diff options
Diffstat (limited to '')
22 files changed, 1591 insertions, 0 deletions
diff --git a/src/tests/keywords/update b/src/tests/keywords/update new file mode 100644 index 0000000..97a2557 --- /dev/null +++ b/src/tests/keywords/update @@ -0,0 +1,7 @@ +update control { + Cleartext-Password := 'hello' +} + +update reply { + Filter-Id := "filter" +} diff --git a/src/tests/keywords/update-add-ref-index b/src/tests/keywords/update-add-ref-index new file mode 100644 index 0000000..7f5e74a --- /dev/null +++ b/src/tests/keywords/update-add-ref-index @@ -0,0 +1,118 @@ +# +# PRE: update array +# + +update request { + reply:Filter-Id := "filter" + Class := 0x01020304 + Class += 0x05060708 + Class += 0x090a0b0c +} + +# +# Copy all the class attributes to Proxy-State +# +update request { + Proxy-State += &Class[*] +} + +if (&Proxy-State[0] != 0x01020304) { + update reply { + Filter-Id := "fail 0a" + } +} + +# Must be the same as above +if (&Proxy-State[1] != 0x05060708) { + update reply { + Filter-Id += "fail 0b" + } +} + +if (&Proxy-State[2] != 0x090a0b0c) { + update reply { + Filter-Id += "fail 0c" + } +} + +# must not exist +if (&Proxy-State[3]) { + update reply { + Filter-Id += "fail 1" + } +} + +# Remove all the Proxy-State attributes +update request { + Proxy-State !* ANY +} + +# +# Copy the first instance (implicitly) of class +# +update request { + Proxy-State += &Class +} + +if (&Proxy-State[0] != 0x01020304) { + update reply { + Filter-Id := "fail 2a" + } +} + +# Must be the same as above +if (&Proxy-State[1]) { + update reply { + Filter-Id += "fail 2b" + } +} + +# Remove all the Proxy-State attributes +update request { + Proxy-State !* ANY +} + +# +# Copy the first instance (explicitly) of class +# +update request { + Proxy-State += &Class[0] +} + +if (&Proxy-State[0] != 0x01020304) { + update reply { + Filter-Id := "fail 3a" + } +} + +# Must be the same as above +if (&Proxy-State[1]) { + update reply { + Filter-Id += "fail 3b" + } +} + +# Remove all the Proxy-State attributes +update request { + Proxy-State !* ANY +} + +# +# Copy the second instance of class +# +update request { + Proxy-State += &Class[1] +} + +if (&Proxy-State[0] != 0x05060708) { + update reply { + Filter-Id := "fail 4a" + } +} + +# Must be the same as above +if (&Proxy-State[1]) { + update reply { + Filter-Id += "fail 4b" + } +} diff --git a/src/tests/keywords/update-add-ref-tag b/src/tests/keywords/update-add-ref-tag new file mode 100644 index 0000000..39800b8 --- /dev/null +++ b/src/tests/keywords/update-add-ref-tag @@ -0,0 +1,118 @@ +# +# PRE: update array +# + +update request { + reply:Filter-Id := "filter" + request:Tunnel-Server-Endpoint += '192.0.1.1' + request:Tunnel-Server-Endpoint += '192.0.1.2' + request:Tunnel-Server-Endpoint:1 += '192.0.1.1' + request:Tunnel-Server-Endpoint:2 += '192.0.2.1' + request:Tunnel-Server-Endpoint:2 += '192.0.2.2' + request:Tunnel-Server-Endpoint:3 += '192.0.3.1' +} + +# +# Copy all Tunnel-Server-Endpoint attributes +# +update request { + control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint[*] +} + +if ((&control:Tunnel-Server-Endpoint[0] != '192.0.1.1') || \ + (&control:Tunnel-Server-Endpoint[1] != '192.0.1.2') || \ + (&control:Tunnel-Server-Endpoint[2] != '192.0.1.1') || \ + (&control:Tunnel-Server-Endpoint[3] != '192.0.2.1') || \ + (&control:Tunnel-Server-Endpoint[4] != '192.0.2.2') || \ + (&control:Tunnel-Server-Endpoint[5] != '192.0.3.1') || \ + &control:Tunnel-Server-Endpoint[6]) { + update reply { + Filter-Id := "fail 0" + } +} + +# +# Clear out control attributes... +# +update control { + Tunnel-Server-Endpoint !* ANY +} + +# +# Copy all Tunnel-Server-Endpoint attributes with tag 2 +# +update request { + control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2[*] +} + +if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \ + (&control:Tunnel-Server-Endpoint[1] != '192.0.2.2') || \ + &control:Tunnel-Server-Endpoint[2]) { + update reply { + Filter-Id := "fail 1" + } +} + +# +# Clear out control attributes... +# +update control { + Tunnel-Server-Endpoint !* ANY +} + +# +# Copy all Tunnel-Server-Endpoint attributes with no tag +# +update request { + control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:0[*] +} + +if ((&control:Tunnel-Server-Endpoint[0] != '192.0.1.1') || \ + (&control:Tunnel-Server-Endpoint[1] != '192.0.1.2') || \ + &control:Tunnel-Server-Endpoint[2]) { + update reply { + Filter-Id := "fail 2" + } +} + +# +# Clear out control attributes... +# +update control { + Tunnel-Server-Endpoint !* ANY +} + +# +# Copy the first attribute with tag 2 (implicit) +# +update request { + control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2 +} + +if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \ + &control:Tunnel-Server-Endpoint[1]) { + update reply { + Filter-Id := "fail 3" + } +} + +# +# Clear out control attributes... +# +update control { + Tunnel-Server-Endpoint !* ANY +} + +# +# Copy the first attribute with tag 2 (explicit) +# +update request { + control:Tunnel-Server-Endpoint += &Tunnel-Server-Endpoint:2[0] +} + +if ((&control:Tunnel-Server-Endpoint[0] != '192.0.2.1') || \ + &control:Tunnel-Server-Endpoint[1]) { + update reply { + Filter-Id := "fail 4" + } +} diff --git a/src/tests/keywords/update-all b/src/tests/keywords/update-all new file mode 100644 index 0000000..549a122 --- /dev/null +++ b/src/tests/keywords/update-all @@ -0,0 +1,9 @@ +# +# PRE: update +# +# A more generic "update" mechanism +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := "filter" +} diff --git a/src/tests/keywords/update-array b/src/tests/keywords/update-array new file mode 100644 index 0000000..c872f4e --- /dev/null +++ b/src/tests/keywords/update-array @@ -0,0 +1,63 @@ +# +# PRE: update array +# + +update request { + Class := 0x01020304 + Class += 0x05060708 + Class += 0x090a0b0c +} + + +# +# Use array references in the RHS +# of the update section +# + +update request { + Proxy-State += &Class[0] + Proxy-State += &Class[1] + Proxy-State += &Class[2] +} + +if (&Proxy-State != 0x01020304) { + update reply { + Filter-Id := "fail 0" + } +} + +# Must be the same as above +if (&Proxy-State[0] != 0x01020304) { + update reply { + Filter-Id += "fail 0a" + } +} + +if (&Proxy-State[1] != 0x05060708) { + update reply { + Filter-Id += "fail 1" + } +} + +if (&Proxy-State[2] != 0x090a0b0c) { + update reply { + Filter-Id += "fail 2" + } +} + +# must not exist +if (&Proxy-State[3]) { + update reply { + Filter-Id += "fail 3" + } +} + +# +# The test passes only if no test above +# added a Filter-Id +# +if (!reply:Filter-Id) { + update reply { + Filter-Id := "filter" + } +}
\ No newline at end of file diff --git a/src/tests/keywords/update-delete b/src/tests/keywords/update-delete new file mode 100644 index 0000000..a5c2d5a --- /dev/null +++ b/src/tests/keywords/update-delete @@ -0,0 +1,40 @@ +# +# PRE: update +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update request { + Tmp-String-0 := 'foobarbaz' + Tmp-Integer-0 := 123456789 + Tmp-IP-Address-0 := 192.0.2.1 +} + +if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789) || (Tmp-IP-Address-0 != 192.0.2.1)) { + update { + reply:Filter-Id := 'fail' + } +} + +# Remove all attributes in the control list +update { + request: !* ANY +} + +# All attributes should now of been removed +if ((Tmp-String-0 && (Tmp-String-0 == 'foobarbaz')) || \ + (Tmp-Integer-0 && (Tmp-Integer-0 == 123456789)) || \ + (Tmp-IP-Address-0 && (Tmp-IP-Address-0 == 192.0.2.1))) { + update { + reply:Filter-Id := 'fail' + } +} + +# This will of been removed too +update request { + User-Password := 'hello' +} diff --git a/src/tests/keywords/update-error b/src/tests/keywords/update-error new file mode 100644 index 0000000..92e0ed2 --- /dev/null +++ b/src/tests/keywords/update-error @@ -0,0 +1,9 @@ +# +# PRE: update +# +# It's an error to update lists that don't exist. +# +update no-such-list { # ERROR + control:Cleartext-Password := 'hello' + reply:Filter-Id := "filter" +} diff --git a/src/tests/keywords/update-error-2 b/src/tests/keywords/update-error-2 new file mode 100644 index 0000000..1fe98f0 --- /dev/null +++ b/src/tests/keywords/update-error-2 @@ -0,0 +1,9 @@ +# +# PRE: update-error +# +# It's an error to update lists that don't exist. +# +update { + no-such-list:Cleartext-Password := 'hello' # ERROR + reply:Filter-Id := "filter" +} diff --git a/src/tests/keywords/update-error-3 b/src/tests/keywords/update-error-3 new file mode 100644 index 0000000..ffab73a --- /dev/null +++ b/src/tests/keywords/update-error-3 @@ -0,0 +1,10 @@ +# +# PRE: update-error +# +# It's an error to assign literal values which are not +# part of the set of enumerated values for an attribute +# +update { + Service-Type := 'hello' # ERROR + reply:Filter-Id := "filter" +} diff --git a/src/tests/keywords/update-exec b/src/tests/keywords/update-exec new file mode 100644 index 0000000..b9a0f73 --- /dev/null +++ b/src/tests/keywords/update-exec @@ -0,0 +1,94 @@ +# +# PRE: update if redundant +# +update control { + Cleartext-Password := 'hello' +} + +update reply { + Filter-Id := "filter" +} + +# +# Exec with script output to attribute +# +update request { + Tmp-String-0 = `/bin/sh -c "echo 'foo bar baz'"` +} + +if (Tmp-String-0 != "foo bar baz") { + update reply { + Filter-Id += "fail 1" + } +} + +# +# Exec with output to list (single attribute) +# +update { + request: = `/bin/sh -c "echo Tmp-String-0 := foo"` +} + +if (Tmp-String-0 != 'foo') { + update reply { + Filter-Id += "fail 2" + } +} + +# +# Exec with output to list (multiple attributes) +# +update { + request: = `/bin/sh -c 'echo Tmp-String-0 := foo, Tmp-String-1 := bar'` +} + +if ((Tmp-String-0 != 'foo') || (Tmp-String-1 != 'bar')) { + update reply { + Filter-Id += "fail 3" + } +} + +# +# Failed exec (malformed attributes) - check no attributes are added +# +update request { + Tmp-String-0 !* ANY + Tmp-String-1 !* ANY +} + +redundant { + group { + update { + request: = `/bin/sh -c 'echo Tmp-String-0 := foo, Tmp-String-1 ?= bar'` + } + } + ok +} +if (Tmp-String-0 || Tmp-String-1) { + update reply { + Filter-Id += "fail 4" + } +} + +# +# Exec with output to list - error code +# +update request { + Tmp-String-0 !* ANY + Tmp-String-1 !* ANY +} + +redundant { + group { + update { + request: = `/bin/sh -c 'echo Tmp-String-0 := foo; exit 64'` + } + } + ok +} +if (Tmp-String-0) { + update reply { + Filter-Id += "fail 5" + } +} + diff --git a/src/tests/keywords/update-filter b/src/tests/keywords/update-filter new file mode 100644 index 0000000..30f96be --- /dev/null +++ b/src/tests/keywords/update-filter @@ -0,0 +1,75 @@ +# +# PRE: update +# +update control { + Tmp-Integer-0 := 5 + Tmp-Integer-0 += 10 + Tmp-Integer-0 += 15 + Tmp-Integer-0 += 20 + Tmp-String-0 := 'foo' + Tmp-String-0 += 'baz' + Tmp-String-0 += 'boink' +} + +# +# Reset the request list +# +update { + &request: !* ANY + &request: += &control:[*] +} + +debug_request + +# +# Only matching attributes of the specified type should remain +# +update request { + &Tmp-Integer-0 == 10 +} + +if (&Tmp-Integer-0[0] != 10) { + update reply { + Filter-Id += "fail 1" + } +} + +if ("%{Tmp-Integer-0[#]}" != 1) { + update reply { + Filter-Id += "fail 2" + } +} + +if ("%{Tmp-String-0[#]}" != 3) { + update reply { + Filter-Id += "fail 3" + } +} + +debug_request + +# +# Only matching attributes of the specified type should remain +# +update request { + &Tmp-String-0 == 'baz' +} + +if (&Tmp-String-0[0] != 'baz') { + update reply { + Filter-Id += "fail 4" + } +} + +if ("%{Tmp-String-0[#]}" != 1) { + update reply { + Filter-Id += "fail 5" + } +} + +update { + control:Auth-Type := Accept + reply:Filter-Id := "filter" +} + +debug_request diff --git a/src/tests/keywords/update-index b/src/tests/keywords/update-index new file mode 100644 index 0000000..390aca7 --- /dev/null +++ b/src/tests/keywords/update-index @@ -0,0 +1,52 @@ +# +# PRE: update update-remove-index +# +# A more generic "update" mechanism +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := "filter" +} + +update { + control:Reply-Message += 'a' + control:Reply-Message += 'b' + control:Reply-Message += 'c' +} + +if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'b') || (&control:Reply-Message[2] != 'c')) { + update { + reply:Filter-Id := 'Fail 0' + } +} + +# Overwrite a specific index, and check the value here is replaced +update { + &control:Reply-Message[1] := 'd' +} + +if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'd') || (&control:Reply-Message[2] != 'c')) { + update { + reply:Filter-Id := 'Fail 1' + } +} + +# Check isolation... +update { + &control:Reply-Message[0] := &control:Reply-Message[0] +} + +if ((&control:Reply-Message[0] != 'a') || (&control:Reply-Message[1] != 'd') || (&control:Reply-Message[2] != 'c')) { + update { + reply:Filter-Id := 'Fail 2' + } +} + +# Verify we haven't acquired any extra.. + +if ("%{control:Reply-Message[#]}" != 3) { + update { + reply:Filter-Id := 'Fail 3' + } +} + diff --git a/src/tests/keywords/update-list-error b/src/tests/keywords/update-list-error new file mode 100644 index 0000000..2613055 --- /dev/null +++ b/src/tests/keywords/update-list-error @@ -0,0 +1,19 @@ +# +# PRE: update +# +# It's an error to update lists that don't exist. +# +update { + request := reply + config += request + reply !