Skip to content

Commit 05d0bd0

Browse files
elsif2elsif2
committed
revised tests
1 parent 1bb40a4 commit 05d0bd0

File tree

10 files changed

+260
-35
lines changed

10 files changed

+260
-35
lines changed

‎intelmq/tests/bots/parsers/shadowserver/test_broken.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,12 @@
1313
REPORT1 = {"raw": utils.base64_encode('adasdasdasdasd\nadasdasdafgf'),
1414
"__type": "Report",
1515
"time.observation": "2015-01-01T00:00:00+00:00",
16-
"extra.file_name": "2019-01-01-scan_http-test-test.csv",
16+
"extra.file_name": "2019-01-01-test_smb-test-test.csv",
1717
}
1818
REPORT2 = {"raw": utils.base64_encode('timestamp,ip,port\n2018-08-01T00:00:00+00,127.0.0.1,80'),
1919
"__type": "Report",
2020
"time.observation": "2015-01-01T00:00:00+00:00",
21-
"extra.file_name": "2019-01-01-scan_ftp-test-test.csv",
21+
"extra.file_name": "2019-01-01-test_telnet-test-test.csv",
2222
}
2323
REPORT3 = {"raw": utils.base64_encode('adasdasdasdasd\nadasdasdafgf'),
2424
"__type": "Report",
@@ -48,10 +48,10 @@ def test_broken(self):
4848
"""
4949
self.input_message = REPORT1
5050
self.run_bot(allowed_error_count=1)
51-
self.assertLogMatches(pattern="Detected report's file name: 'scan_http'.",
51+
self.assertLogMatches(pattern="Detected report's file name: 'test_smb'.",
5252
levelname="DEBUG")
5353
self.assertLogMatches(pattern="Failed to parse line.")
54-
self.assertLogMatches(pattern="ValueError: Required column 'timestamp' not found in feed 'Accessible-HTTP'. Possible change in data format or misconfiguration.")
54+
self.assertLogMatches(pattern="ValueError: Required column 'timestamp' not found in feed 'Test-Accessible-SMB'. Possible change in data format or misconfiguration.")
5555
self.assertLogMatches(pattern=r"Sent 0 events and found 1 problem\(s\)\.",
5656
levelname="INFO")
5757

@@ -61,9 +61,9 @@ def test_half_broken(self):
6161
"""
6262
self.input_message = REPORT2
6363
self.run_bot(allowed_warning_count=63)
64-
self.assertLogMatches(pattern="Detected report's file name: 'scan_ftp'.",
64+
self.assertLogMatches(pattern="Detected report's file name: 'test_telnet'.",
6565
levelname="DEBUG")
66-
self.assertLogMatches(pattern="Optional key 'jarm' not found in feed 'Accessible-FTP'.",
66+
self.assertLogMatches(pattern="Optional key 'banner' not found in feed 'Test-Accessible-Telnet'.",
6767
levelname="WARNING")
6868
self.assertLogMatches(pattern=r"Sent 1 events and found 0 problem\(s\)\.",
6969
levelname="INFO")

‎intelmq/tests/bots/parsers/shadowserver/test_mapping.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,22 @@
1111

1212

1313
with open(os.path.join(os.path.dirname(__file__),
14-
'testdata/scan_telnet.csv')) as handle:
14+
'testdata/test_telnet.csv')) as handle:
1515
TELNET_FILE = handle.read()
1616
EXAMPLE_TELNET = {
1717
"raw": utils.base64_encode(TELNET_FILE),
1818
"__type": "Report",
1919
"time.observation": "2015-01-01T00:00:00+00:00",
20-
"extra.file_name": "2019-01-01-scan_telnet.csv",
20+
"extra.file_name": "2019-01-01-test_telnet.csv",
2121
}
2222
with open(os.path.join(os.path.dirname(__file__),
23-
'testdata/scan_vnc.csv')) as handle:
23+
'testdata/test_smb.csv')) as handle:
2424
TELNET_FILE = handle.read()
2525
EXAMPLE_VNC = {
2626
"raw": utils.base64_encode(TELNET_FILE),
2727
"__type": "Report",
2828
"time.observation": "2015-01-01T00:00:00+00:00",
29-
"extra.file_name": "2019-01-01-scan_vnc.csv",
29+
"extra.file_name": "2019-01-01-test_smb.csv",
3030
}
3131

