From fb8dc2bb28919aad256b7614b2ebd96e0c848bc1 Mon Sep 17 00:00:00 2001 From: kurilova Date: Thu, 16 Jul 2026 08:26:30 +0000 Subject: [PATCH 1/3] Remove tests for tls v1.3 from tsl v1.2 testing --- modules/test/tls/python/src/tls_module.py | 24 +++------- testing/unit/tls/tls_module_test.py | 56 +++++++---------------- 2 files changed, 24 insertions(+), 56 deletions(-) diff --git a/modules/test/tls/python/src/tls_module.py b/modules/test/tls/python/src/tls_module.py index e0cf9f0d3..d11fd29a9 100644 --- a/modules/test/tls/python/src/tls_module.py +++ b/modules/test/tls/python/src/tls_module.py @@ -411,19 +411,14 @@ def _security_tls_v1_2_server(self): LOGGER.info(f'Inspecting Service on port {port}: {service_type}') tls_1_2_results = self._tls_util.validate_tls_server( host=self._device_ipv4_addr, port=port, tls_version='1.2') - tls_1_3_results = self._tls_util.validate_tls_server( - host=self._device_ipv4_addr, port=port, tls_version='1.3') - # If TLS 1.2 is not supported don't process the results if tls_1_2_results[0] is not None: - port_results = self._tls_util.process_tls_server_results( - tls_1_2_results, tls_1_3_results, port=port) - else: - port_results = None - if port_results is not None: - result = port_results[ - 0] if result is None else result and port_results[0] - details.extend(port_results[1]) - if port_results[0]: + result = tls_1_2_results[0] if result is None else result and tls_1_2_results[0] + details.append(f'TLS 1.2 {"" if tls_1_2_results[0] else "not "}validated on port {port}:') + if isinstance(tls_1_2_results[1], list): + details.extend(tls_1_2_results[1]) + else: + details.append(tls_1_2_results[1]) + if tls_1_2_results[0]: ports_valid.append(port) else: ports_invalid.append(port) @@ -439,11 +434,6 @@ def _security_tls_v1_2_server(self): result = 'Feature Not Detected' description = 'TLS 1.2 certificate could not be validated' details.append('TLS 1.2 certificate could not be validated.') - # If TLS 1.2 cert is not valid but TLS 1.3 is valid test is Compliant - elif result and not tls_1_2_results[0] and tls_1_3_results[0]: - ports_csv = ','.join(map(str,ports_valid)) - description = 'TLS 1.2 certificate invalid and ' - description += f'TLS 1.3 certificate valid on ports: {ports_csv}' elif result: ports_csv = ','.join(map(str,ports_valid)) description = f'TLS 1.2 certificate valid on ports: {ports_csv}' diff --git a/testing/unit/tls/tls_module_test.py b/testing/unit/tls/tls_module_test.py index a0364b4ce..035311051 100644 --- a/testing/unit/tls/tls_module_test.py +++ b/testing/unit/tls/tls_module_test.py @@ -69,12 +69,14 @@ def setUpClass(cls): # Setup the default ipv4 address and the scan results def setUp(self): - self.tls_module = TLSModule(module=MODULE) + self.tls_module = TLSModule(module=MODULE, conf_file=CONF_FILE) self.tls_module._device_ipv4_addr = None # pylint: disable=W0212 self.tls_module._scan_results = None # pylint: disable=W0212 - def security_tls_v1_2_server_no_ip_test(self): + @patch('tls_module.TLSModule._get_device_ipv4') + def security_tls_v1_2_server_no_ip_test(self, mock_get_device_ipv4): """Test _security_tls_v1_2_server when device IP could not be resolved""" + mock_get_device_ipv4.return_value = None result, description, details = self.tls_module._security_tls_v1_2_server() # pylint: disable=W0212 @@ -162,11 +164,10 @@ def validate_side_effect(**kwargs): self.assertEqual(details, ['TLS 1.2 certificate could not be