94 lines
2.7 KiB
Python
94 lines
2.7 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Compatibility tests for rule event JSON evolution."""
|
|
import unittest
|
|
|
|
from enodia_sentinel import ruleops
|
|
from enodia_sentinel.config import Config
|
|
|
|
|
|
class TestRuleEventCompatibility(unittest.TestCase):
|
|
def setUp(self):
|
|
self.cfg = Config()
|
|
|
|
def _sids(self, event):
|
|
return {a.sid for a in ruleops.test_event(self.cfg, event)}
|
|
|
|
def test_exec_event_accepts_type_alias(self):
|
|
event = {
|
|
"type": "execve",
|
|
"pid": "4242",
|
|
"ppid": "1",
|
|
"uid": "1000",
|
|
"parent_comm": "nginx",
|
|
"filename": "/usr/bin/sh",
|
|
"argv": ["-c", "id"],
|
|
}
|
|
self.assertIn(100003, self._sids(event))
|
|
|
|
def test_exec_event_kind_can_be_inferred_from_fields(self):
|
|
event = {
|
|
"pid": 4242,
|
|
"ppid": 1,
|
|
"uid": 1000,
|
|
"parent_comm": "bash",
|
|
"filename": "/tmp/payload",
|
|
"argv": [],
|
|
}
|
|
self.assertIn(100001, self._sids(event))
|
|
|
|
def test_syscall_event_accepts_type_alias_and_numeric_strings(self):
|
|
event = {
|
|
"type": "sys",
|
|
"pid": "4242",
|
|
"ppid": "1",
|
|
"uid": "1000",
|
|
"comm": "loader",
|
|
"syscall": "mprotect",
|
|
"args": ["0x1000", "0x1000", "0x6"],
|
|
}
|
|
self.assertIn(100060, self._sids(event))
|
|
|
|
def test_syscall_event_kind_can_be_inferred_from_fields(self):
|
|
event = {
|
|
"pid": 4242,
|
|
"ppid": 1,
|
|
"uid": 1000,
|
|
"comm": "loader",
|
|
"syscall": "memfd_create",
|
|
}
|
|
self.assertIn(100062, self._sids(event))
|
|
|
|
def test_syscall_arg_fields_override_args_array(self):
|
|
event = {
|
|
"event": "syscall",
|
|
"pid": 4242,
|
|
"ppid": 1,
|
|
"uid": 1000,
|
|
"comm": "loader",
|
|
"syscall": "mmap",
|
|
"args": [0, 4096, 0],
|
|
"arg2": "0x6",
|
|
}
|
|
self.assertIn(100061, self._sids(event))
|
|
|
|
def test_host_event_accepts_tcp_connect_shape(self):
|
|
event = {
|
|
"event": "tcp_connect",
|
|
"pid": "4242",
|
|
"ppid": "1",
|
|
"uid": "1000",
|
|
"comm": "python3",
|
|
"remote_ip": "8.8.8.8",
|
|
"remote_port": "4444",
|
|
}
|
|
self.assertIn(100067, self._sids(event))
|
|
|
|
def test_unknown_event_shape_still_errors(self):
|
|
with self.assertRaisesRegex(
|
|
ValueError, "event JSON must be an exec, syscall, or host event"
|
|
):
|
|
ruleops.test_event(self.cfg, {"pid": 4242})
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|