install_strongswan.side_effect = (
+            StrongSwanServiceError(workload_status=expected_workload_status)
+        )
+        self.harness.charm.on.install.emit()
+        self.assertIsInstance(self.harness.charm.unit.status, BlockedStatus)
+        self.assertFalse(self.harness.charm.state.installed)
+        self.assertEqual(
+            self.harness.charm.unit.status.message, expected_workload_status
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/unit/test_lib_strongswan.py b/tests/unit/test_lib_strongswan.py
new file mode 100644
index 0000000..574c713
--- /dev/null
+++ b/tests/unit/test_lib_strongswan.py
@@ -0,0 +1,260 @@
+"""Define unit test of strongswan class."""
+import unittest
+from ipaddress import IPv4Network
+from subprocess import CalledProcessError
+from unittest.mock import Mock, mock_open, patch
+
+from lib.lib_strongswan import (
+    StrongSwanManager,
+    StrongSwanServiceError,
+    StrongSwanValidationError,
+    file_get_contents,
+    get_default_route_subnet,
+)
+
+
+class TestStrongswanManager(unittest.TestCase):
+    """Define TestStrongswanManager class."""
+
+    @classmethod
+    def setUpClass(cls):
+        """Set up class fixture."""
+        # Load default config
+        cls.unit = Mock()
+        cls.relations = Mock()
+
+    @patch("lib.lib_strongswan.distro.codename")
+    def setUp(self, mock_codename):
+        """Set up test fixture."""
+        mock_codename.return_value = "bionic"
+        self.strongswan_manager = StrongSwanManager(self.unit)
+        self.strongswan_manager.installed = False
+        self.strongswan_manager.configured = False
+        self.strongswan_manager.started = False
+        basic_table = {"PREROUTING": {}, "INPUT": {}, "POSTROUTING": {}, "OUTPUT": {}}
+        self.strongswan_manager.dump_table = Mock(return_value=basic_table)
+        self.strongswan_manager.unit.model.config = {"debug": 0}
+
+    def tearDown(self):
+        """Clean up test fixture."""
+        self.strongswan_manager.unit.model.config = {"debug": 0}
+
+    @patch("lib.lib_strongswan.os.path.exists")
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    @patch("lib.lib_strongswan.is_string_in_file")
+    def test_modify_app_armor_profile_requires_modify(
+        self, mock_string_in_file, mock_check_output, mock_exists
+    ):
+        """Test apparmor profile not exists."""
+        mock_exists.return_value = True
+        mock_string_in_file.return_value = False
+        self.strongswan_manager.modify_app_armor_profile()
+        self.assertEqual(
+            mock_check_output.call_count,
+            4,
+            "Subprocess call was not invoked the correct number of times.",
+        )
+
+    @patch("lib.lib_strongswan.distro.codename")
+    def test_strongswan_service_is_focal(self, mock_codename):
+        """Test strongSwan service is correct when distro is focal."""
+        expected_distro = "focal"
+        mock_codename.return_value = expected_distro
+        self.assertEqual(
+            self.strongswan_manager.strongswan_service, "strongswan.service"
+        )
+
+    @patch("lib.lib_strongswan.distro")
+    def test_strongswan_service_is_not_focal(self, mock_codename):
+        """Test strongSwan service is correct when distro is not focal."""
+        expected_distro = "bionic"
+        mock_codename.return_value = expected_distro
+        self.assertEqual(
+            self.strongswan_manager.strongswan_service, "strongswan-swanctl.service"
+        )
+
+    @patch("lib.lib_strongswan.os.path.exists")
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_modify_app_armor_profile_doesnt_exist(self, mock_check_output, exists):
+        """Test apparmor profile."""
+        exists.return_value = False  # change to true for remainder of test
+        self.strongswan_manager.modify_app_armor_profile()
+        mock_check_output.assert_not_called()
+
+    @patch("lib.lib_strongswan.apt_install")
+    @patch("lib.lib_strongswan.os.path.exists")
+    def test_install_strongswan_requires_install(self, mock_exists, mock_apt_install):
+        """Test the installation of strongswan."""
+        mock_exists.return_value = False
+        self.strongswan_manager.install_strongswan()
+        mock_apt_install.assert_called_once()
+
+    @patch("lib.lib_strongswan.apt_install")
+    @patch("lib.lib_strongswan.os.path.exists")
+    def test_install_strongswan_already_installed(self, mock_exists, mock_apt_install):
+        """Test the installation of strongswan."""
+        mock_exists.return_value = True
+        is_success = self.strongswan_manager.install_strongswan()
+        mock_apt_install.assert_not_called()
+        self.assertTrue(is_success)
+
+    @patch("lib.lib_strongswan.apt_install")
+    @patch("lib.lib_strongswan.os.path.exists")
+    def test_install_strongswan_install_fails(self, mock_exists, mock_apt_install):
+        """Test strongswan installation failure returns correct exception."""
