1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
# Copyright (C) 2026 Danilo M. <danix@danix.xyz>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
"""Tests for the RDAP protocol module."""
import email
import unittest
import urllib.error
import urllib.request
from abusectl import rdap
class RedirectPolicy(unittest.TestCase):
"""A redirect is remote data directing our next request.
urllib.request.Request is used rather than a hand-rolled fake, because
HTTPRedirectHandler reads attributes (origin_req_host, unverifiable,
timeout) that a fake would have to reproduce exactly to prove anything.
"""
def _request(self):
return urllib.request.Request("https://rdap.example.invalid/ip/192.0.2.1")
def test_an_https_to_http_downgrade_is_refused(self):
handler = rdap._NoDowngradeRedirectHandler()
with self.assertRaises(urllib.error.HTTPError):
handler.redirect_request(
self._request(), None, 302, "Found",
email.message_from_string(""),
"http://rdap.example.invalid/ip/192.0.2.1",
)
def test_an_https_to_https_redirect_is_allowed(self):
handler = rdap._NoDowngradeRedirectHandler()
result = handler.redirect_request(
self._request(), None, 302, "Found",
email.message_from_string(""),
"https://other.example.invalid/ip/192.0.2.1",
)
self.assertIsNotNone(result)
import json
import tempfile
import time
from pathlib import Path
class Bootstrap(unittest.TestCase):
def setUp(self):
self.tmp = tempfile.TemporaryDirectory()
self.cache = Path(self.tmp.name)
self.addCleanup(self.tmp.cleanup)
def test_a_missing_file_is_fetched_and_cached(self):
calls = []
def fetch(url):
calls.append(url)
return {"services": []}
data = rdap.bootstrap("ipv4", cache_root=self.cache, fetch=fetch)
self.assertEqual(data, {"services": []})
self.assertEqual(calls, ["https://data.iana.org/rdap/ipv4.json"])
self.assertTrue((self.cache / "ipv4.json").exists())
def test_a_fresh_cache_is_not_refetched(self):
(self.cache / "ipv4.json").write_text(json.dumps({"services": ["cached"]}))
def fetch(url):
raise AssertionError(f"should not have fetched {url}")
data = rdap.bootstrap("ipv4", cache_root=self.cache, fetch=fetch)
self.assertEqual(data, {"services": ["cached"]})
def test_a_stale_cache_is_refetched(self):
path = self.cache / "ipv4.json"
path.write_text(json.dumps({"services": ["old"]}))
old = time.time() - (rdap._BOOTSTRAP_TTL + 60)
import os
os.utime(path, (old, old))
data = rdap.bootstrap(
"ipv4", cache_root=self.cache, fetch=lambda url: {"services": ["new"]}
)
self.assertEqual(data, {"services": ["new"]})
def test_a_failed_refetch_falls_back_to_the_stale_copy(self):
"""Losing IANA must not stop the user filing a report.
Last week's map is almost certainly still correct, and a stale
bootstrap fails safe: the worst case is querying a server that has
moved, which misses and reads as no contact.
"""
path = self.cache / "ipv4.json"
path.write_text(json.dumps({"services": ["old"]}))
old = time.time() - (rdap._BOOTSTRAP_TTL + 60)
import os
os.utime(path, (old, old))
def fetch(url):
raise OSError("network is unreachable")
data = rdap.bootstrap("ipv4", cache_root=self.cache, fetch=fetch)
self.assertEqual(data, {"services": ["old"]})
def test_a_failed_fetch_with_no_cache_raises(self):
def fetch(url):
raise OSError("network is unreachable")
with self.assertRaises(rdap.BootstrapUnavailable):
rdap.bootstrap("ipv4", cache_root=self.cache, fetch=fetch)
class ServerSelection(unittest.TestCase):
IPV4 = {
"services": [
[["192.0.2.0/24"], ["https://wide.example.invalid/"]],
[["192.0.2.128/25"], ["https://narrow.example.invalid/"]],
[["198.51.100.0/24"], ["https://other.example.invalid/"]],
]
}
DNS = {
"services": [
[["invalid"], ["https://registry.example.invalid/"]],
[["test"], ["https://test.example.invalid/"]],
]
}
def test_an_address_selects_its_range(self):
self.assertEqual(
rdap.server_for_ip("198.51.100.7", self.IPV4),
"https://other.example.invalid/",
)
def test_the_longest_prefix_wins(self):
"""192.0.2.200 is in both /24 and /25; the /25 is more specific.
Choosing the wider range would ask a registry that has delegated
the block away, and its answer would name the wrong operator.
"""
self.assertEqual(
rdap.server_for_ip("192.0.2.200", self.IPV4),
"https://narrow.example.invalid/",
)
def test_an_unlisted_address_selects_nothing(self):
self.assertIsNone(rdap.server_for_ip("203.0.113.9", self.IPV4))
def test_a_tld_selects_its_registry(self):
self.assertEqual(
rdap.server_for_tld("invalid", self.DNS),
"https://registry.example.invalid/",
)
def test_tld_matching_ignores_case(self):
self.assertEqual(
rdap.server_for_tld("INVALID", self.DNS),
"https://registry.example.invalid/",
)
def test_an_unlisted_tld_selects_nothing(self):
self.assertIsNone(rdap.server_for_tld("example", self.DNS))
if __name__ == "__main__":
unittest.main()
|
