Merge ~danilogondolfo/network-manager/+git/network-manager:new_autopkgtests into network-manager:ubuntu/master

[Danilo Egea Gondolfo]

New autopkgtests targeting the network manager + netplan integration.

I did some refactoring in nm.py so it's a bit easier to implement new tests that rely on wifi authentication.

The new tests are related to https://bugs.launchpad.net/netplan/+bug/2016473 and https://bugs.launchpad.net/netplan/+bug/2016625. The first one is not fixed yet but we are working on it.

[Lukas Märdian (slyon)]

Thank you! LGTM. I left one little (non-blocking) inline comment, which you could consider fixing.

This MP depends on some fixes in libnetplan, so we should hold it back until those fixed landed in Mantic. Once that's done (and the new autopkgtests PASS), we should rebase this MP against https://code.launchpad.net/~network-manager/network-manager/+git/ubuntu/+ref/ubuntu/master and get it landed via the offical NetworkManager package.

review: Approve

[Lukas Märdian (slyon)]

Thank you very much, Danilo! LGTM.

praise: I really like how you enhanced the generic NetworkManager tests in nm.py along the way and resolved an old FIXME!

I left two little (non-blocking) comments inline.

I moved the MP state to "Work in progress" as it's still pending the corresponding update to libnetplan. IMO this can be merged as soon as the new Netplan version hits mantic-proposed! This is the point where the new tests should start passing.

review: Approve

[Danilo Egea Gondolfo (danilogondolfo)]

Thanks, Lukas. I addressed your comments and implemented two new test cases related to Wireguard.

[Lukas Märdian (slyon)]

I'd like us to make sure that this test-case (from bug #1952967) is also supported (doesn't need to be using "nmtui", though):

> To test one can launch nmtui with the following command:
> network-manager.nmtui and then:
> - Proceed to add new connection
> - Select "IP tunnel"
> - enter a profile name e.g. "IP tunnel connection 1"
> - enter a device e.g. "gre10"
> - select mode "GRE"
> - enter local IP e.g. "10.20.20.1"
> - enter remote IP e.g. "10.20.20.2"
> - Press "OK" to save the connection

[Danilo Egea Gondolfo (danilogondolfo)]

Now that netplan.io 0.106.1 is in mantic-release, all these new tests will pass, see https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-danilogondolfo-network-manager/mantic/amd64/n/network-manager/20230529_165124_321d1@/log.gz

May I ask someone from Desktop to take a look at it?

[Lukas Märdian (slyon)]

I talked to @seb128 and he agreed we can go ahead with uploading these new tests.

Rebased, merged and sponsored!

diff --git a/debian/tests/control b/debian/tests/control
index 1985292..e22c775 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -3,7 +3,7 @@ Depends: python3, hostapd, dnsmasq-base, wpasupplicant, isc-dhcp-client, iw
 Restrictions: needs-root allow-stderr isolation-machine skippable
 
 Tests: nm.py
-Depends: python3, dnsmasq-base, isc-dhcp-client, gir1.2-nm-1.0, network-manager, hostapd, iw, python3-dbusmock, python3-netaddr, wpasupplicant
+Depends: python3, dnsmasq-base, isc-dhcp-client, gir1.2-nm-1.0, network-manager, hostapd, iw, python3-dbusmock, python3-netaddr, wpasupplicant, easy-rsa
 Restrictions: needs-root isolation-machine skippable
 
 Tests: killswitches-no-urfkill
diff --git a/debian/tests/nm.py b/debian/tests/nm.py
index f7a03b7..2e59104 100755
--- a/debian/tests/nm.py
+++ b/debian/tests/nm.py
@@ -16,6 +16,7 @@ import socket
 import netaddr
 import unittest
 import ctypes
+import shutil
 
 try:
     from dbusmock import DBusTestCase
@@ -44,6 +45,102 @@ os.environ["GSETTINGS_BACKEND"] = "memory"
 os.dup2(sys.stdout.fileno(), sys.stderr.fileno())
 
