Merge ~gary-wzl77/snappy-hwe-snaps/+git/engineering-tests:easy-openvpn into ~snappy-hwe-team/snappy-hwe-snaps/+git/engineering-tests:master

[Gary.Wang]

*.Add easy-openvpn plainbox test cases.
*.Unify tests launch command.

*.Add easy-openvpn plainbox test cases.
*.Unify tests launch command.

[System Enablement Bot (system-enablement-ci-bot)]

PASSED: Continuous integration, rev:53ec5065fae589ae616a84ae32fa2f33c1973360
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1940/
Executed test runs:
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-build-snap-worker/3359
    None: https://jenkins.canonical.com/system-enablement/job/generic-update-snap-mp/1848/console
    SUCCESS: https://jenkins.canonical.com/system-enablement/job/generic-test-snap/3619
    None: https://jenkins.canonical.com/system-enablement/job/generic-cleanup-snap/2814/console

Click here to trigger a rebuild:
https://jenkins.canonical.com/system-enablement/job/generic-build-snap/1940/rebuild

review: Approve (continuous-integration)

[Simon Fels (morphis)]

LGTM

review: Approve

[Alfonso Sanchez-Beato (alfonsosanchezbeato)]

LGTM

review: Approve

diff --git a/README.md b/README.md
index 5ab766a..50ee19e 100644
--- a/README.md
+++ b/README.md
@@ -22,6 +22,11 @@ It currently covers test cases for the following snaps
  * wifi-connect
  * wireless-tools
  * wpa-supplicant
+ * media-hub
+ * snapweb
+ * serial-vault
+ * easy-openvpn
+
 
 ## How can I run the tests?
 
@@ -56,6 +61,8 @@ categories related to the command's name.
     $ /snap/bin/canonical-se-engineering-tests.wifi-ap
     $ /snap/bin/canonical-se-engineering-tests.wifi-connect
     $ /snap/bin/canonical-se-engineering-tests.wireless-tools
+    $ /snap/bin/canonical-se-engineering-tests.snapweb
+    $ /snap/bin/canonical-se-engineering-tests.easy-openvpn
 
