mirror of
https://github.com/SELinuxProject/setools
synced 2025-03-11 07:18:15 +00:00
Add ibendportcon and ibpkeycon queries.
This commit is contained in:
Chris PeBenito
parent
a9620d8b2b
commit
832462fd0f
@ -29,7 +29,7 @@ import logging
|
||||
|
||||
# Python classes for policy representation
|
||||
from .policyrep import SELinuxPolicy, BoundsRuletype, ConstraintRuletype, DefaultRuletype, \
|
||||
DefaultRangeValue, DefaultValue, FSUseRuletype, HandleUnknown, MLSRuletype, \
|
||||
DefaultRangeValue, DefaultValue, FSUseRuletype, HandleUnknown, IbpkeyconRange, MLSRuletype, \
|
||||
NodeconIPVersion, PolicyTarget, PortconProtocol, RBACRuletype, TERuletype
|
||||
|
||||
# Exceptions
|
||||
@ -62,6 +62,8 @@ from .defaultquery import DefaultQuery
|
||||
# In-policy Context Queries
|
||||
from .fsusequery import FSUseQuery
|
||||
from .genfsconquery import GenfsconQuery
|
||||
from .ibendportconquery import IbendportconQuery
|
||||
from .ibpkeyconquery import IbpkeyconQuery
|
||||
from .initsidquery import InitialSIDQuery
|
||||
from .netifconquery import NetifconQuery
|
||||
from .nodeconquery import NodeconQuery
|
||||
|
||||
85
setools/ibendportconquery.py
Normal file
85
setools/ibendportconquery.py
Normal file
@ -0,0 +1,85 @@
|
||||
# Copyright 2018, Chris PeBenito <pebenito@ieee.org>
|
||||
#
|
||||
# This file is part of SETools.
|
||||
#
|
||||
# SETools is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as
|
||||
# published by the Free Software Foundation, either version 2.1 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# SETools is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public
|
||||
# License along with SETools. If not, see
|
||||
# <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
import logging
|
||||
|
||||
from .mixins import MatchContext, MatchName
|
||||
from .query import PolicyQuery
|
||||
from .util import match_regex
|
||||
|
||||
|
||||
class IbendportconQuery(MatchContext, MatchName, PolicyQuery):
|
||||
|
||||
"""
|
||||
Infiniband endport context query.
|
||||
|
||||
Parameter:
|
||||
policy The policy to query.
|
||||
|
||||
Keyword Parameters/Class attributes:
|
||||
name The name of the network interface to match.
|
||||
name_regex If true, regular expression matching will
|
||||
be used for matching the name.
|
||||
port The port number to match.
|
||||
user The criteria to match the context's user.
|
||||
user_regex If true, regular expression matching
|
||||
will be used on the user.
|
||||
role The criteria to match the context's role.
|
||||
role_regex If true, regular expression matching
|
||||
will be used on the role.
|
||||
type_ The criteria to match the context's type.
|
||||
type_regex If true, regular expression matching
|
||||
will be used on the type.
|
||||
range_ The criteria to match the context's range.
|
||||
range_subset If true, the criteria will match if it is a subset
|
||||
of the context's range.
|
||||
range_overlap If true, the criteria will match if it overlaps
|
||||
any of the context's range.
|
||||
range_superset If true, the criteria will match if it is a superset
|
||||
of the context's range.
|
||||
range_proper If true, use proper superset/subset operations.
|
||||
No effect if not using set operations.
|
||||
"""
|
||||
|
||||
port = None
|
||||
|
||||
def __init__(self, policy, **kwargs):
|
||||
super(IbendportconQuery, self).__init__(policy, **kwargs)
|
||||
self.log = logging.getLogger(__name__)
|
||||
|
||||
def results(self):
|
||||
"""Generator which yields all matching ibendportcons."""
|
||||
self.log.info("Generating ibendportcon results from {0.policy}".format(self))
|
||||
self._match_name_debug(self.log)
|
||||
self.log.debug("Port: {0.port}".format(self))
|
||||
self._match_context_debug(self.log)
|
||||
|
||||
for endport in self.policy.ibendportcons():
|
||||
if self.name and not match_regex(
|
||||
endport.name,
|
||||
self.name,
|
||||
self.name_regex):
|
||||
continue
|
||||
|
||||
if self.port is not None and self.port != endport.port:
|
||||
continue
|
||||
|
||||
if not self._match_context(endport.context):
|
||||
continue
|
||||
|
||||
yield endport
|
||||
141
setools/ibpkeyconquery.py
Normal file
141
setools/ibpkeyconquery.py
Normal file
@ -0,0 +1,141 @@
|
||||
# Copyright 2018, Chris PeBenito <pebenito@ieee.org>
|
||||
#
|
||||
# This file is part of SETools.
|
||||
#
|
||||
# SETools is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as
|
||||
# published by the Free Software Foundation, either version 2.1 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# SETools is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public
|
||||
# License along with SETools. If not, see
|
||||
# <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
import ipaddress
|
||||
import logging
|
||||
|
||||
from .mixins import MatchContext
|
||||
from .policyrep import IbpkeyconRange
|
||||
from .query import PolicyQuery
|
||||
from .util import match_range
|
||||
|
||||
|
||||
class IbpkeyconQuery(MatchContext, PolicyQuery):
|
||||
|
||||
"""
|
||||
Infiniband pkey context query.
|
||||
|
||||
Parameter:
|
||||
policy The policy to query.
