def test_udp_stream_frags_and_ooo(self):
myrpkt = RulePkt("to server", "/my udp3/", 3, 5, 250)
mytsrule = TrafficStreamRule('udp', '1.2.3.6', '9.8.7.6', '9005',
'105', -1, 4, False, False, False, True,
75)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(250)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
myfragid = 0
mylastoff = -1
ooo = False
while myts.hasPackets():
mypkt = myts.getNextPacket()
if mypkt.network_hdr.get_frag_id() != myfragid:
myfragid = mypkt.network_hdr.get_frag_id()
if mylastoff > -1:
if abs((mypkt.network_hdr.get_frag_offset() & 0xFF) -
mylastoff) > 11:
ooo = True
mylastoff = (mypkt.network_hdr.get_frag_offset() & 0xFF)
self.assertIn(mypkt.get_size(), [116, 122])
self.assertEqual(mypkt.get_src_ip(), '1.2.3.6')
self.assertEqual(mypkt.get_dst_ip(), '9.8.7.6')
self.assertIn(mypkt.network_hdr.get_frag_offset(),
[8192, 8203, 22])
mycount += 1
self.assertEqual(mycount, 15)
self.assertEqual(ooo, True)
def test_tcp_stream(self):
myrpkt = RulePkt("to server", "/my tcp1/", 0, 3)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, True, True)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(100)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
myseq = mypkt.transport_hdr.get_seq_num()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN + ACK)
for i in range(0, 3):
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_seq_num(),
myseq + (i * 100) + 1)
self.assertEqual(mypkt.get_src_ip(), '1.2.3.4')
self.assertEqual(mypkt.get_dst_ip(), '9.8.7.5')
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
def test_tcp_stream_frag(self):
myrpkt = RulePkt("to server", "/my tcp2/", 4, 3)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, True, True)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myts = TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN + ACK)
for _ in range(0, 12):
mypkt = myts.getNextPacket()
self.assertNotEqual(mypkt.network_hdr.get_frag_id(), 0)
self.assertIn(mypkt.network_hdr.get_frag_offset(),
[8192, 8197, 8202, 8207, 15])
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
def test_ttl_expiry_scenario3(self):
"""
ttl = 110 and ttl_expiry = 6 and fragment is 2
create two good packet with ttl value is 110
and malicious packet with ttl value is 6
the totall is 3 packet
"""
myrpkt = RulePkt("to server", "/my tcp2/", 2, 1, ttl=110, ttl_expiry=6)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, False, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
if mycount % 2 == 0:
self.assertEqual(mypkt.get_ttl(), 110)
else:
self.assertEqual(mypkt.get_ttl(), 6)
mycount += 1
self.assertEqual(mycount, 3)
def test_ttl_expiry_scenario5(self):
"""
5)ttl_expiry = 9 and fragment is 3
create three good packet with random ttl value
malicious packet with ttl value is 9
the totall is 5 packet
"""
myrpkt = RulePkt("to server", "/abcdefghik/", 3, 1, ttl_expiry=9)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, False, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
if mycount % 2 != 0:
self.assertEqual(mypkt.get_ttl(), 9)
mycount += 1
self.assertEqual(mycount, 5)
def test_traffic_stream_loss(self):
myrpkt = RulePkt("to server", "/abcdef/i", 0, 8, 10, False, False)
mytsrule = TrafficStreamRule('tcp', '1.1.1', '2.2.2', '[100:200]',
'[10,20,30,40,50]', -1, 4, False, True,
False, False, 0, 50)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(10)
myConfig.setPktsPerStream(1)
myConfig.setTCPACK(True)
myConfig.setTCPHandshake(True)
myConfig.setFullMatch(True)
myts = rtgen.TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
