<commit_before># -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import unicode_literals

import mock
import pytest

from paasta_tools import firewall
from paasta_tools import iptables
from paasta_tools.utils import DEFAULT_SOA_DIR


EMPTY_RULE = iptables.Rule(
    protocol='ip',
    src='0.0.0.0/0.0.0.0',
    dst='0.0.0.0/0.0.0.0',
    target=None,
    matches=(),
    target_parameters=(),
)


@pytest.fixture
def service_group():
    return firewall.ServiceGroup(
        service='my_cool_service',
        instance='web',
    )


@pytest.yield_fixture
def mock_get_running_mesos_docker_containers():
    with mock.patch.object(
        firewall, 'get_running_mesos_docker_containers', autospec=True,
        return_value=[
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'hassecurity',
                },
                'NetworkSettings': {
                    'Networks': {
                        'bridge': {
                            'MacAddress': '02:42:a9:fe:00:0a',
                            'IPAddress': '1.1.1.1'
                        },
                    },
                },
            },
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'chronoswithsecurity',
                },
                'NetworkSettings': {
                    'Networks': {
                        'bridge': {
                            'MacAddress': '02:42:a9:fe:00:0b',
                            'IPAddress': '2.2.2.2'
                        },
                    },
                },
            },
            # host networking
            {
                'HostConfig': {'NetworkMode': 'host'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'batch',
                },
            },
            # no labels
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {},
            },
        ],
    ):
        yield


@pytest.mark.usefixtures('mock_get_running_mesos_docker_containers')
def test_services_running_here():
    assert tuple(firewall.services_running_here()) == (
        ('myservice', 'hassecurity', '02:42:a9:fe:00:0a', '1.1.1.1'),
        ('myservice', 'chronoswithsecurity', '02:42:a9:fe:00:0b', '2.2.2.2'),
    )


@pytest.yield_fixture
def mock_services_running_here():
    with mock.patch.object(
        firewall, 'services_running_here', autospec=True,
        side_effect=lambda: iter((
            ('example_happyhour', 'main', '02:42:a9:fe:00:00', '1.1.1.1'),
            ('example_happyhour', 'main', '02:42:a9:fe:00:01', '2.2.2.2'),
            ('example_happyhour', 'batch', '02:42:a9:fe:00:02', '3.3.3.3'),
            ('my_cool_service', 'web', '02:42:a9:fe:00:03', '4.4.4.4'),
            ('my_cool_service', 'web', '02:42:a9:fe:00:04', '5.5.5.5'),
        )),
    ):
        yield


def test_service_group_chain_name(service_group):
    """The chain name must be stable, unique, and short."""
    assert service_group.chain_name == 'PAASTA.my_cool_se.f031797563'
    assert len(service_group.chain_name) <= 28


@pytest.yield_fixture
def mock_service_config():
    with mock.patch.object(
        firewall, 'get_instance_config', autospec=True,
    ) as mock_instance_config, mock.patch.object(
        firewall, 'get_all_namespaces_for_service', autospec=True,
        return_value={'example_happyhour.main': {'proxy_port': '20000'}},
    ), mock.patch.object(
        firewall, 'load_system_paasta_config', autospec=True
    ) as mock_system_paasta_config, mock.patch.object(
        firewall, '_synapse_backends', autospec=True
    ) as mock_synapse_backends:

        mock_system_paasta_config.return_value.get_cluster.return_value = 'mycluster'

        mock_instance_config.return_value = mock.Mock()
        mock_instance_config.return_value.get_dependencies.return_value = [
            {'well-known': 'internet'},
            {'smartstack': 'example_happyhour.main'},
        ]
        mock_instance_config.return_value.get_outbound_firewall.return_value = 'monitor'
        mock_instance_config.return_value.log_prefix = 'my-log-prefix '

        mock_synapse_backends.return_value = [
            {'host': '1.2.3.4', 'port': 123},
            {'host': '5.6.7.8', 'port': 567}
        ]
        yield