|
||||
|
||||
Keyword Parameters/Class attributes:
|
||||
subnet_prefix A subnet prefix to match.
|
||||
pkeys A 2-tuple of the pkey range to match. (Set both to
|
||||
the same value for a single pkey)
|
||||
pkeys_subset If true, the criteria will match if it is a subset
|
||||
of the ibpkeycon's range.
|
||||
pkeys_overlap If true, the criteria will match if it overlaps
|
||||
any of the ibpkeycon's range.
|
||||
pkeys_superset If true, the criteria will match if it is a superset
|
||||
of the ibpkeycon's range.
|
||||
pkeys_proper If true, use proper superset/subset operations.
|
||||
No effect if not using set operations.
|
||||
user The criteria to match the context's user.
|
||||
user_regex If true, regular expression matching
|
||||
will be used on the user.
|
||||
role The criteria to match the context's role.
|
||||
role_regex If true, regular expression matching
|
||||
will be used on the role.
|
||||
type_ The criteria to match the context's type.
|
||||
type_regex If true, regular expression matching
|
||||
will be used on the type.
|
||||
range_ The criteria to match the context's range.
|
||||
range_subset If true, the criteria will match if it is a subset
|
||||
of the context's range.
|
||||
range_overlap If true, the criteria will match if it overlaps
|
||||
any of the context's range.
|
||||
range_superset If true, the criteria will match if it is a superset
|
||||
of the context's range.
|
||||
range_proper If true, use proper superset/subset operations.
|
||||
No effect if not using set operations.
|
||||
"""
|
||||
|
||||
_subnet_prefix = None
|
||||
_pkeys = None
|
||||
pkeys_subset = False
|
||||
pkeys_overlap = False
|
||||
pkeys_superset = False
|
||||
pkeys_proper = False
|
||||
|
||||
def __init__(self, policy, **kwargs):
|
||||
super(IbpkeyconQuery, self).__init__(policy, **kwargs)
|
||||
self.log = logging.getLogger(__name__)
|
||||
|
||||
@property
|
||||
def pkeys(self):
|
||||
return self._pkeys
|
||||
|
||||
@pkeys.setter
|
||||
def pkeys(self, value):
|
||||
if value is not None:
|
||||
pending_pkeys = IbpkeyconRange(*value)
|
||||
|
||||
if pending_pkeys.low < 1 or pending_pkeys.high < 1:
|
||||
raise ValueError("Pkeys must be positive: {0.low:#x}-{0.high:#x}".
|
||||
format(pending_pkeys))
|
||||
|
||||
if pending_pkeys.low > 0xffff or pending_pkeys.high > 0xffff:
|
||||
raise ValueError("Pkeys maximum is 0xffff: {0.low:#x}-{0.high:#x}".
|
||||
format(pending_pkeys))
|
||||
|
||||
if pending_pkeys.low > pending_pkeys.high:
|
||||
raise ValueError(
|
||||
"The low pkey must be smaller than the high pkey: {0.low:#x}-{0.high:#x}".
|
||||
format(pending_pkeys))
|
||||
|
||||
self._pkeys = pending_pkeys
|
||||
else:
|
||||
self._pkeys = None
|
||||
|
||||
@property
|
||||
def subnet_prefix(self):
|
||||
return self._subnet_prefix
|
||||
|
||||
@subnet_prefix.setter
|
||||
def subnet_prefix(self, value):
|
||||
if value:
|
||||
self._subnet_prefix = ipaddress.IPv6Address(value)
|
||||
else:
|
||||
self._subnet_prefix = None
|
||||
|
||||
def results(self):
|
||||
"""Generator which yields all matching ibpkeycons."""
|
||||
self.log.info("Generating ibpkeycon results from {0.policy}".format(self))
|
||||
self.log.debug("Subnet Prefix: {0.subnet_prefix}".format(self))
|
||||
self.log.debug("Pkeys: {0.pkeys}, overlap: {0.pkeys_overlap}, "
|
||||
"subset: {0.pkeys_subset}, superset: {0.pkeys_superset}, "
|
||||
"proper: {0.pkeys_proper}".format(self))
|
||||
self._match_context_debug(self.log)
|
||||
|
||||
for pk in self.policy.ibpkeycons():
|
||||
if self.subnet_prefix is not None and self.subnet_prefix != pk.subnet_prefix:
|
||||
continue
|
||||
|
||||
if self.pkeys and not match_range(
|
||||
pk.pkeys,
|
||||
self.pkeys,
|
||||
self.pkeys_subset,
|
||||
self.pkeys_overlap,
|
||||
self.pkeys_superset,
|
||||
self.pkeys_proper):
|
||||
continue
|
||||
|
||||
if not self._match_context(pk.context):
|
||||
continue
|
||||
|
||||
yield pk
|
||||
@ -25,6 +25,8 @@ from . import diff
|
||||
from . import dta
|
||||
from . import fsusequery
|
||||
from . import genfsconquery
|
||||
from . import ibendportconquery
|
||||
from . import ibpkeyconquery
|
||||
from . import infoflow
|
||||
from . import initsidquery
|
||||
from . import mlsrulequery
|
||||
|
||||
284
tests/ibendportconquery.conf
Normal file
284
tests/ibendportconquery.conf
Normal file
@ -0,0 +1,284 @@
|
||||
class infoflow
|
||||
class infoflow2
|
||||
class infoflow3
|
||||
class infoflow4
|
||||
class infoflow5
|
||||
class infoflow6
|
||||
class infoflow7
|
||||
|
||||
sid kernel
|
||||
sid security
|
||||
|
||||
common infoflow
|
||||
{
|
||||
low_w
|
||||
med_w
|
||||
hi_w
|
||||
low_r
|
||||
med_r
|
||||
hi_r
|
||||
}
|
||||
|
||||
class infoflow
|
||||
inherits infoflow
|
||||
|
||||
class infoflow2
|
||||
inherits infoflow
|
||||
{
|
||||
super_w
|
||||
super_r
|
||||
}
|
||||
|
||||
class infoflow3
|
||||
{
|
||||
null
|
||||
}
|
