diff options
Diffstat (limited to 'tests')
20 files changed, 0 insertions, 1455 deletions
diff --git a/tests/functional/README.md b/tests/functional/README.md deleted file mode 100644 index 4cac22b6..00000000 --- a/tests/functional/README.md +++ /dev/null @@ -1,27 +0,0 @@ -# Moon Functional Test - -[Test Platform Setup](../../tools/moon_kubernetes/README.md) - - -### Pod Functional Test -Launch functional [test scenario](tests/functional/scenario_enabled) : -```bash -sudo pip install python_moonclient --upgrade -cd $MOON_HOME/tests/functional/scenario_tests -moon_create_pdp --consul-host=$MOON_HOST --consul-port=30005 -v rbac_large.py -moon_get_keystone_project --consul-host=$MOON_HOST --consul-port=30005 -moon_get_pdp --consul-host=$MOON_HOST --consul-port=30005 -moon_map_pdp_to_project "<pdp_id>" "<keystone_project_id>" -moon_send_authz_to_wrapper --consul-host=$MOON_HOST --consul-port=30005 --authz-host=$WRAPPER_HOST --authz-port=$WRAPPER_PORT -v rbac_large.py -``` - -To retrieve the wrapper information, use the following command: -```bash -kubectl get -n moon services | grep wrapper -``` - -Launch functional tests: -```bash -cd $MOON_HOME -sudo bash $TARGET_MODULE/tests/functional_pod/run_functional_tests.sh -``` diff --git a/tests/functional/run_tests.sh b/tests/functional/run_tests.sh deleted file mode 100755 index cf55c3bd..00000000 --- a/tests/functional/run_tests.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/usr/bin/env bash - -MOON_HOME=${1:-.} - -echo "Starting Moon Functional Tests on ${MOON_HOME}" - -cd ${MOON_HOME} - -COMPONENTS="moon_manager moon_wrapper" - -for dir in ${COMPONENTS}; do - echo "Testing component ${dir}" - cd ${MOON_HOME}/${dir} - bash ../tests/functional/run_tests_for_component.sh - cd - -done - -# TODO: download tests results diff --git a/tests/functional/run_tests_for_component.sh b/tests/functional/run_tests_for_component.sh deleted file mode 100644 index 6c6a0330..00000000 --- a/tests/functional/run_tests_for_component.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash - -CUR_PWD=$(pwd) -INPUT_FILE=../tools/moon_kubernetes/templates/moon_functest.yaml -OUTPUT_FILE=tests/functional_pod/moon_functest.yaml - -echo current working directory: ${CUR_PWD} - -cat ${INPUT_FILE} | sed "s|{{PATH}}|${CUR_PWD}|" > ${OUTPUT_FILE} - -kubectl create -f ${OUTPUT_FILE} - -sleep 5 -kubectl get -n moon jobs -echo OUTPUT is $? -if [ "$?" -ne 0 ] -then - sleep 5 - kubectl get -n moon jobs -fi - -echo "waiting for FuncTests (it may takes time)..." -echo -e "\033[35m" -sed '/<END OF JOB>/q' <(kubectl logs -n moon jobs/functest -f) -echo -e "\033[m" - -kubectl delete -f ${OUTPUT_FILE} diff --git a/tests/functional/scenario_available/delegation.py b/tests/functional/scenario_available/delegation.py deleted file mode 100644 index 839e74ce..00000000 --- a/tests/functional/scenario_available/delegation.py +++ /dev/null @@ -1,40 +0,0 @@ - -pdp_name = "pdp1" -policy_name = "Delegation policy example" -model_name = "Delegation" - -subjects = {"user0": "", } -objects = {"user1": "", } -actions = {"delegate": ""} - -subject_categories = {"subjectid": "", } -object_categories = {"delegated": "", } -action_categories = {"delegation-action": "", } - -subject_data = {"subjectid": {"user0": ""}} -object_data = {"delegated": {"user1": ""}} -action_data = {"delegation-action": {"delegate": ""}} - -subject_assignments = {"user0": {"subjectid": "user0"}} -object_assignments = {"user1": {"delegated": "user1"}} -action_assignments = {"delegate": {"delegation-action": "delegate"}} - -meta_rule = { - "session": {"id": "", "value": ("subjectid", "delegated", "delegation-action")}, -} - -rules = { - "session": ( - { - "rule": ("user0", "user1", "delegate"), - "instructions": ( - { - "update": {"request:subject": "user1"} # update the current user with "user1" - }, - {"chain": {"security_pipeline": "rbac"}} - ) - }, - ) -} - - diff --git a/tests/functional/scenario_available/mls.py b/tests/functional/scenario_available/mls.py deleted file mode 100644 index 0e6285c9..00000000 --- a/tests/functional/scenario_available/mls.py +++ /dev/null @@ -1,59 +0,0 @@ - -pdp_name = "pdp_mls" -policy_name = "MLS Policy example" -model_name = "MLS" -policy_genre = "authz" - -subjects = {"adminuser": "", "user1": "", "user2": "", } -objects = {"vm0": "", "vm1": "", } -actions = {"start": "", "stop": ""} - -subject_categories = {"subject-security-level": "", } -object_categories = {"object-security-level": "", } -action_categories = {"action-type": "", } - -subject_data = { - "subject-security-level": {"low": "", "medium": "", "high": ""}, -} -object_data = { - "object-security-level": {"low": "", "medium": "", "high": ""}, -} -action_data = {"action-type": {"vm-action": "", "storage-action": "", }} - -subject_assignments = { - "adminuser": {"subject-security-level": "high"}, - "user1": {"subject-security-level": "medium"}, -} -object_assignments = { - "vm0": {"object-security-level": "medium"}, - "vm1": {"object-security-level": "low"}, -} -action_assignments = { - "start": {"action-type": "vm-action"}, - "stop": {"action-type": "vm-action"} -} - -meta_rule = { - "mls": { - "id": "", - "value": ("subject-security-level", - "object-security-level", - "action-type")}, -} - -rules = { - "mls": ( - { - "rule": ("high", "medium", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - { - "rule": ("high", "low", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - { - "rule": ("medium", "low", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - ) -} diff --git a/tests/functional/scenario_available/rbac.py b/tests/functional/scenario_available/rbac.py deleted file mode 100644 index 25c010fd..00000000 --- a/tests/functional/scenario_available/rbac.py +++ /dev/null @@ -1,61 +0,0 @@ - -pdp_name = "pdp_rbac" -policy_name = "RBAC policy example" -model_name = "RBAC" -policy_genre = "authz" - -subjects = {"adminuser": "", "user1": "", } -objects = {"vm0": "", "vm1": "", } -actions = {"start": "", "stop": ""} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": {"admin": "", "employee": "", "*": ""}} -object_data = {"id": {"vm0": "", "vm1": "", "*": ""}} -action_data = {"action-type": {"vm-action": "", "*": ""}} - -subject_assignments = { - "adminuser": - ({"role": "admin"}, {"role": "employee"}, {"role": "*"}), - "user1": - ({"role": "employee"}, {"role": "*"}), -} -object_assignments = { - "vm0": - ({"id": "vm0"}, {"id": "*"}), - "vm1": - ({"id": "vm1"}, {"id": "*"}) -} -action_assignments = { - "start": - ({"action-type": "vm-action"}, {"action-type": "*"}), - "stop": - ({"action-type": "vm-action"}, {"action-type": "*"}) -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": ( - { - "rule": ("admin", "vm0", "vm-action"), - "instructions": ( - {"decision": "grant"}, - # "grant" to immediately exit, - # "continue" to wait for the result of next policy - ) - }, - { - "rule": ("employee", "vm1", "vm-action"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) -} - - diff --git a/tests/functional/scenario_available/rbac_custom_100.py b/tests/functional/scenario_available/rbac_custom_100.py deleted file mode 100644 index 9ee55dbd..00000000 --- a/tests/functional/scenario_available/rbac_custom_100.py +++ /dev/null @@ -1,89 +0,0 @@ -import random - -pdp_name = "pdp_100" -policy_name = "RBAC policy example 100 users" -model_name = "RBAC" -policy_genre = "authz" - -SUBJECT_NUMBER = 100 -OBJECT_NUMBER = 100 -ROLE_NUMBER = 50 - -subjects = {} -for _id in range(SUBJECT_NUMBER): - subjects["user{}".format(_id)] = "" -objects = {} -for _id in range(OBJECT_NUMBER): - objects["vm{}".format(_id)] = "" -actions = { - "start": "", - "stop": "", - "pause": "", - "unpause": "", - "destroy": "", -} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": {"admin": "", "*": ""}} -for _id in range(ROLE_NUMBER): - subject_data["role"]["role{}".format(_id)] = "" -object_data = {"id": {"*": ""}} -for _id in range(OBJECT_NUMBER): - object_data["id"]["vm{}".format(_id)] = "" -action_data = {"action-type": { - "vm-read": "", - "vm-write": "", - "*": "" -}} - -subject_assignments = {} -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - subject_assignments["user{}".format(_id)] = [{"role": _role}, {"role": "*"}] -object_assignments = {"vm0": ({"id": "vm0"}, {"id": "*"}), "vm1": ({"id": "vm1"}, {"id": "*"})} -for _id in range(OBJECT_NUMBER): - object_assignments["vm{}".format(_id)] = [{"id": "vm{}".format(_id)}, {"id": "*"}] -action_assignments = { - "start": ({"action-type": "vm-write"}, {"action-type": "*"}), - "stop": ({"action-type": "vm-write"}, {"action-type": "*"}), - "pause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "unpause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "destroy": ({"action-type": "vm-write"}, {"action-type": "*"}), -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": [ - { - "rule": ("admin", "vm0", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("admin", "vm0", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ] -} - -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - _vm = "vm{}".format(random.randrange(OBJECT_NUMBER)) - _action = random.choice(list(action_data['action-type'].keys())) - rules["rbac"].append( - { - "rule": (_role, _vm, _action), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) diff --git a/tests/functional/scenario_available/rbac_custom_1000.py b/tests/functional/scenario_available/rbac_custom_1000.py deleted file mode 100644 index d6850485..00000000 --- a/tests/functional/scenario_available/rbac_custom_1000.py +++ /dev/null @@ -1,89 +0,0 @@ -import random - -pdp_name = "pdp_1000" -policy_name = "RBAC policy example 1000 users" -model_name = "RBAC" -policy_genre = "authz" - -SUBJECT_NUMBER = 1000 -OBJECT_NUMBER = 500 -ROLE_NUMBER = 50 - -subjects = {} -for _id in range(SUBJECT_NUMBER): - subjects["user{}".format(_id)] = "" -objects = {} -for _id in range(OBJECT_NUMBER): - objects["vm{}".format(_id)] = "" -actions = { - "start": "", - "stop": "", - "pause": "", - "unpause": "", - "destroy": "", -} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": {"admin": "", "*": ""}} -for _id in range(ROLE_NUMBER): - subject_data["role"]["role{}".format(_id)] = "" -object_data = {"id": {"*": ""}} -for _id in range(OBJECT_NUMBER): - object_data["id"]["vm{}".format(_id)] = "" -action_data = {"action-type": { - "vm-read": "", - "vm-write": "", - "*": "" -}} - -subject_assignments = {} -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - subject_assignments["user{}".format(_id)] = [{"role": _role}, {"role": "*"}] -object_assignments = {"vm0": ({"id": "vm0"}, {"id": "*"}), "vm1": ({"id": "vm1"}, {"id": "*"})} -for _id in range(OBJECT_NUMBER): - object_assignments["vm{}".format(_id)] = [{"id": "vm{}".format(_id)}, {"id": "*"}] -action_assignments = { - "start": ({"action-type": "vm-write"}, {"action-type": "*"}), - "stop": ({"action-type": "vm-write"}, {"action-type": "*"}), - "pause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "unpause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "destroy": ({"action-type": "vm-write"}, {"action-type": "*"}), -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": [ - { - "rule": ("admin", "vm0", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("admin", "vm0", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ] -} - -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - _vm = "vm{}".format(random.randrange(OBJECT_NUMBER)) - _action = random.choice(list(action_data['action-type'].keys())) - rules["rbac"].append( - { - "rule": (_role, _vm, _action), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) diff --git a/tests/functional/scenario_available/rbac_custom_50.py b/tests/functional/scenario_available/rbac_custom_50.py deleted file mode 100644 index e1437cf4..00000000 --- a/tests/functional/scenario_available/rbac_custom_50.py +++ /dev/null @@ -1,89 +0,0 @@ -import random - -pdp_name = "pdp_50" -policy_name = "RBAC policy example 50 users" -model_name = "RBAC" -policy_genre = "authz" - -SUBJECT_NUMBER = 50 -OBJECT_NUMBER = 50 -ROLE_NUMBER = 10 - -subjects = {} -for _id in range(SUBJECT_NUMBER): - subjects["user{}".format(_id)] = "" -objects = {} -for _id in range(OBJECT_NUMBER): - objects["vm{}".format(_id)] = "" -actions = { - "start": "", - "stop": "", - "pause": "", - "unpause": "", - "destroy": "", -} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": {"admin": "", "*": ""}} -for _id in range(ROLE_NUMBER): - subject_data["role"]["role{}".format(_id)] = "" -object_data = {"id": {"*": ""}} -for _id in range(OBJECT_NUMBER): - object_data["id"]["vm{}".format(_id)] = "" -action_data = {"action-type": { - "vm-read": "", - "vm-write": "", - "*": "" -}} - -subject_assignments = {} -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - subject_assignments["user{}".format(_id)] = [{"role": _role}, {"role": "*"}] -object_assignments = {"vm0": ({"id": "vm0"}, {"id": "*"}), "vm1": ({"id": "vm1"}, {"id": "*"})} -for _id in range(OBJECT_NUMBER): - object_assignments["vm{}".format(_id)] = [{"id": "vm{}".format(_id)}, {"id": "*"}] -action_assignments = { - "start": ({"action-type": "vm-write"}, {"action-type": "*"}), - "stop": ({"action-type": "vm-write"}, {"action-type": "*"}), - "pause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "unpause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "destroy": ({"action-type": "vm-write"}, {"action-type": "*"}), -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": [ - { - "rule": ("admin", "vm0", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("admin", "vm0", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ] -} - -for _id in range(SUBJECT_NUMBER): - _role = "role{}".format(random.randrange(ROLE_NUMBER)) - _vm = "vm{}".format(random.randrange(OBJECT_NUMBER)) - _action = random.choice(list(action_data['action-type'].keys())) - rules["rbac"].append( - { - "rule": (_role, _vm, _action), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) diff --git a/tests/functional/scenario_available/rbac_large.py b/tests/functional/scenario_available/rbac_large.py deleted file mode 100644 index ef5dd9b2..00000000 --- a/tests/functional/scenario_available/rbac_large.py +++ /dev/null @@ -1,233 +0,0 @@ - -pdp_name = "pdp1" -policy_name = "RBAC policy example" -model_name = "RBAC" -policy_genre = "authz" - -subjects = { - "user0": "", - "user1": "", - "user2": "", - "user3": "", - "user4": "", - "user5": "", - "user6": "", - "user7": "", - "user8": "", - "user9": "", -} -objects = { - "vm0": "", - "vm1": "", - "vm2": "", - "vm3": "", - "vm4": "", - "vm5": "", - "vm6": "", - "vm7": "", - "vm8": "", - "vm9": "", -} -actions = { - "start": "", - "stop": "", - "pause": "", - "unpause": "", - "destroy": "", -} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": { - "admin": "", - "employee": "", - "dev1": "", - "dev2": "", - "*": "" -}} -object_data = {"id": { - "vm0": "", - "vm1": "", - "vm2": "", - "vm3": "", - "vm4": "", - "vm5": "", - "vm6": "", - "vm7": "", - "vm8": "", - "vm9": "", - "*": "" -}} -action_data = {"action-type": { - "vm-read": "", - "vm-write": "", - "*": "" -}} - -subject_assignments = { - "user0": ({"role": "employee"}, {"role": "*"}), - "user1": ({"role": "employee"}, {"role": "*"}), - "user2": ({"role": "dev1"}, {"role": "*"}), - "user3": ({"role": "dev1"}, {"role": "*"}), - "user4": ({"role": "dev1"}, {"role": "*"}), - "user5": ({"role": "dev1"}, {"role": "*"}), - "user6": ({"role": "dev2"}, {"role": "*"}), - "user7": ({"role": "dev2"}, {"role": "*"}), - "user8": ({"role": "dev2"}, {"role": "*"}), - "user9": ({"role": "dev2"}, {"role": "*"}), -} -object_assignments = { - "vm0": ({"id": "vm0"}, {"id": "*"}), - "vm1": ({"id": "vm1"}, {"id": "*"}), - "vm2": ({"id": "vm2"}, {"id": "*"}), - "vm3": ({"id": "vm3"}, {"id": "*"}), - "vm4": ({"id": "vm4"}, {"id": "*"}), - "vm5": ({"id": "vm5"}, {"id": "*"}), - "vm6": ({"id": "vm6"}, {"id": "*"}), - "vm7": ({"id": "vm7"}, {"id": "*"}), - "vm8": ({"id": "vm8"}, {"id": "*"}), - "vm9": ({"id": "vm9"}, {"id": "*"}), -} -action_assignments = { - "start": ({"action-type": "vm-write"}, {"action-type": "*"}), - "stop": ({"action-type": "vm-write"}, {"action-type": "*"}), - "pause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "unpause": ({"action-type": "vm-read"}, {"action-type": "*"}), - "destroy": ({"action-type": "vm-write"}, {"action-type": "*"}), -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": ( - { - "rule": ("admin", "vm0", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("admin", "vm0", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - # Rules for grant all employee to do read actions to all VM except vm0 - { - "rule": ("employee", "vm1", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm2", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm3", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm4", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm5", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm6", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm7", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm8", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("employee", "vm9", "vm-read"), - "instructions": ( - {"decision": "grant"}, - ) - }, - # Rules for grant all dev1 to do read actions to some VM - { - "rule": ("dev1", "vm1", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev1", "vm2", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev1", "vm3", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev1", "vm4", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - # Rules for grant all dev2 to do read actions to some VM - { - "rule": ("dev2", "vm5", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev2", "vm6", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev2", "vm7", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev2", "vm8", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - { - "rule": ("dev2", "vm9", "vm-write"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) -} - - diff --git a/tests/functional/scenario_available/rbac_mls.py b/tests/functional/scenario_available/rbac_mls.py deleted file mode 100644 index 8a5362ea..00000000 --- a/tests/functional/scenario_available/rbac_mls.py +++ /dev/null @@ -1,50 +0,0 @@ - -pdp_name = "pdp1" -policy_name = "Multi policy example" -model_name = "RBAC" - -subjects = {"user0": "", "user1": "", "user2": "", } -objects = {"vm0": "", "vm1": "", } -actions = {"start": "", "stop": ""} - -subject_categories = {"role": "", "subject-security-level": "", } -object_categories = {"id": "", "object-security-level": "", } -action_categories = {"action-type": "", } - -subject_data = { - "role": {"admin": "", "employee": ""}, - "subject-security-level": {"low": "", "medium": "", "high": ""}, -} -object_data = { - "id": {"vm1": "", "vm2": ""}, - "object-security-level": {"low": "", "medium": "", "high": ""}, -} -action_data = {"action-type": {"vm-action": "", "storage-action": "", }} - -subject_assignments = { - "user0": {"role": "admin", "subject-security-level": "high"}, - "user1": {"role": "employee", "subject-security-level": "medium"}, -} -object_assignments = { - "vm0": {"id": "vm1", "object-security-level": "medium"}, - "vm1": {"id": "vm2", "object-security-level": "low"}, -} -action_assignments = { - "start": {"action-type": "vm-action"}, - "stop": {"action-type": "vm-action"} -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, - "mls": {"id": "", "value": ("subject-security-level", "object-security-level", "action-type")}, -} - -rules = { - "rbac": ( - ("admin", "vm1", "vm-action"), - ), - "mls": ( - ("high", "medium", "vm-action"), - ("medium", "low", "vm-action"), - ) -} diff --git a/tests/functional/scenario_available/session.py b/tests/functional/scenario_available/session.py deleted file mode 100644 index 97d7aec3..00000000 --- a/tests/functional/scenario_available/session.py +++ /dev/null @@ -1,60 +0,0 @@ - -pdp_name = "pdp1" -policy_name = "Session policy example" -model_name = "Session" -policy_genre = "session" - -subjects = {"user0": "", "user1": "", } -objects = {"admin": "", "employee": "", } -actions = {"activate": "", "deactivate": ""} - -subject_categories = {"subjectid": "", } -object_categories = {"role": "", } -action_categories = {"session-action": "", } - -subject_data = {"subjectid": {"user0": "", "user1": ""}} -object_data = {"role": {"admin": "", "employee": "", "*": ""}} -action_data = {"session-action": {"activate": "", "deactivate": "", "*": ""}} - -subject_assignments = {"user0": ({"subjectid": "user0"}, ), "user1": ({"subjectid": "user1"}, ), } -object_assignments = {"admin": ({"role": "admin"}, {"role": "*"}), - "employee": ({"role": "employee"}, {"role": "employee"}) - } -action_assignments = {"activate": ({"session-action": "activate"}, {"session-action": "*"}, ), - "deactivate": ({"session-action": "deactivate"}, {"session-action": "*"}, ) - } - -meta_rule = { - "session": {"id": "", "value": ("subjectid", "role", "session-action")}, -} - -rules = { - "session": ( - { - "rule": ("user0", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user1", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "delete", - "target": "rbac:role:employee" # delete the role employee from the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - ) -} - - diff --git a/tests/functional/scenario_available/session_large.py b/tests/functional/scenario_available/session_large.py deleted file mode 100644 index 5b4a64b6..00000000 --- a/tests/functional/scenario_available/session_large.py +++ /dev/null @@ -1,389 +0,0 @@ - -pdp_name = "pdp1" -policy_name = "Session policy