 ## How can I contribute new tests?
 
diff --git a/bin/run-alsa-utils-tests b/bin/run-alsa-utils-tests
new file mode 100755
index 0000000..d22e3cb
--- /dev/null
+++ b/bin/run-alsa-utils-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::alsa_utils.*' \
+	"$@"
diff --git a/bin/run-captive-redirect-tests b/bin/run-captive-redirect-tests
new file mode 100755
index 0000000..3887d71
--- /dev/null
+++ b/bin/run-captive-redirect-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::captive_redirect.*' \
+	"$@"
diff --git a/bin/run-easy-openvpn-tests b/bin/run-easy-openvpn-tests
new file mode 100755
index 0000000..1a5f2ae
--- /dev/null
+++ b/bin/run-easy-openvpn-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::easy_openvpn.*' \
+	"$@"
diff --git a/bin/run-media-hub-tests b/bin/run-media-hub-tests
new file mode 100755
index 0000000..295c791
--- /dev/null
+++ b/bin/run-media-hub-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::media_hub.*' \
+	"$@"
diff --git a/bin/run-serial-vault-tests b/bin/run-serial-vault-tests
new file mode 100755
index 0000000..06537aa
--- /dev/null
+++ b/bin/run-serial-vault-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::serial_vault.*' \
+	"$@"
diff --git a/bin/run-snapweb-tests b/bin/run-snapweb-tests
new file mode 100755
index 0000000..fcb1791
--- /dev/null
+++ b/bin/run-snapweb-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::snapweb.*' \
+	"$@"
diff --git a/bin/run-upower-tests b/bin/run-upower-tests
new file mode 100755
index 0000000..9bb3b9e
--- /dev/null
+++ b/bin/run-upower-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::upower.*' \
+	"$@"
diff --git a/bin/run-wifi-connect-tests b/bin/run-wifi-connect-tests
new file mode 100755
index 0000000..58776f1
--- /dev/null
+++ b/bin/run-wifi-connect-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::wifi-connect.*' \
+	"$@"
diff --git a/bin/run-wpa-supplicant-tests b/bin/run-wpa-supplicant-tests
new file mode 100755
index 0000000..7251334
--- /dev/null
+++ b/bin/run-wpa-supplicant-tests
@@ -0,0 +1,5 @@
+#!/bin/sh
+export PATH="$PATH:$SNAP/usr/sbin"
+exec python3 $(which plainbox) \
+	run -i '2017.com.canonical.se::wpa_supplicant.*' \
+	"$@"
diff --git a/com.canonical.se:engineering-tests/units/easy-openvpn/easy-openvpn.pxu b/com.canonical.se:engineering-tests/units/easy-openvpn/easy-openvpn.pxu
new file mode 100644
index 0000000..c6f8336
--- /dev/null
+++ b/com.canonical.se:engineering-tests/units/easy-openvpn/easy-openvpn.pxu
@@ -0,0 +1,163 @@
+# Copyright 2017 Canonical Ltd.
+# All rights reserved.
+#
+# Written by:
+#   Gary Wang <[e-mail]>
+
+unit: category
+id: easy_openvpn
+_name: An easy-to-manage OpenVPN deployment.
+
+id: easy_openvpn/setup/ensure_interface_connection
+category_id: easy_openvpn
+_description: Ensure the easy-openvpn interfaces are connected
+plugin: manual
+_steps:
+  1. If the easy-openvpn snap is already installed remove it via
+     .
+     $ snap remove easy-openvpn
+     .
+  2. Install easy-openvpn from the store.
+     .
+     $ snap install easy-openvpn
+     .
+_verification:
+  Verify that you see the following when running snap interfaces:
+  :network          easy-openvpn
+  :network-bind     easy-openvpn
+  :network-control  easy-openvpn
+  :firewall-control easy-openvpn
+
+id: easy_openvpn/setup/launch_server
+category_id: easy_openvpn
+plugin: manual
+depends: easy_openvpn/setup/ensure_interface_connection
+_summary: Setup and launch an openvpn Server
+_purpose:
+  Check if an openvpn server is up and running after it's configured.
+_steps:
+  1. Enable IP forwarding firstly.
+     Note: On ubuntu core, IP forwarding is disabled by default.
+     .
+     $ sudo sysctl -w net.ipv4.ip_forward=1
+     .
+  2. Set correct nat device according to your server connection.
+     Typically, the nat device is 'eth0' (default value) if
+     the connection is over an ethernet connection. You need to set
+     it to 'wlan0' if a wireless connection is established.
+     Note: This fits the scenario where people usually setup a
+     wireless connection on ubuntu core at the first boot.
+     .
+     $ sudo snap set easy-openvpn natdevice=wlan0
+     .
+  3. Find IP address if host machine via ifconfig or hostname:
+     .
+     $ hostname  -I | cut -f1 -d' '
+     .
+  4. Configure the server with host machine IP address:
+     Note: PEM pass phrase is mandatory.
+     .
+     $ sudo easy-openvpn.setup -u "udp://SERVER_IP"
+     .
+  5. Launch the openvpn server:
+     .
+     sudo service snap.easy-openvpn.easy-openvpn start
+     .
+_verification:
+  Run the following command to check journal logs of easy-openvpn:
+     .