* ANY +} + +update { + reply += `/path/to/foo bar baz` +} + + +update { + request := nope # ERROR +} diff --git a/src/tests/keywords/update-operator b/src/tests/keywords/update-operator new file mode 100644 index 0000000..ccbcb16 --- /dev/null +++ b/src/tests/keywords/update-operator @@ -0,0 +1,85 @@ +# +# PRE: update +# + +# +# Set it. +# +update request { + NAS-Port := 1000 +} + +# +# Enforce it. +# +update request { + NAS-Port == 1000 +} + +if (NAS-Port != 1000) { + update reply { + Filter-Id += "fail 1" + } +} + +# +# Enforce to new lower value. +# +update request { + NAS-Port <= 500 +} + +if (NAS-Port != 500) { + update reply { + Filter-Id += "fail 2 - expected 500, got %{NAS-Port}" + } +} + +# +# Enforce to new higher value +# +update request { + NAS-Port >= 2000 +} + +if (NAS-Port != 2000) { + update reply { + Filter-Id += "fail 3 - expected 2000, got %{NAS-Port}" + } +} + +# +# Enforce value which previously didn't exist. +# +update request { + Idle-Timeout >= 14400 +} + +if (&request:Idle-Timeout != 14400) { + update reply { + Filter-Id += "fail Idle-Timeout >= 14400" + } +} + +# non-existent attribute +update request { + Class -= 0xabcdef +} + +update request { + Class -= &Class +} + +update request { + NAS-Port -= &NAS-Port +} + +if (!reply:Filter-Id) { + update control { + Cleartext-Password := 'hello' + } + + update reply { + Filter-Id := "filter" + } +} diff --git a/src/tests/keywords/update-prepend b/src/tests/keywords/update-prepend new file mode 100644 index 0000000..4ba9335 --- /dev/null +++ b/src/tests/keywords/update-prepend @@ -0,0 +1,65 @@ +# +# PRE: update +# +update control { + &Tmp-String-0 := 'foo' + &Tmp-String-0 += 'baz' +} + +# Reset the request list +update { + &request !* ANY + &request += &control +} + +debug_request + +# Prepend a single value +update request { + &Tmp-String-0 ^= 'boink' +} + +# The prepended value should be first followd by the other two +if (("%{Tmp-String-0[0]}" != 'boink') || ("%{Tmp-String-0[1]}" != 'foo') || ("%{Tmp-String-0[2]}" != 'baz')) { + update reply { + Filter-Id += "fail 1" + } +} + +if ("%{Tmp-String-0[#]}" != 3) { + update reply { + Filter-Id += "fail 1a" + } +} + +# Add an extra element to the start of control +update control { + &Tmp-String-0 ^= 'wibble' +} + +# Prepend control to request +update { + &request ^= &control +} + +debug_request + +# The attributes should now be "wibble", "foo", "baz", "boink", "foo", "baz" +if (("%{Tmp-String-0[0]}" != 'wibble') || ("%{Tmp-String-0[1]}" != 'foo') || ("%{Tmp-String-0[2]}" != 'baz') || ("%{Tmp-String-0[3]}" != 'boink') || ("%{Tmp-String-0[4]}" != 'foo') || ("%{Tmp-String-0[5]}" != 'baz')) { + update reply { + Filter-Id += "fail 2" + } +} + +if ("%{Tmp-String-0[#]}" != 6) { + update reply { + Filter-Id += "fail 2a" + } +} + +if (!reply:Filter-Id) { + update { + &request:User-Password := 'hello' + &reply:Filter-Id := 'filter' + } +} diff --git a/src/tests/keywords/update-remove-any b/src/tests/keywords/update-remove-any new file mode 100644 index 0000000..e0ef600 --- /dev/null +++ b/src/tests/keywords/update-remove-any @@ -0,0 +1,50 @@ +# +# PRE: update +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update { + request:Tmp-String-0 := 'foobarbaz' + request:Tmp-Integer-0 := 123456789 + request:Tmp-IP-Address-0 := 192.0.2.1 + request:Tmp-IP-Address-0 += 192.0.2.2 + control:Tmp-IP-Address-0 := 192.0.2.1 + control:Tmp-IP-Address-0 += 192.0.2.3 +} + +if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2)) { + update { + reply:Filter-Id := 'fail 1' + } +} + +# Remove all attributes in the control list +update { + request:Tmp-IP-Address-0 !