/bismarkpassive/update_parser_test.py

https://github.com/sburnett/bismark-passive-server · Python · 282 lines · 269 code · 13 blank · 0 comment · 2 complexity · 91459a09783cd1c477fdbdaa991a4710 MD5 · raw file

  1. import update_parser
  2. import calendar
  3. import unittest
  4. def format_source(source):
  5. return '\n'.join([w.strip() for w in source.splitlines()])
  6. class TestParser(unittest.TestCase):
  7. def test_unanonymized_header(self):
  8. source = """9
  9. BUILDID
  10. BISMARKID 1234567890 12 98765
  11. UNANONYMIZED
  12. 0 0
  13. 0 0 0 0
  14. 0 0
  15. 0 0"""
  16. update = update_parser.PassiveUpdate(format_source(source))
  17. self.assertTrue(update.file_format_version == 9)
  18. self.assertTrue(update.build_id == 'BUILDID')
  19. self.assertTrue(update.bismark_id == 'BISMARKID')
  20. self.assertTrue(update.creation_time == 1234567890)
  21. self.assertTrue(update.sequence_number == 12)
  22. self.assertTrue(calendar.timegm(update.timestamp.timetuple()) == 98765)
  23. self.assertFalse(update.anonymized)
  24. def test_anonymized_header(self):
  25. source = """9
  26. BUILDID
  27. BISMARKID 1234567890 12 98765
  28. KEY
  29. 0 0
  30. 0 0 0 0
  31. 0 0
  32. 0 0"""
  33. update = update_parser.PassiveUpdate(format_source(source))
  34. self.assertTrue(update.file_format_version == 9)
  35. self.assertTrue(update.build_id == 'BUILDID')
  36. self.assertTrue(update.bismark_id == 'BISMARKID')
  37. self.assertTrue(update.creation_time == 1234567890)
  38. self.assertTrue(update.sequence_number == 12)
  39. self.assertTrue(calendar.timegm(update.timestamp.timetuple()) == 98765)
  40. self.assertTrue(update.anonymized)
  41. self.assertTrue(update.anonymization_signature == 'KEY')
  42. def test_header_stats(self):
  43. source = """0
  44. BUILDID
  45. BISMARKID 0 0 0
  46. 12 21 43
  47. KEY
  48. 0 0
  49. 0 0 0 0
  50. 0 0
  51. 0 0"""
  52. update = update_parser.PassiveUpdate(format_source(source))
  53. self.assertTrue(update.pcap_received == 12)
  54. self.assertTrue(update.pcap_dropped == 21)
  55. self.assertTrue(update.iface_dropped == 43)
  56. self.assertTrue(update.anonymized)
  57. def test_packet_series(self):
  58. source = """0
  59. BUILDID
  60. BISMARKID 0 0 0
  61. UNANONYMIZED
  62. 100 123
  63. 0 15 1
  64. 10 40 1
  65. 5 1024 2
  66. 0 0 0 0
  67. 0 0
  68. 0 0"""
  69. update = update_parser.PassiveUpdate(format_source(source))
  70. self.assertTrue(update.packet_series_dropped == 123)
  71. self.assertTrue(len(update.packet_series) == 3)
  72. self.assertTrue(update.packet_series[0].timestamp.microsecond == 100)
  73. self.assertTrue(update.packet_series[0].size == 15)
  74. self.assertTrue(update.packet_series[0].flow_id == 1)
  75. self.assertTrue(update.packet_series[1].timestamp.microsecond == 110)
  76. self.assertTrue(update.packet_series[1].size == 40)
  77. self.assertTrue(update.packet_series[1].flow_id == 1)
  78. self.assertTrue(update.packet_series[2].timestamp.microsecond == 115)
  79. self.assertTrue(update.packet_series[2].size == 1024)
  80. self.assertTrue(update.packet_series[2].flow_id == 2)
  81. def test_flow_table(self):
  82. source = """0
  83. BUILDID
  84. BISMARKID 0 0 0
  85. UNANONYMIZED
  86. 0 0
  87. 100 500 12 34
  88. 29 0 987 0 456 23 45 56
  89. 32 0 1004 0 433 30 26 31
  90. 0 0
  91. 0 0"""
  92. update = update_parser.PassiveUpdate(format_source(source))
  93. self.assertTrue(update.flow_table_baseline == 100)
  94. self.assertTrue(update.flow_table_size == 500)
  95. self.assertTrue(update.flow_table_expired == 12)
  96. self.assertTrue(update.flow_table_dropped == 34)
  97. self.assertTrue(len(update.flow_table) == 2)
  98. self.assertTrue(update.flow_table[0].flow_id == 29)
  99. self.assertTrue(update.flow_table[0].source_ip_anonymized == 0)
  100. self.assertTrue(update.flow_table[0].source_ip == '987')
  101. self.assertTrue(update.flow_table[0].destination_ip_anonymized == 0)
  102. self.assertTrue(update.flow_table[0].destination_ip == '456')
  103. self.assertTrue(update.flow_table[0].transport_protocol == 23)
  104. self.assertTrue(update.flow_table[0].source_port == 45)
  105. self.assertTrue(update.flow_table[0].destination_port == 56)