+     $ sudo journalctl -n 10 --no-pager -u snap.easy-openvpn.easy-openvpn
+     .
+  Verify if logs contain the following information like:
+     'Initialization Sequence Completed'
+
+id: easy_openvpn/setup/add_client
+category_id: easy_openvpn
+plugin: manual
+depends: easy_openvpn/setup/launch_server
+_summary: Adding an openvpn client.
+_purpose:
+  Check if a newly added client can be found at the client list of server.
+_steps:
+  1. Add an openvpn client named 'foo' and output corresponding
+     client config file(foo.ovpn).
+     .
+     $ sudo easy-openvpn.add-client foo > foo.ovpn
+     .
+_verification:
+  Verify if the newly added client(foo) can be found at client list
+  Run the following command to view the client list of the openvpn server.
+     .
+     $ sudo easy-openvpn.clients
+     .
+
+id: easy_openvpn/setup/connect_server
+category_id: easy_openvpn
+plugin: manual
+depends: easy_openvpn/setup/launch_server
+_summary: Connecting an openvpn server.
+_purpose:
+  Check if an end user can connect to an openvpn server from another host machine.
+_steps:
+  1. Install this snap on another machine acting as an openvpn client.
+     Copy the generated foo.ovpn from server to read/write location on this client.
+     Remember to change the owner of foo.ovpn to 'root' to overcome
+     dac_override denied in snappy world.
+     .
+     $ sudo chown root.root foo.ovpn
+     .
+  2. Open a terminal and connect the server by running:
+     .
+     $ sudo easy-openvpn.connect-server foo.ovpn
+     .
+_verification:
+  Verify if the client logging output contains the following information.
+      ' openvpn.* Initialization Sequence Completed'
+
+id: easy_openvpn/setup/monitor_status
+category_id: easy_openvpn
+plugin: manual
+depends: easy_openvpn/setup/connect_server
+_summary: Monitor client's status.
+_purpose:
+  Monitor clients connection status i.e. traffic information and router table.
+_steps:
+  1. On client side
+     After vpn connection is established, open a web browser
+     and navigate to any website.
+  2. On server side, run the following command:
+     .
+     $ sudo easy-openvpn.status
+     .
+_verification:
+  Verify if there's internet connection after connection is established.
+  Observing network traffic, especially for bytes received, bytes sent
+  from the logging output and Ensure the values are not zero.
+
+id: easy_openvpn/setup/revoke_client
+category_id: easy_openvpn
+plugin: manual
+depends: easy_openvpn/setup/monitor_status
+_summary: Revoking an openvpn client.
+_purpose:
+  Check if a client can connect to server after the certificate is revoked.
+_steps:
+  On the server side:
+  1. Remove a known client on the server i.e. 'foo'
+     .
+     $ sudo easy-openvpn.revoke-client foo
+     .
+  2. Check if the client is marked as 'REVOKED'
+     .
+     $ sudo easy-openvpn.clients | MATCH "foo.*REVOKED"
+     .
+  On the client side:
+  1. Kill the openvpn client if it's running.
+  2. Connect to server again.
+     .
+     $ sudo easy-openvpn.connect-server foo.ovpn
+     .
+_verification:
+  Verify if VPN connection fails after the client is revoked on the server end
+  and the client logging output contains the following information
+  "TLS Error: TLS handshake failed"
diff --git a/snapcraft.yaml b/snapcraft.yaml
index a48c2c8..5be0981 100644
--- a/snapcraft.yaml
+++ b/snapcraft.yaml
@@ -26,27 +26,29 @@ apps:
   wifi-ap:
     command: bin/run-wifi-ap-tests
   wifi-connect:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::wifi-connect.*'
+    command: bin/run-wifi-connect-tests
   wireless-tools:
     command: bin/run-wireless-tools-tests
   pulseaudio:
     command: bin/run-pulseaudio-tests
   snapweb:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::snapweb.*'
+    command: bin/run-snapweb-tests
   upower:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::upower.*'
+    command: bin/run-upower-tests
   udisks2:
     command: bin/run-udisks2-tests
   alsa-utils:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::alsa_utils.*'
+    command: bin/run-alsa-utils-tests
   media-hub:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::media_hub.*'
+    command: bin/run-media-hub-tests
   captive-redirect:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::captive_redirect.*'
+    command: bin/run-captive-redirect-tests
   wpa-supplicant:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::wpa_supplicant.*'
+    command: bin/run-wpa-supplicant-tests
   serial-vault:
-    command: bin/plainbox-wrapper run -i '2017.com.canonical.se::serial_vault.*'
+    command: bin/run-serial-vault-tests
+  easy-openvpn:
+    command: bin/run-easy-openvpn-tests
 
 parts:
   common: