|
| 1 | +import pytest |
| 2 | +from mock import Mock, patch, call, ANY |
| 3 | +import socket |
| 4 | + |
| 5 | +from sshuttle.methods import get_method |
| 6 | + |
| 7 | + |
| 8 | +def test_get_supported_features(): |
| 9 | + method = get_method('pf') |
| 10 | + features = method.get_supported_features() |
| 11 | + assert not features.ipv6 |
| 12 | + assert not features.udp |
| 13 | + |
| 14 | + |
| 15 | +def test_get_tcp_dstip(): |
| 16 | + sock = Mock() |
| 17 | + sock.getpeername.return_value = ("127.0.0.1", 1024) |
| 18 | + sock.getsockname.return_value = ("127.0.0.2", 1025) |
| 19 | + sock.family = socket.AF_INET |
| 20 | + |
| 21 | + firewall = Mock() |
| 22 | + firewall.pfile.readline.return_value = \ |
| 23 | + "QUERY_PF_NAT_SUCCESS 127.0.0.3,1026\n" |
| 24 | + |
| 25 | + method = get_method('pf') |
| 26 | + method.set_firewall(firewall) |
| 27 | + assert method.get_tcp_dstip(sock) == ('127.0.0.3', 1026) |
| 28 | + |
| 29 | + assert sock.mock_calls == [ |
| 30 | + call.getpeername(), |
| 31 | + call.getsockname(), |
| 32 | + ] |
| 33 | + assert firewall.mock_calls == [ |
| 34 | + call.pfile.write('QUERY_PF_NAT 2,6,127.0.0.1,1024,127.0.0.2,1025\n'), |
| 35 | + call.pfile.flush(), |
| 36 | + call.pfile.readline() |
| 37 | + ] |
| 38 | + |
| 39 | + |
| 40 | +def test_recv_udp(): |
| 41 | + sock = Mock() |
| 42 | + sock.recvfrom.return_value = "11111", "127.0.0.1" |
| 43 | + method = get_method('pf') |
| 44 | + result = method.recv_udp(sock, 1024) |
| 45 | + assert sock.mock_calls == [call.recvfrom(1024)] |
| 46 | + assert result == ("127.0.0.1", None, "11111") |
| 47 | + |
| 48 | + |
| 49 | +def test_send_udp(): |
| 50 | + sock = Mock() |
| 51 | + method = get_method('pf') |
| 52 | + method.send_udp(sock, None, "127.0.0.1", "22222") |
| 53 | + assert sock.mock_calls == [call.sendto("22222", "127.0.0.1")] |
| 54 | + |
| 55 | + |
| 56 | +def test_setup_tcp_listener(): |
| 57 | + listener = Mock() |
| 58 | + method = get_method('pf') |
| 59 | + method.setup_tcp_listener(listener) |
| 60 | + assert listener.mock_calls == [] |
| 61 | + |
| 62 | + |
| 63 | +def test_setup_udp_listener(): |
| 64 | + listener = Mock() |
| 65 | + method = get_method('pf') |
| 66 | + method.setup_udp_listener(listener) |
| 67 | + assert listener.mock_calls == [] |
| 68 | + |
| 69 | + |
| 70 | +def test_check_settings(): |
| 71 | + method = get_method('pf') |
| 72 | + method.check_settings(True, True) |
| 73 | + method.check_settings(False, True) |
| 74 | + |
| 75 | + |
| 76 | +@patch('sshuttle.methods.pf.sys.stdout') |
| 77 | +@patch('sshuttle.methods.pf.ioctl') |
| 78 | +@patch('sshuttle.methods.pf.pf_get_dev') |
| 79 | +def test_firewall_command(mock_pf_get_dev, mock_ioctl, mock_stdout): |
| 80 | + method = get_method('pf') |
| 81 | + assert not method.firewall_command("somthing") |
| 82 | + |
| 83 | + command = "QUERY_PF_NAT %d,%d,%s,%d,%s,%d\n" % ( |
| 84 | + socket.AF_INET, socket.IPPROTO_TCP, |
| 85 | + "127.0.0.1", 1025, "127.0.0.2", 1024) |
| 86 | + assert method.firewall_command(command) |
