| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299 |
- import random
- import string
- import time
- import json
- import datetime
- from django.test import TestCase
- from django.test.utils import override_settings
- from django.contrib.auth.models import User
- from django.urls import NoReverseMatch
- from django.urls import reverse
- from django.utils import six
- from axes.decorators import COOLOFF_TIME
- from axes.decorators import FAILURE_LIMIT
- from axes.decorators import is_valid_ip
- from axes.models import AccessAttempt, AccessLog
- from axes.signals import user_locked_out
- from axes.utils import reset, iso8601
- class AccessAttemptTest(TestCase):
- """Test case using custom settings for testing
- """
- VALID_USERNAME = 'valid-username'
- VALID_PASSWORD = 'valid-password'
- LOCKED_MESSAGE = 'Account locked: too many login attempts.'
- LOGIN_FORM_KEY = '<input type="submit" value="Log in" />'
- def _login(self, is_valid_username=False, is_valid_password=False,
- is_json=False, **kwargs):
- """Login a user. A valid credential is used when is_valid_username is True,
- otherwise it will use a random string to make a failed login.
- """
- try:
- admin_login = reverse('admin:login')
- except NoReverseMatch:
- admin_login = reverse('admin:index')
- if is_valid_username:
- # Use a valid username
- username = self.VALID_USERNAME
- else:
- # Generate a wrong random username
- chars = string.ascii_uppercase + string.digits
- username = ''.join(random.choice(chars) for x in range(10))
- if is_valid_password:
- password = self.VALID_PASSWORD
- else:
- password = 'invalid-password'
- headers = {
- 'user_agent': 'test-browser'
- }
- post_data = {
- 'username': username,
- 'password': password,
- 'this_is_the_login_form': 1,
- }
- post_data.update(kwargs)
- if is_json:
- headers.update({
- 'HTTP_X_REQUESTED_WITH': 'XMLHttpRequest',
- 'content_type': 'application/json',
- })
- post_data = json.dumps(post_data)
- response = self.client.post(admin_login, post_data, **headers)
- return response
- def setUp(self):
- """Create a valid user for login
- """
- self.user = User.objects.create_superuser(
- username=self.VALID_USERNAME,
- email='test@example.com',
- password=self.VALID_PASSWORD,
- )
- def test_failure_limit_once(self):
- """Tests the login lock trying to login one more time
- than failure limit
- """
- # test until one try before the limit
- for i in range(1, FAILURE_LIMIT):
- response = self._login()
- # Check if we are in the same login page
- self.assertContains(response, self.LOGIN_FORM_KEY)
- # So, we shouldn't have gotten a lock-out yet.
- # But we should get one now
- response = self._login()
- self.assertContains(response, self.LOCKED_MESSAGE, status_code=403)
- def test_failure_limit_many(self):
- """Tests the login lock trying to login a lot of times more
- than failure limit
- """
- for i in range(1, FAILURE_LIMIT):
- response = self._login()
- # Check if we are in the same login page
- self.assertContains(response, self.LOGIN_FORM_KEY)
- # So, we shouldn't have gotten a lock-out yet.
- # We should get a locked message each time we try again
- for i in range(0, random.randrange(1, FAILURE_LIMIT)):
- response = self._login()
- self.assertContains(response, self.LOCKED_MESSAGE, status_code=403)
- def test_valid_login(self):
- """Tests a valid login for a real username
- """
- response = self._login(is_valid_username=True, is_valid_password=True)
- self.assertNotContains(response, self.LOGIN_FORM_KEY, status_code=302)
- def test_valid_logout(self):
- """Tests a valid logout and make sure the logout_time is updated
- """
- response = self._login(is_valid_username=True, is_valid_password=True)
- self.assertEquals(AccessLog.objects.latest('id').logout_time, None)
- response = self.client.get(reverse('admin:logout'))
- self.assertNotEquals(AccessLog.objects.latest('id').logout_time, None)
- self.assertContains(response, 'Logged out')
- def test_cooling_off(self):
- """Tests if the cooling time allows a user to login
- """
- self.test_failure_limit_once()
- # Wait for the cooling off period
- time.sleep(COOLOFF_TIME.total_seconds())
- # It should be possible to login again, make sure it is.
- self.test_valid_login()
- def test_cooling_off_for_trusted_user(self):
- """Test the cooling time for a trusted user
- """
- # Test successful login-logout, this makes the user trusted.
