def test_FTL_detect_aarch64_no_errors(Pihole): ''' confirms only aarch64 package is downloaded for FTL engine ''' # mock uname to return aarch64 platform mock_command('uname', {'-m': ('aarch64', '0')}, Pihole) # mock ldd to respond with aarch64 shared library mock_command( 'ldd', { '/bin/ls': ( '/lib/ld-linux-aarch64.so.1', '0' ) }, Pihole ) detectPlatform = Pihole.run(''' source /opt/pihole/basic-install.sh create_pihole_user funcOutput=$(get_binary_name) binary="pihole-FTL${funcOutput##*pihole-FTL}" theRest="${funcOutput%pihole-FTL*}" FTLdetect "${binary}" "${theRest}" ''') expected_stdout = info_box + ' FTL Checks...' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Detected ARM-aarch64 architecture' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Downloading and Installing FTL' assert expected_stdout in detectPlatform.stdout
def test_php_version_lt_7_detected_upgrade_user_optin_centos(Pihole): ''' confirms installer behavior when user opt-in to upgrade to PHP7 via REMI ''' # first we will install the default php version to test installer behavior php_install = Pihole.run('yum install -y php') assert php_install.rc == 0 php_package = Pihole.package('php') default_centos_php_version = php_package.version.split('.')[0] if int(default_centos_php_version) >= 7: # PHP7 is supported/recommended pytest.skip("Test deprecated . Detected default PHP version >= 7") # Whiptail dialog returns Continue for user prompt mock_command('whiptail', {'*': ('', '0')}, Pihole) distro_check = Pihole.run(''' source /opt/pihole/basic-install.sh distro_check install_dependent_packages PIHOLE_WEB_DEPS[@] ''') expected_stdout = info_box + (' User opt-out of PHP 7 upgrade on CentOS. ' 'Deprecated PHP may be in use.') assert expected_stdout not in distro_check.stdout expected_stdout = info_box + (' Enabling Remi\'s RPM repository ' '(https://rpms.remirepo.net)') assert expected_stdout in distro_check.stdout expected_stdout = tick_box + (' Remi\'s RPM repository has ' 'been enabled for PHP7') assert expected_stdout in distro_check.stdout remi_package = Pihole.package('remi-release') assert remi_package.is_installed updated_php_package = Pihole.package('php') updated_php_version = updated_php_package.version.split('.')[0] assert int(updated_php_version) == 7
def test_FTL_detect_unknown_no_errors(Pihole): ''' confirms only generic package is downloaded for FTL engine ''' # mock uname to return generic platform mock_command('uname', {'-m': ('mips', '0')}, Pihole) detectPlatform = Pihole.run(''' source /opt/pihole/basic-install.sh FTLdetect ''') expected_stdout = 'Not able to detect architecture (unknown: mips)' assert expected_stdout in detectPlatform.stdout
def test_selinux_disabled(Pihole): ''' confirms installer continues when SELinux is Disabled ''' mock_command('getenforce', {'*': ('Disabled', '0')}, Pihole) check_selinux = Pihole.run(''' source /opt/pihole/basic-install.sh checkSelinux ''') expected_stdout = info_box + ' SELinux mode detected: Disabled' assert expected_stdout in check_selinux.stdout assert check_selinux.rc == 0
def test_configureFirewall_firewalld_disabled_no_errors(Pihole): ''' confirms firewalld rules are not applied when firewallD is not running ''' # firewallD returns non-running status mock_command('firewall-cmd', {'*': ('not running', '1')}, Pihole) configureFirewall = Pihole.run(''' source /opt/pihole/basic-install.sh configureFirewall ''') expected_stdout = ('No active firewall detected.. ' 'skipping firewall configuration') assert expected_stdout in configureFirewall.stdout
def test_selinux_permissive(Pihole): ''' confirms installer continues when SELinux is Permissive ''' # getenforce returns the running state of SELinux mock_command('getenforce', {'*': ('Permissive', '0')}, Pihole) check_selinux = Pihole.run(''' source /opt/pihole/basic-install.sh checkSelinux ''') expected_stdout = info_box + ' SELinux mode detected: Permissive' assert expected_stdout in check_selinux.stdout assert check_selinux.rc == 0