||||
|
||||
class infoflow4
|
||||
inherits infoflow
|
||||
|
||||
class infoflow5
|
||||
inherits infoflow
|
||||
|
||||
class infoflow6
|
||||
inherits infoflow
|
||||
|
||||
class infoflow7
|
||||
inherits infoflow
|
||||
{
|
||||
super_w
|
||||
super_r
|
||||
super_none
|
||||
super_both
|
||||
super_unmapped
|
||||
}
|
||||
|
||||
sensitivity s0;
|
||||
sensitivity s1;
|
||||
sensitivity s2;
|
||||
sensitivity s3;
|
||||
sensitivity s4;
|
||||
sensitivity s5;
|
||||
sensitivity s6;
|
||||
|
||||
dominance { s0 s1 s2 s3 s4 s5 s6 }
|
||||
|
||||
category c0;
|
||||
category c1;
|
||||
category c2;
|
||||
category c3;
|
||||
category c4;
|
||||
|
||||
#level decl
|
||||
level s0:c0.c4;
|
||||
level s1:c0.c4;
|
||||
level s2:c0.c4;
|
||||
level s3:c0.c4;
|
||||
level s4:c0.c4;
|
||||
level s5:c0.c4;
|
||||
level s6:c0.c4;
|
||||
|
||||
|
||||
#some constraints
|
||||
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));
|
||||
|
||||
attribute mls_exempt;
|
||||
|
||||
type system;
|
||||
role system;
|
||||
role system types system;
|
||||
|
||||
role role30_r;
|
||||
role role31a_r;
|
||||
role role31b_r;
|
||||
role role31c_r;
|
||||
|
||||
role role30_r types system;
|
||||
role role31a_r types system;
|
||||
role role31b_r types system;
|
||||
role role31c_r types system;
|
||||
|
||||
type type40;
|
||||
type type41a;
|
||||
type type41b;
|
||||
type type41c;
|
||||
role system types { type40 type41a type41b type41c };
|
||||
|
||||
################################################################################
|
||||
# Type enforcement declarations and rules
|
||||
|
||||
allow system system:infoflow3 null;
|
||||
|
||||
################################################################################
|
||||
|
||||
#users
|
||||
user system roles { system role30_r role31a_r role31b_r role31c_r } level s0 range s0 - s6:c0.c4;
|
||||
user user20 roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21a roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21b roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21c roles system level s0 range s0 - s2:c0.c4;
|
||||
|
||||
#normal constraints
|
||||
constrain infoflow hi_w (u1 == u2);
|
||||
|
||||
#isids
|
||||
sid kernel system:system:system:s0
|
||||
sid security system:system:system:s0
|
||||
|
||||
#fs_use
|
||||
fs_use_trans devpts system:object_r:system:s0;
|
||||
fs_use_xattr ext3 system:object_r:system:s0;
|
||||
fs_use_task pipefs system:object_r:system:s0;
|
||||
|
||||
#genfscon
|
||||
genfscon proc / system:object_r:system:s1
|
||||
genfscon proc /sys system:object_r:system:s0
|
||||
genfscon selinuxfs / system:object_r:system:s2:c0.c4
|
||||
|
||||
portcon tcp 80 system:object_r:system:s0
|
||||
|
||||
netifcon eth0 system:object_r:system:s0 system:object_r:system:s0
|
||||
|
||||
# test 1:
|
||||
# name: test1, exact
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test1 1 system:system:system:s0:c0.c1
|
||||
|
||||
# test 2:
|
||||
# name: test2(a|b), regex
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test2a 2 system:system:system:s0:c0.c1
|
||||
ibendportcon test2b 3 system:system:system:s0:c0.c1
|
||||
ibendportcon test2c 4 system:system:system:s0:c0.c1
|
||||
|
||||
# test 10:
|
||||
# name: unset
|
||||
# port: 10
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test10 10 system:system:system:s0:c0.c1
|
||||
|
||||
# test 20:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: user20, exact
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test20 20 user20:system:system:s0:c0.c1
|
||||
|
||||
# test 21:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: user21(a|b), regex
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test21a 21 user21a:system:system:s0:c0.c1
|
||||
ibendportcon test21b 22 user21b:system:system:s0:c0.c1
|
||||
ibendportcon test21c 23 user21c:system:system:s0:c0.c1
|
||||
|
||||
# test 30:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: role30_r, exact
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test30 30 system:role30_r:system:s0:c0.c1
|
||||
|
||||
# test 31:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: role30(a|c)_r, regex
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibendportcon test31a 31 system:role31a_r:system:s0:c0.c1
|
||||
ibendportcon test31b 32 system:role31b_r:system:s0:c0.c1
|
||||
ibendportcon test31c 33 system:role31c_r:system:s0:c0.c1
|
||||
|
||||
# test 40:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: type40
|
||||
# range: unset
|
||||
ibendportcon test40 40 system:system:type40:s0:c0.c1
|
||||
|
||||
# test 41:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: type41(b|c)
|
||||
# range: unset
|
||||
ibendportcon test41a 41 system:system:type41a:s0:c0.c1
|
||||
ibendportcon test41b 42 system:system:type41b:s0:c0.c1
|
||||
ibendportcon test41c 43 system:system:type41c:s0:c0.c1
|
||||
|
||||
# test 50:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: equal
|
