worked poc

tests/test_rules.py

@@ -0,0 +1,88 @@
+import os
+import tempfile
+import unittest
+from types import SimpleNamespace
+
+from app.rules import (
+    RuleActionResult,
+    RuleManager,
+    _parse_enabled_sources,
+    _parse_source_catalog,
+)
+
+
+class RuleManagerTests(unittest.TestCase):
+    def make_manager(self, td):
+        custom = os.path.join(td, "custom.rules")
+        threshold = os.path.join(td, "threshold.config")
+        local = os.path.join(td, "local.rules")
+        open(custom, "w").close()
+        open(threshold, "w").close()
+        open(local, "w").close()
+        cfg = SimpleNamespace(
+            suricata_custom_rules=custom,
+            suricata_threshold_config=threshold,
+            suricata_local_rules=local,
+            suricata_extra_rules_glob=os.path.join(td, "*.rules"),
+            suricata_config="/etc/suricata/suricata.yaml",
+            suricata_home_net="[192.168.0.0/16]",
+        )
+        return RuleManager(cfg, pid_provider=lambda: None, suricata_available=False)
+
+    def test_scoped_suppression_uses_source_ip(self):
+        with tempfile.TemporaryDirectory() as td:
+            manager = self.make_manager(td)
+            captured = {}
+
+            def replace(content):
+                captured["content"] = content
+                return RuleActionResult(True, "saved")
+
+            manager.replace_threshold_config = replace
+            result = manager.suppress_sid(1234567, "by_src", "192.0.2.10")
+            self.assertTrue(result.ok)
+            self.assertIn(
+                "suppress gen_id 1, sig_id 1234567, track by_src, ip 192.0.2.10",
+                captured["content"],
+            )
+
+    def test_scoped_suppression_rejects_invalid_ip(self):
+        with tempfile.TemporaryDirectory() as td:
+            manager = self.make_manager(td)
+            result = manager.suppress_sid(1234567, "by_src", "not-an-ip")
+            self.assertFalse(result.ok)
+
+    def test_parses_official_source_catalog_output(self):
+        output = """
+Name: et/open
+  Vendor: Proofpoint
+  Summary: Emerging Threats Open ruleset
+  License: MIT
+  Tags: free, ids
+Name: oisf/trafficid
+  Vendor: OISF
+  Summary: Traffic identification rules
+  License: MIT
+  Parameters: code, token
+"""
+        sources = _parse_source_catalog(output)
+        self.assertEqual([item["name"] for item in sources], ["et/open", "oisf/trafficid"])
+        self.assertEqual(sources[0]["tags"], ["free", "ids"])
+        self.assertEqual(sources[1]["parameters"], ["code", "token"])
+
+    def test_parses_enabled_named_sources_only(self):
+        output = """
+From /etc/suricata/update.yaml:
+ - https://rules.example.invalid/feed.rules
+Enabled sources:
+ - oisf/trafficid
+ - sslbl/ssl-fp-blacklist
+"""
+        self.assertEqual(
+            _parse_enabled_sources(output),
+            {"oisf/trafficid", "sslbl/ssl-fp-blacklist"},
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()