| /** |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.metron.parsers.bro; |
| |
| import org.adrianwalker.multilinestring.Multiline; |
| import org.apache.commons.lang3.tuple.Pair; |
| import org.apache.log4j.Level; |
| import org.apache.metron.parsers.interfaces.MessageParser; |
| import org.apache.metron.test.utils.UnitTestHelper; |
| import org.json.simple.JSONArray; |
| import org.json.simple.JSONObject; |
| import org.json.simple.parser.JSONParser; |
| import org.json.simple.parser.ParseException; |
| import org.junit.jupiter.api.AfterAll; |
| import org.junit.jupiter.api.BeforeAll; |
| import org.junit.jupiter.api.Test; |
| |
| import java.nio.charset.StandardCharsets; |
| import java.util.HashMap; |
| import java.util.Map; |
| |
| import static org.hamcrest.CoreMatchers.equalTo; |
| import static org.hamcrest.MatcherAssert.assertThat; |
| import static org.junit.jupiter.api.Assertions.*; |
| |
| public class BasicBroParserTest { |
| private BasicBroParser broParser = new BasicBroParser(); |
| private JSONParser jsonParser = new JSONParser(); |
| |
| @BeforeAll |
| public static void setup() { |
| UnitTestHelper.setLog4jLevel(BasicBroParser.class, Level.FATAL); |
| } |
| |
| @AfterAll |
| public static void teardown() { |
| UnitTestHelper.setLog4jLevel(BasicBroParser.class, Level.ERROR); |
| } |
| |
| /** |
| * This test is included as a gut-check about our formatting expectations using the Java JDK |
| * https://docs.oracle.com/javase/tutorial/i18n/format/decimalFormat.html |
| */ |
| @Test |
| public void testDecimalFormatAssumptions() { |
| Pair[] pairs = { |
| Pair.of(12345678d, "12345678.0"), |
| Pair.of(12345678.0d, "12345678.0"), |
| Pair.of(12345678.1d, "12345678.1"), |
| Pair.of(12345678.11d, "12345678.11"), |
| Pair.of(12345678.111d, "12345678.111"), |
| Pair.of(12345678.1111d, "12345678.1111"), |
| Pair.of(12345678.11111d, "12345678.11111"), |
| Pair.of(12345678.111111d, "12345678.111111") |
| }; |
| for (Pair pair : pairs) { |
| assertEquals(pair.getRight(), BasicBroParser.DECIMAL_FORMAT.get().format(pair.getLeft()), "Format did not match"); |
| } |
| } |
| |
| /** |
| * { |
| * "ts":1449511228.474, |
| * "uid":"CFgSLp4HgsGqXnNjZi", |
| * "id.orig_h":"104.130.172.191", |
| * "id.orig_p":33893, |
| * "id.resp_h":"69.20.0.164", |
| * "id.resp_p":53, |
| * "proto":"udp", |
| * "trans_id":3514, |
| * "rcode":3, |
| * "rcode_name":"NXDOMAIN", |
| * "AA":false, |
| * "TC":false, |
| * "RD":false, |
| * "RA":false, |
| * "Z":0, |
| * "rejected":false, |
| * "sensor":"cloudbro", |
| * "type":"dns" |
| * } |
| */ |
| @Multiline |
| public static String unwrappedBroMessage; |
| |
| @Test |
| public void testUnwrappedBroMessage() throws ParseException { |
| JSONObject rawJson = (JSONObject)jsonParser.parse(unwrappedBroMessage); |
| JSONObject broJson = broParser.parse(unwrappedBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| |
| String expectedBroTimestamp = "1449511228.474"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1449511228474"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port"), rawJson.get("id.orig_p")); |
| assertEquals(broJson.get("ip_dst_port"), rawJson.get("id.resp_p")); |
| assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); |
| assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); |
| assertEquals(broJson.get("sensor").toString(), rawJson.get("sensor").toString()); |
| assertEquals(broJson.get("type").toString(), rawJson.get("type").toString()); |
| assertEquals(broJson.get("rcode").toString(), rawJson.get("rcode").toString()); |
| assertEquals(broJson.get("rcode_name").toString(), rawJson.get("rcode_name").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("DNS")); |
| } |
| |
| /** |
| * { |
| * "http": { |
| * "ts":1402307733.473, |
| * "uid":"CTo78A11g7CYbbOHvj", |
| * "id.orig_h":"192.249.113.37", |
| * "id.orig_p":58808, |
| * "id.resp_h":"72.163.4.161", |
| * "id.resp_p":80, |
| * "trans_depth":1, |
| * "method":"GET", |
| * "host":"www.cisco.com", |
| * "uri":"/", |
| * "user_agent":"curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3", |
| * "request_body_len":0, |
| * "response_body_len":25523, |
| * "status_code":200, |
| * "status_msg":"OK", |
| * "tags":[], |
| * "resp_fuids":["FJDyMC15lxUn5ngPfd"], |
| * "resp_mime_types":["text/html"] |
| * } |
| * } |
| */ |
| @Multiline |