||||
ibendportcon test50 50 system:system:system:s0:c1 - s0:c0.c4
|
||||
|
||||
# test 51:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: overlap
|
||||
ibendportcon test51 51 system:system:system:s1:c1 - s1:c1.c3
|
||||
|
||||
# test 52:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: subset
|
||||
ibendportcon test52 52 system:system:system:s2:c1 - s2:c1.c3
|
||||
|
||||
# test 53:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: superset
|
||||
ibendportcon test53 53 system:system:system:s3:c1 - s3:c1.c3
|
||||
|
||||
# test 54:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: proper subset
|
||||
ibendportcon test54 54 system:system:system:s4:c1 - s4:c1.c3
|
||||
|
||||
# test 55:
|
||||
# name: unset
|
||||
# port: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: proper superset
|
||||
ibendportcon test55 55 system:system:system:s5:c1 - s5:c1.c3
|
||||
|
||||
233
tests/ibendportconquery.py
Normal file
233
tests/ibendportconquery.py
Normal file
@ -0,0 +1,233 @@
|
||||
# Copyright 2018, Chris PeBenito <pebenito@ieee.org>
|
||||
#
|
||||
# This file is part of SETools.
|
||||
#
|
||||
# SETools is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# SETools is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with SETools. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
import os
|
||||
import unittest
|
||||
|
||||
from setools import IbendportconQuery
|
||||
|
||||
from .policyrep.util import compile_policy
|
||||
|
||||
|
||||
class IbendportconQueryTest(unittest.TestCase):
|
||||
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.p = compile_policy("tests/ibendportconquery.conf")
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(cls):
|
||||
os.unlink(cls.p.path)
|
||||
|
||||
def test_000_unset(self):
|
||||
"""Ibendportcon query with no criteria"""
|
||||
# query with no parameters gets all ibendportcons.
|
||||
ibendportcons = sorted(self.p.ibendportcons())
|
||||
|
||||
q = IbendportconQuery(self.p)
|
||||
q_ibendportcons = sorted(q.results())
|
||||
|
||||
self.assertListEqual(ibendportcons, q_ibendportcons)
|
||||
|
||||
def test_001_name_exact(self):
|
||||
"""Ibendportcon query with exact name match."""
|
||||
q = IbendportconQuery(self.p, name="test1", name_regex=False)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test1"], ibendportcons)
|
||||
|
||||
def test_002_name_regext(self):
|
||||
"""Ibendportcon query with regex name match."""
|
||||
q = IbendportconQuery(self.p, name="test2(a|b)", name_regex=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test2a", "test2b"], ibendportcons)
|
||||
|
||||
def test_010_port(self):
|
||||
"""Ibendportcon query with port match."""
|
||||
q = IbendportconQuery(self.p, port=10)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test10"], ibendportcons)
|
||||
|
||||
def test_020_user_exact(self):
|
||||
"""Ibendportcon query with context user exact match"""
|
||||
q = IbendportconQuery(self.p, user="user20", user_regex=False)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test20"], ibendportcons)
|
||||
|
||||
def test_021_user_regex(self):
|
||||
"""Ibendportcon query with context user regex match"""
|
||||
q = IbendportconQuery(self.p, user="user21(a|b)", user_regex=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test21a", "test21b"], ibendportcons)
|
||||
|
||||
def test_030_role_exact(self):
|
||||
"""Ibendportcon query with context role exact match"""
|
||||
q = IbendportconQuery(self.p, role="role30_r", role_regex=False)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test30"], ibendportcons)
|
||||
|
||||
def test_031_role_regex(self):
|
||||
"""Ibendportcon query with context role regex match"""
|
||||
q = IbendportconQuery(self.p, role="role31(a|c)_r", role_regex=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test31a", "test31c"], ibendportcons)
|
||||
|
||||
def test_040_type_exact(self):
|
||||
"""Ibendportcon query with context type exact match"""
|
||||
q = IbendportconQuery(self.p, type_="type40", type_regex=False)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test40"], ibendportcons)
|
||||
|
||||
def test_041_type_regex(self):
|
||||
"""Ibendportcon query with context type regex match"""
|
||||
q = IbendportconQuery(self.p, type_="type41(b|c)", type_regex=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test41b", "test41c"], ibendportcons)
|
||||
|
||||
def test_050_range_exact(self):
|
||||
"""Ibendportcon query with context range exact match"""
|
||||
q = IbendportconQuery(self.p, range_="s0:c1 - s0:c0.c4")
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test50"], ibendportcons)
|
||||
|
||||
def test_051_range_overlap1(self):
|
||||
"""Ibendportcon query with context range overlap match (equal)"""
|
||||
q = IbendportconQuery(self.p, range_="s1:c1 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test51"], ibendportcons)
|
||||
|
||||