 
+class WifiAuthentication():
+    def __init__(self):
+        self.wpa_settings = None
+        self.wpa_eap_settings = None
+        self.setting_name = None
+        self.needed_secrets = None
+
+        self.tmpdir = '/tmp/hostapd'
+        shutil.rmtree(self.tmpdir, ignore_errors=True)
+
+    @property
+    def auth_settings(self):
+        return self.wpa_settings
+
+    @property
+    def auth_eap_settings(self):
+        return self.wpa_eap_settings
+
+
+class WifiAuthenticationWPAPSK(WifiAuthentication):
+    def __init__(self, psk):
+        super().__init__()
+        self.wpa_settings = NM.SettingWirelessSecurity.new()
+        self.wpa_settings.set_property(NM.SETTING_WIRELESS_SECURITY_KEY_MGMT, "wpa-psk")
+        self.wpa_settings.set_property(NM.SETTING_WIRELESS_SECURITY_PSK, psk)
+
+        self.setting_name = NM.SETTING_WIRELESS_SECURITY_SETTING_NAME
+        self.needed_secrets = [NM.SETTING_WIRELESS_SECURITY_PSK]
+
+
+class WifiAuthenticationWPAEAP(WifiAuthentication):
+    def __init__(self, modes, phase2, identity, password, client_cert=False):
+        super().__init__()
+
+        self.make_certs()
+
+        self.wpa_settings = NM.SettingWirelessSecurity.new()
+        self.wpa_settings.set_property(NM.SETTING_WIRELESS_SECURITY_KEY_MGMT, "wpa-eap")
+
+        self.wpa_eap_settings = NM.Setting8021x.new()
+        self.wpa_eap_settings.set_property(NM.SETTING_802_1X_EAP, modes)
+
+        self.wpa_eap_settings.set_property(NM.SETTING_802_1X_IDENTITY, identity)
+
+        if password:
+            self.wpa_eap_settings.set_property(NM.SETTING_802_1X_PASSWORD, password)
+
+        if phase2 == 'tls':
+            self.wpa_eap_settings.set_property(NM.SETTING_802_1X_PHASE2_AUTHEAP, phase2)
+        else:
+            self.wpa_eap_settings.set_property(NM.SETTING_802_1X_PHASE2_AUTH, phase2)
+
+        if client_cert:
+            # Certificate paths must start with file:// and be null terminated
+            # See src/libnmc-setting/settings-docs.h
+            self.wpa_eap_settings.set_property(
+                    NM.SETTING_802_1X_CA_CERT,
+                    GLib.Bytes(f'file://{self.tmpdir}/pki/ca.crt\0'.encode()))
+            self.wpa_eap_settings.set_property(
+                    NM.SETTING_802_1X_CLIENT_CERT,
+                    GLib.Bytes(f'file://{self.tmpdir}/pki/issued/client.crt\0'.encode()))
+            self.wpa_eap_settings.set_property(
+                    NM.SETTING_802_1X_PRIVATE_KEY,
+                    GLib.Bytes(f'file://{self.tmpdir}/pki/private/client.key\0'.encode()))
+            self.wpa_eap_settings.set_property(
+                    NM.SETTING_802_1X_PRIVATE_KEY_PASSWORD, 'passw0rd')
+
+        self.setting_name = NM.SETTING_802_1X_SETTING_NAME
+        self.needed_secrets = [NM.SETTING_802_1X_PASSWORD, NM.SETTING_802_1X_PRIVATE_KEY_PASSWORD]
+
+    def make_certs(self):
+        os.mkdir(self.tmpdir)
+
+        with open(f'{self.tmpdir}/hostapd.eap_user', 'w') as f:
+            f.write('''* PEAP,TLS
+
+"account1" MSCHAPV2 "password1" [2]
+"account2" MSCHAPV2 "password2" [2]
+''')
+
+        # Create a CA, server and client certificates protected by passw0rd and the DH parameters
+        create_ca_script = """/usr/share/easy-rsa/easyrsa init-pki
+EASYRSA_BATCH=1 /usr/share/easy-rsa/easyrsa build-ca nopass
+EASYRSA_PASSOUT=pass:passw0rd EASYRSA_BATCH=1 /usr/share/easy-rsa/easyrsa build-server-full server
+EASYRSA_PASSOUT=pass:passw0rd EASYRSA_BATCH=1 /usr/share/easy-rsa/easyrsa build-client-full client
+/usr/share/easy-rsa/easyrsa gen-dh
+"""
+
+        with open(f'{self.tmpdir}/make_certs.sh', 'w') as f:
+            f.write(create_ca_script)
+
+        cmd = ['bash', 'make_certs.sh']
+        subprocess.call(cmd, stdout=subprocess.DEVNULL,
+                        stderr=subprocess.DEVNULL, cwd=self.tmpdir)
+
+
 class NetworkManagerTest(network_test_base.NetworkTestBase):
     """Provide common functionality for NM tests"""
 
@@ -260,11 +357,11 @@ class NetworkManagerTest(network_test_base.NetworkTestBase):
 
         return self.nmdev_w.get_access_points()[0]
 
-    def connect_to_ap(self, ap, secret, ipv6_mode, ip6_privacy):
+    def connect_to_ap(self, ap, auth_settings, ipv6_mode, ip6_privacy):
         """Connect to an NMAccessPoint.
 
