Skip to content

Commit 5d111bf

Browse files
vepatelvepatel
committed
separate out readonly and non-readonly tests
1 parent ae6d8a3 commit 5d111bf

File tree

2 files changed

+163
-12
lines changed

2 files changed

+163
-12
lines changed

‎tests/suite/test_app_protect_wafv5_integration.py‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,6 @@ def waf_setup(kube_apis, test_namespace) -> None:
2323
@pytest.mark.parametrize(
2424
"crd_ingress_controller_with_waf_v5, virtual_server_setup",
2525
[
26-
(
27-
{
28-
"type": "rorfs",
29-
"extra_args": [
30-
f"-enable-app-protect",
31-
],
32-
},
33-
{
34-
"example": "ap-waf-v5",
35-
"app_type": "simple",
36-
},
37-
),
3826
(
3927
{
4028
"type": "complete",

‎tests/suite/test_app_protect_wafv5_integration_rorfs.py‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
import pytest
2+
import requests
3+
from settings import TEST_DATA
4+
from suite.utils.policy_resources_utils import create_policy_from_yaml, delete_policy
5+
from suite.utils.resources_utils import wait_before_test
6+
from suite.utils.vs_vsr_resources_utils import (
7+
create_virtual_server_from_yaml,
8+
delete_virtual_server,
9+
patch_v_s_route_from_yaml,
10+
patch_virtual_server_from_yaml,
11+
)
12+
13+
14+
@pytest.fixture(scope="class")
15+
def waf_setup(kube_apis, test_namespace) -> None:
16+
waf = f"{TEST_DATA}/ap-waf-v5/policies/waf.yaml"
17+
create_policy_from_yaml(kube_apis.custom_objects, waf, test_namespace)
18+
wait_before_test()
19+
20+
21+
@pytest.mark.skip_for_nginx_oss
22+
@pytest.mark.appprotect_waf_v5
23+
@pytest.mark.parametrize(
24+
"crd_ingress_controller_with_waf_v5, virtual_server_setup",
25+
[
26+
(
27+
{
28+
"type": "rorfs",
29+
"extra_args": [
30+
f"-enable-app-protect",
31+
],
32+
},
33+
{
34+
"example": "ap-waf-v5",
35+
"app_type": "simple",
36+
},
37+
),
38+
],
39+
indirect=True,
40+
)
41+
class TestAppProtectWAFv5IntegrationVSrorfs:
42+
def restore_default_vs(self, kube_apis, virtual_server_setup) -> None:
43+
"""
44+
Restore VirtualServer without policy spec
45+
"""
46+
std_vs_src = f"{TEST_DATA}/ap-waf-v5/standard/virtual-server.yaml"
47+
delete_virtual_server(kube_apis.custom_objects, virtual_server_setup.vs_name, virtual_server_setup.namespace)
48+
create_virtual_server_from_yaml(kube_apis.custom_objects, std_vs_src, virtual_server_setup.namespace)
49+
wait_before_test()
50+
51+
@pytest.mark.parametrize(
52+
"vs_src",
53+
[f"{TEST_DATA}/ap-waf-v5/virtual-server-waf-spec.yaml", f"{TEST_DATA}/ap-waf-v5/virtual-server-waf-route.yaml"],
54+
)
55+
def test_ap_waf_v5_policy_block_vs(
56+
self,
57+
kube_apis,
58+
ingress_controller_prerequisites,
59+
crd_ingress_controller_with_waf_v5,
60+
test_namespace,
61+
virtual_server_setup,
62+
waf_setup,
63+
vs_src,
64+
):
65+
patch_virtual_server_from_yaml(
66+
kube_apis.custom_objects,
67+
virtual_server_setup.vs_name,
68+
vs_src,
69+
virtual_server_setup.namespace,
70+
)
71+
72+
print("----------------------- Send request with embedded malicious script----------------------")
73+
count = 0
74+
response = requests.get(
75+
virtual_server_setup.backend_1_url + "</script>",
76+
headers={"host": virtual_server_setup.vs_host},
77+
)
78+
while count < 5 and "Request Rejected" not in response.text:
79+
response = requests.get(
80+
virtual_server_setup.backend_1_url + "</script>",
81+
headers={"host": virtual_server_setup.vs_host},
82+
)
83+
wait_before_test()
84+
count += 1
85+
self.restore_default_vs(kube_apis, virtual_server_setup)
86+
assert response.status_code == 200
87+
assert "The requested URL was rejected. Please consult with your administrator." in response.text
88+
89+
90+
@pytest.mark.skip_for_nginx_oss
91+
@pytest.mark.appprotect_waf_v5
92+
@pytest.mark.parametrize(
93+
"crd_ingress_controller_with_waf_v5, v_s_route_setup",
94+
[
95+
(
96+
{
97+
"type": "rorfs",
98+
"extra_args": [
99+
f"-enable-app-protect",
100+
],
101+
},
102+
{
103+
"example": "virtual-server-route",
104+
},
105+
)
106+
],
107+
indirect=True,
108+
)
109+
class TestAppProtectWAFv5IntegrationVSRrorfs:
110+
111+
def restore_default_vsr(self, kube_apis, v_s_route_setup) -> None:
112+
"""
113+
Function to revert vsr deployments to standard state
114+
"""
115+
patch_src_m = f"{TEST_DATA}/virtual-server-route/route-multiple.yaml"
116+
patch_v_s_route_from_yaml(
117+
kube_apis.custom_objects,
118+
v_s_route_setup.route_m.name,
119+
patch_src_m,
120+
v_s_route_setup.route_m.namespace,
121+
)
122+
wait_before_test()
123+
124+
def test_ap_waf_v5_policy_block_vsr(
125+
self,
126+
kube_apis,
127+
ingress_controller_prerequisites,
128+
crd_ingress_controller_with_waf_v5,
129+
test_namespace,
130+
v_s_route_setup,
131+
):
132+
req_url = f"http://{v_s_route_setup.public_endpoint.public_ip}:{v_s_route_setup.public_endpoint.port}"
133+
waf_subroute_vsr_src = f"{TEST_DATA}/ap-waf-v5/virtual-server-route-waf-subroute.yaml"
134+
pol = create_policy_from_yaml(
135+
kube_apis.custom_objects,
136+
f"{TEST_DATA}/ap-waf-v5/policies/waf.yaml",
137+
v_s_route_setup.route_m.namespace,
138+
)
139+
wait_before_test()
140+
patch_v_s_route_from_yaml(
141+
kube_apis.custom_objects,
142+
v_s_route_setup.route_m.name,
143+
waf_subroute_vsr_src,
144+
v_s_route_setup.route_m.namespace,
145+
)
146+
wait_before_test()
147+
print("----------------------- Send request with embedded malicious script----------------------")
148+
count = 0
149+
response = requests.get(
150+
f'{req_url}{v_s_route_setup.route_m.paths[0]}+"</script>"',
151+
headers={"host": v_s_route_setup.vs_host},
152+
)
153+
while count < 5 and "Request Rejected" not in response.text:
154+
response = requests.get(
155+
f'{req_url}{v_s_route_setup.route_m.paths[0]}+"</script>"',
156+
headers={"host": v_s_route_setup.vs_host},
157+
)
158+
wait_before_test()
159+
count += 1
160+
self.restore_default_vsr(kube_apis, v_s_route_setup)
161+
delete_policy(kube_apis.custom_objects, pol, v_s_route_setup.route_m.namespace)
162+
assert response.status_code == 200
163+
assert "The requested URL was rejected. Please consult with your administrator." in response.text

0 commit comments

Comments
 (0)