| public static String httpBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testHttpBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(httpBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(httpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1402307733.473"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1402307733473"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); |
| assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); |
| assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); |
| assertEquals(broJson.get("resp_mime_types").toString(), rawJson.get("resp_mime_types").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); |
| } |
| |
| /** |
| * Ensure we are able to parse values with fewer than 13 digits, including the millis after the decimal. |
| * This test verifies we handle parsing timestamps in situations where, for instance, 123.000000 is represented |
| * more compactly as 123.0 |
| */ |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testHttpBroMessageWithZeroDecimalTruncation() throws ParseException { |
| { |
| String rawMessage = "{\"http\": {\"ts\":1467657279,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + |
| "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg\",\"user_agent\":\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\",\"request_body_len\":0,\"response_body_len\":552,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"F3m7vB2RjUe4n01aqj\"],\"resp_mime_types\":[\"image/png\"]}}"; |
| |
| Map rawMessageMap = (Map) jsonParser.parse(rawMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedTimestamp = "1467657279000"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| String expectedBroTimestamp = "1467657279.0"; |
| assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); |
| } |
| { |
| String rawMessage = "{\"http\": {\"ts\":1467657279.0,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + |
| "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg\",\"user_agent\":\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\",\"request_body_len\":0,\"response_body_len\":552,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"F3m7vB2RjUe4n01aqj\"],\"resp_mime_types\":[\"image/png\"]}}"; |
| |
| Map rawMessageMap = (Map) jsonParser.parse(rawMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedTimestamp = "1467657279000"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| String expectedBroTimestamp = "1467657279.0"; |
| assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); |
| } |
| { |
| String rawMessage = "{\"http\": {\"ts\":1467657279.1,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + |
| "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg\",\"user_agent\":\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\",\"request_body_len\":0,\"response_body_len\":552,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"F3m7vB2RjUe4n01aqj\"],\"resp_mime_types\":[\"image/png\"]}}"; |
| |
| Map rawMessageMap = (Map) jsonParser.parse(rawMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedTimestamp = "1467657279100"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| String expectedBroTimestamp = "1467657279.1"; |
| assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); |
| } |
| { |
| String rawMessage = "{\"http\": {\"ts\":1467657279.11,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + |
| "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http://7oqnsnzwwnm6zb7y.gigapaysun.com/11iQmfg\",\"user_agent\":\"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\",\"request_body_len\":0,\"response_body_len\":552,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"F3m7vB2RjUe4n01aqj\"],\"resp_mime_types\":[\"image/png\"]}}"; |
| |
| Map rawMessageMap = (Map) jsonParser.parse(rawMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedTimestamp = "1467657279110"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| String expectedBroTimestamp = "1467657279.11"; |
| assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); |
| } |
| } |
| |
| /** |
| * { |
| * "http": { |
| * "ts":1457149494.166991, |
| * "uid":"CTo78A11g7CYbbOHvj", |
| * "id.orig_h":"192.249.113.37", |
| * "id.orig_p":58808, |
| * "id.resp_h":"72.163.4.161", |
| * "id.resp_p":80, |
| * "trans_depth":1, |
| * "method":"GET", |
| * "host":"www.cisco.com", |
| * "uri":"/", |
| * "user_agent":"curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3", |
| * "request_body_len":0, |
| * "response_body_len":25523, |
| * "status_code":200, |
| * "status_msg":"OK", |
| * "tags":[], |
| * "resp_fuids":["FJDyMC15lxUn5ngPfd"], |
| * "resp_mime_types":["text/html"] |
| * } |
| * } |
| */ |
| @Multiline |
