greenbone /
ospd
| Total Complexity | 56 |
| Total Lines | 653 |
| Duplicated Lines | 5.67 % |
| Changes | 0 | ||
Duplicate code is one of the most pungent code smells. A rule that is often used is to re-structure code once it is duplicated in three or more places.
Common duplication problems, and corresponding solutions are:
Complex classes like tests.testScanAndResult often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
| 1 | # Copyright (C) 2015-2018 Greenbone Networks GmbH |
||
|
|
|||
| 2 | # |
||
| 3 | # SPDX-License-Identifier: GPL-2.0-or-later |
||
| 4 | # |
||
| 5 | # This program is free software; you can redistribute it and/or |
||
| 6 | # modify it under the terms of the GNU General Public License |
||
| 7 | # as published by the Free Software Foundation; either version 2 |
||
| 8 | # of the License, or (at your option) any later version. |
||
| 9 | # |
||
| 10 | # This program is distributed in the hope that it will be useful, |
||
| 11 | # but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 13 | # GNU General Public License for more details. |
||
| 14 | # |
||
| 15 | # You should have received a copy of the GNU General Public License |
||
| 16 | # along with this program; if not, write to the Free Software |
||
| 17 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
||
| 18 | |||
| 19 | """ Test module for scan runs |
||
| 20 | """ |
||
| 21 | |||
| 22 | from __future__ import print_function |
||
| 23 | |||
| 24 | import time |
||
| 25 | import unittest |
||
| 26 | import xml.etree.ElementTree as ET |
||
| 27 | import defusedxml.lxml as secET |
||
| 28 | from defusedxml.common import EntitiesForbidden |
||
| 29 | |||
| 30 | from ospd.ospd import OSPDaemon, OSPDError |
||
| 31 | |||
| 32 | class Result(object): |
||
| 33 | def __init__(self, type_, **kwargs): |
||
| 34 | self.result_type = type_ |
||
| 35 | self.host = '' |
||
| 36 | self.name = '' |
||
| 37 | self.value = '' |
||
| 38 | self.port = '' |
||
| 39 | self.test_id = '' |
||
| 40 | self.severity = '' |
||
| 41 | self.qod = '' |
||
| 42 | for name, value in kwargs.items(): |
||
| 43 | setattr(self, name, value) |
||
| 44 | |||
| 45 | |||
| 46 | class DummyWrapper(OSPDaemon): |
||
| 47 | def __init__(self, results, checkresult=True): |
||
| 48 | OSPDaemon.__init__(self, 'cert', 'key', 'ca') |
||
| 49 | self.checkresult = checkresult |
||
| 50 | self.results = results |
||
| 51 | |||
| 52 | def check(self): |
||
| 53 | return self.checkresults |
||
| 54 | |||
| 55 | @staticmethod |
||
| 56 | def get_custom_vt_as_xml_str(vt_id, custom): |
||
| 57 | return '<mytest>static test</mytest>' |
||
| 58 | |||
| 59 | @staticmethod |
||
| 60 | def get_params_vt_as_xml_str(vt_id, vt_params): |
||
| 61 | return ('<vt_param id="abc" type="string">' |
||
| 62 | '<name>ABC</name><description>Test ABC</description><default>yes</default>' |
||
| 63 | '</vt_param>' |
||
| 64 | '<vt_param id="def" type="string">' |
||
| 65 | '<name>DEF</name><description>Test DEF</description><default>no</default>' |
||
| 66 | '</vt_param>') |
||
| 67 | |||
| 68 | @staticmethod |
||
| 69 | def get_refs_vt_as_xml_str(vt_id, vt_refs): |
||
| 70 | response = ('<ref type="cve" id="CVE-2010-4480"/>' + |
||
| 71 | '<ref type="url" id="http://example.com"/>') |
||
| 72 | return response |
||
| 73 | |||
| 74 | @staticmethod |
||
| 75 | def get_dependencies_vt_as_xml_str(vt_id, vt_dependencies): |
||
| 76 | response = ('<dependency vt_id="1.3.6.1.4.1.25623.1.0.50282" />' + |
||
| 77 | '<dependency vt_id="1.3.6.1.4.1.25623.1.0.50283" />') |
||
| 78 | |||
| 79 | return response |
||
| 80 | |||
| 81 | @staticmethod |
||
| 82 | def get_severities_vt_as_xml_str(vt_id, severities): |
||
| 83 | response = ('<severity cvss_base="5.0" cvss_type="cvss_base_v2">' + |
