/osquery/tables/networking/tests/networking_tables_tests.cpp

https://github.com/HeroicCybersecurity/osquery · C++ · 79 lines · 52 code · 15 blank · 12 comment · 5 complexity · c190995f6f4abcfb357021650ab69a72 MD5 · raw file

  1. /**
  2. * Copyright (c) 2014-present, Facebook, Inc.
  3. * All rights reserved.
  4. *
  5. * This source code is licensed under both the Apache 2.0 license (found in the
  6. * LICENSE file in the root directory of this source tree) and the GPLv2 (found
  7. * in the COPYING file in the root directory of this source tree).
  8. * You may select, at your option, one of the above-listed licenses.
  9. */
  10. #include <gtest/gtest.h>
  11. #include <osquery/logger.h>
  12. #include <osquery/sql.h>
  13. #include "osquery/tests/test_additional_util.h"
  14. #include "osquery/tests/test_util.h"
  15. namespace osquery {
  16. namespace tables {
  17. QueryData parseEtcHostsContent(const std::string& content);
  18. QueryData parseEtcProtocolsContent(const std::string& content);
  19. class NetworkingTablesTests : public testing::Test {};
  20. TEST_F(NetworkingTablesTests, test_parse_etc_hosts_content) {
  21. EXPECT_EQ(parseEtcHostsContent(getEtcHostsContent()),
  22. getEtcHostsExpectedResults());
  23. }
  24. TEST_F(NetworkingTablesTests, test_parse_etc_protocols_content) {
  25. EXPECT_EQ(parseEtcProtocolsContent(getEtcProtocolsContent()),
  26. getEtcProtocolsExpectedResults());
  27. }
  28. TEST_F(NetworkingTablesTests, test_listening_ports) {
  29. auto& server = TLSServerRunner::instance();
  30. server.start();
  31. auto results = SQL::selectAllFrom("listening_ports");
  32. // Expect to find a process PID for the server.
  33. std::string pid;
  34. for (const auto& row : results) {
  35. // We are not interested in rows without ports (i.e. UNIX sockets)
  36. const auto& listening_port = row.at("port");
  37. if (listening_port.empty()) {
  38. continue;
  39. }
  40. if (listening_port == server.port()) {
  41. const auto& process_id = row.at("pid");
  42. if (process_id.empty()) {
  43. VLOG(1) << "Failed to acquire the process id";
  44. break;
  45. }
  46. pid = process_id;
  47. break;
  48. }
  49. }
  50. EXPECT_GT(pid.size(), 0U);
  51. EXPECT_NE(pid, "-1");
  52. server.stop();
  53. }
  54. TEST_F(NetworkingTablesTests, test_address_details_join) {
  55. // Expect that we can join interface addresses with details
  56. auto query =
  57. "select * from interface_details id, interface_addresses ia "
  58. "on ia.interface = id.interface "
  59. "where ia.address = '127.0.0.1';";
  60. auto results = SQL(query);
  61. EXPECT_GT(results.rows().size(), 0U);
  62. }
  63. } // namespace tables
  64. } // namespace osquery