3232

‎intelmq/tests/bots/parsers/shadowserver/test_parameters.py‎

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,38 +12,41 @@
1212
from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
1313

1414
with open(os.path.join(os.path.dirname(__file__),
15-
'testdata/scan_dns.csv')) as handle:
15+
'testdata/test_smb.csv')) as handle:
1616
EXAMPLE_FILE = handle.read()
1717
EXAMPLE_LINES = EXAMPLE_FILE.splitlines()
1818

1919
EXAMPLE_REPORT = {"raw": utils.base64_encode(EXAMPLE_FILE),
2020
"__type": "Report",
2121
"time.observation": "2018-07-30T00:00:00+00:00",
22-
"extra.file_name": "2019-01-01-scan_dns-test-test.csv",
22+
"extra.file_name": "2019-01-01-test_smb-test-test.csv",
2323
'feed.name': 'report feedname',
2424
}
2525
EVENTS = [{
2626
'__type': 'Event',
2727
'feed.name': 'report feedname',
28-
"classification.identifier": "dns-open-resolver",
28+
"classification.identifier": 'test-smb',
2929
"classification.taxonomy": "vulnerable",
3030
"classification.type": "vulnerable-system",
31-
"extra.dns_version": "dnsmasq-2.66",
32-
"extra.min_amplification": 4.619,
33-
"extra.tag": "openresolver",
34-
"protocol.application": "dns",
35-
"protocol.transport": "udp",
31+
"extra.smb_implant": False,
32+
"extra.smb_major_number": '2',
33+
"extra.smb_minor_number": '1',
34+
"extra.smb_version_string": 'SMB 2.1',
35+
"extra.smbv1_support": 'N',
36+
"extra.tag": "smb",
37+
"protocol.application": "smb",
38+
"protocol.transport": "tcp",
3639
'raw': utils.base64_encode('\n'.join([EXAMPLE_LINES[0],
3740
EXAMPLE_LINES[1]])),
38-
"source.asn": 25255,
39-
"source.geolocation.cc": "AT",
40-
"source.geolocation.city": "VIENNA",
41-
"source.geolocation.region": "WIEN",
42-
"source.ip": "198.51.100.179",
43-
"source.port": 53,
44-
"source.reverse_dns": "198-51-100-189.example.net",
41+
"source.asn": 64512,
42+
"source.geolocation.cc": "ZZ",
43+
"source.geolocation.city": "City",
44+
"source.geolocation.region": "Region",
45+
"source.ip": "192.168.0.1",
46+
"source.port": 445,
47+
"source.reverse_dns": "node01.example.com",
4548
"time.observation": "2018-07-30T00:00:00+00:00",
46-
"time.source": "2018-04-14T00:14:34+00:00"
49+
"time.source": "2010-02-10T00:00:00+00:00"
4750
},
4851
]
4952

@@ -70,7 +73,7 @@ def test_overwrite_feed_name(self):
7073
self.run_bot(prepare=False)
7174
for i, EVENT in enumerate(EVENTS):
7275
event = EVENT.copy()
73-
event['feed.name'] = 'DNS-Open-Resolvers'
76+
event['feed.name'] = 'Test-Accessible-SMB'
7477
self.assertMessageEqual(i, event)
7578