example" -model_name = "Session" -policy_genre = "session" - -subjects = { - "user0": "", - "user1": "", - "user2": "", - "user3": "", - "user4": "", - "user5": "", - "user6": "", - "user7": "", - "user8": "", - "user9": "", -} -objects = {"admin": "", "employee": "", "dev1": "", "dev2": "", } -actions = {"activate": "", "deactivate": ""} - -subject_categories = {"subjectid": "", } -object_categories = {"role": "", } -action_categories = {"session-action": "", } - -subject_data = {"subjectid": { - "user0": "", - "user1": "", - "user2": "", - "user3": "", - "user4": "", - "user5": "", - "user6": "", - "user7": "", - "user8": "", - "user9": "", -}} -object_data = {"role": { - "admin": "", - "employee": "", - "dev1": "", - "dev2": "", - "*": "" -}} -action_data = {"session-action": {"activate": "", "deactivate": "", "*": ""}} - -subject_assignments = { - "user0": ({"subjectid": "user0"}, ), - "user1": ({"subjectid": "user1"}, ), - "user2": ({"subjectid": "user2"}, ), - "user3": ({"subjectid": "user3"}, ), - "user4": ({"subjectid": "user4"}, ), - "user5": ({"subjectid": "user5"}, ), - "user6": ({"subjectid": "user6"}, ), - "user7": ({"subjectid": "user7"}, ), - "user8": ({"subjectid": "user8"}, ), - "user9": ({"subjectid": "user9"}, ), -} -object_assignments = {"admin": ({"role": "admin"}, {"role": "*"}), - "employee": ({"role": "employee"}, {"role": "*"}), - "dev1": ({"role": "employee"}, {"role": "dev1"}, {"role": "*"}), - "dev2": ({"role": "employee"}, {"role": "dev2"}, {"role": "*"}), - } -action_assignments = {"activate": ({"session-action": "activate"}, {"session-action": "*"}, ), - "deactivate": ({"session-action": "deactivate"}, {"session-action": "*"}, ) - } - -meta_rule = { - "session": {"id": "", "value": ("subjectid", "role", "session-action")}, -} - -rules = { - "session": ( - { - "rule": ("user0", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user1", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "delete", - "target": "rbac:role:employee" # delete the role employee from the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user2", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user2", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user2", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user3", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user3", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user3", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user4", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user4", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user4", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user5", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user5", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user5", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user6", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user6", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user6", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user7", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user7", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user7", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user8", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user8", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user8", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user9", "employee", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user9", "dev1", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - { - "rule": ("user9", "dev2", "*"), - "instructions": ( - { - "update": { - "operation": "add", - "target": "rbac:role:admin" # add the role admin to the current user - } - }, - {"chain": {"name": "rbac"}} # chain with the meta_rule named rbac - ) - }, - ) -} - - diff --git a/tests/functional/scenario_enabled/mls.py b/tests/functional/scenario_enabled/mls.py deleted file mode 120000 index 6acd75ce..00000000 --- a/tests/functional/scenario_enabled/mls.py +++ /dev/null @@ -1 +0,0 @@ -../scenario_available/mls.py
\ No newline at end of file diff --git a/tests/functional/scenario_enabled/rbac.py b/tests/functional/scenario_enabled/rbac.py deleted file mode 120000 index 0edc905a..00000000 --- a/tests/functional/scenario_enabled/rbac.py +++ /dev/null @@ -1 +0,0 @@ -../scenario_available/rbac.py