def test_update_package_cache_failure_no_errors(Pihole): ''' confirms package cache was not updated ''' mock_command('apt-get', {'update': ('', '1')}, Pihole) updateCache = Pihole.run(''' source /opt/pihole/basic-install.sh distro_check update_package_cache ''') expected_stdout = cross_box + ' Update local cache of available packages' assert expected_stdout in updateCache.stdout assert 'Error: Unable to update package cache.' in updateCache.stdout
def mock_selinux_config(state, Pihole): ''' Creates a mock SELinux config file with expected content ''' # validate state string valid_states = ['enforcing', 'permissive', 'disabled'] assert state in valid_states # getenforce returns the running state of SELinux mock_command('getenforce', {'*': (state.capitalize(), '0')}, Pihole) # create mock configuration with desired content Pihole.run(''' mkdir /etc/selinux echo "SELINUX={state}" > /etc/selinux/config '''.format(state=state.lower()))
def test_FTL_detect_unknown_no_errors(Pihole): ''' confirms only generic package is downloaded for FTL engine ''' # mock uname to return generic platform mock_command('uname', {'-m': ('mips', '0')}, Pihole) detectPlatform = Pihole.run(''' source /opt/pihole/basic-install.sh create_pihole_user funcOutput=$(get_binary_name) binary="pihole-FTL${funcOutput##*pihole-FTL}" theRest="${funcOutput%pihole-FTL*}" FTLdetect "${binary}" "${theRest}" ''') expected_stdout = 'Not able to detect architecture (unknown: mips)' assert expected_stdout in detectPlatform.stdout
def test_configureFirewall_firewalld_enabled_declined_no_errors(Pihole): ''' confirms firewalld rules are not applied when firewallD is running, user declines ruleset ''' # firewallD returns running status mock_command('firewall-cmd', {'*': ('running', 0)}, Pihole) # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', 1)}, Pihole) configureFirewall = Pihole.run(''' source /opt/pihole/basic-install.sh configureFirewall ''') expected_stdout = 'Not installing firewall rulesets.' assert expected_stdout in configureFirewall.stdout
def test_php_upgrade_user_optout_centos(Pihole): ''' confirms installer behavior when user opt-out of installing PHP7 from REMI (php not currently installed) ''' # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', '1')}, Pihole) distro_check = Pihole.run(''' source /opt/pihole/basic-install.sh distro_check ''') expected_stdout = info_box + (' User opt-out of PHP 7 upgrade on CentOS. ' 'Deprecated PHP may be in use.') assert expected_stdout in distro_check.stdout remi_package = Pihole.package('remi-release') assert not remi_package.is_installed
def test_selinux_enforcing_default_exit(Pihole): ''' confirms installer prompts to exit when SELinux is Enforcing by default ''' # getenforce returns the running state of SELinux mock_command('getenforce', {'*': ('Enforcing', '0')}, Pihole) # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', '1')}, Pihole) check_selinux = Pihole.run(''' source /opt/pihole/basic-install.sh checkSelinux ''') expected_stdout = info_box + ' SELinux mode detected: Enforcing' assert expected_stdout in check_selinux.stdout expected_stdout = 'SELinux Enforcing detected, exiting installer' assert expected_stdout in check_selinux.stdout assert check_selinux.rc == 1
def test_FTL_detect_armv7l_no_errors(Pihole): ''' confirms only armv7l package is downloaded for FTL engine ''' # mock uname to return armv7l platform mock_command('uname', {'-m': ('armv7l', '0')}, Pihole) # mock ldd to respond with aarch64 shared library mock_command('ldd', {'/bin/ls': ('/lib/ld-linux-armhf.so.3', '0')}, Pihole) detectPlatform = Pihole.run(''' source /opt/pihole/basic-install.sh FTLdetect ''') expected_stdout = info_box + ' FTL Checks...' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Detected ARM-hf architecture (armv7+)' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Downloading and Installing FTL' assert expected_stdout in detectPlatform.stdout