||
| 84 | 'AV:N/AC:L/Au:N/C:N/I:N/A:P</severity>') |
||
| 85 | |||
| 86 | return response |
||
| 87 | |||
| 88 | @staticmethod |
||
| 89 | def get_detection_vt_as_xml_str(vt_id, detection=None, |
||
| 90 | qod_type=None, qod=None): |
||
| 91 | response = ('<detection qod_type="package">some detection</detection>') |
||
| 92 | |||
| 93 | return response |
||
| 94 | |||
| 95 | @staticmethod |
||
| 96 | def get_summary_vt_as_xml_str(vt_id, summary): |
||
| 97 | response = ('<summary>Some summary</summary>') |
||
| 98 | |||
| 99 | return response |
||
| 100 | |||
| 101 | @staticmethod |
||
| 102 | def get_affected_vt_as_xml_str(vt_id, affected): |
||
| 103 | response = ('<affected>Some affected</affected>') |
||
| 104 | |||
| 105 | return response |
||
| 106 | |||
| 107 | @staticmethod |
||
| 108 | def get_impact_vt_as_xml_str(vt_id, impact): |
||
| 109 | response = ('<impact>Some impact</impact>') |
||
| 110 | |||
| 111 | return response |
||
| 112 | |||
| 113 | @staticmethod |
||
| 114 | def get_insight_vt_as_xml_str(vt_id, insight): |
||
| 115 | response = ('<insight>Some insight</insight>') |
||
| 116 | |||
| 117 | return response |
||
| 118 | |||
| 119 | @staticmethod |
||
| 120 | def get_solution_vt_as_xml_str(vt_id, solution, solution_type=None): |
||
| 121 | response = ('<solution>Some solution</solution>') |
||
| 122 | |||
| 123 | return response |
||
| 124 | |||
| 125 | def exec_scan(self, scan_id, target): |
||
| 126 | time.sleep(0.01) |
||
| 127 | for res in self.results: |
||
| 128 | if res.result_type == 'log': |
||
| 129 | self.add_scan_log(scan_id, res.host or target, res.name, res.value, res.port) |
||
| 130 | if res.result_type == 'error': |
||
| 131 | self.add_scan_error(scan_id, res.host or target, res.name, res.value, res.port) |
||
| 132 | elif res.result_type == 'host-detail': |
||
| 133 | self.add_scan_host_detail(scan_id, res.host or target, res.name, res.value) |
||
| 134 | elif res.result_type == 'alarm': |
||
| 135 | self.add_scan_alarm(scan_id, res.host or target, res.name, res.value, res.port, res.test_id, res.severity, res.qod) |
||
| 136 | else: |
||
| 137 | raise ValueError(res.result_type) |
||
| 138 | |||
| 139 | |||
| 140 | class FullTest(unittest.TestCase): |
||
| 141 | # TODO: There should be a lot more assert in there ! |
||
| 142 | |||
| 143 | def testGetDefaultScannerParams(self): |
||
| 144 | daemon = DummyWrapper([]) |
||
| 145 | response = secET.fromstring(daemon.handle_command('<get_scanner_details />')) |
||
| 146 | # The status of the response must be success (i.e. 200) |
||
| 147 | self.assertEqual(response.get('status'), '200') |
||
| 148 | # The response root element must have the correct name |
||
| 149 | self.assertEqual(response.tag, 'get_scanner_details_response') |
||
| 150 | # The response must contain a 'scanner_params' element |
||
| 151 | self.assertIsNotNone(response.find('scanner_params')) |
||
| 152 | |||
| 153 | def testGetDefaultHelp(self): |
||
| 154 | daemon = DummyWrapper([]) |
||
| 155 | response = secET.fromstring(daemon.handle_command('<help />')) |
||
| 156 | self.assertEqual(response.get('status'), '200') |
||
| 157 | response = secET.fromstring(daemon.handle_command('<help format="xml" />')) |
||
| 158 | self.assertEqual(response.get('status'), '200') |
||
| 159 | self.assertEqual(response.tag, 'help_response') |
||
| 160 | |||
| 161 | def testGetDefaultScannerVersion(self): |
||
| 162 | daemon = DummyWrapper([]) |
||
| 163 | response = secET.fromstring(daemon.handle_command('<get_version />')) |
||
| 164 | self.assertEqual(response.get('status'), '200') |
||
| 165 | self.assertIsNotNone(response.find('protocol')) |
||
| 166 | |||
| 167 | def testGetVTs_no_VT(self): |
||
| 168 | daemon = DummyWrapper([]) |
||
| 169 | response = secET.fromstring(daemon.handle_command('<get_vts />')) |
||
| 170 | self.assertEqual(response.get('status'), '200') |
||
| 171 | self.assertIsNotNone(response.find('vts')) |
||
| 172 | |||
| 173 | def testGetVTs_single_VT(self): |
||
| 174 | daemon = DummyWrapper([]) |
||
| 175 | daemon.add_vt('1.2.3.4', 'A vulnerability test') |
||
| 176 | response = secET.fromstring(daemon.handle_command('<get_vts />')) |
||
| 177 | self.assertEqual(response.get('status'), '200') |
||
| 178 | vts = response.find('vts') |
||
| 179 | self.assertIsNotNone(vts.find('vt')) |
||
| 180 | vt = vts.find('vt') |
||
| 181 | self.assertEqual(vt.get('id'), '1.2.3.4') |
||
| 182 | |||
| 183 | def testGetVTs_multiple_VTs(self): |
||
| 184 | daemon = DummyWrapper([]) |
||
| 185 | daemon.add_vt('1.2.3.4', 'A vulnerability test') |
||
| 186 | daemon.add_vt('some id', 'Another vulnerability test') |
||
| 187 | daemon.add_vt('123456789', 'Yet another vulnerability test') |
||
| 188 | response = secET.fromstring(daemon.handle_command('<get_vts />')) |
||
| 189 | self.assertEqual(response.get('status'), '200') |
||
| 190 | vts = response.find('vts') |
||
| 191 | self.assertIsNotNone(vts.find('vt')) |
||
| 192 | |||
| 193 | def testGetVTs_multiple_VTs_with_custom(self): |
||
| 194 | daemon = DummyWrapper([]) |
||
| 195 | daemon.add_vt('1.2.3.4', 'A vulnerability test') |
||
| 196 | daemon.add_vt('some id', 'Another vulnerability test with custom info', {'depencency': '1.2.3.4'}) |
||
| 197 | daemon.add_vt('123456789', 'Yet another vulnerability test') |
||
| 198 | response = secET.fromstring(daemon.handle_command('<get_vts />')) |
||
| 199 | |||
| 200 | View Code Duplication | def testGetVTs_VTs_with_params(self): |
|
| 201 | daemon = DummyWrapper([]) |
||
| 202 | daemon.add_vt('1.2.3.4', 'A vulnerability test', vt_params="a", custom="b") |
||
| 203 | response = secET.fromstring(daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 204 | # The status of the response must be success (i.e. 200) |
||
| 205 | self.assertEqual(response.get('status'), '200') |
||
| 206 | # The response root element must have the correct name |
||
| 207 | self.assertEqual(response.tag, 'get_vts_response') |
||
| 208 | # The response must contain a 'scanner_params' element |
||
| 209 | self.assertIsNotNone(response.find('vts')) |
||
| 210 | vt_params = response[0][0].findall('vt_params') |
||
| 211 | self.assertEqual(1, len(vt_params)) |
||
| 212 | custom = response[0][0].findall('custom') |
||
| 213 | self.assertEqual(1, len(custom)) |
||
| 214 | params = response.findall('vts/vt/vt_params/vt_param') |
||
| 215 | self.assertEqual(2, len(params)) |
||
| 216 | |||
| 217 | View Code Duplication | def testGetVTs_VTs_with_refs(self): |
|
| 218 | daemon = DummyWrapper([]) |
||
| 219 | daemon.add_vt('1.2.3.4', |
||
| 220 | 'A vulnerability test', |
||
| 221 | vt_params="a", |
||
| 222 | custom="b", |
||
| 223 | vt_refs="c") |
||
| 224 | response = secET.fromstring( |
||
| 225 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 226 | # The status of the response must be success (i.e. 200) |
||
| 227 | self.assertEqual(response.get('status'), '200') |
||
| 228 | # The response root element must have the correct name |
||
| 229 | self.assertEqual(response.tag, 'get_vts_response') |
||
| 230 | # The response must contain a 'vts' element |
||
| 231 | self.assertIsNotNone(response.find('vts')) |
||
| 232 | vt_params = response[0][0].findall('vt_params') |
||
| 233 | self.assertEqual(1, len(vt_params)) |
||
| 234 | custom = response[0][0].findall('custom') |
||
| 235 | self.assertEqual(1, len(custom)) |
||
| 236 | refs = response.findall('vts/vt/vt_refs/ref') |
||
| 237 | self.assertEqual(2, len(refs)) |