def test_051_range_overlap2(self):
|
||||
"""Ibendportcon query with context range overlap match (subset)"""
|
||||
q = IbendportconQuery(self.p, range_="s1:c1,c2 - s1:c0.c3", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test51"], ibendportcons)
|
||||
|
||||
def test_051_range_overlap3(self):
|
||||
"""Ibendportcon query with context range overlap match (superset)"""
|
||||
q = IbendportconQuery(self.p, range_="s1 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test51"], ibendportcons)
|
||||
|
||||
def test_051_range_overlap4(self):
|
||||
"""Ibendportcon query with context range overlap match (overlap low level)"""
|
||||
q = IbendportconQuery(self.p, range_="s1 - s1:c1,c2", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test51"], ibendportcons)
|
||||
|
||||
def test_051_range_overlap5(self):
|
||||
"""Ibendportcon query with context range overlap match (overlap high level)"""
|
||||
q = IbendportconQuery(self.p, range_="s1:c1,c2 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test51"], ibendportcons)
|
||||
|
||||
def test_052_range_subset1(self):
|
||||
"""Ibendportcon query with context range subset match"""
|
||||
q = IbendportconQuery(self.p, range_="s2:c1,c2 - s2:c0.c3", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test52"], ibendportcons)
|
||||
|
||||
def test_052_range_subset2(self):
|
||||
"""Ibendportcon query with context range subset match (equal)"""
|
||||
q = IbendportconQuery(self.p, range_="s2:c1 - s2:c1.c3", range_overlap=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test52"], ibendportcons)
|
||||
|
||||
def test_053_range_superset1(self):
|
||||
"""Ibendportcon query with context range superset match"""
|
||||
q = IbendportconQuery(self.p, range_="s3 - s3:c0.c4", range_superset=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test53"], ibendportcons)
|
||||
|
||||
def test_053_range_superset2(self):
|
||||
"""Ibendportcon query with context range superset match (equal)"""
|
||||
q = IbendportconQuery(self.p, range_="s3:c1 - s3:c1.c3", range_superset=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test53"], ibendportcons)
|
||||
|
||||
def test_054_range_proper_subset1(self):
|
||||
"""Ibendportcon query with context range proper subset match"""
|
||||
q = IbendportconQuery(self.p, range_="s4:c1,c2", range_subset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test54"], ibendportcons)
|
||||
|
||||
def test_054_range_proper_subset2(self):
|
||||
"""Ibendportcon query with context range proper subset match (equal)"""
|
||||
q = IbendportconQuery(self.p, range_="s4:c1 - s4:c1.c3", range_subset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual([], ibendportcons)
|
||||
|
||||
def test_054_range_proper_subset3(self):
|
||||
"""Ibendportcon query with context range proper subset match (equal low only)"""
|
||||
q = IbendportconQuery(self.p, range_="s4:c1 - s4:c1.c2", range_subset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test54"], ibendportcons)
|
||||
|
||||
def test_054_range_proper_subset4(self):
|
||||
"""Ibendportcon query with context range proper subset match (equal high only)"""
|
||||
q = IbendportconQuery(self.p, range_="s4:c1,c2 - s4:c1.c3", range_subset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test54"], ibendportcons)
|
||||
|
||||
def test_055_range_proper_superset1(self):
|
||||
"""Ibendportcon query with context range proper superset match"""
|
||||
q = IbendportconQuery(self.p, range_="s5 - s5:c0.c4", range_superset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test55"], ibendportcons)
|
||||
|
||||
def test_055_range_proper_superset2(self):
|
||||
"""Ibendportcon query with context range proper superset match (equal)"""
|
||||
q = IbendportconQuery(self.p, range_="s5:c1 - s5:c1.c3", range_superset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual([], ibendportcons)
|
||||
|
||||
def test_055_range_proper_superset3(self):
|
||||
"""Ibendportcon query with context range proper superset match (equal low)"""
|
||||
q = IbendportconQuery(self.p, range_="s5:c1 - s5:c1.c4", range_superset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test55"], ibendportcons)
|
||||
|
||||
def test_055_range_proper_superset4(self):
|
||||
"""Ibendportcon query with context range proper superset match (equal high)"""
|
||||
q = IbendportconQuery(self.p, range_="s5 - s5:c1.c3", range_superset=True, range_proper=True)
|
||||
|
||||
ibendportcons = sorted(n.name for n in q.results())
|
||||
self.assertListEqual(["test55"], ibendportcons)
|
||||
273
tests/ibpkeyconquery.conf
Normal file
273
tests/ibpkeyconquery.conf
Normal file
@ -0,0 +1,273 @@
|
||||
class infoflow
|
||||
class infoflow2
|
||||
class infoflow3
|
||||
class infoflow4
|
||||
class infoflow5
|
||||
class infoflow6
|
||||
class infoflow7
|
||||
|
||||
sid kernel
|
||||
sid security
|
||||
|
||||
common infoflow
|
||||
{
|
||||
low_w
|
||||
med_w
|
||||
hi_w
|
||||