myseq = mypkt.transport_hdr.get_seq_num()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.SYN)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(),
(rtgen.SYN + rtgen.ACK))
while myts.hasPackets():
mypkt = myts.getNextPacket()
if mypkt.get_content() is None or \
mypkt.get_content().get_size() == 0:
self.assertIn(mypkt.transport_hdr.get_ack_num(), [
myseq + 1, myseq + 11, myseq + 21, myseq + 31, myseq + 41,
myseq + 51, myseq + 61, myseq + 71, myseq + 81
])
else:
self.assertEqual(mypkt.get_content().get_size(), 10)
def test_traffic_stream_split(self):
myrpkt = RulePkt("to server", "/abcdefghij/", 0, 1, -1, False, False,
2)
mytsrule = TrafficStreamRule('tcp', '1.1.1', '2.2.2', '[100:200]',
'[10,20,30,40,50]', -1, 4, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setFullMatch(True)
myts = rtgen.TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
self.assertEqual(mypkt.get_content().get_size(), 5)
self.assertEqual(mypkt.get_content().get_data(), b'abcde')
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
self.assertNotEqual(mypkt.get_content().get_data(), b'abcde')
self.assertEqual(mypkt.get_content().get_data(), b'fghij')
self.assertEqual(mypkt.get_content().get_size(), 5)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt, None)
def test_udp_stream_frags_loss(self):
myrpkt = RulePkt("to server", RuleContent("pcre", "/my udp4/"), 3, 2,
250)
mytsrule = TrafficStreamRule('udp', '1.2.3.6', '9.8.7.6', '9005',
'105', -1, 4, False, False, False, False,
0, 99)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(250)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
if mypkt is None:
mycount += 1
self.assertTrue(mycount > 0) # Should be at least one lost fragement.
myrpkt2 = RulePkt("to server", RuleContent("pcre", "/my udp4/"), 3, 2,
250)
mytsrule2 = TrafficStreamRule('udp', '1.2.3.6', '9.8.7.6', '9005',
'105', -1, 4, False, False, False, False,
0, 0)
mytsrule2.addPktRule(myrpkt2)
myConfig2 = SnifflesConfig()
myConfig2.setPktLength(250)
myConfig2.setIPV6Percent(0)
myConfig2.setFullMatch(True)
myts2 = TrafficStream(mytsrule2, myConfig2)
mycount = 0
while myts2.hasPackets():
mypkt = myts2.getNextPacket()
if mypkt is not None:
mycount += 1
self.assertEqual(mycount, 6) # should be no lost fragments.
def test_packet(self):
myrpkt = RulePkt("to server", "/12345/")
cg = rtgen.ContentGenerator(myrpkt)
mypkt = rtgen.Packet('udp', '10.11.12.13', '13.12.11.10', 4, '1234',
'4321', rtgen.ACK, 0, 0,
rtgen.ETHERNET_HDR_GEN_RANDOM, None,
cg.get_next_published_content())
self.assertEqual(mypkt.get_src_ip(), '10.11.12.13')
self.assertEqual(mypkt.get_dst_ip(), '13.12.11.10')
self.assertEqual(mypkt.get_size(), 47)
self.assertEqual(mypkt.get_content_length(), 5)
self.assertEqual(mypkt.get_content().get_data()[0:4], b'1234')
def test_traffic_stream_frags(self):
myrpkt = RulePkt("to client", "/abcdef/i", 3, 2, 500, True, True)
mytsrule = TrafficStreamRule('tcp', '1.1.1', '2.2.2', '[100:200]',
'[10,20,30,40,50]', -1, 4, False, True,
True)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(500)
myConfig.setIPV6Percent(0)
myConfig.setTCPACK(True)
myConfig.setTCPHandshake(True)
myConfig.setTCPTeardown(True)
myConfig.setFullMatch(True)
myts = rtgen.TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
myseq = mypkt.transport_hdr.get_seq_num()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.SYN)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(),
(rtgen.SYN + rtgen.ACK))
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
