gfwleak/dongxiaoyan-tsg-autotest
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

安全策略Deny_SSL 补充:ip geo,ip learning,改变策略中SAN,SNI,CN用例

Browse Source
This commit is contained in:
hebingning
2021-01-29 13:50:43 +08:00
parent d8c9ecd560
commit 591737c77a
14 changed files with 116 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
01-TestCase/tsg_adc/multi_step/a_Deny_Dns_Tests.robot
View File

@@ -12,7 +12,7 @@ Resource ../../../02-Keyword/tsg_bfapi/policy_object/ProcessPolicyBody.
*** Test Cases ***
SecurityPolicy-Deny-Dns-00001
[Tags] fqdn完整和右匹配,update policy:source ip_geo,fqdn
[Tags] fqdn完整和右匹配,update policy:source ip_geo
Comment 创建fqdn
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=$www.facebook.com,*rutube.ru
${rescode} ${objectId} AddObject2 ${1} ${objectDict}

60
01-TestCase/tsg_adc/multi_step/a_Deny_Ssl_Tests.robot
View File

@@ -11,49 +11,85 @@ Resource ../../../03-Variable/ApplicationID.txt
*** Test Cases ***
SecurityPolicy-Deny-Ssl-00001
[Tags] sni fqdn完整和右匹配
[Tags] sni fqdn完整和右匹配 update policy:ip geo,fqdn_sni
Comment 创建fqdn
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=$www.cxwl.com,*freestockimages.ru
${rescode} ${objectId} AddObject2 ${1} ${objectDict}
Comment 创建fqdn2
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=*www.cxwl.com
${rescode} ${objectId1} AddObject2 ${1} ${objectDict}
Comment 创建ip geo
${addItemList1} Create Dictionary keywordArray=XXG地区.*
${addItemLists} Create list ${addItemList1}
${objectDict} Create Dictionary objectType=ip objectSubType=geo_location isValid=${1} addItemList=${addItemLists}
${rescode} ${objectId2} AddObjects ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00001 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"rst"} filterList=${objectId}|TSG_FIELD_SSL_SNI isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} ${policyId} AddPolicies 1 ${policyDict} v2
${policyId} Get-Pids ${policyId}
${policyId} Set Variable ${policyId}[0]
insert_policyId_to_file1 deny_ssl_objectId ${objectId}
insert_policyId_to_file1 deny_ssl_objectId4 ${objectId1}
insert_policyId_to_file1 deny_ssl_objectId5 ${objectId2}
insert_policyId_to_file1 deny_ssl_policyId ${policyId}
SecurityPolicy-Deny-Ssl-00002
[Tags] cn cat右匹配
Comment 创建cat
${objectDict} Create Dictionary objectType=fqdn_category isValid=${1} addItemList=*vip.com,*berkeleygroup.co.uk
${rescode} ${objectId} AddObject2 ${1} ${objectDict}
#Comment 创建cat
# ${objectDict} Create Dictionary objectType=fqdn_category isValid=${1} addItemList=*vip.com,*berkeleygroup.co.uk
# ${rescode} ${objectId} AddObject2 ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00002 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"rst"} filterList=${objectId}|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00002 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"rst"} filterList=153|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} ${policyId} AddPolicies 1 ${policyDict} v2
insert_policyId_to_file1 deny_ssl_objectId1 ${objectId}
${policyId} Get-Pids ${policyId}
${policyId} Set Variable ${policyId}[0]
#insert_policyId_to_file1 deny_ssl_objectId1 ${objectId}
insert_policyId_to_file1 deny_ssl_policyId1 ${policyId}
SecurityPolicy-Deny-Ssl-00003
[Tags] san cat右匹配
Comment 创建cat
${objectDict} Create Dictionary objectType=fqdn_category isValid=${1} addItemList=*pulitzer.org,*nastol.com.ua
${rescode} ${objectId} AddObject2 ${1} ${objectDict}
#Comment 创建cat
# ${objectDict} Create Dictionary objectType=fqdn_category isValid=${1} addItemList=*pulitzer.org,*nastol.com.ua
# ${rescode} ${objectId} AddObject2 ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00003 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=${objectId}|TSG_FIELD_SSL_SAN isValid=${1} appIdObjects=${SSL_ID}
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00003 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=173|TSG_FIELD_SSL_SAN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} ${policyId} AddPolicies 1 ${policyDict} v2
insert_policyId_to_file1 deny_ssl_objectId2 ${objectId}
${policyId} Get-Pids ${policyId}
${policyId} Set Variable ${policyId}[0]
#insert_policyId_to_file1 deny_ssl_objectId2 ${objectId}
insert_policyId_to_file1 deny_ssl_policyId2 ${policyId}
SecurityPolicy-Deny-Ssl-00004
[Tags] 最大组合
[Tags] 最大组合 update policy:fqdn_sni,fqdn_san,fqdn_cn
Comment 创建fqdn
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=*prlib.ru
${rescode} ${objectId} AddObject2 ${1} ${objectDict}
Comment 创建fqdn2
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=$www.prlib.ru
${rescode} ${objectId1} AddObject2 ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00004 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=${objectId}|TSG_FIELD_SSL_SAN,${objectId}|TSG_FIELD_SSL_SNI,${objectId}|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} ${policyId} AddPolicies 1 ${policyDict} v2
${policyId} Get-Pids ${policyId}
${policyId} Set Variable ${policyId}[0]
insert_policyId_to_file1 deny_ssl_objectId3 ${objectId}
insert_policyId_to_file1 deny_ssl_objectId6 ${objectId1}
insert_policyId_to_file1 deny_ssl_policyId3 ${policyId}
SecurityPolicy-Deny-Ssl-00005
[Tags] update policy:destination learning
Comment 创建fqdn
${objectDict} Create Dictionary objectType=fqdn isValid=${1} addItemList=*leisu.com
${rescode} ${objectId} AddObject2 ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Deny-Ssl-00005 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=${objectId}|TSG_FIELD_SSL_SAN,${objectId}|TSG_FIELD_SSL_SNI,${objectId}|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} ${policyId} AddPolicies 1 ${policyDict} v2
${policyId} Get-Pids ${policyId}
${policyId} Set Variable ${policyId}[0]
insert_policyId_to_file1 deny_ssl_objectId7 ${objectId}
insert_policyId_to_file1 deny_ssl_policyId4 ${policyId}