\ No newline at end of file diff --git a/tests/functional/scenario_tests/mls.py b/tests/functional/scenario_tests/mls.py deleted file mode 100644 index 0e6285c9..00000000 --- a/tests/functional/scenario_tests/mls.py +++ /dev/null @@ -1,59 +0,0 @@ - -pdp_name = "pdp_mls" -policy_name = "MLS Policy example" -model_name = "MLS" -policy_genre = "authz" - -subjects = {"adminuser": "", "user1": "", "user2": "", } -objects = {"vm0": "", "vm1": "", } -actions = {"start": "", "stop": ""} - -subject_categories = {"subject-security-level": "", } -object_categories = {"object-security-level": "", } -action_categories = {"action-type": "", } - -subject_data = { - "subject-security-level": {"low": "", "medium": "", "high": ""}, -} -object_data = { - "object-security-level": {"low": "", "medium": "", "high": ""}, -} -action_data = {"action-type": {"vm-action": "", "storage-action": "", }} - -subject_assignments = { - "adminuser": {"subject-security-level": "high"}, - "user1": {"subject-security-level": "medium"}, -} -object_assignments = { - "vm0": {"object-security-level": "medium"}, - "vm1": {"object-security-level": "low"}, -} -action_assignments = { - "start": {"action-type": "vm-action"}, - "stop": {"action-type": "vm-action"} -} - -meta_rule = { - "mls": { - "id": "", - "value": ("subject-security-level", - "object-security-level", - "action-type")}, -} - -rules = { - "mls": ( - { - "rule": ("high", "medium", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - { - "rule": ("high", "low", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - { - "rule": ("medium", "low", "vm-action"), - "instructions": ({"decision": "grant"}) - }, - ) -} diff --git a/tests/functional/scenario_tests/rbac.py b/tests/functional/scenario_tests/rbac.py deleted file mode 100644 index 1d2cabee..00000000 --- a/tests/functional/scenario_tests/rbac.py +++ /dev/null @@ -1,61 +0,0 @@ - -pdp_name = "pdp_rbac1" -policy_name = "RBAC policy example" -model_name = "RBAC" -policy_genre = "authz" - -subjects = {"adminuser": "", "user1": "", } -objects = {"vm0": "", "vm1": "", } -actions = {"start": "", "stop": ""} - -subject_categories = {"role": "", } -object_categories = {"id": "", } -action_categories = {"action-type": "", } - -subject_data = {"role": {"admin": "", "employee": "", "*": ""}} -object_data = {"id": {"vm0": "", "vm1": "", "*": ""}} -action_data = {"action-type": {"vm-action": "", "*": ""}} - -subject_assignments = { - "adminuser": - ({"role": "admin"}, {"role": "employee"}, {"role": "*"}), - "user1": - ({"role": "employee"}, {"role": "*"}), -} -object_assignments = { - "vm0": - ({"id": "vm0"}, {"id": "*"}), - "vm1": - ({"id": "vm1"}, {"id": "*"}) -} -action_assignments = { - "start": - ({"action-type": "vm-action"}, {"action-type": "*"}), - "stop": - ({"action-type": "vm-action"}, {"action-type": "*"}) -} - -meta_rule = { - "rbac": {"id": "", "value": ("role", "id", "action-type")}, -} - -rules = { - "rbac": ( - { - "rule": ("admin", "vm0", "vm-action"), - "instructions": ( - {"decision": "grant"}, - # "grant" to immediately exit, - # "continue" to wait for the result of next policy - ) - }, - { - "rule": ("employee", "vm1", "vm-action"), - "instructions": ( - {"decision": "grant"}, - ) - }, - ) -} - - diff --git a/tests/performance/README.md b/tests/performance/README.md deleted file mode 100644 index fcb80589..00000000 --- a/tests/performance/README.md +++ /dev/null @@ -1,80 +0,0 @@ -# Moon Yardstick/Bottlenecks Performance Tests - -The main objective of this document is to describe the performance tests for the Moon project/module. -Moon is a security management platform which provides a set of security functions to project the underlying OPNFV infrastructure and/or VNFs. -It is consisted of 2 parts: a master and a set of slaves. The master holds all security-related information and each slave only fetches and holds -related information for its local usage from master. - -## Master Performance Tests -### Pre-requisite -- setup a Moon master service on a physical server -- create a project in OpenStack/Keystone -- create a MSL PDP with a model of 4 subject security levels and 4 object security levels, the MLS policy will be defined later - -### Policy Size Test -Increase the number of users and resources N to find the limit of the security policy -- create N users and N resources (VMs in our case) in