<commit_before>import pytest

testinfra_hosts = ["app-staging"]
sdvars = pytest.securedrop_test_vars


@pytest.mark.parametrize('package', [
    'tor',
])
def test_tor_packages(Package, package):
    """
    Ensure Tor packages are installed. Does not include the Tor keyring
    package, since we want only the SecureDrop Release Signing Key
    to be used even for Tor packages.
    """
    assert Package(package).is_installed


def test_tor_service_running(Command, File, Sudo):
    """
    Ensure tor is running and enabled. Tor is required for SSH access,
    so it must be enabled to start on boot.
    """
    # TestInfra tries determine the service manager intelligently, and
    # inappropriately assumes Upstart on Trusty, due to presence of the
    # `initctl` command. The tor service is handled via a SysV-style init
    # script, so let's just shell out and verify the running and enabled
    # states explicitly.
    with Sudo():
        assert Command.check_output("service tor status") == \
               " * tor is running"
        tor_enabled = Command.check_output("find /etc/rc?.d -name S??tor")

    assert tor_enabled != ""

    tor_targets = tor_enabled.split("\n")
    assert len(tor_targets) == 4
    for target in tor_targets:
        t = File(target)
        assert t.is_symlink
        assert t.linked_to == "/etc/init.d/tor"


@pytest.mark.parametrize('torrc_option', [
    'SocksPort 0',
    'SafeLogging 1',
    'RunAsDaemon 1',
])
def test_tor_torrc_options(File, torrc_option):
    """
    Check for required options in the system Tor config file.
    These options should be present regardless of machine role,
    meaning both Application and Monitor server will have them.

    Separate tests will check for specific hidden services.
    """
    f = File("/etc/tor/torrc")
    assert f.is_file
    assert f.user == "debian-tor"
    assert oct(f.mode) == "0644"
    assert f.contains("^{}$".format(torrc_option))


def test_tor_torrc_sandbox(File):
    """
    Check that the `Sandbox 1` declaration is not present in the torrc.
    The torrc manpage states this option is experimental, and although we
    use it already on Tails workstations, further testing is required<commit_msg>Updates tor config tests for Xenial support<commit_after>import pytest

testinfra_hosts = ["app-staging"]
sdvars = pytest.securedrop_test_vars


@pytest.mark.parametrize('package', [
    'tor',
])
def test_tor_packages(Package, package):
    """
    Ensure Tor packages are installed. Does not include the Tor keyring
    package, since we want only the SecureDrop Release Signing Key
    to be used even for Tor packages.
    """
    assert Package(package).is_installed


def test_tor_service_running_trusty(host):
    """
    Ensure tor is running and enabled. Tor is required for SSH access,
    so it must be enabled to start on boot. Checks upstart/sysv-style
    services, used by Trusty.
    """
    # TestInfra tries determine the service manager intelligently, and
    # inappropriately assumes Upstart on Trusty, due to presence of the
    # `initctl` command. The tor service is handled via a SysV-style init
    # script, so let's just shell out and verify the running and enabled
    # states explicitly.
    if host.system_info.codename == "xenial":
        return True

    with host.sudo():
        assert host.check_output("service tor status") == \
               " * tor is running"
        tor_enabled = host.check_output("find /etc/rc?.d -name S??tor")

    assert tor_enabled != ""

    tor_targets = tor_enabled.split("\n")
    assert len(tor_targets) == 4
    for target in tor_targets:
        t = host.file(target)
        assert t.is_symlink
        assert t.linked_to == "/etc/init.d/tor"


def test_tor_service_running_xenial(host):
    """
    Ensure tor is running and enabled. Tor is required for SSH access,
    so it must be enabled to start on boot. Checks systemd-style services,
    used by Xenial.
    """
    # TestInfra tries determine the service manager intelligently, and
    # inappropriately assumes Upstart on Trusty, due to presence of the
    # `initctl` command. The tor service is handled via a SysV-style init
    # script, so let's just shell out and verify the running and enabled
    # states explicitly.
    if host.system_info.codename == "trusty":
        return True

    s = host.service("tor")
    assert s.is_running
    assert s.is_enabled


@pytest.mark.parametrize('torrc_option', [
    'SocksPort 0',
    'SafeLogging 1',
    'RunAsDaemon 1',
])
def test_tor_torrc_options(File, torrc_option):
    """
    Check for required options in the system Tor config file.
    These options should be present regardless of machine role,
    meaning both Application and Monitor server will have them.

    Separate tests will check for specific hidden services.
    """
    f = File("/etc/tor/torrc")
    assert f.is_file
    assert f.user == "debian-tor"
    assert oct(f.mode) == "0644"
    assert f.contains("^{}$".format(torrc_option))


def test_tor_torrc_sandbox(File):
    """
    Check that the `Sandbox 1` declaration is not present in the torrc.
    The torrc manpage states this option is experimental, and although we
    use it already on Tails workstations, further testing is required
{'fraction_non_alphanumeric': 0.08696475937855248, 'fraction_numerical': 0.0034103827207275484, 'mean_word_length': 3.1501572327044025, 'pattern_counts': {'":': 2, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2395973', 'n_tokens_mistral': 1587, 'n_tokens_neox': 1535, 'n_words': 565}