-        secret should be None for open networks, and a string with the password
-        for WEP/WPA.
+        auth_settings should be None for open networks and an instance of
+        WifiAuthentication for WEP/WPA-PSK/WPA-EAP.
 
         ip6_privacy is a NM.SettingIP6ConfigPrivacy flag.
 
@@ -284,13 +381,10 @@ class NetworkManagerTest(network_test_base.NetworkTestBase):
         # map of a map of gpointers to gpointers which is too much for PyGI
         partial_conn = NM.SimpleConnection.new()
         partial_conn.add_setting(NM.SettingIP4Config(method=ip4_method))
-        if secret:
-            partial_conn.add_setting(NM.SettingWirelessSecurity.new())
-            # FIXME: needs update for other auth types
-            partial_conn.update_secrets(
-                NM.SETTING_WIRELESS_SECURITY_SETTING_NAME,
-                GLib.Variant("a{sv}", {"psk": GLib.Variant("s", secret)}),
-            )
+        if auth_settings:
+            partial_conn.add_setting(auth_settings.auth_settings)
+            if isinstance(auth_settings, WifiAuthenticationWPAEAP):
+                partial_conn.add_setting(auth_settings.auth_eap_settings)
         if ip6_privacy is not None:
             partial_conn.add_setting(
                 NM.SettingIP6Config(ip6_privacy=ip6_privacy, method=ip6_method)
@@ -344,16 +438,15 @@ class NetworkManagerTest(network_test_base.NetworkTestBase):
 
         # verify need_secrets()
         needed_secrets = conn.need_secrets()
-        if secret is None:
+        if auth_settings is None:
             self.assertEqual(needed_secrets, (None, []))
         else:
             self.assertEqual(
-                needed_secrets[0], NM.SETTING_WIRELESS_SECURITY_SETTING_NAME
+                needed_secrets[0], auth_settings.setting_name
             )
             self.assertEqual(type(needed_secrets[1]), list)
             self.assertGreaterEqual(len(needed_secrets[1]), 1)
-            # FIXME: needs update for other auth types
-            self.assertIn(needed_secrets[1][0], [NM.SETTING_WIRELESS_SECURITY_PSK])
+            self.assertIn(needed_secrets[1][0], auth_settings.needed_secrets)
 
         # we are usually ACTIVATING at this point; wait for completion
         # TODO: 5s is not enough, argh slow DHCP client
@@ -540,7 +633,7 @@ wpa_passphrase=12345678
             % SSID,
             None,
             54000,
-            "12345678",
+            WifiAuthenticationWPAPSK('12345678'),
         )
 
     def test_wpa2_ip4(self):
@@ -558,7 +651,7 @@ wpa_passphrase=12345678
             % SSID,
             None,
             54000,
-            "12345678",
+            WifiAuthenticationWPAPSK('12345678'),
         )
 
     def test_wpa2_ip6(self):
@@ -576,10 +669,70 @@ wpa_passphrase=12345678
             % SSID,
             "ra-only",
             54000,
-            "12345678",
+            WifiAuthenticationWPAPSK('12345678'),
             ip6_privacy=NM.SettingIP6ConfigPrivacy.PREFER_TEMP_ADDR,
         )
 