this MLS security policy -- sends 5 authz requests/second -- gather performance metrics like CPU, memory, network usages -Through the iteration, determine the maximal number of N to support 5 requests/second - -### PDP Number Test -- setup 20 user and 20 resources (VMs in our case) for each MLS PDP -- sends 5 authz requests/second for each MLS PDP -- increase the number of PDP to test the maximal number of PDP on the master - -### Policy Size Test for 5 PDPs -- setup 5 PDPs of N users and N resources (VMs in our case) -- sends 5 authz requests/second for each MLS PDP -- gather performance metrics like CPU, memory, network usages -Through the iteration, determine the maximal user/resource number of these 5 PDPs - -### Policy Size Test for 10 PDPs -- setup 10 PDPs of N users and N resources (VMs in our case) -- sends 5 authz requests/second for each MLS PDP -- gather performance metrics like CPU, memory, network usages -Through the iteration, determine the maximal user/resource number of these 10 PDPs - -### Policy Size Test for 20 PDPs -- setup 20 PDPs of N users and N resources (VMs in our case) -- sends 5 authz requests/second for each MLS PDP -- gather performance metrics like CPU, memory, network usages -Through the iteration, determine the maximal user/resource number of these 20 PDPs - - -## Master-Slave Performance Tests -### Pre-requisite -- setup a Moon master on a physical server -- setup a Moon slave on a physical server -- create a project in OpenStack/Keystone -- create a MSL PDP with a model of 4 subject security levels and 4 object security levels, the MLS policy will be defined later on the master - -### Slave Policy Size Test -Increase the number of users and resources N to find the limit of the security policy -- create N users and N resources (VMs in our case) in this MLS security policy on the master -- sends 5 authz requests/second to the slave -- gather performance metrics like CPU, memory, network usages of the slave -Through the iteration, determine the maximal number of N to support 5 requests/second of the slave - -### Slave PDP Number Test -- setup 20 user and 20 resources (VMs in our case) for each MLS PDP on the master -- sends 5 authz requests/second for each MLS PDP to the slave -Through the iteration, determine the maximal number of PDP to support 5 requests/second of the slave - -### Slave Policy Size Test for 5 PDPs -- setup 5 PDPs of N users and N resources (VMs in our case) on the master -- sends 5 authz requests/second for each MLS PDP to the slave -- gather performance metrics like CPU, memory, network usages of the slave -Through the iteration, determine the maximal user/resource number of these 5 PDPs - -### Slave Policy Size Test for 10 PDPs -- setup 10 PDPs of N users and N resources (VMs in our case) on the master -- sends 5 authz requests/second for each MLS PDP to the slave -- gather performance metrics like CPU, memory, network usages of the slave -Through the iteration, determine the maximal user/resource number of these 10 PDPs - -### Slave Policy Size Test for 20 PDPs -- setup 20 PDPs of N users and N resources (VMs in our case) on the master -- sends 5 authz requests/second for each MLS PDP to the slave -- gather performance metrics like CPU, memory, network usages of the slave -Through the iteration, determine the maximal user/resource number of these 20 PDPs diff --git a/tests/python_unit/README.md b/tests/python_unit/README.md deleted file mode 100644 index a399f834..00000000 --- a/tests/python_unit/README.md +++ /dev/null @@ -1,5 +0,0 @@ -# Python Unit Test - -```bash -bash run_tests.sh -``` diff --git a/tests/python_unit/run_tests.sh b/tests/python_unit/run_tests.sh deleted file mode 100644 index ab30e523..00000000 --- a/tests/python_unit/run_tests.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash - -echo "starting Moon Unit Tests" - -cd python_moonutilities -docker run --rm --volume $(pwd):/data wukongsun/moon_python_unit_test:latest - -cd ../python_moondb -docker run --rm --volume $(pwd):/data wukongsun/moon_python_unit_test:latest - -cd ../python_moonclient -docker run --rm --volume $(pwd):/data wukongsun/moon_python_unit_test:latest - -cd ../moon_manager -rm -f tests/unit_python/database.db -docker run --rm --volume $(pwd):/data wukongsun/moon_python_unit_test:latest - |