||
| 238 | |||
| 239 | def testGetVTs_VTs_with_dependencies(self): |
||
| 240 | daemon = DummyWrapper([]) |
||
| 241 | daemon.add_vt('1.2.3.4', |
||
| 242 | 'A vulnerability test', |
||
| 243 | vt_params="a", |
||
| 244 | custom="b", |
||
| 245 | vt_dependencies="c",) |
||
| 246 | response = secET.fromstring( |
||
| 247 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 248 | deps = response.findall('vts/vt/dependencies/dependency') |
||
| 249 | self.assertEqual(2, len(deps)) |
||
| 250 | |||
| 251 | def testGetVTs_VTs_with_severities(self): |
||
| 252 | daemon = DummyWrapper([]) |
||
| 253 | daemon.add_vt('1.2.3.4', |
||
| 254 | 'A vulnerability test', |
||
| 255 | vt_params="a", |
||
| 256 | custom="b", |
||
| 257 | severities="c",) |
||
| 258 | response = secET.fromstring( |
||
| 259 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 260 | severity = response.findall('vts/vt/severities/severity') |
||
| 261 | self.assertEqual(1, len(severity)) |
||
| 262 | |||
| 263 | def testGetVTs_VTs_with_detection_qodt(self): |
||
| 264 | daemon = DummyWrapper([]) |
||
| 265 | daemon.add_vt('1.2.3.4', |
||
| 266 | 'A vulnerability test', |
||
| 267 | vt_params="a", |
||
| 268 | custom="b", |
||
| 269 | detection="c", |
||
| 270 | qod_t="d") |
||
| 271 | response = secET.fromstring( |
||
| 272 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 273 | detection = response.findall('vts/vt/detection') |
||
| 274 | self.assertEqual(1, len(detection)) |
||
| 275 | |||
| 276 | def testGetVTs_VTs_with_detection_qodv(self): |
||
| 277 | daemon = DummyWrapper([]) |
||
| 278 | daemon.add_vt('1.2.3.4', |
||
| 279 | 'A vulnerability test', |
||
| 280 | vt_params="a", |
||
| 281 | custom="b", |
||
| 282 | detection="c", |
||
| 283 | qod_v="d") |
||
| 284 | response = secET.fromstring( |
||
| 285 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 286 | detection = response.findall('vts/vt/detection') |
||
| 287 | self.assertEqual(1, len(detection)) |
||
| 288 | |||
| 289 | def testGetVTs_VTs_with_summary(self): |
||
| 290 | daemon = DummyWrapper([]) |
||
| 291 | daemon.add_vt('1.2.3.4', |
||
| 292 | 'A vulnerability test', |
||
| 293 | vt_params="a", |
||
| 294 | custom="b", |
||
| 295 | summary="c",) |
||
| 296 | response = secET.fromstring( |
||
| 297 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 298 | summary = response.findall('vts/vt/summary') |
||
| 299 | self.assertEqual(1, len(summary)) |
||
| 300 | |||
| 301 | def testGetVTs_VTs_with_impact(self): |
||
| 302 | daemon = DummyWrapper([]) |
||
| 303 | daemon.add_vt('1.2.3.4', |
||
| 304 | 'A vulnerability test', |
||
| 305 | vt_params="a", |
||
| 306 | custom="b", |
||
| 307 | impact="c",) |
||
| 308 | response = secET.fromstring( |
||
| 309 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 310 | impact = response.findall('vts/vt/impact') |
||
| 311 | self.assertEqual(1, len(impact)) |
||
| 312 | |||
| 313 | def testGetVTs_VTs_with_affected(self): |
||
| 314 | daemon = DummyWrapper([]) |
||
| 315 | daemon.add_vt('1.2.3.4', |
||
| 316 | 'A vulnerability test', |
||
| 317 | vt_params="a", |
||
| 318 | custom="b", |
||
| 319 | affected="c",) |
||
| 320 | response = secET.fromstring( |
||
| 321 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 322 | affect = response.findall('vts/vt/affected') |
||
| 323 | self.assertEqual(1, len(affect)) |
||
| 324 | |||
| 325 | def testGetVTs_VTs_with_insight(self): |
||
| 326 | daemon = DummyWrapper([]) |
||
| 327 | daemon.add_vt('1.2.3.4', |
||
| 328 | 'A vulnerability test', |
||
| 329 | vt_params="a", |
||
| 330 | custom="b", |
||
| 331 | insight="c",) |
||
| 332 | response = secET.fromstring( |
||
| 333 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 334 | insight = response.findall('vts/vt/insight') |