| public static String httpBroDecimalMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testHttpBroDecimalMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(httpBroDecimalMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(httpBroDecimalMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1457149494.166991"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1457149494166"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); |
| assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); |
| assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); |
| assertEquals(broJson.get("resp_mime_types").toString(), rawJson.get("resp_mime_types").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); |
| } |
| |
| |
| /** |
| * { |
| * "dns": { |
| * "ts":1402308259.609, |
| * "uid":"CuJT272SKaJSuqO0Ia", |
| * "id.orig_h":"10.122.196.204", |
| * "id.orig_p":33976, |
| * "id.resp_h":"144.254.71.184", |
| * "id.resp_p":53, |
| * "proto":"udp", |
| * "trans_id":62418, |
| * "query":"www.cisco.com", |
| * "qclass":1, |
| * "qclass_name":"C_INTERNET", |
| * "qtype":28, |
| * "qtype_name":"AAAA", |
| * "rcode":0, |
| * "rcode_name":"NOERROR", |
| * "AA":true, |
| * "TC":false, |
| * "RD":true, |
| * "RA":true, |
| * "Z":0, |
| * "answers":["www.cisco.com.akadns.net","origin-www.cisco.com","2001:420:1201:2::a"], |
| * "TTLs":[3600.0,289.0,14.0], |
| * "rejected":false |
| * } |
| * } |
| */ |
| @Multiline |
| public static String dnsBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testDnsBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(dnsBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(dnsBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1402308259.609"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1402308259609"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("qtype").toString(), rawJson.get("qtype").toString()); |
| assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("DNS")); |
| } |
| |
| /** |
| * { |
| * "files": { |
| * "analyzers": ["X509","MD5","SHA1"], |
| * "conn_uids":["C4tygJ3qxJBEJEBCeh"], |
| * "depth": 0, |
| * "duration": 0.0, |
| * "fuid":"FZEBC33VySG0nHSoO9", |
| * "is_orig": false, |
| * "local_orig": false, |
| * "md5": "eba37166385e3ef42464ed9752e99f1b", |
| * "missing_bytes": 0, |
| * "overflow_bytes": 0, |
| * "rx_hosts": ["10.220.15.205"], |
| * "seen_bytes": 1136, |
| * "sha1": "73e42686657aece354fbf685712361658f2f4357", |
| * "source": "SSL", |
| * "timedout": false, |
| * "ts": 1425845251.334, |
| * "tx_hosts": ["68.171.237.7"] |
| * } |
| * } |
| */ |
| @Multiline |
| public static String filesBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testFilesBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(filesBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(filesBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1425845251.334"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1425845251334"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), ((JSONArray)rawJson.get("tx_hosts")).get(0).toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), ((JSONArray)rawJson.get("rx_hosts")).get(0).toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("fuid").toString(), rawJson.get("fuid").toString()); |
| assertEquals(broJson.get("md5").toString(), rawJson.get("md5").toString()); |
| assertEquals(broJson.get("analyzers").toString(), rawJson.get("analyzers").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("FILES")); |
| } |
| |
| /** |
| * { |
| * "conn": { |
| * "ts":1166289883.163553, |
| * "uid":"CTKCLy1z4C9U8OqU0c", |
| * "id.orig_h":"192.168.0.114", |
| * "id.orig_p":1140, |
| * "id.resp_h":"192.168.0.193", |
| * "id.resp_p":7254, |
| * "proto":"tcp", |
| * "service":"ftp-data", |
| * "duration":0.006635, |
| * "orig_bytes":0, |
| * "resp_bytes":5808, |
| * "conn_state":"S1", |
| * "missed_bytes":0, |
| * "history":"ShAd", |
| * "orig_pkts":3, |
| * "orig_ip_bytes":128, |
| * "resp_pkts":5, |
| * "resp_ip_bytes":6016, |
| * "tunnel_parents":[] |
| * } |
| * } |
| */ |
| @Multiline |
| public static String connBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testConnBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(connBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(connBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1166289883.163553"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1166289883163"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); |
| assertEquals(broJson.get("service").toString(), rawJson.get("service").toString()); |
