Skip to content

[TACACS] Add UT to check TACACS will send remote address to server.#7702

Merged
qiluo-msft merged 5 commits intosonic-net:masterfrom
liuh-80:dev/liuh/test-remote-address
Apr 6, 2023
Merged

[TACACS] Add UT to check TACACS will send remote address to server.#7702
qiluo-msft merged 5 commits intosonic-net:masterfrom
liuh-80:dev/liuh/test-remote-address

Conversation

@liuh-80
Copy link
Contributor

@liuh-80 liuh-80 commented Mar 9, 2023

What I did
Add UT to check TACACS will send remote address to server.

Why I did it
nss-tacplus add a patch to send remote address to server with this PR:sonic-net/sonic-buildimage#12190

To protect the patch, add this UT to check TACACS will send remote address to server.

How I verified it
Pass all UT.

Details if related

@mssonicbld

This comment was marked as resolved.

@mssonicbld

This comment was marked as resolved.

@liuh-80 liuh-80 marked this pull request as ready for review March 10, 2023 01:08
@liuh-80 liuh-80 requested a review from qiluo-msft March 10, 2023 01:08
# Extract received data from tac_plus.log, then use grep to check if the received data contains hex_string
sed_command = "sed -n 's/.*-> 0x\(..\).*/\\1/p' /var/log/tac_plus.log | sed ':a; N; $!ba; s/\\n//g' | grep '{0}'".format(hex_string) # noqa W605 E501
res = ptfhost.shell(sed_command)
logger.info(sed_command) # lgtm [py/clear-text-logging-sensitive-data]
Copy link
Contributor

@qiluo-msft qiluo-msft Mar 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

lgtm is deprecated. Is this comment needed? #Closed

hex_string = hex.decode()

# Extract received data from tac_plus.log, then use grep to check if the received data contains hex_string
sed_command = "sed -n 's/.*-> 0x\(..\).*/\\1/p' /var/log/tac_plus.log | sed ':a; N; $!ba; s/\\n//g' | grep '{0}'".format(hex_string) # noqa W605 E501
Copy link
Contributor

@qiluo-msft qiluo-msft Mar 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

W605

I guess you intend to suppress some static code analysis warnings or errors. Could you explain in details so we can review in PR? #Closed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, add detail in comments:

        W605 : Invalid escape sequence. Flake8 can't handle sed command escape sequence, so will report false alert.
        E501 : Line too long. Following sed command difficult to split to multiple line.

hex_string = hex.decode()

# Extract received data from tac_plus.log, then use grep to check if the received data contains hex_string
sed_command = "sed -n 's/.*-> 0x\(..\).*/\\1/p' /var/log/tac_plus.log | sed ':a; N; $!ba; s/\\n//g' | grep '{0}'".format(hex_string) # noqa W605 E501
Copy link
Contributor

@qiluo-msft qiluo-msft Mar 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tac_plus.log

I did not get the relationship between

  1. server received a 'remote address' from client
  2. tac_plus.log matched some pattern.
    Could you explain it in details? #Closed

Copy link
Contributor Author

@liuh-80 liuh-80 Mar 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed, add detail in comments:

  1. tac_plus server start with '-d 2058' parameter to log received data in following format in tac_plus.log:

     Thu Mar  9 06:26:16 2023 [75483]: data[140] = 0xf8, xor'ed with hash[12] = 0xab -> 0x53
     Thu Mar  9 06:26:16 2023 [75483]: data[141] = 0x8d, xor'ed with hash[13] = 0xc2 -> 0x4f
    

    In above log, the 'data[140] = 0xf8' is received data.

  2. Following sed command will extract the received data from tac_plus.log:
    sed -n 's/.-> 0x(..)./\1/p' /var/log/tac_plus.log

    So the result will be:
        f8
        8d
    
  3. Following set command will join all received data to hex string:
    sed ':a; N; $!ba; s/\n//g'

    So the result will be:
        f88d.....
    
  4. Then the grep command will check if the received hex data containes expected hex string.
    grep '{0}'".format(hex_string)

In our case, because we send remote address to TACACS server, so:

  1. we convert remote address to hex string:
    "10.20.0.1" => 31302E32302E302E31
  2. We check if the received hex data contains "31302E32302E302E31", if it contains, then we know client do send remote address in TACACS+ package, so the UT passed.

@mssonicbld
Copy link
Collaborator

The pre-commit check detected issues in the files touched by this pull request.
The detected issues may be old or new. For new issues, please try to fix them.

For old issues, it is not mandatory to fix them because they were not caused by this change. It is unfair to blame
author of this pull request. But if you can take extra effort to fix the old issues as well, that would be great!

Detailed pre-commit check results:
trim trailing whitespace.................................................Passed
fix end of files.........................................................Passed
check yaml...........................................(no files to check)Skipped
check for added large files..............................................Passed
check python ast.........................................................Passed
flake8...................................................................Failed
- hook id: flake8
- exit code: 1

tests/tacacs/test_accounting.py:141:38: W605 invalid escape sequence '('
tests/tacacs/test_accounting.py:141:42: W605 invalid escape sequence ')'

To run the pre-commit checks locally, you can follow below steps:

  1. Ensure that default python is python3. In sonic-mgmt docker container, default python is python2. You can run
    the check by activating the python3 virtual environment in sonic-mgmt docker container or outside of sonic-mgmt
    docker container.
  2. Ensure that the pre-commit package is installed:
sudo pip install pre-commit
  1. Go to repository root folder
  2. Install the pre-commit hooks:
pre-commit install
  1. Use pre-commit to check staged file:
pre-commit
  1. Alternatively, you can check committed files using:
pre-commit run --from-ref <commit_id> --to-ref <commit_id>

@qiluo-msft qiluo-msft merged commit f6dda4a into sonic-net:master Apr 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants