71 lines
3.0 KiB
Python
71 lines
3.0 KiB
Python
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_deploy_uses_uploaded_tar_and_versioned_container():
|
|
script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
|
|
assert 'CONTAINER_NAME="suricata_${VERSION}"' in script
|
|
assert 'ROOT_DIR="/containers/${CONTAINER_NAME}/root"' in script
|
|
assert 'IMAGE_TAR_ROS="${1:-}"' in script
|
|
assert '/container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}"' in script
|
|
assert 'build-routeros.sh' not in script
|
|
assert 'ROUTER_ARCH' not in script
|
|
assert '/container/get' not in script
|
|
|
|
|
|
def test_upload_helper_only_accepts_ready_tar():
|
|
script = (ROOT / "scripts" / "upload-routeros-image.sh").read_text()
|
|
assert 'IMAGE_PATH="${1:-}"' in script
|
|
assert 'build-routeros.sh' not in script
|
|
assert 'ROUTER_ARCH' not in script
|
|
assert '/container/add' not in script
|
|
assert '/import' not in script
|
|
|
|
|
|
def test_upgrade_helper_reuses_existing_routeros_setup_only():
|
|
script = (ROOT / "scripts" / "upgrade-routeros-container.sh").read_text()
|
|
assert 'CONTAINER_NAME="suricata_${VERSION}"' in script
|
|
assert 'ROOT_DIR="/containers/${CONTAINER_NAME}/root"' in script
|
|
assert '/container/add name="${CONTAINER_NAME}" file="${IMAGE_TAR_ROS}"' in script
|
|
assert 'interface="${CONTAINER_VETH}"' in script
|
|
assert 'mountlists="${CONTAINER_MOUNTLIST}"' in script
|
|
assert 'envlist="${CONTAINER_ENVLIST}"' in script
|
|
assert '/container/get' not in script
|
|
assert '/interface/bridge/add' not in script
|
|
assert '/interface/veth/add' not in script
|
|
assert '/ip/address/add' not in script
|
|
assert '/ip/firewall/nat/add' not in script
|
|
assert '/tool/sniffer/set' not in script
|
|
assert '/container/envs/add' not in script
|
|
assert '/container/mounts/add list="${CONTAINER_MOUNTLIST}" src="${ROUTER_DISK}/containers/suricata-data" dst=/data' in script
|
|
|
|
|
|
def test_routeros_deploy_uses_one_persistent_data_mount():
|
|
script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
|
|
assert '/container/mounts/add list=IDS_MOUNTS src="${DATA_DIR}" dst=/data' in script
|
|
assert 'suricata-logs' not in script
|
|
assert 'suricata-rules' not in script
|
|
|
|
|
|
def test_compose_uses_one_named_volume():
|
|
compose = (ROOT / "docker-compose.yml").read_text()
|
|
assert compose.count(':/data') == 1
|
|
assert 'routeros-suricata-data' in compose
|
|
assert 'routeros-suricata-logs' not in compose
|
|
assert 'routeros-suricata-rules' not in compose
|
|
|
|
|
|
def test_routeros_deploy_forwards_ndr_and_persistence_controls():
|
|
script = (ROOT / "scripts" / "deploy-routeros.sh").read_text()
|
|
for key in (
|
|
"REDIS_AOF", "NDR_ENABLED", "NDR_CORRELATION_WINDOW_SECONDS",
|
|
"BEHAVIOR_MIN_OBSERVATIONS", "NDR_AUTO_BLOCK", "NDR_AUTO_BLOCK_RISK",
|
|
"ROUTEROS_INVENTORY_INTERVAL_SECONDS", "NOTIFY_WEBHOOK_URL",
|
|
"NOTIFY_MIN_RISK", "NOTIFY_TIMEOUT_SECONDS",
|
|
"METRICS_ALLOWED_IPS", "METRICS_BASIC_AUTH_USERNAME",
|
|
"METRICS_BASIC_AUTH_PASSWORD",
|
|
):
|
|
assert f"key={key}" in script
|