* ANY +} + +# Non Tmp-IP-Address-0 address attributes should still be in the request list +if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) { + update reply { + reply:Filter-Id += 'fail 2' + } +} + +# There should be no Tmp-IP-Address attributes in the request list +if (Tmp-IP-Address-0 || ("%{Tmp-IP-Address-0[1]}" != '')) { + update { + reply:Filter-Id += 'fail 3' + } +} + +# But there should still be some in the control list +if ((control:Tmp-IP-Address-0 != 192.0.2.1) || ("%{control:Tmp-IP-Address-0[1]}" != 192.0.2.3)) { + update { + reply:Filter-Id += 'fail 4' + } +} diff --git a/src/tests/keywords/update-remove-index b/src/tests/keywords/update-remove-index new file mode 100644 index 0000000..58df9a5 --- /dev/null +++ b/src/tests/keywords/update-remove-index @@ -0,0 +1,100 @@ +# +# PRE: update update-remove-value +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update { + request:Tmp-String-0 := 'foobarbaz' + request:Tmp-Integer-0 := 123456789 + request:Tmp-IP-Address-0 := 192.0.2.1 + request:Tmp-IP-Address-0 += 192.0.2.2 + request:Tmp-IP-Address-0 += 192.0.2.3 + request:Tmp-IP-Address-0 += 192.0.2.2 + request:Tmp-IP-Address-0 += 192.0.2.4 +} + + +update request { + Tmp-IP-Address-0[3] -= 192.0.2.2 +} + +# Only the 1st, 2nd, 3rd and 5th Tmp-IP-Address attributes should still be in the list +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.1') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[2]}" != '192.0.2.3') || \ + ("%{Tmp-IP-Address-0[3]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[4]}" != '')) { + update reply { + Filter-Id += 'fail 1' + } +} + +# There's still a 192.0.2.2 but it's not at index 3 +update request { + Tmp-IP-Address-0[3] -= 192.0.2.2 +} + +# Should be the same as the previous result +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.1') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[2]}" != '192.0.2.3') || \ + ("%{Tmp-IP-Address-0[3]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[4]}" != '')) { + update reply { + Filter-Id += 'fail 2' + } +} + +# Remove whatever's at index 0 +update request { + Tmp-IP-Address-0[0] !* ANY +} + +# IP address at index 0 should be removed +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \ + ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[3]}" != '')) { + update reply { + Filter-Id += 'fail 3' + } +} + +# Remove whatever's at index 3 (should be nothing) +update request { + Tmp-IP-Address-0[3] !* ANY +} + +# Should be the same as the previous result +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \ + ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[3]}" != '')) { + update reply { + Filter-Id += 'fail 4' + } +} + +# Remove all instances of Tmp-IP-Address +update request { + Tmp-IP-Address-0 !* ANY +} + +# No more IP address attributes! +if ("%{Tmp-IP-Address-0[0]}" != '') { + update reply { + Filter-Id += 'fail 5' + } +} + +# Non Tmp-IP-Address-0 address attributes should still be in the request list +if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) { + update reply { + Filter-Id += 'fail 6' + } +} diff --git a/src/tests/keywords/update-remove-list b/src/tests/keywords/update-remove-list new file mode 100644 index 0000000..22ae577 --- /dev/null +++ b/src/tests/keywords/update-remove-list @@ -0,0 +1,40 @@ +# +# PRE: update +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update request { + Tmp-String-0 := 'foobarbaz' + Tmp-Integer-0 := 123456789 + Tmp-IP-Address-0 := 192.0.2.1 +} + +if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789) || (Tmp-IP-Address-0 != 192.0.2.1)) { + update reply { + Filter-Id += 'fail 0' + } +} + +# Remove all attributes in the control list +update { + request: !* ANY +} + +# All attributes should now of been removed +if ((Tmp-String-0 && (Tmp-String-0 == 'foobarbaz')) || \ + (Tmp-Integer-0 && (Tmp-Integer-0 == 123456789)) || \ + (Tmp-IP-Address-0 && (Tmp-IP-Address-0 == 192.0.2.1))) { + update reply { + Filter-Id := 'fail 1' + } +} + +# This will of been removed too +update request { + User-Password := 'hello' +} diff --git a/src/tests/keywords/update-remove-tag b/src/tests/keywords/update-remove-tag new file mode 100644 index 0000000..3328789 --- /dev/null +++ b/src/tests/keywords/update-remove-tag @@ -0,0 +1,275 @@ +# +# PRE: update update-remove-value update-remove-index update-tag +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update { + request:Tunnel-Server-Endpoint += '192.0.1.1' + request:Tunnel-Server-Endpoint += '192.0.1.2' + request:Tunnel-Server-Endpoint:1 += '192.0.1.1' + request:Tunnel-Server-Endpoint:2 += '192.0.2.1' + request:Tunnel-Server-Endpoint:2 += '192.0.2.2' + request:Tunnel-Server-Endpoint:3 += '192.0.3.1' + request:Tunnel-Server-Endpoint:3 += '192.0.3.2' + request:Tunnel-Server-Endpoint:3 += '192.0.3.3' + control: += request: +} + +# Check [#] is working correctly (should probably be another set of tests) +if (("%{request:Tunnel-Server-Endpoint[#]}" != 8) || \ + ("%{request:Tunnel-Server-Endpoint:0[#]}" != 2) || \ + ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \ + ("%{request:Tunnel-Server-Endpoint:2[#]}" != 2) || \ + ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) { + update reply { + Filter-Id += 'fail 0' + } +} + +update { + Tunnel-Server-Endpoint !