||
| 335 | self.assertEqual(1, len(insight)) |
||
| 336 | |||
| 337 | def testGetVTs_VTs_with_solution(self): |
||
| 338 | daemon = DummyWrapper([]) |
||
| 339 | daemon.add_vt('1.2.3.4', |
||
| 340 | 'A vulnerability test', |
||
| 341 | vt_params="a", |
||
| 342 | custom="b", |
||
| 343 | solution="c", |
||
| 344 | solution_t="d") |
||
| 345 | response = secET.fromstring( |
||
| 346 | daemon.handle_command('<get_vts vt_id="1.2.3.4"></get_vts>')) |
||
| 347 | solution = response.findall('vts/vt/solution') |
||
| 348 | self.assertEqual(1, len(solution)) |
||
| 349 | |||
| 350 | def testiScanWithError(self): |
||
| 351 | daemon = DummyWrapper([ |
||
| 352 | Result('error', value='something went wrong'), |
||
| 353 | ]) |
||
| 354 | |||
| 355 | response = secET.fromstring(daemon.handle_command('<start_scan target="localhost" ports="80, 443"><scanner_params /></start_scan>')) |
||
| 356 | scan_id = response.findtext('id') |
||
| 357 | finished = False |
||
| 358 | while not finished: |
||
| 359 | response = secET.fromstring(daemon.handle_command('<get_scans scan_id="%s" details="0"/>' % scan_id)) |
||
| 360 | scans = response.findall('scan') |
||
| 361 | self.assertEqual(1, len(scans)) |
||
| 362 | scan = scans[0] |
||
| 363 | if int(scan.get('progress')) != 100: |
||
| 364 | self.assertEqual('0', scan.get('end_time')) |
||
| 365 | time.sleep(.010) |
||
| 366 | else: |
||
| 367 | finished = True |
||
| 368 | response = secET.fromstring(daemon.handle_command('<get_scans scan_id="%s"/>' % scan_id)) |
||
| 369 | response = secET.fromstring(daemon.handle_command('<get_scans />')) |
||
| 370 | response = secET.fromstring(daemon.handle_command('<get_scans scan_id="%s" details="1"/>' % scan_id)) |
||
| 371 | self.assertEqual(response.findtext('scan/results/result'), 'something went wrong') |
||
| 372 | |||
| 373 | response = secET.fromstring(daemon.handle_command('<delete_scan scan_id="%s" />' % scan_id)) |
||
| 374 | self.assertEqual(response.get('status'), '200') |
||
| 375 | |||
| 376 | |||
| 377 | def testGetScanPop(self): |
||
| 378 | daemon = DummyWrapper([ |
||
| 379 | Result('host-detail', value='Some Host Detail'), |
||
| 380 | ]) |
||
| 381 | |||
| 382 | response = secET.fromstring(daemon.handle_command('<start_scan target="localhost" ports="80, 443"><scanner_params /></start_scan>')) |
||
| 383 | scan_id = response.findtext('id') |
||
| 384 | time.sleep(1) |
||
| 385 | |||
| 386 | response = secET.fromstring( |
||
| 387 | daemon.handle_command('<get_scans scan_id="%s"/>' % scan_id)) |
||
| 388 | self.assertEqual(response.findtext('scan/results/result'), |
||
| 389 | 'Some Host Detail') |
||
| 390 | |||
| 391 | response = secET.fromstring( |
||
| 392 | daemon.handle_command( |
||
| 393 | '<get_scans details="0" pop_results="1"/>')) |
||
| 394 | self.assertEqual(response.findtext('scan/results/result'), |
||
| 395 | None) |
||
| 396 | |||
| 397 | response = secET.fromstring( |
||
| 398 | daemon.handle_command( |
||
| 399 | '<get_scans scan_id="%s" pop_results="1"/>' % scan_id)) |
||
| 400 | self.assertEqual(response.findtext('scan/results/result'), |
||
| 401 | 'Some Host Detail') |
||
| 402 | |||
| 403 | response = secET.fromstring( |
||
| 404 | daemon.handle_command( |
||
| 405 | '<get_scans scan_id="%s" pop_results="1"/>' % scan_id)) |
||
| 406 | self.assertNotEqual(response.findtext('scan/results/result'), |
||
| 407 | 'Some Host Detail') |
||
| 408 | self.assertEqual(response.findtext('scan/results/result'), |
||
| 409 | None) |
||
| 410 | |||
| 411 | while True: |
||
| 412 | response = secET.fromstring( |
||
| 413 | daemon.handle_command( |
||
| 414 | '<get_scans scan_id="%s" details="0"/>' % scan_id)) |
||