+    def test_wpa_enterprise_authentication_ip4(self):
+        """WPA2 + 802.1x, 802.11g, IPv4"""
+
+        self.do_test(
+            """hw_mode=g
+channel=1
+ssid=%s
+auth_algs=1
+eap_server=1
+ieee8021x=1
+eapol_version=2
+wpa=2
+wpa_key_mgmt=WPA-EAP
+wpa_pairwise=TKIP
+rsn_pairwise=CCMP
+eap_user_file=/tmp/hostapd/hostapd.eap_user
+ca_cert=/tmp/hostapd/pki/ca.crt
+server_cert=/tmp/hostapd/pki/issued/server.crt
+private_key=/tmp/hostapd/pki/private/server.key
+private_key_passwd=passw0rd
+dh_file=/tmp/hostapd/pki/dh.pem
+ctrl_interface=/var/run/hostapd
+ctrl_interface_group=0
+"""
+            % SSID,
+            None,
+            54000,
+            WifiAuthenticationWPAEAP(['peap'], 'mschapv2', 'account1', 'password1')
+        )
+
+    def test_wpa_enterprise_authentication_with_client_certificate_ip4(self):
+        """WPA2 + 802.1x with client certificate, 802.11g, IPv4"""
+
+        self.do_test(
+            """hw_mode=g
+channel=1
+ssid=%s
+auth_algs=1
+eap_server=1
+ieee8021x=1
+eapol_version=2
+wpa=2
+wpa_key_mgmt=WPA-EAP
+wpa_pairwise=TKIP CCMP
+rsn_pairwise=TKIP CCMP
+eap_user_file=/tmp/hostapd/hostapd.eap_user
+ca_cert=/tmp/hostapd/pki/ca.crt
+server_cert=/tmp/hostapd/pki/issued/server.crt
+private_key=/tmp/hostapd/pki/private/server.key
+private_key_passwd=passw0rd
+dh_file=/tmp/hostapd/pki/dh.pem
+ctrl_interface=/var/run/hostapd
+ctrl_interface_group=0
+"""
+            % SSID,
+            None,
+            54000,
+            WifiAuthenticationWPAEAP(['tls'], 'tls', 'client', None, client_cert=True)
+        )
+
     @network_test_base.run_in_subprocess
     def test_rfkill(self):
         """shut down connection on killswitch, restore it on unblock"""
@@ -626,7 +779,7 @@ wpa_passphrase=12345678
         hostapd_conf,
         ipv6_mode,
         expected_max_bitrate,
-        secret=None,
+        auth_settings=None,
         ip6_privacy=None,
     ):
         """Actual test code, parameterized for the particular test case"""
@@ -645,7 +798,7 @@ wpa_passphrase=12345678
         self.assertEqual(self.filtered_active_connections(), [])
 
         # connect to that AP
-        (conn, active_conn) = self.connect_to_ap(ap, secret, ipv6_mode, ip6_privacy)
+        (conn, active_conn) = self.connect_to_ap(ap, auth_settings, ipv6_mode, ip6_privacy)
 
         # check NMActiveConnection object
         self.assertIn(
@@ -660,7 +813,7 @@ wpa_passphrase=12345678
         wireless_setting = conn.get_setting_wireless()
         self.assertEqual(wireless_setting.get_ssid().get_data(), SSID.encode())
         self.assertEqual(wireless_setting.get_hidden(), False)
-        if secret:
+        if auth_settings:
             self.assertEqual(
                 conn.get_setting_wireless_security().get_name(),
                 NM.SETTING_WIRELESS_SECURITY_SETTING_NAME,
diff --git a/debian/tests/nm_netplan.py b/debian/tests/nm_netplan.py
index cc86bcf..b396627 100644
--- a/debian/tests/nm_netplan.py
+++ b/debian/tests/nm_netplan.py
@@ -103,13 +103,29 @@ class TestNetplan(unittest.TestCase):
         subprocess.call(cmd, stdout=subprocess.DEVNULL)
 
     def _add_connection(self, connection):
-        main_loop = GLib.MainLoop()
+        self.main_loop = GLib.MainLoop()
+        self.cancel = Gio.Cancellable()
+        self.timeout_tag = 0
+
         def add_cb(client, result, data):
             self.nmclient.add_connection_finish(result)
-            main_loop.quit()
+            self.main_loop.quit()
+
+        def timeout_cb():
+            self.timeout_tag = -1
+            self.cancel.cancel()
+            self.main_loop.quit()
+            return GLib.SOURCE_REMOVE
+
+        self.timeout_tag = GLib.timeout_add_seconds(120, timeout_cb)
+
+        self.nmclient.add_connection_async(connection, True, self.cancel, add_cb, None)
+        self.main_loop.run()
+
+        if self.timeout_tag < 0:
+            self.timeout_tag = 0
+            self.fail('nm_netplan.py: main loop timed out during connection creation')
 