self.assertEqual(mypkt.transport_hdr.get_seq_num(), myseq + 1)
mypkt = myts.getNextPacket()
self.assertNotEqual(mypkt.network_hdr.get_frag_id(), 0)
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
self.assertIn(mypkt.get_size(), [202, 218])
mypkt = myts.getNextPacket()
self.assertIn(mypkt.get_size(), [202, 218])
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
mypkt = myts.getNextPacket()
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
self.assertIn(mypkt.get_size(), [202, 218])
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_size(), 54)
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
mypkt = myts.getNextPacket()
self.assertNotEqual(mypkt.network_hdr.get_frag_id(), 0)
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
self.assertIn(mypkt.get_size(), [202, 218])
mypkt = myts.getNextPacket()
self.assertIn(mypkt.get_size(), [202, 218])
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
mypkt = myts.getNextPacket()
self.assertIn(mypkt.network_hdr.get_frag_offset(), [8192, 8213, 42])
self.assertIn(mypkt.get_size(), [202, 218])
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_size(), 54)
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
def test_content_gen(self):
cg = rtgen.ContentGenerator()
mycon = cg.get_next_published_content()
self.assertNotEqual(mycon.get_size(), 0)
mypkt = RulePkt("to client", "/abcdef/m", 1, 150)
cg = rtgen.ContentGenerator(mypkt, 150, False, True)
mycon = cg.get_next_published_content()
self.assertEqual(mycon.get_size(), 150)
self.assertEqual(
mycon.get_data(),
b'abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc' +
b'abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabc' +
b'abcabcabcabcabcabcabcabcabcdef')
mypkt = RulePkt("to server", "/1234567890/", 1, 5)
cg = rtgen.ContentGenerator(mypkt, 5, False, True)
mycon = cg.get_next_published_content()
self.assertEqual(mycon.get_size(), 5)
self.assertEqual(mycon.get_data(), b'12345')
mypkt = RulePkt("to server", "/abc(cd|ef)g/")
cg = rtgen.ContentGenerator(mypkt, -1, False, True, True)
# Note: 4 is the correct number of published content as the above
# regex is not anchored and thus can begin with an arbitrary
# character, or directly with the start of the expression.
self.assertEqual(cg.get_number_of_published_content(), 4)
for _ in range(0, 3):
cg.get_next_published_content()
self.assertEqual(cg.get_number_of_published_content(), 1)
mypkt = RulePkt("to server", "/^1234567890/")
cg = rtgen.ContentGenerator(mypkt)
mycon = cg.get_next_published_content()
self.assertEqual(mycon.get_size(), 10)
def test_content_gen_zero_data(self):
with warnings.catch_warnings(record=True) as w:
for _ in range(0, 200):
mypkt = RulePkt("to client", "/a*/", 1)
cg = rtgen.ContentGenerator(mypkt)
mycon = cg.get_next_published_content()
if mycon.get_size() > 0:
self.assertEqual(mycon.get_size(), 1)
self.assertEqual(mycon.get_data(), b'a')
else:
self.assertEqual(len(w), 1)
self.assertIn("No content generated for regex:",
str(w[-1].message))
mypkt2 = RulePkt("to client", "/b?/", 1)
cg2 = rtgen.ContentGenerator(mypkt2)
mycon2 = cg2.get_next_published_content()
if mycon2.get_size() > 0:
self.assertEqual(mycon2.get_size(), 1)
self.assertEqual(mycon2.get_data(), b'b')
else:
self.assertEqual(len(w), 1)
self.assertIn("No content generated for regex:",
str(w[-1].message))
def test_traffic_stream_split_too_large(self):
myrpkt = RulePkt("to server", "/12345/", 0, 1, -1, False, False, 200)
mytsrule = TrafficStreamRule('tcp', '1.1.1', '2.2.2', '[100:200]',