2
01-TestCase/tsg_adc/multi_step/a_Intercept_Http_Tests.robot
View File

@@ -56,7 +56,7 @@ SecurityPolicy-Intercept-Http-00003
Comment 创建destination ip
${addItemList1} Create Dictionary isSession=endpoint ip=192.168.40.158-192.168.40.158 port=0-65535 direction=0 protocol=0 isInitialize=0
${addItemLists} Create list ${addItemList1}
${objectDict} Create Dictionary objectType=ip isValid=${1} addItemList=${addItemLists}
${objectDict} Create Dictionary objectType=ip objectSubType=endpoint isValid=${1} addItemList=${addItemLists}
${rescode} ${objectId1} AddObjects ${1} ${objectDict}
Comment 创建安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Intercept-Http-00003 policyType=tsg_security policyDesc=autotest action=intercept userRegion={"protocol":"HTTP"} filterList=${objectId}|TSG_FIELD_HTTP_HOST isValid=${1} appIdObjects=${HTTP_ID}

44
01-TestCase/tsg_adc/multi_step/b_Deny_Ssl_Tests.robot
View File

@@ -5,6 +5,9 @@ Resource ../../../02-Keyword/tsg_adc/SystemCommand.robot
Resource ../../../02-Keyword/tsg_bfapi/PolicyObject.robot
Resource ../../../02-Keyword/tsg_bfapi/LogVariable.robot
Resource ../../../02-Keyword/tsg_adc/FileOperation.robot
Resource ../../../02-Keyword/tsg_bfapi/policy_object/Policy.robot
Resource ../../../03-Variable/ApplicationID.txt
Resource ../../../05-Other/AllFlowCaseVariable.txt
*** Test Cases ***
SecurityPolicy-Deny-Ssl-00001
@@ -20,17 +23,27 @@ SecurityPolicy-Deny-Ssl-00001
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 改变阻断策略
${policyDict} Create Dictionary policyId=${deny_ssl_policyId} source=${deny_ssl_objectId5}|TSG_SECURITY_SOURCE_LOCATION policyName=SecurityPolicy-Deny-Ssl-00001_1 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"rst"} filterList=${deny_ssl_objectId4}|TSG_FIELD_SSL_SNI isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} UpdatePolicies 1 ${policyDict} v2 update
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00001_1.bat
... ELSE set variable curl \ \ \ https://www.cxwl.com/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
SecurityPolicy-Deny-Ssl-00002
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00002.bat
... ELSE set variable curl https://www.berkeleygroup.co.uk/
... ELSE set variable curl https://amesweb.info/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00002_2.bat
... ELSE set variable curl https://www.vip.com/
... ELSE set variable curl https://rentar.com/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
@@ -38,13 +51,13 @@ SecurityPolicy-Deny-Ssl-00002
SecurityPolicy-Deny-Ssl-00003
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00003.bat
... ELSE set variable curl https://www.nastol.com.ua/
... ELSE set variable curl https://www.utarc.org/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00003_3.bat
... ELSE set variable curl https://www.pulitzer.org/
... ELSE set variable curl https://www.nq4y.net/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Connection was reset
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
@@ -56,3 +69,24 @@ SecurityPolicy-Deny-Ssl-00004
${stringlist} run keyword if '${systemType}'=='Windows' Create List Operation timed out
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 改变阻断策略