-        self.nmclient.add_connection_async(connection, True, None, add_cb, None)
-        main_loop.run()
 
     def _delete_connection(self, connection):
         uuid = connection.get_uuid()
@@ -124,7 +140,7 @@ class TestNetplan(unittest.TestCase):
 
     def _nmcli(self, parameters):
         cmd = ['nmcli'] + parameters
-        subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        return subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
     def _bridge_show(self, bridge):
         cmd = ['bridge', '-j', 'link', 'show', bridge]
@@ -351,7 +367,6 @@ class TestNetplan(unittest.TestCase):
         # There should be zero netplan NM yaml after deleting the bridge
         self.assertEqual(self._get_number_of_yaml_files(), 0)
 
-    @unittest.skip('XXX: the netplan yaml file will be deleted when we try to change the connetion')
     def test_create_an_interface_and_change_it(self):
         """Add a tap interface and change it after create adding IP addresses to it."""
 
@@ -536,7 +551,7 @@ class TestNetplan(unittest.TestCase):
         with open('/etc/netplan/10-test.yaml', 'w') as f:
             f.write(netplan_yaml)
 
-        self._netplan_generate();
+        self._netplan_generate()
         self._nmcli_con_reload()
         self.nmclient = NM.Client.new()
 
@@ -565,7 +580,7 @@ class TestNetplan(unittest.TestCase):
         with open('/etc/netplan/10-test.yaml', 'w') as f:
             f.write(netplan_yaml)
 
-        self._netplan_generate();
+        self._netplan_generate()
         self._nmcli_con_reload()
         self.nmclient = NM.Client.new()
 
@@ -607,7 +622,7 @@ class TestNetplan(unittest.TestCase):
         with open('/etc/netplan/10-test.yaml', 'w') as f:
             f.write(netplan_yaml)
 
-        self._netplan_generate();
+        self._netplan_generate()
         self._nmcli_con_reload()
         self._nmcli(['con', 'mod', 'netplan-eth123', 'ipv4.method', 'auto'])
 
@@ -672,7 +687,7 @@ EASYRSA_BATCH=1 /usr/share/easy-rsa/easyrsa build-client-full client nopass
             f.write(client_config)
 
         cmd = ['bash', 'openvpn_spinup.sh']
-        subprocess.call(cmd, stdout=subprocess.DEVNULL)
+        subprocess.call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
         openvpn_server_cmd = ['openvpn', '--config', 'server.conf']
         p_server = subprocess.Popen(openvpn_server_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
@@ -711,6 +726,124 @@ EASYRSA_BATCH=1 /usr/share/easy-rsa/easyrsa build-client-full client nopass
         self.assertEqual(self._get_number_of_yaml_files(), 2,
                          msg='More than expected YAML files were found after stopping the OpenVPN server')
 