7679

‎intelmq/tests/bots/parsers/shadowserver/test_report_smb.py‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
# SPDX-FileCopyrightText: 2019 Guillermo Rodriguez
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-or-later
4+
5+
# -*- coding: utf-8 -*-
6+
7+
import os
8+
import unittest
9+
10+
import intelmq.lib.test as test
11+
import intelmq.lib.utils as utils
12+
from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
13+
14+
with open(os.path.join(os.path.dirname(__file__),
15+
'testdata/test_smb.csv')) as handle:
16+
EXAMPLE_FILE = handle.read()
17+
EXAMPLE_LINES = EXAMPLE_FILE.splitlines()
18+
19+
EXAMPLE_REPORT = {'feed.name': 'Test-Accessible-SMB',
20+
"raw": utils.base64_encode(EXAMPLE_FILE),
21+
"__type": "Report",
22+
"time.observation": "2015-01-01T00:00:00+00:00",
23+
"extra.file_name": "2019-01-01-test_smb-test-geo.csv",
24+
}
25+
EVENTS = [
26+
{
27+
'__type' : 'Event',
28+
'classification.identifier' : 'test-smb',
29+
'classification.taxonomy' : 'vulnerable',
30+
'classification.type' : 'vulnerable-system',
31+
'extra.smb_implant' : False,
32+
'extra.smb_major_number' : '2',
33+
'extra.smb_minor_number' : '1',
34+
'extra.smb_version_string' : 'SMB 2.1',
35+
'extra.smbv1_support' : 'N',
36+
'extra.tag' : 'smb',
37+
'feed.name' : 'Test-Accessible-SMB',
38+
'protocol.application' : 'smb',
39+
'protocol.transport' : 'tcp',
40+
'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[1]])),
41+
'source.asn' : 64512,
42+
'source.geolocation.cc' : 'ZZ',
43+
'source.geolocation.city' : 'City',
44+
'source.geolocation.region' : 'Region',
45+
'source.ip' : '192.168.0.1',
46+
'source.port' : 445,
47+
'source.reverse_dns' : 'node01.example.com',
48+
'time.observation' : '2015-01-01T00:00:00+00:00',
49+
'time.source' : '2010-02-10T00:00:00+00:00'
50+
},
51+
52+
{
53+
'__type' : 'Event',
54+
'classification.identifier' : 'test-smb',
55+
'classification.taxonomy' : 'vulnerable',
56+
'classification.type' : 'vulnerable-system',
57+
'extra.smb_implant' : False,
58+
'extra.smb_major_number' : '2',
59+
'extra.smb_minor_number' : '1',
60+
'extra.smb_version_string' : 'SMB 2.1',
61+
'extra.smbv1_support' : 'N',
62+
'extra.tag' : 'smb',
63+
'feed.name' : 'Test-Accessible-SMB',
64+
'protocol.application' : 'smb',
65+
'protocol.transport' : 'tcp',
66+
'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[2]])),
67+
'source.asn' : 64512,
68+
'source.geolocation.cc' : 'ZZ',
69+
'source.geolocation.city' : 'City',
70+
'source.geolocation.region' : 'Region',
71+
'source.ip' : '192.168.0.2',
72+
'source.port' : 445,
73+
'source.reverse_dns' : 'node02.example.com',
74+
'time.observation' : '2015-01-01T00:00:00+00:00',
75+
'time.source' : '2010-02-10T00:00:01+00:00'
76+
},
77+
78+
{
79+
'__type' : 'Event',
80+
'classification.identifier' : 'test-smb',
81+
'classification.taxonomy' : 'vulnerable',
82+
'classification.type' : 'vulnerable-system',
83+
'extra.smb_implant' : False,
84+
'extra.smb_major_number' : '2',
85+
'extra.smb_minor_number' : '1',
86+
'extra.smb_version_string' : 'SMB 2.1',
87+
'extra.smbv1_support' : 'N',
88+
'extra.tag' : 'smb',
89+
'feed.name' : 'Test-Accessible-SMB',
90+
'protocol.application' : 'smb',
91+
'protocol.transport' : 'tcp',
92+
'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[3]])),
93+
'source.asn' : 64512,
94+
'source.geolocation.cc' : 'ZZ',
95+
'source.geolocation.city' : 'City',
96+
'source.geolocation.region' : 'Region',
97+
'source.ip' : '192.168.0.3',
98+
'source.port' : 445,
99+
'source.reverse_dns' : 'node03.example.com',
100+
'time.observation' : '2015-01-01T00:00:00+00:00',
101+
'time.source' : '2010-02-10T00:00:02+00:00'
102+
}
103+
]
104+
105+
106+
class TestShadowserverParserBot(test.BotTestCase, unittest.TestCase):
107+
"""
108+
A TestCase for a ShadowserverParserBot.
109+
"""
110+
111+
@classmethod
112+
def set_bot(cls):
113+
cls.bot_reference = ShadowserverParserBot
114+
cls.default_input_message = EXAMPLE_REPORT
115+
116+
def test_event(self):
117+
""" Test if correct Event has been produced. """
118+
self.run_bot()
119+
for i, EVENT in enumerate(EVENTS):
120+
self.assertMessageEqual(i, EVENT)
121+
122+
123+
if __name__ == '__main__': # pragma: no cover
124+
unittest.main()