def test_FTL_download_aarch64_no_errors(Pihole): ''' confirms only aarch64 package is downloaded for FTL engine ''' # mock whiptail answers and ensure installer dependencies mock_command('whiptail', {'*': ('', '0')}, Pihole) Pihole.run(''' source /opt/pihole/basic-install.sh distro_check install_dependent_packages ${INSTALLER_DEPS[@]} ''') download_binary = Pihole.run(''' source /opt/pihole/basic-install.sh create_pihole_user FTLinstall "pihole-FTL-aarch64-linux-gnu" ''') expected_stdout = tick_box + ' Downloading and Installing FTL' assert expected_stdout in download_binary.stdout assert 'error' not in download_binary.stdout.lower()
def test_FTL_detect_aarch64_no_errors(Xfilter): ''' confirms only aarch64 package is downloaded for FTL engine ''' # mock uname to return aarch64 platform mock_command('uname', {'-m': ('aarch64', '0')}, Xfilter) # mock ldd to respond with aarch64 shared library mock_command('ldd', {'/bin/ls': ('/lib/ld-linux-aarch64.so.1', '0')}, Xfilter) detectPlatform = Xfilter.run(''' source /opt/xfilter/basic-install.sh FTLdetect ''') expected_stdout = info_box + ' FTL Checks...' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Detected ARM-aarch64 architecture' assert expected_stdout in detectPlatform.stdout expected_stdout = tick_box + ' Downloading and Installing FTL' assert expected_stdout in detectPlatform.stdout
def test_php_upgrade_user_optin_centos(Pihole): ''' confirms installer behavior when user opt-in to installing PHP7 from REMI (php not currently installed) ''' # Whiptail dialog returns Continue for user prompt mock_command('whiptail', {'*': ('', '0')}, Pihole) distro_check = Pihole.run(''' source /opt/pihole/basic-install.sh distro_check ''') assert 'opt-out' not in distro_check.stdout expected_stdout = info_box + (' Enabling Remi\'s RPM repository ' '(https://rpms.remirepo.net)') assert expected_stdout in distro_check.stdout expected_stdout = tick_box + (' Remi\'s RPM repository has ' 'been enabled for PHP7') assert expected_stdout in distro_check.stdout remi_package = Pihole.package('remi-release') assert remi_package.is_installed
def test_FTL_download_binary_unset_no_errors(Pihole): ''' confirms unset binary variable does not download FTL engine ''' # mock whiptail answers and ensure installer dependencies mock_command('whiptail', {'*': ('', '0')}, Pihole) Pihole.run(''' source /opt/pihole/basic-install.sh distro_check install_dependent_packages ${INSTALLER_DEPS[@]} ''') download_binary = Pihole.run(''' source /opt/pihole/basic-install.sh FTLinstall ''') expected_stdout = cross_box + ' Downloading and Installing FTL' assert expected_stdout in download_binary.stdout error1 = 'Error: URL https://github.com/pi-hole/FTL/releases/download/' assert error1 in download_binary.stdout error2 = 'not found' assert error2 in download_binary.stdout
def test_configureFirewall_firewalld_running_no_errors(Pihole): ''' confirms firewalld rules are applied when firewallD is running ''' # firewallD returns 'running' as status mock_command('firewall-cmd', {'*': ('running', 0)}, Pihole) # Whiptail dialog returns Ok for user prompt mock_command('whiptail', {'*': ('', 0)}, Pihole) configureFirewall = Pihole.run(''' source /opt/pihole/basic-install.sh configureFirewall ''') expected_stdout = 'Configuring FirewallD for httpd and pihole-FTL' assert expected_stdout in configureFirewall.stdout firewall_calls = Pihole.run('cat /var/log/firewall-cmd').stdout assert 'firewall-cmd --state' in firewall_calls assert ('firewall-cmd ' '--permanent ' '--add-service=http ' '--add-service=dns') in firewall_calls assert 'firewall-cmd --reload' in firewall_calls