low_r
|
||||
med_r
|
||||
hi_r
|
||||
}
|
||||
|
||||
class infoflow
|
||||
inherits infoflow
|
||||
|
||||
class infoflow2
|
||||
inherits infoflow
|
||||
{
|
||||
super_w
|
||||
super_r
|
||||
}
|
||||
|
||||
class infoflow3
|
||||
{
|
||||
null
|
||||
}
|
||||
|
||||
class infoflow4
|
||||
inherits infoflow
|
||||
|
||||
class infoflow5
|
||||
inherits infoflow
|
||||
|
||||
class infoflow6
|
||||
inherits infoflow
|
||||
|
||||
class infoflow7
|
||||
inherits infoflow
|
||||
{
|
||||
super_w
|
||||
super_r
|
||||
super_none
|
||||
super_both
|
||||
super_unmapped
|
||||
}
|
||||
|
||||
sensitivity s0;
|
||||
sensitivity s1;
|
||||
sensitivity s2;
|
||||
sensitivity s3;
|
||||
sensitivity s4;
|
||||
sensitivity s5;
|
||||
sensitivity s6;
|
||||
|
||||
dominance { s0 s1 s2 s3 s4 s5 s6 }
|
||||
|
||||
category c0;
|
||||
category c1;
|
||||
category c2;
|
||||
category c3;
|
||||
category c4;
|
||||
|
||||
#level decl
|
||||
level s0:c0.c4;
|
||||
level s1:c0.c4;
|
||||
level s2:c0.c4;
|
||||
level s3:c0.c4;
|
||||
level s4:c0.c4;
|
||||
level s5:c0.c4;
|
||||
level s6:c0.c4;
|
||||
|
||||
|
||||
#some constraints
|
||||
mlsconstrain infoflow hi_r ((l1 dom l2) or (t1 == mls_exempt));
|
||||
|
||||
attribute mls_exempt;
|
||||
|
||||
type system;
|
||||
role system;
|
||||
role system types system;
|
||||
|
||||
role role30_r;
|
||||
role role31a_r;
|
||||
role role31b_r;
|
||||
role role31c_r;
|
||||
|
||||
role role30_r types system;
|
||||
role role31a_r types system;
|
||||
role role31b_r types system;
|
||||
role role31c_r types system;
|
||||
|
||||
type type40;
|
||||
type type41a;
|
||||
type type41b;
|
||||
type type41c;
|
||||
role system types { type40 type41a type41b type41c };
|
||||
|
||||
################################################################################
|
||||
# Type enforcement declarations and rules
|
||||
|
||||
allow system system:infoflow3 null;
|
||||
|
||||
################################################################################
|
||||
|
||||
#users
|
||||
user system roles { system role30_r role31a_r role31b_r role31c_r } level s0 range s0 - s6:c0.c4;
|
||||
user user20 roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21a roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21b roles system level s0 range s0 - s2:c0.c4;
|
||||
user user21c roles system level s0 range s0 - s2:c0.c4;
|
||||
|
||||
#normal constraints
|
||||
constrain infoflow hi_w (u1 == u2);
|
||||
|
||||
#isids
|
||||
sid kernel system:system:system:s0
|
||||
sid security system:system:system:s0
|
||||
|
||||
#fs_use
|
||||
fs_use_trans devpts system:object_r:system:s0;
|
||||
fs_use_xattr ext3 system:object_r:system:s0;
|
||||
fs_use_task pipefs system:object_r:system:s0;
|
||||
|
||||
#genfscon
|
||||
genfscon proc / system:object_r:system:s1
|
||||
genfscon proc /sys system:object_r:system:s0
|
||||
genfscon selinuxfs / system:object_r:system:s2:c0.c4
|
||||
|
||||
portcon tcp 80 system:object_r:system:s0
|
||||
|
||||
netifcon eth0 system:object_r:system:s0 system:object_r:system:s0
|
||||
|
||||
# test 1:
|
||||
# subnet_prefix: fe81::
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon fe81:: 1 system:system:system:s0:c0.c1
|
||||
|
||||
# test 10:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: 10, exact
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 0x10c-0x10e system:system:system:s0:c0.c1
|
||||
|
||||
# test 20:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: user20, exact
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 20 user20:system:system:s0:c0.c1
|
||||
|
||||
# test 21:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: user21(a|b), regex
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 0x21a user21a:system:system:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x21b user21b:system:system:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x21c user21c:system:system:s0:c0.c1
|
||||
|
||||
# test 30:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: role30_r, exact
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 30 system:role30_r:system:s0:c0.c1
|
||||
|
||||
# test 31:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: role30(a|c)_r, regex
|
||||
# type: unset
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 0x31a system:role31a_r:system:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x31b system:role31b_r:system:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x31c system:role31c_r:system:s0:c0.c1
|
||||
|
||||
# test 40:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: type40
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 40 system:system:type40:s0:c0.c1
|
||||
|
||||
# test 41:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: type41(b|c)
|
||||
# range: unset
|
||||
ibpkeycon ffff:: 0x41a system:system:type41a:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x41b system:system:type41b:s0:c0.c1