| assertEquals(broJson.get("duration").toString(), rawJson.get("duration").toString()); |
| assertEquals(broJson.get("orig_bytes").toString(), rawJson.get("orig_bytes").toString()); |
| assertEquals(broJson.get("resp_bytes").toString(), rawJson.get("resp_bytes").toString()); |
| assertEquals(broJson.get("conn_state").toString(), rawJson.get("conn_state").toString()); |
| assertEquals(broJson.get("missed_bytes").toString(), rawJson.get("missed_bytes").toString()); |
| assertEquals(broJson.get("history").toString(), rawJson.get("history").toString()); |
| assertEquals(broJson.get("orig_pkts").toString(), rawJson.get("orig_pkts").toString()); |
| assertEquals(broJson.get("orig_ip_bytes").toString(), rawJson.get("orig_ip_bytes").toString()); |
| assertEquals(broJson.get("resp_pkts").toString(), rawJson.get("resp_pkts").toString()); |
| assertEquals(broJson.get("resp_ip_bytes").toString(), rawJson.get("resp_ip_bytes").toString()); |
| assertEquals(broJson.get("tunnel_parents").toString(), rawJson.get("tunnel_parents").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("CONN")); |
| } |
| |
| /** |
| * { |
| * "dpd": { |
| * "ts":1216704078.712276, |
| * "uid":"CwlB8d119WPanz63J", |
| * "id.orig_h":"192.168.15.4", |
| * "id.orig_p":34508, |
| * "id.resp_h":"66.33.212.43", |
| * "id.resp_p":80, |
| * "proto":"tcp", |
| * "analyzer":"HTTP", |
| * "failure_reason":"not a http reply line" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String dpdBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testDpdBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(dpdBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(dpdBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216704078.712276"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216704078712"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); |
| assertEquals(broJson.get("analyzer").toString(), rawJson.get("analyzer").toString()); |
| assertEquals(broJson.get("failure_reason").toString(), rawJson.get("failure_reason").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("DPD")); |
| } |
| |
| /** |
| * { |
| * "ftp": { |
| * "ts":1166289883.164645, |
| * "uid":"CuVhX03cii8zrjrtva", |
| * "id.orig_h":"192.168.0.114", |
| * "id.orig_p":1137, |
| * "id.resp_h":"192.168.0.193", |
| * "id.resp_p":21, |
| * "user":"csanders", |
| * "password":"<hidden>", |
| * "command":"RETR", |
| * "arg":"ftp://192.168.0.193/Music.mp3", |
| * "mime_type":"<unknown>", |
| * "file_size":192, |
| * "reply_code":150, |
| * "reply_msg":"Data connection accepted from 192.168.0.114:1140; transfer starting for Music.mp3 (4980924 bytes).", |
| * "fuid":"FlS6Jg1aNdsBxNn9Bf" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String ftpBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testFtpBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(ftpBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(ftpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1166289883.164645"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1166289883164"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("user").toString(), rawJson.get("user").toString()); |
| assertEquals(broJson.get("password").toString(), rawJson.get("password").toString()); |
| assertEquals(broJson.get("command").toString(), rawJson.get("command").toString()); |
| assertEquals(broJson.get("arg").toString(), rawJson.get("arg").toString()); |
| assertEquals(broJson.get("mime_type").toString(), rawJson.get("mime_type").toString()); |
| assertEquals(broJson.get("file_size").toString(), rawJson.get("file_size").toString()); |
| assertEquals(broJson.get("reply_code").toString(), rawJson.get("reply_code").toString()); |
| assertEquals(broJson.get("reply_msg").toString(), rawJson.get("reply_msg").toString()); |
| assertEquals(broJson.get("fuid").toString(), rawJson.get("fuid").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("FTP")); |
| } |
| |
| /** |
| * { |
| * "known_certs": { |
| * "ts":1216706999.896836, |
| * "host":"65.54.186.47", |
| * "port_num":443, |
| * "subject":"CN=login.live.com,OU=MSN-Passport,O=Microsoft Corporation,street=One Microsoft Way,L=Redmond,ST=Washington,postalCode=98052,C=US,serialNumber=600413485,businessCategory=V1.0\u005c, Clause 5.(b),1.3.6.1.4.1.311.60.2.1.2=#130A57617368696E67746F6E,1.3.6.1.4.1.311.60.2.1.3=#13025553", |
| * "issuer_subject":"CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\u005c, Inc.,C=US", |