| 415 | scans = response.findall('scan') |
||
| 416 | self.assertEqual(1, len(scans)) |
||
| 417 | scan = scans[0] |
||
| 418 | if int(scan.get('progress')) == 100: |
||
| 419 | break |
||
| 420 | |||
| 421 | response = secET.fromstring( |
||
| 422 | daemon.handle_command('<delete_scan scan_id="%s" />' % scan_id)) |
||
| 423 | self.assertEqual(response.get('status'), '200') |
||
| 424 | |||
| 425 | |||
| 426 | def testStopScan(self): |
||
| 427 | daemon = DummyWrapper([]) |
||
| 428 | response = secET.fromstring( |
||
| 429 | daemon.handle_command('<start_scan ' + |
||
| 430 | 'target="localhost" ports="80, 443">' + |
||
| 431 | '<scanner_params /></start_scan>')) |
||
| 432 | scan_id = response.findtext('id') |
||
| 433 | |||
| 434 | # Depending on the sistem this test can end with a race condition |
||
| 435 | # because the scanner is already stopped when the <stop_scan> command |
||
| 436 | # is run. |
||
| 437 | time.sleep(3) |
||
| 438 | cmd = secET.fromstring('<stop_scan scan_id="%s" />' % scan_id) |
||
| 439 | self.assertRaises(OSPDError, daemon.handle_stop_scan_command, cmd) |
||
| 440 | |||
| 441 | cmd = secET.fromstring('<stop_scan />') |
||
| 442 | self.assertRaises(OSPDError, daemon.handle_stop_scan_command, cmd) |
||
| 443 | |||
| 444 | |||
| 445 | def testScanWithVTs(self): |
||
| 446 | daemon = DummyWrapper([]) |
||
| 447 | cmd = secET.fromstring('<start_scan ' + |
||
| 448 | 'target="localhost" ports="80, 443">' + |
||
| 449 | '<scanner_params /><vt_selection /></start_scan>') |
||
| 450 | self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) |
||
| 451 | |||
| 452 | # With one VT, without params |
||
| 453 | response = secET.fromstring( |
||
| 454 | daemon.handle_command('<start_scan ' + |
||
| 455 | 'target="localhost" ports="80, 443">' + |
||
| 456 | '<scanner_params /><vt_selection><vt_single id="1.2.3.4" />' + |
||
| 457 | '</vt_selection></start_scan>')) |
||
| 458 | scan_id = response.findtext('id') |
||
| 459 | time.sleep(0.01) |
||
| 460 | self.assertEqual(daemon.get_scan_vts(scan_id), {'1.2.3.4': {}, 'vt_groups': []}) |
||
| 461 | self.assertNotEqual(daemon.get_scan_vts(scan_id), {'1.2.3.6': {}}) |
||
| 462 | |||
| 463 | # With out VTS |
||
| 464 | response = secET.fromstring( |
||
| 465 | daemon.handle_command('<start_scan ' + |
||
| 466 | 'target="localhost" ports="80, 443">' + |
||
| 467 | '<scanner_params /></start_scan>')) |
||
| 468 | scan_id = response.findtext('id') |
||
| 469 | time.sleep(0.01) |
||
| 470 | self.assertEqual(daemon.get_scan_vts(scan_id), {}) |
||
| 471 | |||
| 472 | def testScanWithVTs_and_param(self): |
||
| 473 | daemon = DummyWrapper([]) |
||
| 474 | |||
| 475 | # Raise because no vt_param id attribute |
||
| 476 | cmd = secET.fromstring('<start_scan ' + |
||
| 477 | 'target="localhost" ports="80, 443">' + |
||
| 478 | '<scanner_params /><vt_selection><vt_single id="1234">' + |
||
| 479 | '<vt_value>200</vt_value>' + |
||
| 480 | '</vt_single></vt_selection></start_scan>') |
||
| 481 | self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) |
||
| 482 | |||
| 483 | # No error |
||
| 484 | response = secET.fromstring( |
||
| 485 | daemon.handle_command('<start_scan ' + |
||
| 486 | 'target="localhost" ports="80, 443">' + |
||
| 487 | '<scanner_params /><vt_selection><vt_single id="1234">' + |
||
| 488 | '<vt_value id="ABC">200' + |
||
| 489 | '</vt_value></vt_single></vt_selection></start_scan>')) |
||
| 490 | scan_id = response.findtext('id') |
||
| 491 | time.sleep(0.01) |
||
| 492 | self.assertEqual(daemon.get_scan_vts(scan_id), |
||
| 493 | {'1234': {'ABC': '200'}, 'vt_groups': []}) |
||
| 494 | |||
| 495 | |||
| 496 | # Raise because no vtgroup filter attribute |
||
| 497 | cmd = secET.fromstring('<start_scan ' + |