‎intelmq/tests/bots/parsers/shadowserver/test_report_switch.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,24 @@
1212
from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
1313

1414
with open(os.path.join(os.path.dirname(__file__),
15-
'testdata/scan_ftp.csv')) as handle:
15+
'testdata/test_smb.csv')) as handle:
1616
EXAMPLE_LINES = handle.read().splitlines()[:2]
1717

18-
FIRST_REPORT = {'feed.name': 'Accessible FTP',
18+
FIRST_REPORT = {'feed.name': 'Test-Accessible-SMB',
1919
"raw": utils.base64_encode('\n'.join(EXAMPLE_LINES)),
2020
"__type": "Report",
2121
"time.observation": "2019-03-25T00:00:00+00:00",
22-
"extra.file_name": "2019-03-25-scan_ftp-test-test.csv",
22+
"extra.file_name": "2019-03-25-test_smb-test-test.csv",
2323
}
24-
with open(os.path.join(os.path.dirname(__file__), 'testdata/blocklist.csv')) as handle:
24+
with open(os.path.join(os.path.dirname(__file__), 'testdata/test_telnet.csv')) as handle:
2525
EXAMPLE_LINES = handle.read().splitlines()[:2]
2626

2727
SECOND_REPORT = {
28-
'feed.name': 'Blocklist',
28+
'feed.name': 'Test-Accessible-Telnet',
2929
"raw": utils.base64_encode('\n'.join(EXAMPLE_LINES)),
3030
"__type": "Report",
3131
"time.observation": "2015-01-01T00:00:00+00:00",
32-
"extra.file_name": "2019-01-01-blocklist-test-geo.csv",
32+
"extra.file_name": "2019-01-01-test_telnet-test-geo.csv",
3333
}
3434

3535

@@ -48,9 +48,9 @@ def test_event(self):
4848
""" Test if the parser correctly detects and handles different report types. """
4949
self.input_message = [FIRST_REPORT, SECOND_REPORT]
5050
self.run_bot(iterations=2)
51-
self.assertLogMatches("Detected report's file name: 'scan_ftp'",
51+
self.assertLogMatches("Detected report's file name: 'test_smb'",
5252
levelname='DEBUG')
53-
self.assertLogMatches("Detected report's file name: 'blocklist'",
53+
self.assertLogMatches("Detected report's file name: 'test_telnet'",
5454
levelname='DEBUG')
5555

