github_mirrors/openappsec
3
0
Fork 1
mirror of https://github.com/openappsec/openappsec.git synced 2025-09-29 19:24:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

sync code

Browse Source
This commit is contained in:
Ned Wright
2025-03-17 14:49:44 +00:00
parent df7be864e2
commit 0246b73bbd
20 changed files with 877 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/intelligence_is_v2/intelligence_comp_v2.cc
View File

@@ -254,7 +254,7 @@ private:
C2S_OPTIONAL_PARAM(string, sourceId);
C2S_OPTIONAL_PARAM(string, invalidationRegistrationId);
C2S_OPTIONAL_PARAM(vector<StrAttributes>, mainAttributes);
C2S_OPTIONAL_PARAM(vector<StrAttributes>, attributes);
C2S_OPTIONAL_PARAM(vector<IpAttributes>, attributes);
C2S_OPTIONAL_PARAM(string, invalidationType);
};
@@ -624,7 +624,7 @@ private:
query_request.isBulk() ? queries_uri : query_uri,
*json_body,
MessageCategory::INTELLIGENCE,
global_req_md
query_request.getReqMD().getHostName().empty() ? global_req_md : query_request.getReqMD()
);
if (!req_data.ok()) {
auto response_error = req_data.getErr().toString();

124
core/intelligence_is_v2/intelligence_is_v2_ut/invalidation_ut.cc
View File

@@ -32,6 +32,30 @@ TEST(StringAttributesBasic, SettersAndGetters)
EXPECT_FALSE(string_attributes.isEmpty());
EXPECT_EQ(string_attributes.getStringAttr("attr1").unpack(), "1");
EXPECT_EQ(string_attributes.getStringSetAttr("attr2").unpack(), vals);
IpAttributes attributes;
EXPECT_TRUE(attributes.isEmpty());
EXPECT_FALSE(attributes.getIpv4Addresses().ok());
EXPECT_FALSE(attributes.getIpv6Addresses().ok());
EXPECT_FALSE(attributes.getIpv4AddressRanges().ok());
EXPECT_FALSE(attributes.getIpv6AddressRanges().ok());
IpAddressRange range("1.1.1.1", "1.1.1.5");
attributes
.addIpv4Addresses("1.1.1.2")
.addIpv4AddressRanges(range)
.addIpv6Addresses("1.1.1.2")
.addIpv6AddressRanges(range);
EXPECT_FALSE(attributes.isEmpty());
vector<string> ip_vector = {"1.1.1.2"};
vector<IpAddressRange> ip_range_vector = {range};
EXPECT_EQ(attributes.getIpv4Addresses().unpack(), ip_vector);
EXPECT_EQ(attributes.getIpv4AddressRanges().unpack(), ip_range_vector);
EXPECT_EQ(attributes.getIpv6Addresses().unpack(), ip_vector);
EXPECT_EQ(attributes.getIpv6AddressRanges().unpack(), ip_range_vector);
}
TEST(StringAttributesBasic, attr_schema)
@@ -51,6 +75,39 @@ TEST(StringAttributesBasic, attr_schema)
" ]\n"
"}";
EXPECT_EQ(ss.str(), expected_schema);
IpAddressRange range("1.1.1.1", "1.1.1.5");
IpAttributes attributes = IpAttributes()
.addIpv4Addresses("1.1.1.2")
.addIpv4Addresses("1.1.1.3")
.addIpv4AddressRanges(range)
.addIpv6Addresses("1.1.1.4")
.addIpv6AddressRanges(range);
stringstream attr_ss;
attributes.performOutputingSchema(attr_ss, 0);
expected_schema =
"{\n"
" \"ipv4Addresses\": [\n"
" \"1.1.1.2\",\n"
" \"1.1.1.3\"\n"
" ],\n"
" \"ipv6Addresses\": [\n"
" \"1.1.1.4\"\n"
" ],\n"
" \"ipv4AddressesRange\": [\n"
" {\n"
" \"max\": \"1.1.1.5\",\n"
" \"min\": \"1.1.1.1\"\n"
" }\n"
" ],\n"
" \"ipv6AddressesRange\": [\n"
" {\n"
" \"max\": \"1.1.1.5\",\n"
" \"min\": \"1.1.1.1\"\n"
" }\n"
" ]\n"
"}";
EXPECT_EQ(attr_ss.str(), expected_schema);
}
TEST(StringAttributesBasic, Matching)
@@ -105,6 +162,20 @@ TEST(StringAttributesBasic, genObject)
string expected_json = "{ \"attr1\": \"1\", \"attr2\": [ \"2\", \"3\" ] }";
EXPECT_EQ(string_attributes.genObject().unpack(), expected_json);
IpAddressRange range("1.1.1.1", "1.1.1.5");
IpAttributes attributes = IpAttributes()
.addIpv4Addresses("1.1.1.2")
.addIpv4Addresses("1.1.1.3")
.addIpv4AddressRanges(range)
.addIpv6Addresses("1.1.1.4")
.addIpv6AddressRanges(range);
expected_json =
"{ \"ipv4Addresses\": [ \"1.1.1.2\", \"1.1.1.3\" ], \"ipv6Addresses\": [ \"1.1.1.4\" ], "
"\"ipv4AddressesRange\": [ { \"max\": \"1.1.1.5\", \"min\": \"1.1.1.1\" } ], "
"\"ipv6AddressesRange\": [ { \"max\": \"1.1.1.5\", \"min\": \"1.1.1.1\" } ] }";
EXPECT_EQ(attributes.genObject().unpack(), expected_json);
}
TEST(InvalidationBasic, SettersAndGetters)
@@ -125,15 +196,15 @@ TEST(InvalidationBasic, SettersAndGetters)
EXPECT_FALSE(invalidation.getInvalidationType().ok());
set<string> main_vals = { "2", "3" };
set<string> vals = { "5", "6" };
vector<string> vals = {"1.1.1.1", "2.2.2.2"};
auto main_attr = StrAttributes()
.addStringAttr("main_attr1", "1")
.addStringSetAttr("main_attr2", main_vals);
auto attr = StrAttributes()
.addStringAttr("attr1", "4")
.addStringSetAttr("attr2", vals);
auto attr = IpAttributes()
.addIpv4Addresses("1.1.1.1")
.addIpv4Addresses("2.2.2.2");
invalidation
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -148,8 +219,7 @@ TEST(InvalidationBasic, SettersAndGetters)
EXPECT_EQ(invalidation.getClassifier(ClassifierType::FAMILY), "ccc");
EXPECT_EQ(invalidation.getMainAttributes().begin()->getStringAttr("main_attr1").unpack(), "1");
EXPECT_EQ(invalidation.getMainAttributes().begin()->getStringSetAttr("main_attr2").unpack(), main_vals);
EXPECT_EQ(invalidation.getAttributes().begin()->getStringAttr("attr1").unpack(), "4");
EXPECT_EQ(invalidation.getAttributes().begin()->getStringSetAttr("attr2").unpack(), vals);
EXPECT_EQ(invalidation.getAttributes().begin()->getIpv4Addresses().unpack(), vals);
EXPECT_EQ(invalidation.getSourceId().unpack(), "id");
EXPECT_EQ(invalidation.getObjectType().unpack(), Intelligence::ObjectType::ASSET);
EXPECT_EQ(invalidation.getInvalidationType().unpack(), InvalidationType::DELETE);
@@ -164,9 +234,9 @@ TEST(InvalidationBasic, Matching)
.addStringAttr("main_attr1", "1")
.addStringSetAttr("main_attr2", main_vals);
auto attr = StrAttributes()
.addStringAttr("attr1", "4")
.addStringSetAttr("attr2", vals);
auto attr = IpAttributes()
.addIpv4Addresses("1.1.1.1")
.addIpv4Addresses("2.2.2.2");
auto base_invalidation = Invalidation("aaa")
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -179,10 +249,9 @@ TEST(InvalidationBasic, Matching)
.addStringSetAttr("main_attr2", main_vals)
.addStringAttr("main_attr3", "6");
auto matching_attr = StrAttributes()
.addStringAttr("attr1", "4")
.addStringSetAttr("attr2", vals)
.addStringAttr("attr3", "7");
auto matching_attr = IpAttributes()
.addIpv4Addresses("1.1.1.1")
.addIpv4Addresses("2.2.2.2");
auto matching_invalidation = Invalidation("aaa")
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -212,10 +281,9 @@ TEST(InvalidationBasic, Matching)
EXPECT_FALSE(base_invalidation.matches(missing_attr_invalidation_main));
auto missing_attr = StrAttributes()
.addStringAttr("attr1", "4")
.addStringAttr("attr2", "2")
.addStringAttr("attr3", "7");
auto missing_attr = IpAttributes()
.addIpv4Addresses("2.2.2.2")
.addIpv4Addresses("3.3.3.3");
auto missing_attr_invalidation = Invalidation("aaa")
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -280,7 +348,7 @@ public:
intelligence.preload();
intelligence.init();
main_attr.addStringAttr("attr2", "2");
attr.addStringAttr("attr3", "3");
