89 lines
2.8 KiB
Python
89 lines
2.8 KiB
Python
import os
|
|
import tempfile
|
|
import unittest
|
|
from types import SimpleNamespace
|
|
|
|
from app.rules import (
|
|
RuleActionResult,
|
|
RuleManager,
|
|
_parse_enabled_sources,
|
|
_parse_source_catalog,
|
|
)
|
|
|
|
|
|
class RuleManagerTests(unittest.TestCase):
|
|
def make_manager(self, td):
|
|
custom = os.path.join(td, "custom.rules")
|
|
threshold = os.path.join(td, "threshold.config")
|
|
local = os.path.join(td, "local.rules")
|
|
open(custom, "w").close()
|
|
open(threshold, "w").close()
|
|
open(local, "w").close()
|
|
cfg = SimpleNamespace(
|
|
suricata_custom_rules=custom,
|
|
suricata_threshold_config=threshold,
|
|
suricata_local_rules=local,
|
|
suricata_extra_rules_glob=os.path.join(td, "*.rules"),
|
|
suricata_config="/etc/suricata/suricata.yaml",
|
|
suricata_home_net="[192.168.0.0/16]",
|
|
)
|
|
return RuleManager(cfg, pid_provider=lambda: None, suricata_available=False)
|
|
|
|
def test_scoped_suppression_uses_source_ip(self):
|
|
with tempfile.TemporaryDirectory() as td:
|
|
manager = self.make_manager(td)
|
|
captured = {}
|
|
|
|
def replace(content):
|
|
captured["content"] = content
|
|
return RuleActionResult(True, "saved")
|
|
|
|
manager.replace_threshold_config = replace
|
|
result = manager.suppress_sid(1234567, "by_src", "192.0.2.10")
|
|
self.assertTrue(result.ok)
|
|
self.assertIn(
|
|
"suppress gen_id 1, sig_id 1234567, track by_src, ip 192.0.2.10",
|
|
captured["content"],
|
|
)
|
|
|
|
def test_scoped_suppression_rejects_invalid_ip(self):
|
|
with tempfile.TemporaryDirectory() as td:
|
|
manager = self.make_manager(td)
|
|
result = manager.suppress_sid(1234567, "by_src", "not-an-ip")
|
|
self.assertFalse(result.ok)
|
|
|
|
def test_parses_official_source_catalog_output(self):
|
|
output = """
|
|
Name: et/open
|
|
Vendor: Proofpoint
|
|
Summary: Emerging Threats Open ruleset
|
|
License: MIT
|
|
Tags: free, ids
|
|
Name: oisf/trafficid
|
|
Vendor: OISF
|
|
Summary: Traffic identification rules
|
|
License: MIT
|
|
Parameters: code, token
|
|
"""
|
|
sources = _parse_source_catalog(output)
|
|
self.assertEqual([item["name"] for item in sources], ["et/open", "oisf/trafficid"])
|
|
self.assertEqual(sources[0]["tags"], ["free", "ids"])
|
|
self.assertEqual(sources[1]["parameters"], ["code", "token"])
|
|
|
|
def test_parses_enabled_named_sources_only(self):
|
|
output = """
|
|
From /etc/suricata/update.yaml:
|
|
- https://rules.example.invalid/feed.rules
|
|
Enabled sources:
|
|
- oisf/trafficid
|
|
- sslbl/ssl-fp-blacklist
|
|
"""
|
|
self.assertEqual(
|
|
_parse_enabled_sources(output),
|
|
{"oisf/trafficid", "sslbl/ssl-fp-blacklist"},
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|