  106. self.assertTrue(update.flow_table[1].flow_id == 32)
  107. self.assertTrue(update.flow_table[1].source_ip == '1004')
  108. self.assertTrue(update.flow_table[1].destination_ip == '433')
  109. self.assertTrue(update.flow_table[1].transport_protocol == 30)
  110. self.assertTrue(update.flow_table[1].source_port == 26)
  111. self.assertTrue(update.flow_table[1].destination_port == 31)
  112. def test_dns_table(self):
  113. source = """0
  114. BUILDID
  115. BISMARKID 0 0 0
  116. UNANONYMIZED
  117. 0 0
  118. 0 0 0 0
  119. 5 6
  120. 9 12 0 foo.com 123cd 2
  121. 8 34 1 bar.org ae321 34
  122. 7 45 1 blah.cn 0 blorg.us 93
  123. 6 56 0 gorp.com 1 boink.ca 28
  124. 0 0"""
  125. update = update_parser.PassiveUpdate(format_source(source))
  126. self.assertTrue(update.dropped_a_records == 5)
  127. self.assertTrue(update.dropped_cname_records == 6)
  128. self.assertTrue(len(update.a_records) == 2)
  129. self.assertTrue(update.a_records[0].packet_id == 9)
  130. self.assertTrue(update.a_records[0].address_id == 12)
  131. self.assertTrue(update.a_records[0].anonymized == 0)
  132. self.assertTrue(update.a_records[0].domain == 'foo.com')
  133. self.assertTrue(update.a_records[0].ip_address == '123cd')
  134. self.assertTrue(update.a_records[0].ttl.seconds == 2)
  135. self.assertTrue(update.a_records[1].packet_id == 8)
  136. self.assertTrue(update.a_records[1].address_id == 34)
  137. self.assertTrue(update.a_records[1].anonymized == 1)
  138. self.assertTrue(update.a_records[1].domain == 'bar.org')
  139. self.assertTrue(update.a_records[1].ip_address == 'ae321')
  140. self.assertTrue(update.a_records[1].ttl.seconds == 34)
  141. self.assertTrue(len(update.cname_records) == 2)
  142. self.assertTrue(update.cname_records[0].packet_id == 7)
  143. self.assertTrue(update.cname_records[0].address_id == 45)
  144. self.assertTrue(update.cname_records[0].domain_anonymized == 1)
  145. self.assertTrue(update.cname_records[0].domain == 'blah.cn')
  146. self.assertTrue(update.cname_records[0].cname_anonymized == 0)
  147. self.assertTrue(update.cname_records[0].cname == 'blorg.us')
  148. self.assertTrue(update.cname_records[0].ttl.seconds == 93)
  149. self.assertTrue(update.cname_records[1].packet_id == 6)
  150. self.assertTrue(update.cname_records[1].address_id == 56)
  151. self.assertTrue(update.cname_records[1].domain_anonymized == 0)
  152. self.assertTrue(update.cname_records[1].domain == 'gorp.com')
  153. self.assertTrue(update.cname_records[1].cname_anonymized == 1)
  154. self.assertTrue(update.cname_records[1].cname == 'boink.ca')
  155. self.assertTrue(update.cname_records[1].ttl.seconds == 28)
  156. def test_address_table(self):
  157. source = """0
  158. BUILDID
  159. BISMARKID 0 0 0
  160. UNANONYMIZED
  161. 0 0
  162. 0 0 0 0
  163. 0 0
  164. 1 2
  165. ABCDEF 1234ab
  166. FEDCBA ba4321
  167. """
  168. update = update_parser.PassiveUpdate(format_source(source))
  169. self.assertTrue(update.address_table_first_id == 1)
  170. self.assertTrue(update.address_table_size == 2)
  171. self.assertTrue(len(update.addresses) == 2)
  172. self.assertTrue(update.addresses[0].mac_address == 'ABCDEF')
  173. self.assertTrue(update.addresses[0].ip_address == '1234ab')
  174. self.assertTrue(update.addresses[1].mac_address == 'FEDCBA')
  175. self.assertTrue(update.addresses[1].ip_address == 'ba4321')
  176. def test_whitelist(self):
  177. source = """0
  178. BUILDID
  179. BISMARKID 1234567890 12 0
  180. foo.com
  181. bar.org
  182. UNANONYMIZED
  183. 0 0
  184. 0 0 0 0
  185. 0 0
  186. 0 0"""
  187. update = update_parser.PassiveUpdate(format_source(source))
  188. self.assertTrue(update.whitelist == ['foo.com', 'bar.org'])
  189. def test_drop_statistics(self):
  190. source = """0
  191. BUILDID
  192. BISMARKID 0 0 0
  193. UNANONYMIZED
  194. 0 0
  195. 0 0 0 0
  196. 0 0
  197. 0 0
  198. 12 53
  199. 1500 34
  200. """
  201. update = update_parser.PassiveUpdate(format_source(source))
  202. self.assertTrue(update.dropped_packets[12] == 53)
  203. self.assertTrue(update.dropped_packets[1500] == 34)
  204. if __name__ == '__main__':
  205. unittest.main()