${policyDict} Create Dictionary policyId=${deny_ssl_policyId3} policyName=SecurityPolicy-Deny-Ssl-00004 policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=${deny_ssl_objectId6}|TSG_FIELD_SSL_SAN,${deny_ssl_objectId6}|TSG_FIELD_SSL_SNI,${deny_ssl_objectId6}|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} UpdatePolicies 1 ${policyDict} v2 update
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00004.bat
... ELSE set variable curl https://www.prlib.ru/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Operation timed out
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
SecurityPolicy-Deny-Ssl-00005
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Deny_SSL_00005.bat
... ELSE set variable curl https://www.leisu.com/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Operation timed out
... ELSE Create List Connection reset by peer
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 改变阻断策略
${policyDict} Create Dictionary policyId=${deny_ssl_policyId4} policyName=SecurityPolicy-Deny-Ssl-00005-1 destination=166860|TSG_SECURITY_DESTINATION_ADDR policyType=tsg_security policyDesc=autotest action=deny userRegion={"protocol":"SSL","method":"drop"} filterList=${deny_ssl_objectId7}|TSG_FIELD_SSL_SAN,${deny_ssl_objectId7}|TSG_FIELD_SSL_SNI,${deny_ssl_objectId7}|TSG_FIELD_SSL_CN isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} UpdatePolicies 1 ${policyDict} v2 update

4
01-TestCase/tsg_adc/multi_step/b_Intercept_Http_Tests.robot
View File

@@ -39,8 +39,8 @@ SecurityPolicy-Intercept-Http-00003
Comment 功能端验证HTTP验证
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Intercept_HTTP_00003.bat
... ELSE set variable curl http://open.node.com/
${stringlist} run keyword if '${systemType}'=='Windows' Create List Post
... ELSE Create List Post
${stringlist} run keyword if '${systemType}'=='Windows' Create List POST
... ELSE Create List POST
${rescode} SystemCommands ${commandstr} ${stringlist}
SecurityPolicy-Intercept-Http-00004

2
01-TestCase/tsg_adc/multi_step/b_Intercept_Ssl_Tests.robot
View File

@@ -44,7 +44,7 @@ SecurityPolicy-Intercept-Http-00003
... ELSE Create List Book
${rescode} SystemCommands ${commandstr} ${stringlist}
Comment 改变安全策略
${policyDict} Create Dictionary policyName=SecurityPolicy-Intercept-Ssl-00003_1 policyType=tsg_security policyDesc=autotest action=intercept userRegion={"protocol":"SSL","keyring":1727,"decryption":1,"decrypt_mirror":{"enable":0,"mirror_profile":null}} filterList=${intercept_ssl_objectId3}|TSG_FIELD_SSL_SNI isValid=${1} appIdObjects=${SSL_ID}
${policyDict} Create Dictionary policyId=${intercept_ssl_policyId2} policyName=SecurityPolicy-Intercept-Ssl-00003_1 policyType=tsg_security policyDesc=autotest action=intercept userRegion={"protocol":"SSL","keyring":1727,"decryption":1,"decrypt_mirror":{"enable":0,"mirror_profile":null}} filterList=${intercept_ssl_objectId3}|TSG_FIELD_SSL_SNI isValid=${1} appIdObjects=${SSL_ID}
log ${policyDict}
${rescode} UpdatePolicies 1 ${policyDict} v2 update
${commandstr} run keyword if '${systemType}'=='Windows' set variable ${curlbatpath}/command/SecurityPolicy_Intercept_SSL_00002_2.bat