def test_service_group_rules(mock_service_config, service_group):
    assert service_group.get_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR) == (
        EMPTY_RULE._replace(
            target='LOG',
            matches=(
                ('limit', (('limit', '1/sec'),)),
            ),
            target_parameters=(
                ('log-prefix', ('my-log-prefix ',)),
            ),
        ),
        EMPTY_RULE._replace(target='PAASTA-INTERNET'),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='1.2.3.4/255.255.255.255',
            matches=(
                ('tcp', (('dport', '123'),)),
            ),
        ),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='5.6.7.8/255.255.255.255',
            matches=(
                ('tcp', (('dport', '567'),)),
            ),
        ),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='169.254.255.254/255.255.255.255',
            matches=(
                ('tcp', (('dport', '20000'),)),
            ),
        ),
    )


def test_service_group_rules_synapse_backend_error(mock_service_config, service_group):
    firewall._synapse_backends.side_effect = IOError('Error loading file')
    assert service_group.get_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR) == (
        EMPTY_RULE._replace(
            target='LOG',
            matches=(
                ('limit', (('limit', '1/sec'),)),
            ),
            target_parameters=(
                ('log-prefix', ('my-log-prefix ',)),
            ),
        ),
        EMPTY_RULE._replace(target='PAASTA-INTERNET'),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='169.254.255.254/255.255.255.255',
            matches=(
                ('tcp', (('dport', '20000'),)),
            ),
        ),
    )


def test_service_group_update_rules(service_group):
    with mock.patch.object(iptables, 'ensure_chain', autospec=True) as m:
        with mock.patch.object(type(service_group), 'get_rules', return_value=mock.sentinel.RULES):
            service_group.update_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR)
    m.assert_called_once_with(
        service_group.chain_name,<commit_msg>fix tests for log_prefix change<commit_after># -*- coding: utf-8 -*-
from __future__ import absolute_import
from __future__ import unicode_literals

import mock
import pytest

from paasta_tools import firewall
from paasta_tools import iptables
from paasta_tools.utils import DEFAULT_SOA_DIR


EMPTY_RULE = iptables.Rule(
    protocol='ip',
    src='0.0.0.0/0.0.0.0',
    dst='0.0.0.0/0.0.0.0',
    target=None,
    matches=(),
    target_parameters=(),
)


@pytest.fixture
def service_group():
    return firewall.ServiceGroup(
        service='my_cool_service',
        instance='web',
    )


@pytest.yield_fixture
def mock_get_running_mesos_docker_containers():
    with mock.patch.object(
        firewall, 'get_running_mesos_docker_containers', autospec=True,
        return_value=[
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'hassecurity',
                },
                'NetworkSettings': {
                    'Networks': {
                        'bridge': {
                            'MacAddress': '02:42:a9:fe:00:0a',
                            'IPAddress': '1.1.1.1'
                        },
                    },
                },
            },
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'chronoswithsecurity',
                },
                'NetworkSettings': {
                    'Networks': {
                        'bridge': {
                            'MacAddress': '02:42:a9:fe:00:0b',
                            'IPAddress': '2.2.2.2'
                        },
                    },
                },
            },
            # host networking
            {
                'HostConfig': {'NetworkMode': 'host'},
                'Labels': {
                    'paasta_service': 'myservice',
                    'paasta_instance': 'batch',
                },
            },
            # no labels
            {
                'HostConfig': {'NetworkMode': 'bridge'},
                'Labels': {},
            },
        ],
    ):
        yield


@pytest.mark.usefixtures('mock_get_running_mesos_docker_containers')
def test_services_running_here():
    assert tuple(firewall.services_running_here()) == (
        ('myservice', 'hassecurity', '02:42:a9:fe:00:0a', '1.1.1.1'),
        ('myservice', 'chronoswithsecurity', '02:42:a9:fe:00:0b', '2.2.2.2'),
    )


