mirror of
https://github.com/Av0idD4rk/firegex.git
synced 2026-10-23 16:31:00 +00:00
61 lines
2.7 KiB
Python
61 lines
2.7 KiB
Python
"""What the filter editor is allowed to suggest.
|
|
|
|
Introspected from the library rather than written down, so a model that gains a property
|
|
gains a hint. A second, hand-written description would be wrong the first time a model
|
|
changed, and autocompletion that lies is worse than none.
|
|
"""
|
|
|
|
import pytest
|
|
|
|
pytestmark = pytest.mark.instance
|
|
|
|
|
|
@pytest.fixture(scope="module")
|
|
def described(api):
|
|
return api.services_pyfilter_api()
|
|
|
|
|
|
def test_the_library_describes_its_own_models(described):
|
|
names = {model["name"] for model in described["models"]}
|
|
assert {"RawPacket", "HttpRequest", "TCPInputStream"} <= names, str(sorted(names))
|
|
|
|
|
|
def test_a_raw_packet_offers_the_metadata_a_filter_may_read(described):
|
|
raw = [m for m in described["models"] if m["name"] == "RawPacket"][0]
|
|
members = {m["name"] for m in raw["members"]}
|
|
assert {"client_ip", "server_port", "is_tcp", "is_input"} <= members, str(sorted(members))
|
|
|
|
|
|
def test_nothing_a_filter_is_shown_is_writable(described):
|
|
"""A filter reads, and answers with a verdict.
|
|
|
|
Nothing below the application layer ever crossed into one: the two layers cannot
|
|
honestly offer the same thing underneath it — NFQUEUE has a real header whose
|
|
rewriting desynchronises the stream, while the proxy terminated the connection and
|
|
writes its own. The payload was the one exception, for `UNSTABLE_MANGLE`, and stopped
|
|
being one with it: assignable and read by nothing afterwards, it was an editor
|
|
promising a rewrite that never reached the other end.
|
|
"""
|
|
raw = [m for m in described["models"] if m["name"] == "RawPacket"][0]
|
|
members = {m["name"]: m for m in raw["members"]}
|
|
assert members["data"]["writable"] is False
|
|
writable = [f"{model['name']}.{member['name']}" for model in described["models"]
|
|
for member in model["members"] if member["writable"]]
|
|
assert writable == [], str(writable)
|
|
|
|
|
|
def test_each_model_says_which_protocols_it_belongs_to(described):
|
|
"""`type_annotations_associations` is the single place a protocol is defined, and this
|
|
endpoint reads that same table back — a second list of names would be one more thing
|
|
to keep in step, and the day it fell behind the symptom would be a filter that
|
|
silently never runs."""
|
|
http_request = [m for m in described["models"] if m["name"] == "HttpRequest"][0]
|
|
raw = [m for m in described["models"] if m["name"] == "RawPacket"][0]
|
|
assert http_request["protocols"] == ["http"], str(http_request["protocols"])
|
|
assert len(raw["protocols"]) > 1, str(raw["protocols"])
|
|
|
|
|
|
def test_the_verdicts_are_described_too(described):
|
|
assert {v["name"] for v in described["verdicts"]} == {"ACCEPT", "REJECT", "DROP"}, \
|
|
str(described["verdicts"])
|