class ThresholdProcessorTestCase(unittest.TestCase):
processor = main.ThresholdProcessor()
def test_extract_regex(self):
processor = main.ThresholdProcessor()
line = "suppress re:java"
self.assertEqual("java", processor.extract_regex(line))
line = 'suppress re:"vulnerable java version"'
self.assertEqual(
"vulnerable java version", processor.extract_regex(line))
line = "suppress re:java, track <by_src|by_dst>, ip <ip|subnet>"
self.assertEqual("java", processor.extract_regex(line))
line = 'suppress re:"vulnerable java version", track <by_src|by_dst>, ip <ip|subnet>'
self.assertEqual(
"vulnerable java version", processor.extract_regex(line))
line = 'threshold re:"vulnerable java version", type threshold, track by_dst, count 1, seconds 10'
self.assertEqual(
"vulnerable java version", processor.extract_regex(line))
def test_replace(self):
rule_string = """alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Windows executable sent when remote host claims to send an image 2"; flow: established,from_server; content:"|0d 0a|Content-Type|3a| image/jpeg|0d 0a 0d 0a|MZ"; fast_pattern:12,20; classtype:trojan-activity; sid:2020757; rev:2;)"""
rule = suricata.update.rule.parse(rule_string)
line = "suppress re:windows"
self.assertEqual(
"suppress gen_id 1, sig_id 2020757",
self.processor.replace(line, rule))
bad_line = "nothing to match"
self.assertEqual(
"nothing to match",
self.processor.replace(bad_line, rule)
)
line = 'threshold re:"ET MALWARE Windows", type threshold, ' \
'track by_dst, count 1, seconds 10'
self.assertEqual("threshold gen_id 1, sig_id 2020757, type threshold, track by_dst, count 1, seconds 10", self.processor.replace(line, rule))
line = 'threshold re:malware, type threshold, track by_dst, count 1, ' \
'seconds 10'
self.assertEqual(
"threshold gen_id 1, sig_id 2020757, type threshold, "
"track by_dst, count 1, seconds 10",
self.processor.replace(line, rule))
def test_extract_regex(self):
processor = main.ThresholdProcessor()
line = "suppress re:java"
self.assertEqual("java", processor.extract_regex(line))
line = 'suppress re:"vulnerable java version"'
self.assertEqual("vulnerable java version",
processor.extract_regex(line))
line = "suppress re:java, track <by_src|by_dst>, ip <ip|subnet>"
self.assertEqual("java", processor.extract_regex(line))
line = 'suppress re:"vulnerable java version", track <by_src|by_dst>, ip <ip|subnet>'
self.assertEqual("vulnerable java version",
processor.extract_regex(line))
line = 'threshold re:"vulnerable java version", type threshold, track by_dst, count 1, seconds 10'
self.assertEqual("vulnerable java version",
processor.extract_regex(line))