attr.addIpv4Addresses("1.1.1.1");
}
bool
@@ -291,7 +359,7 @@ public:
}
StrAttributes main_attr;
StrAttributes attr;
IpAttributes attr;
StrictMock<MockMessaging> messaging_mock;
StrictMock<MockMainLoop> mock_ml;
NiceMock<MockTimeGet> mock_time;
@@ -350,7 +418,7 @@ TEST_F(IntelligenceInvalidation, sending_public_invalidation)
"\"objectType\": \"asset\", "
"\"sourceId\": \"id\", "
"\"mainAttributes\": [ { \"attr2\": \"2\" } ], "
"\"attributes\": [ { \"attr3\": \"3\" } ]"
"\"attributes\": [ { \"ipv4Addresses\": [ \"1.1.1.1\" ] } ]"
" } ] }";
EXPECT_EQ(invalidation_json, expected_json);
EXPECT_FALSE(md.getConnectionFlags().isSet(MessageConnectionConfig::UNSECURE_CONN));
@@ -390,7 +458,7 @@ TEST_F(IntelligenceInvalidation, multiple_assets_invalidation)
"\"objectType\": \"asset\", "
"\"sourceId\": \"id\", "
"\"mainAttributes\": [ { \"attr2\": \"2\" }, { \"attr2\": \"22\", \"attr3\": [ \"33\", \"44\" ] } ], "
"\"attributes\": [ { \"attr3\": \"3\" } ]"
"\"attributes\": [ { \"ipv4Addresses\": [ \"1.1.1.1\" ] } ]"
" } ] }";
EXPECT_EQ(invalidation_json, expected_json);
}
@@ -439,7 +507,7 @@ TEST_F(IntelligenceInvalidation, sending_private_invalidation)
"\"objectType\": \"asset\", "
"\"sourceId\": \"id\", "
"\"mainAttributes\": [ { \"attr2\": \"2\" } ], "
"\"attributes\": [ { \"attr3\": \"3\" } ]"
"\"attributes\": [ { \"ipv4Addresses\": [ \"1.1.1.1\" ] } ]"
" } ] }";
EXPECT_EQ(invalidation_json, expected_json);
EXPECT_TRUE(md.getConnectionFlags().isSet(MessageConnectionConfig::UNSECURE_CONN));
@@ -484,7 +552,7 @@ TEST_F(IntelligenceInvalidation, register_for_invalidation)
EXPECT_THAT(body, HasSubstr("\"url\": \"http://127.0.0.1:7000/set-new-invalidation\""));
EXPECT_THAT(body, HasSubstr("\"apiVersion\": \"v2\", \"communicationType\": \"sync\""));
EXPECT_THAT(body, HasSubstr("\"mainAttributes\": [ { \"attr2\": \"2\" } ]"));
EXPECT_THAT(body, HasSubstr("\"attributes\": [ { \"attr3\": \"3\" } ]"));
EXPECT_THAT(body, HasSubstr("\"attributes\": [ { \"ipv4Addresses\": [ \"1.1.1.1\" ] } ]"));
EXPECT_TRUE(md.getConnectionFlags().isSet(MessageConnectionConfig::UNSECURE_CONN));
EXPECT_THAT(body, HasSubstr("\"capabilities\": { \"getBulkCallback\": true }"));
@@ -888,11 +956,19 @@ TEST_F(IntelligenceInvalidation, invalidation_cb_match_by_registration_id)
configuration << "}";
Singleton::Consume<Config::I_Config>::from(conf)->loadConfiguration(configuration);
IpAddressRange range("1.1.1.1", "1.1.1.5");
IpAttributes attributes = IpAttributes()
.addIpv4Addresses("1.1.1.2")
.addIpv4AddressRanges(range)
.addIpv6Addresses("1.1.1.2")
.addIpv6AddressRanges(range);
auto base_main_attr2 = StrAttributes()
.addStringAttr("attr3", "3");
auto invalidation_to_register = Invalidation("aaa")
.addMainAttr(main_attr)
.addMainAttr(base_main_attr2)
.addAttr(attributes)
.setSourceId("id")
.setClassifier(ClassifierType::FAMILY, "ccc")
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -911,6 +987,7 @@ TEST_F(IntelligenceInvalidation, invalidation_cb_match_by_registration_id)
auto matching_invalidation = Invalidation("aaa")
.addMainAttr(matching_second_main_attribute)
.addAttr(attributes)
.setSourceId("id")
.setClassifier(ClassifierType::FAMILY, "ccc")
.setClassifier(ClassifierType::CATEGORY, "bbb")
@@ -919,6 +996,7 @@ TEST_F(IntelligenceInvalidation, invalidation_cb_match_by_registration_id)
auto invalidation_2_to_register = Invalidation("aaa")
.addMainAttr(base_main_attr2)
.addAttr(attributes)