| * "serial":"6905C4A47CFDBF9DBC98DACE38835FB8" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String knownCertsBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testKnownCertsBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(knownCertsBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(knownCertsBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216706999.896836"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216706999896"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); |
| assertEquals(broJson.get("port_num").toString(), rawJson.get("port_num").toString()); |
| assertEquals(broJson.get("subject").toString(), rawJson.get("subject").toString()); |
| assertEquals(broJson.get("issuer_subject").toString(), rawJson.get("issuer_subject").toString()); |
| assertEquals(broJson.get("serial").toString(), rawJson.get("serial").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("KNOWN_CERTS")); |
| } |
| |
| /** |
| * { |
| * "smtp": { |
| * "ts":1258568059.130219, |
| * "uid":"CMeLem2ouYvV8fzUp9", |
| * "id.orig_h":"192.168.1.103", |
| * "id.orig_p":1836, |
| * "id.resp_h":"192.168.1.1", |
| * "id.resp_p":25, |
| * "trans_depth":1, |
| * "helo":"m57pat", |
| * "last_reply":"220 2.0.0 Ready to start TLS", |
| * "path":["192.168.1.1","192.168.1.103"], |
| * "tls":true, |
| * "fuids":[], |
| * "is_webmail":false |
| * } |
| * } |
| */ |
| @Multiline |
| public static String smtpBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSmtpBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(smtpBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(smtpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1258568059.130219"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1258568059130"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("trans_depth").toString(), rawJson.get("trans_depth").toString()); |
| assertEquals(broJson.get("helo").toString(), rawJson.get("helo").toString()); |
| assertEquals(broJson.get("last_reply").toString(), rawJson.get("last_reply").toString()); |
| assertEquals(broJson.get("path").toString(), rawJson.get("path").toString()); |
| assertEquals(broJson.get("tls").toString(), rawJson.get("tls").toString()); |
| assertEquals(broJson.get("fuids").toString(), rawJson.get("fuids").toString()); |
| assertEquals(broJson.get("is_webmail").toString(), rawJson.get("is_webmail").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("SMTP")); |
| } |
| |
| /** |
| * { |
| * "ssl": { |
| * "ts":1216706999.444925, |
| * "uid":"Chy3Ge1k0IceXK4Di", |
| * "id.orig_h":"192.168.15.4", |
| * "id.orig_p":36532, |
| * "id.resp_h":"65.54.186.47", |
| * "id.resp_p":443, |
| * "version":"TLSv10", |
| * "cipher":"TLS_RSA_WITH_RC4_128_MD5", |
| * "server_name":"login.live.com", |
| * "resumed":false, |
| * "established":true, |
| * "cert_chain_fuids":["FkYBO41LPAXxh44KFk","FPrzYN1SuBqHflXZId","FZ71xF13r5XVSam1z1"], |
| * "client_cert_chain_fuids":[], |
| * "subject":"CN=login.live.com,OU=MSN-Passport,O=Microsoft Corporation,street=One Microsoft Way,L=Redmond,ST=Washington,postalCode=98052,C=US,serialNumber=600413485,businessCategory=V1.0\u005c, Clause 5.(b),1.3.6.1.4.1.311.60.2.1.2=#130A57617368696E67746F6E,1.3.6.1.4.1.311.60.2.1.3=#13025553", |
| * "issuer":"CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\u005c, Inc.,C=US", |
| * "validation_status":"unable to get local issuer certificate" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String sslBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSslBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(sslBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(sslBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216706999.444925"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216706999444"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("version").toString(), rawJson.get("version").toString()); |
| assertEquals(broJson.get("cipher").toString(), rawJson.get("cipher").toString()); |
| assertEquals(broJson.get("server_name").toString(), rawJson.get("server_name").toString()); |
| assertEquals(broJson.get("resumed").toString(), rawJson.get("resumed").toString()); |
| assertEquals(broJson.get("established").toString(), rawJson.get("established").toString()); |
| assertEquals(broJson.get("cert_chain_fuids").toString(), rawJson.get("cert_chain_fuids").toString()); |
| assertEquals(broJson.get("client_cert_chain_fuids").toString(), rawJson.get("client_cert_chain_fuids").toString()); |
| assertEquals(broJson.get("subject").toString(), rawJson.get("subject").toString()); |