+        mock_exists.return_value = False
+        mock_apt_install.side_effect = CalledProcessError(cmd="", returncode=1)
+        try:
+            self.strongswan_manager.install_strongswan()
+        except StrongSwanServiceError:
+            mock_apt_install.assert_called_once()
+        else:
+            self.fail("install_strongswan should have raised an error")
+
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_enable_strongswan(self, mock_check_output):
+        """Test enabling the strongswan service."""
+        self.strongswan_manager.enable_strongswan()
+        mock_check_output.assert_called_once()
+
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_enable_strongswan_cmd_error(self, mock_check_output):
+        """Test enabling the strongswan service, where check_output errors."""
+        mock_check_output.side_effect = CalledProcessError(cmd="", returncode=1)
+        try:
+            self.strongswan_manager.enable_strongswan()
+            mock_check_output.assert_called_once()
+        except StrongSwanServiceError as e:
+            self.assertIn(self.strongswan_manager.strongswan_service, e.workload_status)
+        else:
+            self.fail("enable_strongswan should have raised a StrongSwanServiceError")
+
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_restart_strongswan_is_required(self, mock_check_output):
+        """Test restarting the strongswan service."""
+        self.strongswan_manager.swanctl_restart_required = True
+        self.strongswan_manager.restart_strongswan()
+        mock_check_output.assert_called_once()
+        self.assertFalse(self.strongswan_manager.swanctl_restart_required)
+
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_restart_strongswan_not_required(self, mock_check_output):
+        """Test restarting the strongswan service."""
+        self.strongswan_manager.swanctl_restart_required = False
+        self.strongswan_manager.restart_strongswan()
+        mock_check_output.assert_not_called()
+        self.assertFalse(self.strongswan_manager.swanctl_restart_required)
+
+    @patch("lib.lib_strongswan.subprocess.check_output")
+    def test_restart_strongswan_is_required_fails(self, mock_check_output):
+        """Test restarting the strongswan service."""
+        self.strongswan_manager.swanctl_restart_required = True
+        mock_check_output.side_effect = CalledProcessError(cmd="", returncode=1)
+        try:
+            self.strongswan_manager.restart_strongswan()
+        except StrongSwanServiceError as e:
+            mock_check_output.assert_called_once()
+            self.assertTrue(self.strongswan_manager.swanctl_restart_required)
+            self.assertIn(self.strongswan_manager.strongswan_service, e.workload_status)
+        else:
+            self.fail("restart_strongswan should have raised StrongSwanServiceError")
+
+    def test_validate_proposals_one_cipher_success(self):
+        """Test proposals validation."""
+        self.strongswan_manager.unit.model.config = {"cipher": "aes256-sha256-modp2048"}
+        self.assertEqual(
+            self.strongswan_manager.validate_proposals("cipher"),
+            "aes256-sha256-modp2048",
+        )
+
+    def test_validate_charon_debug_integer_out_of_range(self):
+        """Verify a workload status (error message) is returned."""
+        self.strongswan_manager.unit.model.config = {"debug_level": 5}
+        try:
+            self.strongswan_manager.validate_charon_debug("debug_level")
+        except StrongSwanValidationError as e:
+            self.assertIn("5", e.workload_status)
+        else:
+            self.fail(
+                "StrongSwanValidationError should have been thrown for out of"
+                " range int."
+            )
+
+    def test_validate_charon_debug_success(self):
+        """Verify a valid debug level is allowed."""
+        expected_debug_level = 2
+        self.strongswan_manager.unit.model.config = dict(
+            debug_level=expected_debug_level
+        )
+        actual_debug_level_map = self.strongswan_manager.validate_charon_debug(
+            "debug_level"
+        )
+        for charon_key, actual_debug_level in actual_debug_level_map.items():
+            self.assertEqual(
+                actual_debug_level,
+                expected_debug_level,
+                "debug level for {} is incorrect".format(charon_key),
+            )
+
+    def test_validate_ip(self):
+        """Test validate ip."""
+        self.strongswan_manager.unit.model.config = {"local_addr": "10.10.10.10"}
+        self.assertEqual(
+            self.strongswan_manager.validate_ip("local_addr"), "10.10.10.10"
+        )
+
+    def test_validate_cidr(self):
+        """Test validate cidr."""
+        self.strongswan_manager.unit.model.config = {"remote_subnet": "10.10.10.0/24"}
+        self.assertEqual(
+            self.strongswan_manager.validate_cidr("remote_subnet"), "10.10.10.0/24"
+        )
+
+    def test_validate_secrets(self):
+        """Test validate secrets."""
+        self.strongswan_manager.unit.model.config = {"secrets": "ssss"}
+        self.assertEqual(self.strongswan_manager.validate_secrets("secrets"), ["ssss"])
+
+    @patch("lib.lib_strongswan.get_default_route_subnet")
+    def test_generate_jinja_context_success(self, mock_get_default_route_subnet):
+        """Test generate jinja template context."""