5656

‎intelmq/tests/bots/parsers/shadowserver/test_report_telnet.py‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# SPDX-FileCopyrightText: 2019 Guillermo Rodriguez
2+
#
3+
# SPDX-License-Identifier: AGPL-3.0-or-later
4+
5+
# -*- coding: utf-8 -*-
6+
7+
import os
8+
import unittest
9+
10+
import intelmq.lib.test as test
11+
import intelmq.lib.utils as utils
12+
from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
13+
14+
with open(os.path.join(os.path.dirname(__file__),
15+
'testdata/test_telnet.csv')) as handle:
16+
EXAMPLE_FILE = handle.read()
17+
EXAMPLE_LINES = EXAMPLE_FILE.splitlines()
18+
19+
EXAMPLE_REPORT = {'feed.name': 'Test-Accessible-Telnet',
20+
"raw": utils.base64_encode(EXAMPLE_FILE),
21+
"__type": "Report",
22+
"time.observation": "2015-01-01T00:00:00+00:00",
23+
"extra.file_name": "2019-01-01-test_telnet-test-geo.csv",
24+
}
25+
EVENTS = [{'__type': 'Event',
26+
'feed.name': 'Test-Accessible-Telnet',
27+
"classification.identifier": "test-telnet",
28+
"classification.taxonomy": "vulnerable",
29+
"classification.type": "vulnerable-system",
30+
"extra.banner": "|MikroTik v6.5|Login:",
31+
"extra.tag": "telnet-alt",
32+
"protocol.application": "telnet",
33+
"protocol.transport": "tcp",
34+
'raw': utils.base64_encode('\n'.join([EXAMPLE_LINES[0],
35+
EXAMPLE_LINES[1]])),
36+
"source.asn": 20255,
37+
"source.geolocation.cc": "AA",
38+
"source.geolocation.city": "LOCATION",
39+
"source.geolocation.region": "LOCATION",
40+
"source.ip": "198.123.245.145",
41+
"source.port": 5678,
42+
"source.reverse_dns": "example.local",
43+
"time.observation": "2015-01-01T00:00:00+00:00",
44+
"time.source": "2019-09-04T12:27:34+00:00"
45+
},
46+
{'__type': 'Event',
47+
'feed.name': 'Test-Accessible-Telnet',
48+
"classification.identifier": "test-telnet",
49+
"classification.taxonomy": "vulnerable",
50+
"classification.type": "vulnerable-system",
51+
"extra.banner": "|MikroTik v6.45.3 (stable)|Login:",
52+
"extra.tag": "telnet-alt",
53+
"protocol.application": "telnet",
54+
"protocol.transport": "tcp",
55+
'raw': utils.base64_encode('\n'.join([EXAMPLE_LINES[0],
56+
EXAMPLE_LINES[2]])),
57+
"source.asn": 20255,
58+
"source.geolocation.cc": "AA",
59+
"source.geolocation.city": "LOCATION",
60+
"source.geolocation.region": "LOCATION",
61+
"source.ip": "198.123.245.145",
62+
"source.port": 5678,
63+
"source.reverse_dns": "example.local",
64+
"time.observation": "2015-01-01T00:00:00+00:00",
65+
"time.source": "2019-09-04T12:27:40+00:00"
66+
}]
67+
68+
69+
class TestShadowserverParserBot(test.BotTestCase, unittest.TestCase):
70+
"""
71+
A TestCase for a ShadowserverParserBot.
72+
"""
73+
74+
@classmethod
75+
def set_bot(cls):
76+
cls.bot_reference = ShadowserverParserBot
77+
cls.default_input_message = EXAMPLE_REPORT
78+
79+
def test_event(self):
80+
""" Test if correct Event has been produced. """
81+
self.run_bot()
82+
for i, EVENT in enumerate(EVENTS):
83+
self.assertMessageEqual(i, EVENT)
84+
85+
86+
if __name__ == '__main__': # pragma: no cover
87+
unittest.main()

‎intelmq/tests/bots/parsers/shadowserver/testdata/test_smb.csv‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
"timestamp","ip","port","hostname","tag","asn","geo","region","city","naics","sic","smb_implant","arch","key","smbv1_support","smb_major_number","smb_minor_number","smb_revision","smb_version_string"
2+
"2010-02-10 00:00:00",192.168.0.1,445,node01.example.com,smb,64512,ZZ,Region,City,0,0,N,,,N,2,1,0,"SMB 2.1"
3+
"2010-02-10 00:00:01",192.168.0.2,445,node02.example.com,smb,64512,ZZ,Region,City,0,0,N,,,N,2,1,0,"SMB 2.1"
4+
"2010-02-10 00:00:02",192.168.0.3,445,node03.example.com,smb,64512,ZZ,Region,City,0,0,N,,,N,2,1,0,"SMB 2.1"

‎intelmq/tests/bots/parsers/shadowserver/testdata/test_smb.csv.license‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
SPDX-FileCopyrightText: 2022 The Shadowserver Foundation
2+
SPDX-License-Identifier: AGPL-3.0-or-later

0 commit comments

Comments
 (0)