| assertEquals(broJson.get("issuer").toString(), rawJson.get("issuer").toString()); |
| assertEquals(broJson.get("validation_status").toString(), rawJson.get("validation_status").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("SSL")); |
| } |
| |
| /** |
| * { |
| * "weird": { |
| * "ts":1216706886.239896, |
| * "uid":"CLSluk42pqbExeZQFl", |
| * "id.orig_h":"192.168.15.4", |
| * "id.orig_p":36336, |
| * "id.resp_h":"66.151.146.194", |
| * "id.resp_p":80, |
| * "name":"unescaped_special_URI_char", |
| * "notice":false, |
| * "peer":"bro" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String weirdBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testWeirdBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(weirdBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(weirdBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216706886.239896"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216706886239"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); |
| assertEquals(broJson.get("notice").toString(), rawJson.get("notice").toString()); |
| assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("WEIRD")); |
| } |
| |
| /** |
| * { |
| * "notice": { |
| * "ts":1216706377.196728, |
| * "uid":"CgpsTT28ZTiuSEsfVi", |
| * "id.orig_h":"192.168.15.4", |
| * "id.orig_p":35736, |
| * "id.resp_h":"74.125.19.104", |
| * "id.resp_p":443, |
| * "proto":"tcp", |
| * "note":"SSL::Invalid_Server_Cert", |
| * "msg":"SSL certificate validation failed with (unable to get local issuer certificate)", |
| * "sub":"CN=www.google.com,O=Google Inc,L=Mountain View,ST=California,C=US", |
| * "src":"192.168.15.4", |
| * "dst":"74.125.19.104", |
| * "p":443, |
| * "peer_descr":"bro", |
| * "actions":["Notice::ACTION_LOG"], |
| * "suppress_for":3600.0, |
| * "dropped":false |
| * } |
| * } |
| */ |
| @Multiline |
| public static String noticeBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testNoticeBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(noticeBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(noticeBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216706377.196728"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216706377196"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); |
| assertEquals(broJson.get("note").toString(), rawJson.get("note").toString()); |
| assertEquals(broJson.get("msg").toString(), rawJson.get("msg").toString()); |
| assertEquals(broJson.get("sub").toString(), rawJson.get("sub").toString()); |
| assertEquals(broJson.get("src").toString(), rawJson.get("src").toString()); |
| assertEquals(broJson.get("dst").toString(), rawJson.get("dst").toString()); |
| assertEquals(broJson.get("p").toString(), rawJson.get("p").toString()); |
| assertEquals(broJson.get("peer_descr").toString(), rawJson.get("peer_descr").toString()); |
| assertEquals(broJson.get("actions").toString(), rawJson.get("actions").toString()); |
| assertEquals(broJson.get("suppress_for").toString(), rawJson.get("suppress_for").toString()); |
| assertEquals(broJson.get("dropped").toString(), rawJson.get("dropped").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("NOTICE")); |
| } |
| |
| /** |
| * { |
| * "dhcp": { |
| * "ts":1258567562.944638, |
| * "uid":"C8rZDh400N68UV9Ulj", |
| * "id.orig_h":"192.168.1.103", |
| * "id.orig_p":68, |
| * "id.resp_h":"192.168.1.1", |
| * "id.resp_p":67, |
| * "mac":"00:0b:db:63:5b:d4", |
| * "assigned_ip":"192.168.1.103", |
| * "lease_time":3564.0, |
| * "trans_id":418901490 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String dhcpBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testDhcpBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(dhcpBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(dhcpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1258567562.944638"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1258567562944"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("mac").toString(), rawJson.get("mac").toString()); |
| assertEquals(broJson.get("assigned_ip").toString(), rawJson.get("assigned_ip").toString()); |
| assertEquals(broJson.get("lease_time").toString(), rawJson.get("lease_time").toString()); |
| assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("DHCP")); |
| } |
| |
| /** |
| * { |
| * "ssh": { |
| * "ts":1320435870.747967, |
| * "uid":"CSbqud1LKhRqlJiLDg", |
| * "id.orig_h":"172.16.238.1", |
| * "id.orig_p":58429, |
| * "id.resp_h":"172.16.238.136", |
| * "id.resp_p":22, |
| * "version":2, |
| * "auth_success":false, |
| * "client":"SSH-2.0-OpenSSH_5.6", |