* ANY +} + +# List should now be empty +if ("%{request:Tunnel-Server-Endpoint[#]}" != 0) { + update reply { + Filter-Id += 'fail 1' + } +} + +# Reset the list +update { + request: += control: +} + +# Now remove all Tunnel-Server-Endpoint attributes with :2 +update { + Tunnel-Server-Endpoint:2 !* ANY +} + +if (("%{request:Tunnel-Server-Endpoint[#]}" != 6) || \ + ("%{request:Tunnel-Server-Endpoint:0[#]}" != 2) || \ + ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \ + ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) { + update reply { + Filter-Id += 'fail 2' + } +} + +# Now remove all Tunnel-Server-Endpoint attributes with :0 (no tags) +update { + Tunnel-Server-Endpoint:0 !* ANY +} + +if (("%{request:Tunnel-Server-Endpoint[#]}" != 4) || \ + ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \ + ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:3[#]}" != 3)) { + update reply { + Filter-Id += 'fail 3' + } +} + +# Now remove all Tunnel-Server-Endpoint attributes with :3 +update { + Tunnel-Server-Endpoint:3 !* ANY +} + +if (("%{request:Tunnel-Server-Endpoint[#]}" != 1) || \ + ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:1[#]}" != 1) || \ + ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:3[#]}" != 0)) { + update reply { + Filter-Id += 'fail 4' + } +} + +# Now remove all Tunnel-Server-Endpoint attributes with :1 +update { + Tunnel-Server-Endpoint:1 !* ANY +} + +if (("%{request:Tunnel-Server-Endpoint[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:0[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:1[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:2[#]}" != 0) || \ + ("%{request:Tunnel-Server-Endpoint:3[#]}" != 0)) { + update reply { + Filter-Id += 'fail 5' + } +} + +# Reset the list +update { + request: += control: +} + +# Remove all Tunnel-Server-Endpoint attributes at :3[0] (none) +update { + Tunnel-Server-Endpoint:1[3] !* ANY +} + +if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') { + update reply { + Filter-Id += 'fail 6' + } +} + +if (Tunnel-Server-Endpoint:3[1] != '192.0.3.2') { + update reply { + Filter-Id += 'fail 7' + } +} + +if (Tunnel-Server-Endpoint:3[2] != '192.0.3.3') { + update reply { + Filter-Id += 'fail 8' + } +} + +# Remove all Tunnel-Server-Endpoint attributes at :3[1] +update { + Tunnel-Server-Endpoint:3[1] !* ANY +} + +if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') { + update reply { + Filter-Id += 'fail 9' + } +} + +if (Tunnel-Server-Endpoint:3[1] != '192.0.3.3') { + update reply { + Filter-Id += 'fail 10' + } +} + +# Remove any Tunnel-Server-Endpoint with a value of '192.0.1.1' (should remove both tagged and untagged versions) +update { + Tunnel-Server-Endpoint -= '192.0.1.1' +} + +# Also checks whether presence checks for tagged attributes work correctly +if (request:Tunnel-Server-Endpoint:1) { + update reply { + Filter-Id += 'fail 11' + } +} + +if (request:Tunnel-Server-Endpoint:0[0] != '192.0.1.2') { + update reply { + Filter-Id += 'fail 12' + } +} + +# Remove any Tunnel-Server-Endpoint with a value of '192.0.3.1' +update { + Tunnel-Server-Endpoint:3 -= '192.0.3.2' +} + +if (request:Tunnel-Server-Endpoint:3[0] != '192.0.3.1') { + update reply { + Filter-Id += 'fail 13' + } +} + +if (request:Tunnel-Server-Endpoint:3[1] != '192.0.3.3') { + update reply { + Filter-Id += 'fail 14' + } +} + +# Reset the list +update { + request: !* ANY +} +update { + request: += control: +} + +# Remove only the tagged version of '192.0.1.1' +update { + request:Tunnel-Server-Endpoint:1 -= '192.0.1.1' +} + +if (request:Tunnel-Server-Endpoint:0[0] != '192.0.1.1') { + update reply { + Filter-Id += 'fail 15' + } +} + +# Reset the list +update { + request: !* ANY +} +update { + request: += control: +} + +# Remove only the untagged version of '192.0.1.1' +update { + request:Tunnel-Server-Endpoint:0 -= '192.0.1.1' +} + +if (request:Tunnel-Server-Endpoint:1[0] != '192.0.1.1') { + update reply { + Filter-Id += 'fail 16' + } +} + +# Remove the value of Tunnel-Server-Endpoint:3 at index 1 only if it matches '192.0.3.3' (which it does) +update { + Tunnel-Server-Endpoint:3[1] -= '192.0.3.2' +} + +if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') { + update reply { + Filter-Id += 'fail 17' + } +} + +if (Tunnel-Server-Endpoint:3[1] != '192.0.3.3') { + update reply { + Filter-Id += 'fail 18' + } +} + +# Reset the list +update { + request: !