'[10,20,30,40,50]', -1, 4, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myts = rtgen.TrafficStream(mytsrule, myConfig)
for i in range(0, 5):
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), rtgen.ACK)
self.assertEqual(mypkt.get_content().get_size(), 1)
if i < 4:
self.assertIn(mypkt.get_content().get_data(),
[b'1', b'2', b'3', b'4', b'5'])
mypkt = myts.getNextPacket()
self.assertEqual(mypkt, None)
def test_tcp_stream_frag_ooo(self):
myrpkt = RulePkt("to server", "/my tcp2/", 4, 3, 140, False, True)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, True, True)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), SYN + ACK)
myfragid = 0
mylastoff = -1
ooo = False
for _ in range(0, 12):
mypkt = myts.getNextPacket()
self.assertNotEqual(mypkt.network_hdr.get_frag_id(), 0)
self.assertIn(mypkt.network_hdr.get_frag_offset(),
[8192, 8197, 8202, 8207, 15])
if mypkt.network_hdr.get_frag_id() != myfragid:
myfragid = mypkt.network_hdr.get_frag_id()
if mylastoff > -1:
if abs((mypkt.network_hdr.get_frag_offset() & 0xFF) -
mylastoff) > 5:
ooo = True
else:
mylastoff = (mypkt.network_hdr.get_frag_offset() & 0xFF)
self.assertEqual(ooo, True)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), FIN + ACK)
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.transport_hdr.get_flags(), ACK)
def test_split(self):
myrpkt = RulePkt("to server", "/my split message/", 0, 1, -1, False,
False, 2)
mytsrule = TrafficStreamRule('tcp', '1.2.3.6', '9.8.7.6', '9005',
'105')
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(-1)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_size(), 62)
mycount += 1
self.assertEqual(mycount, 2)
def test_udp_stream(self):
myrpkt = RulePkt("to server", "/my udp1/", 0, 3)
mytsrule = TrafficStreamRule('udp', '1.2.3.6', '9.8.7.6', '9005',
'105')
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(25)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_size(), 67)
self.assertEqual(mypkt.get_src_ip(), '1.2.3.6')
self.assertEqual(mypkt.get_dst_ip(), '9.8.7.6')
mycount += 1
self.assertEqual(mycount, 3)
def test_ttl_expiry_scenario1(self):
"""
1)tll = 110, no fragment
one packet should have ttl is 110
"""
myrpkt = RulePkt("to server", "/my tcp2/", 0, 1, ttl=110)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, False, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_ttl(), 110)
mycount += 1
self.assertEqual(mycount, 1)
def test_udp_stream_frags(self):
myrpkt = RulePkt("to server", "/my udp2/", 3, 2)
mytsrule = TrafficStreamRule('udp', '1.2.3.6', '9.8.7.6', '9005',
'105')
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(250)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
self.assertIn(mypkt.get_size(), [116, 122])
self.assertEqual(mypkt.get_src_ip(), '1.2.3.6')
self.assertEqual(mypkt.get_dst_ip(), '9.8.7.6')
self.assertIn(mypkt.network_hdr.get_frag_offset(),
[8192, 8203, 22])
mycount += 1
self.assertEqual(mycount, 6)
def test_ttl_expiry_scenario4(self):
"""
4)ttl = 147 and ttl_expiry = 0 and fragment is 2
create two packet with ttl value is 147
since ttl_expiry is 0
"""
myrpkt = RulePkt("to server", "/my tcp2/", 2, 1, ttl=147, ttl_expiry=0)
mytsrule = TrafficStreamRule('tcp', '1.2.3.4', '9.8.7.5', '9000',
'101', -1, 4, False, False, False)
mytsrule.addPktRule(myrpkt)
myConfig = SnifflesConfig()
myConfig.setPktLength(140)
myConfig.setIPV6Percent(0)
myConfig.setFullMatch(True)
myts = TrafficStream(mytsrule, myConfig)
mycount = 0
while myts.hasPackets():
mypkt = myts.getNextPacket()
self.assertEqual(mypkt.get_ttl(), 147)
mycount += 1
self.assertEqual(mycount, 2)