@pytest.yield_fixture
def mock_services_running_here():
    with mock.patch.object(
        firewall, 'services_running_here', autospec=True,
        side_effect=lambda: iter((
            ('example_happyhour', 'main', '02:42:a9:fe:00:00', '1.1.1.1'),
            ('example_happyhour', 'main', '02:42:a9:fe:00:01', '2.2.2.2'),
            ('example_happyhour', 'batch', '02:42:a9:fe:00:02', '3.3.3.3'),
            ('my_cool_service', 'web', '02:42:a9:fe:00:03', '4.4.4.4'),
            ('my_cool_service', 'web', '02:42:a9:fe:00:04', '5.5.5.5'),
        )),
    ):
        yield


def test_service_group_chain_name(service_group):
    """The chain name must be stable, unique, and short."""
    assert service_group.chain_name == 'PAASTA.my_cool_se.f031797563'
    assert len(service_group.chain_name) <= 28


@pytest.yield_fixture
def mock_service_config():
    with mock.patch.object(
        firewall, 'get_instance_config', autospec=True,
    ) as mock_instance_config, mock.patch.object(
        firewall, 'get_all_namespaces_for_service', autospec=True,
        return_value={'example_happyhour.main': {'proxy_port': '20000'}},
    ), mock.patch.object(
        firewall, 'load_system_paasta_config', autospec=True
    ) as mock_system_paasta_config, mock.patch.object(
        firewall, '_synapse_backends', autospec=True
    ) as mock_synapse_backends:

        mock_system_paasta_config.return_value.get_cluster.return_value = 'mycluster'

        mock_instance_config.return_value = mock.Mock()
        mock_instance_config.return_value.get_dependencies.return_value = [
            {'well-known': 'internet'},
            {'smartstack': 'example_happyhour.main'},
        ]
        mock_instance_config.return_value.get_outbound_firewall.return_value = 'monitor'

        mock_synapse_backends.return_value = [
            {'host': '1.2.3.4', 'port': 123},
            {'host': '5.6.7.8', 'port': 567}
        ]
        yield


def test_service_group_rules(mock_service_config, service_group):
    assert service_group.get_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR) == (
        EMPTY_RULE._replace(
            target='LOG',
            matches=(
                ('limit', (('limit', '1/sec'),)),
            ),
            target_parameters=(
                ('log-prefix', ('paasta.my_cool_service ',)),
            ),
        ),
        EMPTY_RULE._replace(target='PAASTA-INTERNET'),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='1.2.3.4/255.255.255.255',
            matches=(
                ('tcp', (('dport', '123'),)),
            ),
        ),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='5.6.7.8/255.255.255.255',
            matches=(
                ('tcp', (('dport', '567'),)),
            ),
        ),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='169.254.255.254/255.255.255.255',
            matches=(
                ('tcp', (('dport', '20000'),)),
            ),
        ),
    )


def test_service_group_rules_synapse_backend_error(mock_service_config, service_group):
    firewall._synapse_backends.side_effect = IOError('Error loading file')
    assert service_group.get_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR) == (
        EMPTY_RULE._replace(
            target='LOG',
            matches=(
                ('limit', (('limit', '1/sec'),)),
            ),
            target_parameters=(
                ('log-prefix', ('paasta.my_cool_service ',)),
            ),
        ),
        EMPTY_RULE._replace(target='PAASTA-INTERNET'),
        EMPTY_RULE._replace(
            protocol='tcp',
            target='ACCEPT',
            dst='169.254.255.254/255.255.255.255',
            matches=(
                ('tcp', (('dport', '20000'),)),
            ),
        ),
    )


def test_service_group_update_rules(service_group):
    with mock.patch.object(iptables, 'ensure_chain', autospec=True) as m:
        with mock.patch.object(type(service_group), 'get_rules', return_value=mock.sentinel.RULES):
            service_group.update_rules(DEFAULT_SOA_DIR, firewall.DEFAULT_SYNAPSE_SERVICE_DIR)
    m.assert_called_once_with(
        service_group.chain_name,
{'fraction_non_alphanumeric': 0.143053148469093, 'fraction_numerical': 0.03726169844020797, 'mean_word_length': 1.907621247113164, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 46, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5288316', 'n_tokens_mistral': 4636, 'n_tokens_neox': 4265, 'n_words': 591}