| 87 | + |
| 88 | + assert mock_pf_get_dev.mock_calls == [call()] |
| 89 | + assert mock_ioctl.mock_calls == [ |
| 90 | + call(mock_pf_get_dev(), 3226747927, ANY), |
| 91 | + ] |
| 92 | + assert mock_stdout.mock_calls == [ |
| 93 | + call.write('QUERY_PF_NAT_SUCCESS 0.0.0.0,0\n'), |
| 94 | + call.flush(), |
| 95 | + ] |
| 96 | + |
| 97 | + |
| 98 | +# FIXME - test fails with platform=='darwin' due re.search not liking Mock |
| 99 | +# objects. |
| 100 | +@patch('sshuttle.methods.pf.sys.platform', 'not_darwin') |
| 101 | +@patch('sshuttle.methods.pf.pfctl') |
| 102 | +@patch('sshuttle.methods.pf.ioctl') |
| 103 | +@patch('sshuttle.methods.pf.pf_get_dev') |
| 104 | +def test_setup_firewall(mock_pf_get_dev, mock_ioctl, mock_pfctl): |
| 105 | + method = get_method('pf') |
| 106 | + assert method.name == 'pf' |
| 107 | + |
| 108 | + with pytest.raises(Exception) as excinfo: |
| 109 | + method.setup_firewall( |
| 110 | + 1024, 1026, |
| 111 | + [(10, u'2404:6800:4004:80c::33')], |
| 112 | + 10, |
| 113 | + [(10, 64, False, u'2404:6800:4004:80c::'), |
| 114 | + (10, 128, True, u'2404:6800:4004:80c::101f')], |
| 115 | + True) |
| 116 | + assert str(excinfo.value) \ |
| 117 | + == 'Address family "AF_INET6" unsupported by pf method_name' |
| 118 | + assert mock_pf_get_dev.mock_calls == [] |
| 119 | + assert mock_ioctl.mock_calls == [] |
| 120 | + assert mock_pfctl.mock_calls == [] |
| 121 | + |
| 122 | + with pytest.raises(Exception) as excinfo: |
| 123 | + method.setup_firewall( |
| 124 | + 1025, 1027, |
| 125 | + [(2, u'1.2.3.33')], |
| 126 | + 2, |
| 127 | + [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')], |
| 128 | + True) |
| 129 | + assert str(excinfo.value) == 'UDP not supported by pf method_name' |
| 130 | + assert mock_pf_get_dev.mock_calls == [] |
| 131 | + assert mock_ioctl.mock_calls == [] |
| 132 | + assert mock_pfctl.mock_calls == [] |
| 133 | + |
| 134 | + method.setup_firewall( |
| 135 | + 1025, 1027, |
| 136 | + [(2, u'1.2.3.33')], |
| 137 | + 2, |
| 138 | + [(2, 24, False, u'1.2.3.0'), (2, 32, True, u'1.2.3.66')], |
| 139 | + False) |
| 140 | + assert mock_ioctl.mock_calls == [ |
| 141 | + call(mock_pf_get_dev(), 3295691827, ANY), |
| 142 | + call(mock_pf_get_dev(), 3424666650, ANY), |
| 143 | + call(mock_pf_get_dev(), 3424666650, ANY), |
| 144 | + call(mock_pf_get_dev(), 3295691827, ANY), |
| 145 | + call(mock_pf_get_dev(), 3424666650, ANY), |
| 146 | + call(mock_pf_get_dev(), 3424666650, ANY), |
| 147 | + ] |
| 148 | + # FIXME - needs more work |
| 149 | + # print(mock_pfctl.mock_calls) |
| 150 | + # assert mock_pfctl.mock_calls == [] |
| 151 | + mock_pf_get_dev.reset_mock() |
| 152 | + mock_ioctl.reset_mock() |
| 153 | + mock_pfctl.reset_mock() |
| 154 | + |
| 155 | + method.setup_firewall(1025, 0, [], 2, [], False) |
| 156 | + assert mock_ioctl.mock_calls == [] |
| 157 | + assert mock_pfctl.mock_calls == [call('-a sshuttle -F all')] |
| 158 | + mock_pf_get_dev.reset_mock() |
| 159 | + mock_pfctl.reset_mock() |
| 160 | + mock_ioctl.reset_mock() |
0 commit comments