|
||||
ibpkeycon ffff:: 0x41c system:system:type41c:s0:c0.c1
|
||||
|
||||
# test 50:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: equal
|
||||
ibpkeycon ffff:: 50 system:system:system:s0:c1 - s0:c0.c4
|
||||
|
||||
# test 51:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: overlap
|
||||
ibpkeycon ffff:: 51 system:system:system:s1:c1 - s1:c1.c3
|
||||
|
||||
# test 52:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: subset
|
||||
ibpkeycon ffff:: 52 system:system:system:s2:c1 - s2:c1.c3
|
||||
|
||||
# test 53:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: superset
|
||||
ibpkeycon ffff:: 53 system:system:system:s3:c1 - s3:c1.c3
|
||||
|
||||
# test 54:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: proper subset
|
||||
ibpkeycon ffff:: 54 system:system:system:s4:c1 - s4:c1.c3
|
||||
|
||||
# test 55:
|
||||
# subnet_prefix: unset
|
||||
# pkeys: unset
|
||||
# user: unset
|
||||
# role: unset
|
||||
# type: unset
|
||||
# range: proper superset
|
||||
ibpkeycon ffff:: 55 system:system:system:s5:c1 - s5:c1.c3
|
||||
|
||||
279
tests/ibpkeyconquery.py
Normal file
279
tests/ibpkeyconquery.py
Normal file
@ -0,0 +1,279 @@
|
||||
# Copyright 2018, Chris PeBenito <pebenito@ieee.org>
|
||||
#
|
||||
# This file is part of SETools.
|
||||
#
|
||||
# SETools is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation, either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# SETools is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with SETools. If not, see <http://www.gnu.org/licenses/>.
|
||||
#
|
||||
import os
|
||||
import unittest
|
||||
|
||||
from setools import IbpkeyconQuery
|
||||
|
||||
from .policyrep.util import compile_policy
|
||||
|
||||
|
||||
class IbpkeyconQueryTest(unittest.TestCase):
|
||||
|
||||
@classmethod
|
||||
def setUpClass(cls):
|
||||
cls.p = compile_policy("tests/ibpkeyconquery.conf")
|
||||
|
||||
@classmethod
|
||||
def tearDownClass(cls):
|
||||
os.unlink(cls.p.path)
|
||||
|
||||
def test_000_unset(self):
|
||||
"""ibpkeycon query with no criteria"""
|
||||
# query with no parameters gets all ibpkeycons.
|
||||
ibpkeycons = sorted(self.p.ibpkeycons())
|
||||
|
||||
q = IbpkeyconQuery(self.p)
|
||||
q_ibpkeycons = sorted(q.results())
|
||||
|
||||
self.assertListEqual(ibpkeycons, q_ibpkeycons)
|
||||
|
||||
def test_001_subnet_mask(self):
|
||||
"""Ibpkeycon query with subnet mask match."""
|
||||
q = IbpkeyconQuery(self.p, subnet_prefix="fe81::")
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(1, 1)], ibpkeycons)
|
||||
|
||||
def test_010_pkey_exact(self):
|
||||
"""Ibpkeycon query with exact pkey match."""
|
||||
q = IbpkeyconQuery(self.p, pkeys=(0x10c, 0x10e))
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(0x10c, 0x10e)], ibpkeycons)
|
||||
|
||||
def test_020_user_exact(self):
|
||||
"""ibpkeycon query with context user exact match"""
|
||||
q = IbpkeyconQuery(self.p, user="user20", user_regex=False)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(20, 20)], ibpkeycons)
|
||||
|
||||
def test_021_user_regex(self):
|
||||
"""ibpkeycon query with context user regex match"""
|
||||
q = IbpkeyconQuery(self.p, user="user21(a|b)", user_regex=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(0x21a, 0x21a), (0x21b, 0x21b)], ibpkeycons)
|
||||
|
||||
def test_030_role_exact(self):
|
||||
"""ibpkeycon query with context role exact match"""
|
||||
q = IbpkeyconQuery(self.p, role="role30_r", role_regex=False)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(30, 30)], ibpkeycons)
|
||||
|
||||
def test_031_role_regex(self):
|
||||
"""ibpkeycon query with context role regex match"""
|
||||
q = IbpkeyconQuery(self.p, role="role31(a|c)_r", role_regex=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(0x31a, 0x31a), (0x31c, 0x31c)], ibpkeycons)
|
||||
|
||||
def test_040_type_exact(self):
|
||||
"""ibpkeycon query with context type exact match"""
|
||||
q = IbpkeyconQuery(self.p, type_="type40", type_regex=False)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(40, 40)], ibpkeycons)
|
||||
|
||||
def test_041_type_regex(self):
|
||||
"""ibpkeycon query with context type regex match"""
|
||||
q = IbpkeyconQuery(self.p, type_="type41(b|c)", type_regex=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(0x41b, 0x41b), (0x41c, 0x41c)], ibpkeycons)
|
||||
|
||||
def test_050_range_exact(self):
|
||||
"""ibpkeycon query with context range exact match"""
|
||||
q = IbpkeyconQuery(self.p, range_="s0:c1 - s0:c0.c4")
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(50, 50)], ibpkeycons)
|
||||
|
||||
def test_051_range_overlap1(self):
|
||||
"""ibpkeycon query with context range overlap match (equal)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s1:c1 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(51, 51)], ibpkeycons)
|
||||
|
||||
def test_051_range_overlap2(self):
|
||||
"""ibpkeycon query with context range overlap match (subset)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s1:c1,c2 - s1:c0.c3", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(51, 51)], ibpkeycons)
|
||||
|
||||
def test_051_range_overlap3(self):
|
||||
"""ibpkeycon query with context range overlap match (superset)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s1 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(51, 51)], ibpkeycons)
|
||||
|
||||
def test_051_range_overlap4(self):
|
||||
"""ibpkeycon query with context range overlap match (overlap low level)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s1 - s1:c1,c2", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(51, 51)], ibpkeycons)
