def test_ap_enable_true_policy_correct_uds(self, request, kube_apis,
crd_ingress_controller_with_ap,
appprotect_setup,
test_namespace):
"""
Test request with UDS rule string is rejected while AppProtect with User Defined Signatures is enabled in Ingress
"""
usersig_name = create_ap_usersig_from_yaml(kube_apis.custom_objects,
uds_crd_resource,
test_namespace)
# Apply dataguard-alarm AP policy with UDS
delete_and_create_ap_policy_from_yaml(
kube_apis.custom_objects,
ap_policy,
f"{TEST_DATA}/appprotect/{ap_policy_uds}.yaml",
test_namespace,
)
wait_before_test()
create_ingress_with_ap_annotations(kube_apis, src_ing_yaml,
test_namespace, ap_policy, "True",
"True", "127.0.0.1:514")
ingress_host = get_first_ingress_host_from_yaml(src_ing_yaml)
print(
"--------- Run test while AppProtect module is enabled with correct policy and UDS ---------"
)
ap_crd_info = read_ap_custom_resource(kube_apis.custom_objects,
test_namespace, "appolicies",
ap_policy)
wait_before_test(120)
ensure_response_from_backend(appprotect_setup.req_url,
ingress_host,
check404=True)
print("----------------------- Send request ----------------------")
response = requests.get(appprotect_setup.req_url,
headers={"host": ingress_host},
verify=False,
data="kic")
print(response.text)
reload_ms = get_last_reload_time(appprotect_setup.metrics_url, "nginx")
print(f"last reload duration: {reload_ms} ms")
reload_times[
f"{request.node.name}"] = f"last reload duration: {reload_ms} ms"
# Restore default dataguard-alarm policy
delete_and_create_ap_policy_from_yaml(
kube_apis.custom_objects,
ap_policy,
f"{TEST_DATA}/appprotect/{ap_policy}.yaml",
test_namespace,
)
delete_items_from_yaml(kube_apis, src_ing_yaml, test_namespace)
assert_ap_crd_info(ap_crd_info, ap_policy)
assert_invalid_responses(response)
def appprotect_setup(request, kube_apis, test_namespace) -> None:
"""
Deploy simple application and all the AppProtect(dataguard-alarm) resources under test in one namespace.
:param request: pytest fixture
:param kube_apis: client apis
:param ingress_controller_endpoint: public endpoint
:param test_namespace:
"""
print(
"------------------------- Deploy logconf -----------------------------"
)
src_log_yaml = f"{TEST_DATA}/ap-waf/logconf.yaml"
global log_name
log_name = create_ap_logconf_from_yaml(kube_apis.custom_objects,
src_log_yaml, test_namespace)
print(
"------------------------- Create UserSig CRD -----------------------------"
)
ap_uds_crd_name = get_name_from_yaml(uds_crd)
create_crd_from_yaml(
kube_apis.api_extensions_v1_beta1,
ap_uds_crd_name,
uds_crd,
)
wait_before_test()
print(
"------------------------- Create UserSig CRD resource-----------------------------"
)
usersig_name = create_ap_usersig_from_yaml(kube_apis.custom_objects,
uds_crd_resource,
test_namespace)
print(
f"------------------------- Deploy dataguard-alarm appolicy ---------------------------"
)
src_pol_yaml = f"{TEST_DATA}/ap-waf/{ap_policy_uds}.yaml"
global ap_pol_name
ap_pol_name = create_ap_policy_from_yaml(kube_apis.custom_objects,
src_pol_yaml, test_namespace)
def fin():
print("Clean up:")
delete_ap_policy(kube_apis.custom_objects, ap_pol_name, test_namespace)
delete_ap_usersig(kube_apis.custom_objects, usersig_name,
test_namespace)
delete_crd(
kube_apis.api_extensions_v1_beta1,
ap_uds_crd_name,
)
delete_ap_logconf(kube_apis.custom_objects, log_name, test_namespace)
request.addfinalizer(fin)