- self.test_valid_logout()
- # Try the cooling off time
- self.test_cooling_off()
- def test_long_user_agent_valid(self):
- """Tests if can handle a long user agent
- """
- long_user_agent = 'ie6' * 1024
- response = self._login(
- is_valid_username=True,
- is_valid_password=True,
- user_agent=long_user_agent,
- )
- self.assertNotContains(response, self.LOGIN_FORM_KEY, status_code=302)
- def test_long_user_agent_not_valid(self):
- """Tests if can handle a long user agent with failure
- """
- long_user_agent = 'ie6' * 1024
- for i in range(0, FAILURE_LIMIT + 1):
- response = self._login(user_agent=long_user_agent)
- self.assertContains(response, self.LOCKED_MESSAGE, status_code=403)
- def test_reset_ip(self):
- """Tests if can reset an ip address
- """
- # Make a lockout
- self.test_failure_limit_once()
- # Reset the ip so we can try again
- reset(ip='127.0.0.1')
- # Make a login attempt again
- self.test_valid_login()
- def test_reset_all(self):
- """Tests if can reset all attempts
- """
- # Make a lockout
- self.test_failure_limit_once()
- # Reset all attempts so we can try again
- reset()
- # Make a login attempt again
- self.test_valid_login()
- def test_send_lockout_signal(self):
- """Test if the lockout signal is emitted
- """
- class Scope(object): pass # this "hack" is needed so we don't have to use global variables or python3 features
- scope = Scope()
- scope.signal_received = 0
- def signal_handler(request, username, ip_address, *args, **kwargs):
- scope.signal_received += 1
- self.assertIsNotNone(request)
- # Connect signal handler
- user_locked_out.connect(signal_handler)
- # Make a lockout
- self.test_failure_limit_once()
- self.assertEquals(scope.signal_received, 1)
- reset()
- # Make another lockout
- self.test_failure_limit_once()
- self.assertEquals(scope.signal_received, 2)
- @override_settings(AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP=True)
- def test_lockout_by_combination_user_and_ip(self):
- """Tests the login lock with a valid username and invalid password
- when AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP is True
- """
- # test until one try before the limit
- for i in range(1, FAILURE_LIMIT):
- response = self._login(
- is_valid_username=True,
- is_valid_password=False,
- )
- # Check if we are in the same login page
- self.assertContains(response, self.LOGIN_FORM_KEY)
- # So, we shouldn't have gotten a lock-out yet.
- # But we should get one now
- response = self._login(is_valid_username=True, is_valid_password=False)
- self.assertContains(response, self.LOCKED_MESSAGE, status_code=403)
- def test_log_data_truncated(self):
- """Tests that query2str properly truncates data to the max_length (default 1024)
- """
- # An impossibly large post dict
- extra_data = {string.ascii_letters * x: x for x in range(0, 1000)}
- self._login(**extra_data)
- self.assertEquals(
- len(AccessAttempt.objects.latest('id').post_data), 1024
- )
- def test_json_response(self):
- """Tests response content type and status code for the ajax request
- """
- self.test_failure_limit_once()
- response = self._login(is_json=True)
- self.assertEquals(response.status_code, 403)
- self.assertEquals(response.get('Content-Type'), 'application/json')
- class IPClassifierTest(TestCase):
- def test_classify_private_ips(self):
- """Tests whether is_valid_public_ip correctly classifies IPs as being
- bot public and valid
- """
- EXPECTED = {
- 'foobar': False, # invalid - not octects
- '192.168.0': False, # invalid - only 3 octets
- '192.168.0.0': False, # private
- '192.168.165.1': False, # private
- '192.249.19.1': True, # public but 192 prefix
- '10.0.201.13': False, # private
- '172.15.12.1': True, # public but 172 prefix
- '172.16.12.1': False, # private
- '172.31.12.1': False, # private
- '172.32.0.1': True, # public but 127 prefix
- '200.150.23.5': True, # normal public
- }
- for ip_address, is_valid_public in six.iteritems(EXPECTED):
- self.assertEqual(is_valid_ip(ip_address), is_valid_public)
- class UtilsTest(TestCase):
- def test_iso8601(self):
- """Tests iso8601 correctly translates datetime.timdelta to ISO 8601
- formatted duration."""
- EXPECTED = {
- datetime.timedelta(days=1, hours=25, minutes=42, seconds=8):
- 'P2DT1H42M8S',
- datetime.timedelta(days=7, seconds=342):
- 'P7DT5M42S',
- datetime.timedelta(days=0, hours=2, minutes=42):
- 'PT2H42M',
- datetime.timedelta(hours=20, seconds=42):
- 'PT20H42S',
- datetime.timedelta(seconds=300):
- 'PT5M',
- datetime.timedelta(seconds=9005):
- 'PT2H30M5S',
- datetime.timedelta(minutes=9005):
- 'P6DT6H5M',
- datetime.timedelta(days=15):
- 'P15D'
- }
- for timedelta, iso_duration in six.iteritems(EXPECTED):
- self.assertEqual(iso8601(timedelta), iso_duration)
|