||
| 498 | 'target="localhost" ports="80, 443">' + |
||
| 499 | '<scanner_params /><vt_selection><vt_group/>' + |
||
| 500 | '</vt_selection></start_scan>') |
||
| 501 | self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) |
||
| 502 | |||
| 503 | # No error |
||
| 504 | response = secET.fromstring( |
||
| 505 | daemon.handle_command('<start_scan ' + |
||
| 506 | 'target="localhost" ports="80, 443">' + |
||
| 507 | '<scanner_params /><vt_selection>' + |
||
| 508 | '<vt_group filter="a"/>' + |
||
| 509 | '</vt_selection></start_scan>')) |
||
| 510 | scan_id = response.findtext('id') |
||
| 511 | time.sleep(0.01) |
||
| 512 | self.assertEqual(daemon.get_scan_vts(scan_id), |
||
| 513 | {'vt_groups': ['a']}) |
||
| 514 | |||
| 515 | |||
| 516 | def testBillonLaughs(self): |
||
| 517 | daemon = DummyWrapper([]) |
||
| 518 | lol = ('<?xml version="1.0"?>' + |
||
| 519 | '<!DOCTYPE lolz [' + |
||
| 520 | ' <!ENTITY lol "lol">' + |
||
| 521 | ' <!ELEMENT lolz (#PCDATA)>' + |
||
| 522 | ' <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">' + |
||
| 523 | ' <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">' + |
||
| 524 | ' <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">' + |
||
| 525 | ' <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">' + |
||
| 526 | ' <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">' + |
||
| 527 | ' <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">' + |
||
| 528 | ' <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">' + |
||
| 529 | ' <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">' + |
||
| 530 | ' <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">' + |
||
| 531 | ']>') |
||
| 532 | self.assertRaises(EntitiesForbidden, daemon.handle_command, lol) |
||
| 533 | |||
| 534 | def testScanMultiTarget(self): |
||
| 535 | daemon = DummyWrapper([]) |
||
| 536 | response = secET.fromstring( |
||
| 537 | daemon.handle_command('<start_scan>' + |
||
| 538 | '<scanner_params /><vts><vt id="1.2.3.4" />' + |
||
| 539 | '</vts>' + |
||
| 540 | '<targets><target>' + |
||
| 541 | '<hosts>localhosts</hosts>' + |
||
| 542 | '<ports>80,443</ports>' + |
||
| 543 | '</target>' + |
||
| 544 | '<target><hosts>192.168.0.0/24</hosts>' + |
||
| 545 | '<ports>22</ports></target></targets>' + |
||
| 546 | '</start_scan>')) |
||
| 547 | self.assertEqual(response.get('status'), '200') |
||
| 548 | |||
| 549 | |||
| 550 | def testMultiTargetWithCredentials(self): |
||
| 551 | daemon = DummyWrapper([]) |
||
| 552 | response = secET.fromstring( |
||
| 553 | daemon.handle_command('<start_scan>' + |
||
| 554 | '<scanner_params /><vts><vt id="1.2.3.4" />' + |
||
| 555 | '</vts>' + |
||
| 556 | '<targets><target><hosts>localhosts</hosts>' + |
||
| 557 | '<ports>80,443</ports></target><target>' + |
||
| 558 | '<hosts>192.168.0.0/24</hosts><ports>22' + |
||
| 559 | '</ports><credentials>' + |
||
| 560 | '<credential type="up" service="ssh" port="22">' + |
||
| 561 | '<username>scanuser</username>' + |
||
| 562 | '<password>mypass</password>' + |
||
| 563 | '</credential><credential type="up" service="smb">' + |
||
| 564 | '<username>smbuser</username>' + |
||
| 565 | '<password>mypass</password></credential>' + |
||
| 566 | '</credentials>' + |
||
| 567 | '</target></targets>' + |
||
| 568 | '</start_scan>')) |
||
| 569 | self.assertEqual(response.get('status'), '200') |
||
| 570 | cred_dict = {'ssh': {'type': 'up', 'password': |
||
| 571 | 'mypass', 'port': '22', 'username': |
||
| 572 | 'scanuser'}, 'smb': {'type': 'up', |
||
| 573 | 'password': 'mypass', 'username': 'smbuser'}} |
||
| 574 | scan_id = response.findtext('id') |
||
| 575 | response = daemon.get_scan_credentials(scan_id, "192.168.0.0/24") |
||