.setSourceId("id")
.setClassifier(ClassifierType::FAMILY, "ccc")
.setClassifier(ClassifierType::CATEGORY, "bbb")

237
core/intelligence_is_v2/invalidation.cc
View File

@@ -20,6 +20,8 @@
#include "i_intelligence_is_v2.h"
USE_DEBUG_FLAG(D_INTELLIGENCE);
using namespace Intelligence;
using namespace std;
@@ -203,6 +205,18 @@ Invalidation::attr_matches(const vector<StrAttributes> &current, const vector<St
return false;
}
bool
Invalidation::attr_matches(const vector<IpAttributes> &current, const vector<IpAttributes> &other) const
{
if (current.empty()) return true;
for (const auto &attr : current) {
for(const auto &other_attr : other) {
if (attr.matches(other_attr)) return true;
}
}
return false;
}
bool
Invalidation::matches(const Invalidation &other) const
{
@@ -230,7 +244,7 @@ Invalidation::matches(const Invalidation &other) const
}
Invalidation &
Invalidation::addAttr(const StrAttributes &attr)
Invalidation::addAttr(const IpAttributes &attr)
{
attributes.emplace_back(attr);
return *this;
@@ -378,3 +392,224 @@ StrAttributes::performOutputingSchema(ostream &out, int level) {
}
RestHelper::printIndent(out, level) << "}";
}
IpAttributes &
IpAttributes::addIpv4Addresses(const string &val)
{
ipv4_addresses.push_back(val);
return *this;
}
IpAttributes &
IpAttributes::addIpv6Addresses(const string &val)
{
ipv6_addresses.push_back(val);
return *this;
}
IpAttributes &
IpAttributes::addIpv4AddressRanges(const IpAddressRange &val)
{
ipv4_address_ranges.push_back(val);
return *this;
}
IpAttributes &
IpAttributes::addIpv6AddressRanges(const IpAddressRange &val)
{
ipv6_address_ranges.push_back(val);
return *this;
}
Maybe<vector<string>, void>
IpAttributes::getIpv4Addresses() const
{
if (ipv4_addresses.empty()) return genError<void>();
return ipv4_addresses;
}
Maybe<vector<string>, void>
IpAttributes::getIpv6Addresses() const
{
if (ipv6_addresses.empty()) return genError<void>();
return ipv6_addresses;
}
Maybe<vector<IpAddressRange>, void>
IpAttributes::getIpv4AddressRanges() const
{
if (ipv4_address_ranges.empty()) return genError<void>();
return ipv4_address_ranges;
}
Maybe<vector<IpAddressRange>, void>
IpAttributes::getIpv6AddressRanges() const
{
if (ipv6_address_ranges.empty()) return genError<void>();
return ipv6_address_ranges;
}
Maybe<string, void>
IpAttributes::genObject() const
{
stringstream attributes_ss;
if (this->isEmpty()) return genError<void>();
bool internal_first = true;
bool first = true;
attributes_ss << "{ ";
if (!ipv4_addresses.empty()) {
attributes_ss << "\"ipv4Addresses\": [ ";
for (auto &attr : ipv4_addresses) {
if (!internal_first) attributes_ss << ", ";
attributes_ss << "\"" << attr << "\"";
internal_first = false;
}
attributes_ss << " ]";
first = false;
}
if (!ipv6_addresses.empty()) {
if (!first) attributes_ss << ", ";
attributes_ss << "\"ipv6Addresses\": [ ";
internal_first = true;
for (auto &attr : ipv6_addresses) {
if (!internal_first) attributes_ss << ", ";
attributes_ss << "\"" << attr << "\"";
internal_first = false;
}
attributes_ss << " ]";
first = false;
}
if (!ipv4_address_ranges.empty()) {
if (!first) attributes_ss << ", ";
attributes_ss << "\"ipv4AddressesRange\": [ ";
internal_first = true;
for (auto &attr : ipv4_address_ranges) {
if (!internal_first) attributes_ss << ", ";
attributes_ss << "{ \"max\": \"" << attr.getMax() << "\", \"min\": \"" << attr.getMin() << "\" }";
internal_first = false;
}
attributes_ss << " ]";