* ANY +} +update { + request: += control: +} + +# Remove the value of Tunnel-Server-Endpoint:3 at index 1 only if it matches '192.0.3.4' (which it doesn't) +update { + Tunnel-Server-Endpoint:3[1] -= '192.0.3.4' +} + +if (Tunnel-Server-Endpoint:3[0] != '192.0.3.1') { + update reply { + Filter-Id += 'fail 19' + } +} + +if (Tunnel-Server-Endpoint:3[1] != '192.0.3.2') { + update reply { + Filter-Id += 'fail 20' + } +} + +if (Tunnel-Server-Endpoint:3[2] != '192.0.3.3') { + update reply { + Filter-Id += 'fail 21' + } +} + diff --git a/src/tests/keywords/update-remove-value b/src/tests/keywords/update-remove-value new file mode 100644 index 0000000..3fd1f94 --- /dev/null +++ b/src/tests/keywords/update-remove-value @@ -0,0 +1,116 @@ +# +# PRE: update +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update { + request:Tmp-String-0 := 'foobarbaz' + request:Tmp-Integer-0 := 123456789 + request:Tmp-IP-Address-0 := 192.0.2.1 + request:Tmp-IP-Address-0 += 192.0.2.2 + request:Tmp-IP-Address-0 += 192.0.2.3 + request:Tmp-IP-Address-0 += 192.0.2.4 + control:Tmp-IP-Address-0 := 192.0.2.1 + control:Tmp-IP-Address-0 += 192.0.2.3 +} + +if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || \ + ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2) || \ + ("%{Tmp-IP-Address-0[2]}" != 192.0.2.3) || \ + ("%{Tmp-IP-Address-0[3]}" != 192.0.2.4)) { + update reply { + Filter-Id += 'fail 0' + } +} + +# Remove Tmp-IP-Address-0 with a specific value +update { + request:Tmp-IP-Address-0 -= 192.0.2.1 +} + +# Only the 2nd, 3rd and 4th Tmp-IP-Address attributes should still be in the list +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.3') || \ + ("%{Tmp-IP-Address-0[2]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[3]}" != '')) { + update reply { + Filter-Id += 'fail 1' + } +} + +# Remove Tmp-IP-Address-0 with a specific value (somewhere in the middle) +update { + request:Tmp-IP-Address-0 -= 192.0.2.3 +} + +# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[2]}" != '')) { + update reply { + Filter-Id += 'fail 2' + } +} + +# Remove Tmp-IP-Address-0 with a specific value (which doesn't exist) +update { + request:Tmp-IP-Address-0 -= 192.0.2.3 +} + +# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '192.0.2.4') || \ + ("%{Tmp-IP-Address-0[2]}" != '')) { + update reply { + Filter-Id += 'fail 3' + } +} + +# Remove Tmp-IP-Address-4 (which doesn't exist - more to check for SEGV/assert) +update { + request:Tmp-IP-Address-4 -= 192.0.2.3 +} + +# Remove Tmp-IP-Address-0 with a specific value +update { + request:Tmp-IP-Address-0 -= 192.0.2.4 +} + +# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list +if (("%{Tmp-IP-Address-0[0]}" != '192.0.2.2') || \ + ("%{Tmp-IP-Address-0[1]}" != '')) { + update reply { + Filter-Id += 'fail 4' + } +} + +# Remove Tmp-IP-Address-0 with a specific value +update { + request:Tmp-IP-Address-0 -= 192.0.2.2 +} + +# Only the 1st, and 3rd Tmp-IP-Address attributes should still be in the list +if ("%{Tmp-IP-Address-0[0]}" != '') { + update reply { + Filter-Id += 'fail 5' + } +} + +# Non Tmp-IP-Address-0 address attributes should still be in the request list +if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) { + update reply { + Filter-Id += 'fail 6' + } +} + +# But there should still be some in the control list +if (("%{control:Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{control:Tmp-IP-Address-0[1]}" != 192.0.2.3)) { + update { + Filter-Id += 'fail 7' + } +} diff --git a/src/tests/keywords/update-tag b/src/tests/keywords/update-tag new file mode 100644 index 0000000..15afd59 --- /dev/null +++ b/src/tests/keywords/update-tag @@ -0,0 +1,176 @@ +# +# PRE: update +# +# Remove all attributes in a list +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + +update request { + Tunnel-Server-Endpoint:0 := '192.0.1.1' # Should not be tagged + Tunnel-Server-Endpoint:0 += '192.0.1.2' # Should not be tagged + Tunnel-Server-Endpoint:1 := '192.0.2.1' + Tunnel-Server-Endpoint:1 += '192.0.2.2' + Tunnel-Server-Endpoint:2 := '192.0.3.1' + Tunnel-Server-Endpoint:2 += '192.0.3.2' +} + +update request { + Tmp-Integer-0 := "%{debug_attr:request:}" +} + + +# +# Selecting on attributes which have no tag (0) +# +if (Tunnel-Server-Endpoint:0[0] != '192.0.1.1') { + update { + reply:Filter-Id += 'fail 1' + } +} + +if (Tunnel-Server-Endpoint:0[1] != '192.0.1.2') { + update { + reply:Filter-Id += 'fail 2' + } +} + +# +# Selecting on attributes with no tag specified (should match all of that type) +# +if (Tunnel-Server-Endpoint[0] != '192.0.1.1') { + update { + reply:Filter-Id += 'fail 3' + } +} + +if (Tunnel-Server-Endpoint[1] != '192.0.1.2') { + update { + reply:Filter-Id += 'fail 4' + } +} + +if (Tunnel-Server-Endpoint[2] != '192.0.2.1') { + update { + reply:Filter-Id += 'fail 5' + } +} + +# +# Now the none xlat version +# +# Check that access attributes by tag works first +if (Tunnel-Server-Endpoint:2 != '192.0.3.1') { + update { + reply:Filter-Id += 'fail 6' + } +} + +if (Tunnel-Server-Endpoint:2 == '192.0.3.2') { + update { + reply:Filter-Id += 'fail 7' + } +} + +if (Tunnel-Server-Endpoint:1 != '192.0.2.1') { + update { + reply:Filter-Id += 'fail 8' + } +} + +# Get the first instance of Tunnel-Server-Endpoint:2 +if (Tunnel-Server-Endpoint:2[0] != '192.0.3.1') { + update { + reply:Filter-Id += 'fail 9' + } +} + +# Get the first instance of Tunnel-Server-Endpoint:2 +if (Tunnel-Server-Endpoint:2[1] != '192.0.3.2') { + update { + reply:Filter-Id += 'fail 10' + } +} + +# +# Assignment (bare) +# +update request { + Tmp-String-1 += &Tunnel-Server-Endpoint:2 # 0 + Tmp-String-1 += &Tunnel-Server-Endpoint:2 # 1 + Tmp-String-1 += &Tunnel-Server-Endpoint:1 # 2 + Tmp-String-1 += &Tunnel-Server-Endpoint:2[0] # 3 + Tmp-String-1 += &Tunnel-Server-Endpoint:2[1] # 4 + Tmp-String-1 += &Tunnel-Server-Endpoint:0[0] # 5 + Tmp-String-1 += &Tunnel-Server-Endpoint:0[1] # 6 + Tmp-String-1 += &Tunnel-Server-Endpoint:0[2] # 7 (No attribute should be added here) + Tmp-String-1 += &Tunnel-Server-Endpoint[0] # 8 + Tmp-String-1 += &Tunnel-Server-Endpoint[1] # 9 + Tmp-String-1 += &Tunnel-Server-Endpoint[2] # 10 +} + +# Check that access attributes by tag works first +if (Tmp-String-1[0] != '192.0.3.1') { + update { + reply:Filter-Id += 'fail 11' + } +} + +if (Tmp-String-1[1] == '192.0.3.2') { + update { + reply:Filter-Id += 'fail 12' + } +} + +if (Tmp-String-1[2] != '192.0.2.1') { + update { + reply:Filter-Id += 'fail 13' + } +} + +# Get the first instance of Tunnel-Server-Endpoint:2 +if (Tmp-String-1[3] != '192.0.3.1') { + update { + reply:Filter-Id += 'fail 14' + } +} + +# Get the first instance of Tunnel-Server-Endpoint:2 +if (Tmp-String-1[4] != '192.0.3.2') { + update { + reply:Filter-Id += 'fail 15' + } +} + +# Now check the assignment +if (Tmp-String-1[5] != '192.0.1.1') { + update { + reply:Filter-Id += 'fail 16' + } +} + +if (Tmp-String-1[6] != '192.0.1.2') { + update { + reply:Filter-Id += 'fail 17' + } +} + +if (Tmp-String-1[7] != '192.0.1.1') { + update { + reply:Filter-Id += 'fail 19' + } +} + +if (Tmp-String-1[8] != '192.0.1.2') { + update { + reply:Filter-Id += 'fail 20' + } +} + +if (Tmp-String-1[9] != '192.0.2.1') { + update { + reply:Filter-Id += 'fail 21' + } +} diff --git a/src/tests/keywords/update-xlat b/src/tests/keywords/update-xlat new file mode 100644 index 0000000..59230dc --- /dev/null +++ b/src/tests/keywords/update-xlat @@ -0,0 +1,61 @@ +# +# PRE: update +# +# Form attribute references with xlats +# +update { + control:Cleartext-Password := 'hello' + reply:Filter-Id := 'filter' +} + + +update request { + Tmp-String-0 := 'Tmp-String-1' +} + +# +# Shouldn't update Tmp-String-0, should instead update Tmp-String-1 +# ... maybe this is what Alan meant when he was talking about people +# doing stupid things with this feature. +# +update request { + "%{Tmp-String-0}" := 'hello' +} + +if (&Tmp-String-1 != 'hello') { + update reply { + Filter-Id += 'Fail 0' + } +} + +if (&Tmp-String-0 == 'hello') { + update reply { + Filter-Id += 'Fail 1' + } +} + +# +# Try updating an attribute specified by an OID string +# +update { + Tmp-Integer-0 := 11344 +} +update { + "Vendor-%{Tmp-Integer-0}-Attr-1" := 127.0.0.1 +} + +if (&FreeRADIUS-Proxied-To != 127.0.0.1) { + update reply { + Filter-Id += 'Fail 2' + } +} + +update { + "Attr-%{attr_num:Tmp-String-1}" := 'hello2' +} + +if (&Tmp-String-1 != 'hello2') { + update reply { + Filter-Id += 'Fail 3' + } +} |