| 576 | self.assertEqual(response, cred_dict) |
||
| 577 | |||
| 578 | def testScanGetTarget(self): |
||
| 579 | daemon = DummyWrapper([]) |
||
| 580 | response = secET.fromstring( |
||
| 581 | daemon.handle_command('<start_scan>' + |
||
| 582 | '<scanner_params /><vts><vt id="1.2.3.4" />' + |
||
| 583 | '</vts>' + |
||
| 584 | '<targets><target>' + |
||
| 585 | '<hosts>localhosts</hosts>' + |
||
| 586 | '<ports>80,443</ports>' + |
||
| 587 | '</target>' + |
||
| 588 | '<target><hosts>192.168.0.0/24</hosts>' + |
||
| 589 | '<ports>22</ports></target></targets>' + |
||
| 590 | '</start_scan>')) |
||
| 591 | scan_id = response.findtext('id') |
||
| 592 | response = secET.fromstring( |
||
| 593 | daemon.handle_command('<get_scans scan_id="%s"/>' % scan_id)) |
||
| 594 | scan_res = response.find('scan') |
||
| 595 | self.assertEqual(scan_res.get('target'), 'localhosts,192.168.0.0/24') |
||
| 596 | |||
| 597 | def testScanGetLegacyTarget(self): |
||
| 598 | daemon = DummyWrapper([]) |
||
| 599 | |||
| 600 | response = secET.fromstring( |
||
| 601 | daemon.handle_command('<start_scan target="localhosts,192.168.0.0/24" ports="22">' + |
||
| 602 | '<scanner_params /><vts><vt id="1.2.3.4" />' + |
||
| 603 | '</vts>' + |
||
| 604 | '</start_scan>')) |
||
| 605 | scan_id = response.findtext('id') |
||
| 606 | response = secET.fromstring( |
||
| 607 | daemon.handle_command('<get_scans scan_id="%s"/>' % scan_id)) |
||
| 608 | scan_res = response.find('scan') |
||
| 609 | self.assertEqual(scan_res.get('target'), 'localhosts,192.168.0.0/24') |
||
| 610 | |||
| 611 | def testScanMultiTargetParallelWithError(self): |
||
| 612 | daemon = DummyWrapper([]) |
||
| 613 | cmd = secET.fromstring('<start_scan parallel="100a">' + |
||
| 614 | '<scanner_params />' + |
||
| 615 | '<targets><target>' + |
||
| 616 | '<hosts>localhosts</hosts>' + |
||
| 617 | '<ports>22</ports>' + |
||
| 618 | '</target></targets>' + |
||
| 619 | '</start_scan>') |
||
| 620 | time.sleep(1) |
||
| 621 | self.assertRaises(OSPDError, daemon.handle_start_scan_command, cmd) |
||
| 622 | |||
| 623 | def testScanMultiTargetParallel100(self): |
||
| 624 | daemon = DummyWrapper([]) |
||
| 625 | response = secET.fromstring( |
||
| 626 | daemon.handle_command('<start_scan parallel="100">' + |
||
| 627 | '<scanner_params />' + |
||
| 628 | '<targets><target>' + |
||
| 629 | '<hosts>localhosts</hosts>' + |
||
| 630 | '<ports>22</ports>' + |
||
| 631 | '</target></targets>' + |
||
| 632 | '</start_scan>')) |
||
| 633 | time.sleep(1) |
||
| 634 | self.assertEqual(response.get('status'), '200') |
||
| 635 | |||
| 636 | def testProgress(self): |
||
| 637 | daemon = DummyWrapper([]) |
||
| 638 | response = secET.fromstring( |
||
| 639 | daemon.handle_command('<start_scan parallel="2">' + |
||
| 640 | '<scanner_params />' + |
||
| 641 | '<targets><target>' + |
||
| 642 | '<hosts>localhost1</hosts>' + |
||
| 643 | '<ports>22</ports>' + |
||
| 644 | '</target><target>' + |
||
| 645 | '<hosts>localhost2</hosts>' + |
||
| 646 | '<ports>22</ports>' + |
||
| 647 | '</target></targets>' + |
||
| 648 | '</start_scan>')) |
||
| 649 | scan_id = response.findtext('id') |
||
| 650 | daemon.set_scan_target_progress(scan_id, 'localhost1', 75) |
||
| 651 | daemon.set_scan_target_progress(scan_id, 'localhost2', 25) |
||
| 652 | self.assertEqual(daemon.calculate_progress(scan_id), 50) |
||
| 653 |
Loading history...
This check looks for invalid names for a range of different identifiers.
You can set regular expressions to which the identifiers must conform if the defaults do not match your requirements.
If your project includes a Pylint configuration file, the settings contained in that file take precedence.
To find out more about Pylint, please refer to their site.