+        expected_network = IPv4Network("192.168.0.0/24")
+        self.strongswan_manager.unit.model.app.name = "test"
+        mock_get_default_route_subnet.return_value = expected_network
+        actual_jinja_context = self.strongswan_manager.generate_jinja_context()
+        self.assertEqual(actual_jinja_context["charm_name"], "test")
+        self.assertEqual(actual_jinja_context["local_subnet"], expected_network)
+
+    # @patch('lib.lib_strongswan.get_default_route_subnet')
+    # def test_generate_jinja_context_success(self, mock_get_default_route_subnet):
+    #     """Test generate jinja template context."""
+    #     expected_network = IPv4Network('192.168.0.0/24')
+    #     self.strongswan_manager.unit.model.app.name = "test"
+    #     mock_get_default_route_subnet.return_value = expected_network
+    #     actual_jinja_context = self.strongswan_manager.generate_jinja_context()
+    #     self.assertEqual(actual_jinja_context['charm_name'], 'test')
+    #     self.assertEqual(actual_jinja_context['local_subnet'], expected_network)
+
+    @patch("lib.lib_strongswan.os.utime")
+    @patch("lib.lib_strongswan.Environment.get_template")
+    def test_generate_strongswan_config(self, template_file, utime):
+        """Test rendering config with no relation information."""
+        with patch("builtins.open", mock_open(read_data="data")) as mock_file:
+            assert open("/etc/swanctl.conf").read() == "data"
+            mock_file.assert_called_with("/etc/swanctl.conf")
+            self.assertEqual(self.strongswan_manager.generate_strongswan_config(), None)
+
+
+def test_get_default_route_subnet(self):
+    """Test get default route."""
+    self.assertEqual(type(get_default_route_subnet()), IPv4Network)
+
+
+@patch("lib.lib_strongswan.os.utime")
+def test_file_get_contents(self, utime):
+    """Test get file contents."""
+    with patch("builtins.open", mock_open(read_data="data")) as mock_file:
+        assert open("/etc/swanctl.conf").read() == "data"
+        mock_file.assert_called_with("/etc/swanctl.conf")
+
+        self.assertEqual(file_get_contents("/etc/swanctl.conf"), b"")
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..adefd9d
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,79 @@
+[tox]
+skipsdist=True
+skip_missing_interpreters = True
+envlist = lint, unit, func
+
+[testenv]
+basepython = python3
+setenv =
+  PYTHONPATH = {toxinidir}:{toxinidir}/lib/:{toxinidir}/hooks/:{toxinidir}/src/
+passenv =
+  HOME
+  PATH
+  CHARM_BUILD_DIR
+  PYTEST_KEEP_MODEL
+  PYTEST_CLOUD_NAME
+  PYTEST_CLOUD_REGION
+  PYTEST_MODEL
+  MODEL_SETTINGS
+  HTTP_PROXY
+  HTTPS_PROXY
+  NO_PROXY
+  SNAP_HTTP_PROXY
+  SNAP_HTTPS_PROXY
+
+[testenv:build]
+deps = charmcraft
+commands = charmcraft build
+
+[testenv:lint]
+commands =
+    flake8
+    black --check --exclude "/(\.eggs|\.git|\.tox|\.venv|\.build|dist|charmhelpers|mod|build|vpncommon)/" .
+deps =
+    black
+    flake8
+    flake8-docstrings
+    flake8-import-order
+    pep8-naming
+    flake8-colors
+
+[flake8]
+exclude =
+    .git,
+    __pycache__,
+    .tox,
+    charmhelpers,
+    mod,
+    build,
+    .build
+
+max-line-length = 88
+max-complexity = 10
+
+[testenv:black]
+commands =
+    black --exclude "/(\.eggs|\.git|\.tox|\.venv|\.build|dist|charmhelpers|mod|vpncommon)/" .
+deps =
+    black
+
+[testenv:unit]
+commands =
+    coverage run -m unittest discover -s {toxinidir}/tests/unit -v
+    coverage report --omit tests/*,mod/*,.tox/*,lib/vpncommon/*
+    coverage html --omit tests/*,mod/*,.tox/*,lib/vpncommon/*
+deps = -r{toxinidir}/tests/unit/requirements.txt
+       -r{toxinidir}/requirements.txt
+
+[testenv:func]
+changedir = {toxinidir}/tests/functional
+commands = functest-run-suite {posargs}
+deps = -r{toxinidir}/tests/functional/requirements.txt
+
+[testenv:func-noop]
+basepython = python3
+commands =
+    functest-run-suite --help
+deps = -r{toxinidir}/tests/functional/requirements.txt
+       -r{toxinidir}/requirements.txt
+       -r{toxinidir}/tests/unit/requirements.txt