validated.']) @patch('tls_module.TLSUtil.validate_tls_server') - def security_tls_v1_2_server_compliant_invalid_v1_2_cert_test(self, + def security_tls_v1_2_server_invalid_v1_2_cert_test(self, mock_validate_tls_server): """ - Test _security_tls_v1_2_server when TLS 1.2 cert is invalid but - TLS 1.3 cert is valid + Test _security_tls_v1_2_server when TLS 1.2 cert is invalid """ self.tls_module._device_ipv4_addr = '10.10.10.14' # pylint: disable=W0212 @@ -177,30 +178,21 @@ def validate_side_effect(**kwargs): tls_version = kwargs.get('tls_version') if tls_version == '1.2': return (False, ['Certificate has expired']) - elif tls_version == '1.3': - return (True, ['Time range valid', - 'Public key valid', - 'Signature valid'] - ) mock_validate_tls_server.side_effect = validate_side_effect result, description, details = self.tls_module._security_tls_v1_2_server() # pylint: disable=W0212 - # Expects compliant result - self.assertEqual(result, True) + # Expects non-compliant result + self.assertEqual(result, False) expected_description = ( - 'TLS 1.2 certificate invalid and TLS 1.3 certificate valid on ports: 443' + 'TLS 1.2 certificate invalid on ports: 443' ) self.assertEqual(description, expected_description ) expected_details = [ 'TLS 1.2 not validated on port 443:', - 'Certificate has expired', - 'TLS 1.3 validated on port 443:', - 'Time range valid', - 'Public key valid', - 'Signature valid' + 'Certificate has expired' ] self.assertEqual(details, expected_details) @@ -231,9 +223,7 @@ def validate_side_effect(**kwargs): expected_details = [ 'TLS 1.2 not validated on port 443:', - 'Certificate has expired', - 'TLS 1.3 not validated on port 443:', - 'Device certificate has not been signed' + 'Certificate has expired' ] self.assertEqual(details, expected_details) @@ -265,10 +255,6 @@ def validate_side_effect(**kwargs): 'TLS 1.2 validated on port 443:', 'Time range valid', 'Public key valid', - 'Signature valid', - 'TLS 1.3 validated on port 443:', - 'Time range valid', - 'Public key valid', 'Signature valid' ] self.assertEqual(details, expected_details) @@ -303,18 +289,10 @@ def validate_side_effect(**kwargs): 'Time range valid', 'Public key valid', 'Signature valid', - 'TLS 1.3 validated on port 443:', - 'Time range valid', - 'Public key valid', - 'Signature valid', 'TLS 1.2 validated on port 8443:', 'Time range valid', 'Public key valid', 'Signature valid', - 'TLS 1.3 validated on port 8443:', - 'Time range valid', - 'Public key valid', - 'Signature valid', ] self.assertEqual(details, expected_details) @@ -345,10 +323,6 @@ def validate_side_effect(**kwargs): 'Time range valid', 'Public key valid', 'Signature valid', - 'TLS 1.3 validated on port 443:', - 'Time range valid', - 'Public key valid', - 'Signature valid', 'HTTP service detected on port 80.' ] self.assertEqual(details, expected_details) @@ -640,7 +614,7 @@ def outbound_connections_report_test(self): capture_file = os.path.join(CAPTURES_DIR, 'monitor.pcap') ip_dst = TLS_UTIL.get_all_outbound_connections( device_mac='70:b3:d5:96:c0:00', capture_files=[capture_file]) - tls = TLSModule(module=MODULE) + tls = TLSModule(module=MODULE, conf_file=CONF_FILE) gen_html = tls.generate_outbound_connection_table(ip_dst) print(gen_html) @@ -651,6 +625,7 @@ def tls_module_report_multi_page_test(self): monitor_pcap_file = os.path.join(CAPTURES_DIR, 'multi_page_monitor.pcap') tls_pcap_file = os.path.join(CAPTURES_DIR, 'multi_page_tls.pcap') tls = TLSModule(module=MODULE, + conf_file=CONF_FILE, results_dir=OUTPUT_DIR, startup_capture_file=startup_pcap_file, monitor_capture_file=monitor_pcap_file, @@ -674,6 +649,7 @@ def tls_module_report_test(self): os.environ['DEVICE_MAC'] = '38:d1:35:01:17:fe' pcap_file = os.path.join(CAPTURES_DIR, 'tls.pcap') tls = TLSModule(module=MODULE, + conf_file=CONF_FILE, results_dir=OUTPUT_DIR, startup_capture_file=pcap_file, monitor_capture_file=pcap_file, @@ -692,6 +668,7 @@ def tls_module_report_ext_test(self): os.environ['DEVICE_MAC'] = '28:29:86:27:d6:05' pcap_file = os.path.join(CAPTURES_DIR, 'tls_ext.pcap') tls = TLSModule(module=MODULE, + conf_file=CONF_FILE, results_dir=OUTPUT_DIR, startup_capture_file=pcap_file, monitor_capture_file=pcap_file, @@ -718,6 +695,7 @@ def tls_module_report_no_cert_test(self): os.environ['DEVICE_MAC'] = '' pcap_file = os.path.join(CAPTURES_DIR, 'tls_ext.pcap') tls = TLSModule(module=MODULE, + conf_file=CONF_FILE, results_dir=OUTPUT_DIR, startup_capture_file=pcap_file, monitor_capture_file=pcap_file, @@ -902,7 +880,7 @@ def download_public_cert(self, hostname, port=443): suite.addTest(TLSModuleTest('security_tls_v1_2_multiple_https_servers_test')) suite.addTest(TLSModuleTest('security_tls_v1_2_server_http_test')) suite.addTest( - TLSModuleTest('security_tls_v1_2_server_compliant_invalid_v1_2_cert_test') + TLSModuleTest('security_tls_v1_2_server_invalid_v1_2_cert_test') ) suite.addTest( TLSModuleTest( From ae52592115d9bd380c778f186f85c1aca8695316 Mon Sep 17 00:00:00 2001 From: kurilova Date: Thu, 16 Jul 2026 08:35:38 +0000 Subject: [PATCH 2/3] Fix lint --- modules/test/tls/python/src/tls_module.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/test/tls/python/src/tls_module.py b/modules/test/tls/python/src/tls_module.py index d11fd29a9..9b989eb3c 100644 --- a/modules/test/tls/python/src/tls_module.py +++ b/modules/test/tls/python/src/tls_module.py @@ -412,8 +412,13 @@ def _security_tls_v1_2_server(self): tls_1_2_results = self._tls_util.validate_tls_server( host=self._device_ipv4_addr, port=port, tls_version='1.2') if tls_1_2_results[0] is not None: - result = tls_1_2_results[0] if result is None else result and tls_1_2_results[0] - details.append(f'TLS 1.2 {"" if tls_1_2_results[0] else "not "}validated on port {port}:') + if result is None: + result = tls_1_2_results[0] + else: + result = result and tls_1_2_results[0] + status_str = '' if tls_1_2_results[0] else 'not ' + details.append( + f'TLS 1.2 {status_str}validated on port {port}:') if isinstance(tls_1_2_results[1], list): details.extend(tls_1_2_results[1]) else: From a16708956a3a4a7e7c0b258ed90d13f86e29dacb Mon Sep 17 00:00:00 2001 From: kurilova Date: Thu, 16 Jul 2026 08:46:02 +0000 Subject: [PATCH 3/3] Fix tests --- testing/unit/tls/tls_module_test.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/testing/unit/tls/tls_module_test.py b/testing/unit/tls/tls_module_test.py index 035311051..fb2f6744b 100644 --- a/testing/unit/tls/tls_module_test.py +++ b/testing/unit/tls/tls_module_test.py @@ -46,7 +46,11 @@ LOCAL_REPORT_EXT = os.path.join(REPORTS_DIR, 'tls_report_ext_local.html') LOCAL_REPORT_NO_CERT = os.path.join(REPORTS_DIR, 'tls_report_no_cert_local.html') -CONF_FILE = 'modules/test/' + MODULE + '/conf/module_config.json' +CONF_FILE = ( + '/testrun/conf/module_config.json' + if os.path.exists('/testrun/conf/module_config.json') + else 'modules/test/' + MODULE + '/conf/module_config.json' +) INTERNET_IFACE = 'eth0'