|
||||
|
||||
def test_051_range_overlap5(self):
|
||||
"""ibpkeycon query with context range overlap match (overlap high level)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s1:c1,c2 - s1:c0.c4", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(51, 51)], ibpkeycons)
|
||||
|
||||
def test_052_range_subset1(self):
|
||||
"""ibpkeycon query with context range subset match"""
|
||||
q = IbpkeyconQuery(self.p, range_="s2:c1,c2 - s2:c0.c3", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(52, 52)], ibpkeycons)
|
||||
|
||||
def test_052_range_subset2(self):
|
||||
"""ibpkeycon query with context range subset match (equal)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s2:c1 - s2:c1.c3", range_overlap=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(52, 52)], ibpkeycons)
|
||||
|
||||
def test_053_range_superset1(self):
|
||||
"""ibpkeycon query with context range superset match"""
|
||||
q = IbpkeyconQuery(self.p, range_="s3 - s3:c0.c4", range_superset=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(53, 53)], ibpkeycons)
|
||||
|
||||
def test_053_range_superset2(self):
|
||||
"""ibpkeycon query with context range superset match (equal)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s3:c1 - s3:c1.c3", range_superset=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(53, 53)], ibpkeycons)
|
||||
|
||||
def test_054_range_proper_subset1(self):
|
||||
"""ibpkeycon query with context range proper subset match"""
|
||||
q = IbpkeyconQuery(self.p, range_="s4:c1,c2", range_subset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(54, 54)], ibpkeycons)
|
||||
|
||||
def test_054_range_proper_subset2(self):
|
||||
"""ibpkeycon query with context range proper subset match (equal)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s4:c1 - s4:c1.c3", range_subset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([], ibpkeycons)
|
||||
|
||||
def test_054_range_proper_subset3(self):
|
||||
"""ibpkeycon query with context range proper subset match (equal low only)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s4:c1 - s4:c1.c2", range_subset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(54, 54)], ibpkeycons)
|
||||
|
||||
def test_054_range_proper_subset4(self):
|
||||
"""ibpkeycon query with context range proper subset match (equal high only)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s4:c1,c2 - s4:c1.c3", range_subset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(54, 54)], ibpkeycons)
|
||||
|
||||
def test_055_range_proper_superset1(self):
|
||||
"""ibpkeycon query with context range proper superset match"""
|
||||
q = IbpkeyconQuery(self.p, range_="s5 - s5:c0.c4", range_superset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(55, 55)], ibpkeycons)
|
||||
|
||||
def test_055_range_proper_superset2(self):
|
||||
"""ibpkeycon query with context range proper superset match (equal)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s5:c1 - s5:c1.c3", range_superset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([], ibpkeycons)
|
||||
|
||||
def test_055_range_proper_superset3(self):
|
||||
"""ibpkeycon query with context range proper superset match (equal low)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s5:c1 - s5:c1.c4", range_superset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(55, 55)], ibpkeycons)
|
||||
|
||||
def test_055_range_proper_superset4(self):
|
||||
"""ibpkeycon query with context range proper superset match (equal high)"""
|
||||
q = IbpkeyconQuery(self.p, range_="s5 - s5:c1.c3", range_superset=True, range_proper=True)
|
||||
|
||||
ibpkeycons = sorted(n.pkeys for n in q.results())
|
||||
self.assertListEqual([(55, 55)], ibpkeycons)
|
||||
|
||||
def test_900_invalid_subnet_prefix(self):
|
||||
"""Ibpkeycon query with invalid subnet prefix"""
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, subnet_prefix="INVALID")
|
||||
|
||||
def test_910_invalid_pkey_negative(self):
|
||||
"""Ibpkeycon query with negative pkey"""
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(-1, -1))
|
||||
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(1, -1))
|
||||
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(-1, 1))
|
||||
|
||||
def test_911_invalid_pkey_zero(self):
|
||||
"""Ibpkeycon query with 0 pkey"""
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(0, 0))
|
||||
|
||||
def test_912_invalid_pkey_over_max(self):
|
||||
"""Ibpkeycon query with pkey over maximum value"""
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(1, 0xfffff))
|
||||
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(0xfffff, 1))
|
||||
|
||||
with self.assertRaises(ValueError):
|
||||
IbpkeyconQuery(self.p, pkeys=(0xfffff, 0xfffff))
|
||||
|
||||
def test_913_invalid_pkey_not_a_number(self):
|
||||
"""Ibpkeycon query with pkey is not a number"""
|
||||
with self.assertRaises(TypeError):
|
||||
IbpkeyconQuery(self.p, pkeys=(1, "INVALID"))
|
||||
|
||||
with self.assertRaises(TypeError):
|
||||
IbpkeyconQuery(self.p, pkeys=("INVALID", 2))
|
||||
|
||||
def test_914_invalid_pkey_not_tuple(self):
|
||||
"""Ibpkeycon query with pkey is not a tuple"""
|
||||
with self.assertRaises(TypeError):
|
||||
IbpkeyconQuery(self.p, pkeys=1)
|
||||
|
||||
def test_915_invalid_pkey_wrong_tuple_length(self):
|
||||
"""Ibpkeycon query with pkey is not correct tuple size"""
|
||||
with self.assertRaises(TypeError):
|
||||
IbpkeyconQuery(self.p, pkeys=(1,))
|
||||
|
||||
with self.assertRaises(TypeError):
|
||||
IbpkeyconQuery(self.p, pkeys=(1, 2, 3))
|
||||
Loading…
Reference in New Issue
Block a user