23
01-TestCase/tsg_adc/multi_step/c_Deny_Ssl_Tests.robot
View File

@@ -17,6 +17,8 @@ ${objectids} ${EMPTY}
SecurityPolicy-Deny-Ssl-00001
#删除对象
${objectids} set Variable ${deny_ssl_objectId}
${objectids} Catenate SEPARATOR=, ${objectids} ${deny_ssl_objectId4}
${objectids} Catenate SEPARATOR=, ${objectids} ${deny_ssl_objectId5}
#删除策略
${policyIds} Create List {"policyType":"tsg_security","policyIds":[${deny_ssl_policyId}]}
${s} Convert to String ${deny_ssl_policyId}
@@ -25,26 +27,35 @@ SecurityPolicy-Deny-Ssl-00001
SecurityPolicy-Deny-Ssl-00002
#删除对象
${objectids} set Variable ${deny_ssl_objectId1}
#${objectids} set Variable ${deny_ssl_objectId1}
#删除策略
${policyIds} Create List {"policyType":"tsg_security","policyIds":[${deny_ssl_policyId1}]}
${s} Convert to String ${deny_ssl_policyId1}
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni berkeleygroup.co.uk
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni vip.com
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni amesweb.info
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni rentar
SecurityPolicy-Deny-Ssl-00003
#删除对象
${objectids} set Variable ${deny_ssl_objectId2}
#${objectids} set Variable ${deny_ssl_objectId2}
#删除策略
${policyIds} Create List {"policyType":"tsg_security","policyIds":[${deny_ssl_policyId2}]}
${s} Convert to String ${deny_ssl_policyId2}
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni nastol.com.ua
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni pulitzer.org
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni astanait
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni edu
SecurityPolicy-Deny-Ssl-00004
#删除对象
${objectids} set Variable ${deny_ssl_objectId3}
${objectids} Catenate SEPARATOR=, ${objectids} ${deny_ssl_objectId6}
#删除策略
${policyIds} Create List {"policyType":"tsg_security","policyIds":[${deny_ssl_policyId3}]}
${s} Convert to String ${deny_ssl_policyId3}
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni www.prlib.ru
SecurityPolicy-Deny-Ssl-00005
#删除对象
${objectids} set Variable ${deny_ssl_objectId7}
#删除策略
${policyIds} Create List {"policyType":"tsg_security","policyIds":[${deny_ssl_policyId4}]}
${s} Convert to String ${deny_ssl_policyId4}
GetLogList security_event_log ${starttime} ${endtime} ${testClentIP} ${s} ssl_sni www.leisu.com

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00001.bat
View File

@@ -1 +1 @@
curl https://www.freestockimages.ru/ | iconv -f utf-8 -t gbk
curl https://amesweb.info/ | iconv -f utf-8 -t gbk

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00001_1.bat
View File

@@ -1 +1 @@
curl https://www.cxwl.com/ | iconv -f utf-8 -t gbk
curl https://rentar.com/ | iconv -f utf-8 -t gbk

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00002.bat
View File

@@ -1 +1 @@
curl https://www.berkeleygroup.co.uk/ | iconv -f utf-8 -t gbk
curl https://iitu.kz/ru/ | iconv -f utf-8 -t gbk

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00002_2.bat
View File

@@ -1 +1 @@
curl https://www.vip.com/ | iconv -f utf-8 -t gbk
curl https://kaznu.kz/ | iconv -f utf-8 -t gbk

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00003.bat
View File

@@ -1 +1 @@
curl https://www.nastol.com.ua/ | iconv -f utf-8 -t gbk
curl https://www.utarc.org/ | iconv -f utf-8 -t gbk

2
05-Other/curl/command/SecurityPolicy_Deny_SSL_00003_3.bat
View File

@@ -1 +1 @@
curl https://www.pulitzer.org/ | iconv -f utf-8 -t gbk
curl https://www.nq4y.net/ | iconv -f utf-8 -t gbk

1
05-Other/curl/command/SecurityPolicy_Deny_SSL_00005.bat Normal file
View File

@@ -0,0 +1 @@
curl https://www.leisu.com/ | iconv -f utf-8 -t gbk