+    def test_migrate_existing_tunnel_with_nmcli(self):
+        """
+        Change an existing tunnel defined in Netplan with nmcli so it will be "imported"
+        to NM. See LP: #2016473.
+        """
+
+        netplan_yaml = '''network:
+  renderer: NetworkManager
+  tunnels:
+    wg0:
+      mode: wireguard
+      port: 51821
+      key: YCNQCAes1OTbD2ynY+aBlaA5x4ZFJhsc4co+XHpZ4FU=
+      addresses:
+        - 172.17.0.1/24
+      peers:
+        - allowed-ips: [172.17.0.0/24]
+          endpoint: 4.4.4.4:51821
+          keys:
+            public: cwkb7k0xDgLSnunZpFIjLJw4u+mJDDr+aBR5DqzpmgI='''
+
+        with open('/etc/netplan/10-test.yaml', 'w') as f:
+            f.write(netplan_yaml)
+
+        self._netplan_generate()
+        self._nmcli_con_reload()
+        self._nmcli(['con', 'mod', 'netplan-wg0', 'con-name', 'netplan-wireguard-wg0'])
+
+        # After being processed by NM (and libnetplan) the new file shouldn't
+        # redefine the interface type. If it does, "netplan get" will fail
+        # when it tries to load the YAML hierarchy.
+        out = subprocess.run(['netplan', 'get'],
+                             capture_output=True, text=True)
+
+        self.assertEqual(out.returncode, 0, f'"netplan get" failed due to issues in the resulting YAML files.')
+
+    def test_create_wireguard_tunnel_in_multiple_steps_nmcli(self):
+        """
+        Network Manager should be able to create partial Wireguard connections
+
+        See:  LP: #2016473
+        """
+
+        ret = self._nmcli(['con', 'add', 'type', 'wireguard', 'con-name', 'client-wg0', 'ifname', 'wg0', 'autoconnect', 'no'])
+        self.assertEqual(ret, 0, 'nmcli con add failed.')
+        ret = self._nmcli(['con', 'modify', 'client-wg0', 'ipv4.method', 'manual', 'ipv4.addresses', '10.1.2.3/24'])
+        self.assertEqual(ret, 0, 'nmcli ipv4 modify failed.')
+        ret = self._nmcli(['con', 'modify', 'client-wg0', 'wireguard.private-key', 'aPUcp5vHz8yMLrzk8SsDyYnV33IhE/k20e52iKJFV0A='])
+        self.assertEqual(ret, 0, 'nmcli add private key failed.')
+
+        # Use examples/python/gi/nm-wg-set to add one peer,
+        # nmcli doesn't support adding peers yet.
+        wg_peer_cmd = ['python3', 'examples/python/gi/nm-wg-set', 'client-wg0',
+                       'peer', 'cwkb7k0xDgLSnunZpFIjLJw4u+mJDDr+aBR5DqzpmgI=',
+                       'endpoint', '1.2.3.4:12345', 'allowed-ips', '192.168.0.0/24']
+        out = subprocess.run(wg_peer_cmd, capture_output=True, text=True)
+        self.assertEqual(out.returncode, 0, 'nm-wg-set failed to add the peer')
+
+    def test_import_wireguard_profile_from_file(self):
+        """
+        Network Manager should be able to import a Wireguard connection
+        from a configuration file.
+
+        See:  LP: #2016473
+        """
+        wg_profile = '''[Interface]
+PrivateKey = wFemfDk+MQbdHQnpADll/4fN/TaI7OPEMgbALP4BtF0=
+Address = 10.8.1.2/24
+DNS = 10.8.1.1
+[Peer]
+PublicKey = e3Yvr6qmGHGfOcF1wgsIWILT57FzpIgKjjP+AfcMwGI=
+AllowedIPs = 192.168.0.0/24
+Endpoint = 1.2.3.4:12345
+PersistentKeepalive = 15'''
+
+        wg_profile_path = '/etc/netplan/wg-client.conf'
+
+        with open(wg_profile_path, 'w') as f:
+            f.write(wg_profile)
+
+        ret = self._nmcli(['con', 'import', 'type', 'wireguard', 'file', wg_profile_path])
+        self.assertEqual(ret, 0, f'nmcli failed to import the Wireguard profile from {wg_profile_path}')
+
+    def test_create_wifi_connection_with_8021x(self):
+        """
+        See LP: #2016625.
+        """
+
+        openssl_cmd = [
+                'openssl', 'req', '-new', '-newkey', 'rsa:2048',
+                '-nodes', '-x509', '-subj',
+                '/C=US/ST=A/L=B/O=C/CN=www.a.com', '-keyout',
+                '/etc/netplan/a.key',  '-out', '/etc/netplan/a.crt']
+
+        subprocess.check_output(openssl_cmd, universal_newlines=True,
+                                stderr=subprocess.DEVNULL)
+
+        ret = self._nmcli(['con', 'add', 'con-name', 'eduroam',
+                           'type', 'wifi', 'ssid', 'eduroam',
+                           'wifi-sec.key-mgmt', 'wpa-eap', '802-1x.eap',
+                           'peap', '802-1x.identity', '[e-mail]',
+                           '802-1x.password', 'testing123',
+                           '802-1x.phase2-auth', 'mschapv2',
+                           '802-1x.ca-cert', '/etc/netplan/a.crt'])
+
+        self.assertEqual(ret, 0, 'nmcli failed to add connection')
+
+    def test_create_gre_connection(self):
+        """
+        Test case for LP: #1952967.
+        """
+
+        ret = self._nmcli(['con', 'add', 'con-name', '"IP tunnel connection 1"',
+                           'type', 'ip-tunnel', 'ip-tunnel.mode', 'gre',
+                           'ifname', 'gre10', 'remote',
+                           '10.20.20.2', 'local', '10.20.20.1'])
+
+        self.assertEqual(ret, 0, 'nmcli failed to add connection')
 
 if __name__ == '__main__':
     runner = unittest.TextTestRunner(stream=sys.stdout, verbosity=2)