def test_selinux_enforcing_continue(Pihole): ''' confirms installer prompts to continue with custom policy warning ''' # getenforce returns the running state of SELinux mock_command('getenforce', {'*': ('Enforcing', '0')}, Pihole) # Whiptail dialog returns Continue for user prompt mock_command('whiptail', {'*': ('', '0')}, Pihole) check_selinux = Pihole.run(''' source /opt/pihole/basic-install.sh checkSelinux ''') expected_stdout = info_box + ' SELinux mode detected: Enforcing' assert expected_stdout in check_selinux.stdout expected_stdout = info_box + (' Continuing installation with SELinux ' 'Enforcing') assert expected_stdout in check_selinux.stdout expected_stdout = info_box + (' Please refer to official SELinux ' 'documentation to create a custom policy') assert expected_stdout in check_selinux.stdout assert check_selinux.rc == 0
def test_configureFirewall_IPTables_enabled_not_exist_no_errors(Pihole): ''' confirms IPTables rules are applied when IPTables is running and rules do not exist ''' # iptables command and returns 0 on calls (should return 1 on iptables -C) mock_command('iptables', { '-S': ('-P INPUT DENY', '0'), '-C': ('', 1), '-I': ('', 0) }, Pihole) # modinfo returns always true (ip_tables module check) mock_command('modinfo', {'*': ('', '0')}, Pihole) # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', '0')}, Pihole) configureFirewall = Pihole.run(''' source /opt/pihole/basic-install.sh configureFirewall ''') expected_stdout = 'Installing new IPTables firewall rulesets' assert expected_stdout in configureFirewall.stdout firewall_calls = Pihole.run('cat /var/log/iptables').stdout # General call type occurances assert len(re.findall(r'iptables -S', firewall_calls)) == 1 assert len(re.findall(r'iptables -C', firewall_calls)) == 4 assert len(re.findall(r'iptables -I', firewall_calls)) == 4 # Specific port call occurances assert len(re.findall(r'tcp --dport 80', firewall_calls)) == 2 assert len(re.findall(r'tcp --dport 53', firewall_calls)) == 2 assert len(re.findall(r'udp --dport 53', firewall_calls)) == 2 assert len(re.findall(r'tcp --dport 4711:4720', firewall_calls)) == 2
def test_php_version_lt_7_detected_upgrade_user_optout_centos(Pihole): ''' confirms installer behavior when user opt-out to upgrade to PHP7 via REMI ''' # first we will install the default php version to test installer behavior php_install = Pihole.run('yum install -y php') assert php_install.rc == 0 php_package = Pihole.package('php') default_centos_php_version = php_package.version.split('.')[0] if int(default_centos_php_version) >= 7: # PHP7 is supported/recommended pytest.skip("Test deprecated . Detected default PHP version >= 7") # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', '1')}, Pihole) distro_check = Pihole.run(''' source /opt/pihole/basic-install.sh distro_check ''') expected_stdout = info_box + (' User opt-out of PHP 7 upgrade on CentOS. ' 'Deprecated PHP may be in use.') assert expected_stdout in distro_check.stdout remi_package = Pihole.package('remi-release') assert not remi_package.is_installed
def test_configureFirewall_IPTables_enabled_declined_no_errors(Pihole): ''' confirms IPTables rules are not applied when IPTables is running, user declines ruleset ''' # iptables command exists mock_command('iptables', {'*': ('', '0')}, Pihole) # modinfo returns always true (ip_tables module check) mock_command('modinfo', {'*': ('', '0')}, Pihole) # Whiptail dialog returns Cancel for user prompt mock_command('whiptail', {'*': ('', '1')}, Pihole) configureFirewall = Pihole.run(''' source /opt/pihole/basic-install.sh configureFirewall ''') expected_stdout = 'Not installing firewall rulesets.' assert expected_stdout in configureFirewall.stdout