first = false;
}
if (!ipv6_address_ranges.empty()) {
if (!first) attributes_ss << ", ";
attributes_ss << "\"ipv6AddressesRange\": [ ";
internal_first = true;
for (auto &attr : ipv6_address_ranges) {
if (!internal_first) attributes_ss << ", ";
attributes_ss << "{ \"max\": \"" << attr.getMax() << "\", \"min\": \"" << attr.getMin() << "\" }";
internal_first = false;
}
attributes_ss << " ]";
first = false;
}
attributes_ss << " }";
return attributes_ss.str();
}
bool
IpAttributes::isEmpty() const
{
return
ipv4_addresses.empty() &&
ipv6_addresses.empty() &&
ipv4_address_ranges.empty() &&
ipv6_address_ranges.empty();
}
bool
IpAttributes::matches(const IpAttributes &other) const
{
return
ipv4_addresses == other.ipv4_addresses &&
ipv6_addresses == other.ipv6_addresses &&
ipv4_address_ranges == other.ipv4_address_ranges &&
ipv6_address_ranges == other.ipv6_address_ranges;
}
void
IpAttributes::serialize(cereal::JSONInputArchive &ar)
{
try {
ar(cereal::make_nvp("ipv4Addresses", ipv4_addresses));
ar(cereal::make_nvp("ipv4AddressesRange", ipv4_address_ranges));
ar(cereal::make_nvp("ipv6Addresses", ipv6_addresses));
ar(cereal::make_nvp("ipv6AddressesRange", ipv6_address_ranges));
} catch (cereal::Exception &e) {
dbgError(D_INTELLIGENCE) << e.what();
}
}
void
IpAttributes::performOutputingSchema(ostream &out, int level)
{
bool first = true;
bool internal_first = true;
RestHelper::printIndent(out, level) << "{\n";
if (!ipv4_addresses.empty()) {
RestHelper::printIndent(out, level + 1) << "\"ipv4Addresses\": [\n";
for (auto &attr : ipv4_addresses) {
if (!internal_first) out << ",\n";
RestHelper::printIndent(out, level + 2) << "\"" << attr << "\"";
internal_first = false;
}
out << "\n";
RestHelper::printIndent(out, level + 1) << "]";
first = false;
}
if (!ipv6_addresses.empty()) {
if (!first) out << ",\n";
RestHelper::printIndent(out, level + 1) << "\"ipv6Addresses\": [\n";
internal_first = true;
for (auto &attr : ipv6_addresses) {
if (!internal_first) out << ",\n";
RestHelper::printIndent(out, level + 2) << "\"" << attr << "\"";
internal_first = false;
}
out << "\n";
RestHelper::printIndent(out, level + 1) << "]";
first = false;
}
if (!ipv4_address_ranges.empty()) {
if (!first) out << ",\n";
RestHelper::printIndent(out, level + 1) << "\"ipv4AddressesRange\": [\n";
internal_first = true;
for (auto &attr : ipv4_address_ranges) {
if (!internal_first) out << ",\n";
RestHelper::printIndent(out, level + 2) << "{\n";
RestHelper::printIndent(out, level + 3) << "\"max\": \"" << attr.getMax() << "\",\n";
RestHelper::printIndent(out, level + 3) << "\"min\": \"" << attr.getMin() << "\"\n";
RestHelper::printIndent(out, level + 2) << "}";
internal_first = false;
}
out << "\n";
RestHelper::printIndent(out, level + 1) << "]";
first = false;
}
if (!ipv6_address_ranges.empty()) {
if (!first) out << ",\n";
RestHelper::printIndent(out, level + 1) << "\"ipv6AddressesRange\": [\n";
internal_first = true;
for (auto &attr : ipv6_address_ranges) {
if (!internal_first) out << ",\n";
RestHelper::printIndent(out, level + 2) << "{\n";
RestHelper::printIndent(out, level + 3) << "\"max\": \"" << attr.getMax() << "\",\n";
RestHelper::printIndent(out, level + 3) << "\"min\": \"" << attr.getMin() << "\"\n";
RestHelper::printIndent(out, level + 2) << "}";
internal_first = false;
}
out << "\n";
RestHelper::printIndent(out, level + 1) << "]";
first = false;
}
RestHelper::printIndent(out, level) << "\n}";
}