| * "server":"SSH-2.0-OpenSSH_5.8p1 Debian-7ubuntu1", |
| * "cipher_alg":"aes128-ctr", |
| * "mac_alg":"hmac-md5", |
| * "compression_alg":"none", |
| * "kex_alg":"diffie-hellman-group-exchange-sha256", |
| * "host_key_alg":"ssh-rsa", |
| * "host_key":"87:11:46:da:89:c5:2b:d9:6b:ee:e0:44:7e:73:80:f8" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String sshBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSshBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(sshBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(sshBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1320435870.747967"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1320435870747"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("version").toString(), rawJson.get("version").toString()); |
| assertEquals(broJson.get("auth_success").toString(), rawJson.get("auth_success").toString()); |
| assertEquals(broJson.get("client").toString(), rawJson.get("client").toString()); |
| assertEquals(broJson.get("server").toString(), rawJson.get("server").toString()); |
| assertEquals(broJson.get("cipher_alg").toString(), rawJson.get("cipher_alg").toString()); |
| assertEquals(broJson.get("mac_alg").toString(), rawJson.get("mac_alg").toString()); |
| assertEquals(broJson.get("compression_alg").toString(), rawJson.get("compression_alg").toString()); |
| assertEquals(broJson.get("kex_alg").toString(), rawJson.get("kex_alg").toString()); |
| assertEquals(broJson.get("host_key_alg").toString(), rawJson.get("host_key_alg").toString()); |
| assertEquals(broJson.get("host_key").toString(), rawJson.get("host_key").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("SSH")); |
| } |
| |
| /** |
| * { |
| * "software": { |
| * "ts":1216707079.49066, |
| * "host":"38.102.35.231", |
| * "host_p":80, |
| * "software_type":"HTTP::SERVER", |
| * "name":"lighttpd", |
| * "version.major":1, |
| * "version.minor":4, |
| * "version.minor2":18, |
| * "unparsed_version":"lighttpd/1.4.18" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String softwareBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSoftwareBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(softwareBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(softwareBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216707079.49066"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216707079490"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); |
| assertEquals(broJson.get("host_p").toString(), rawJson.get("host_p").toString()); |
| assertEquals(broJson.get("software_type").toString(), rawJson.get("software_type").toString()); |
| assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); |
| assertEquals(broJson.get("version.major").toString(), rawJson.get("version.major").toString()); |
| assertEquals(broJson.get("version.minor").toString(), rawJson.get("version.minor").toString()); |
| assertEquals(broJson.get("version.minor2").toString(), rawJson.get("version.minor2").toString()); |
| assertEquals(broJson.get("unparsed_version").toString(), rawJson.get("unparsed_version").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("SOFTWARE")); |
| } |
| |
| /** |
| * { |
| * "software": { |
| * "ts":1216707079.518447, |
| * "host":"72.21.202.98", |
| * "host_p":80, |
| * "software_type":"HTTP::SERVER", |
| * "name":"AmazonS3", |
| * "unparsed_version":"AmazonS3" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String softwareBroMessage2; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSoftwareBroMessage2() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(softwareBroMessage2); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(softwareBroMessage2.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216707079.518447"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216707079518"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); |
| assertEquals(broJson.get("host_p").toString(), rawJson.get("host_p").toString()); |
| assertEquals(broJson.get("software_type").toString(), rawJson.get("software_type").toString()); |
| assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); |
| assertEquals(broJson.get("unparsed_version").toString(), rawJson.get("unparsed_version").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("SOFTWARE")); |
| } |
| |
| /** |
| * { |
| * "radius": { |
| * "ts":1440447766.441298, |
| * "uid":"Cfvksv4SEJJiqFobPj", |
| * "id.orig_h":"127.0.0.1", |
| * "id.orig_p":53031, |
| * "id.resp_h":"127.0.0.1", |
| * "id.resp_p":1812, |
| * "username":"steve", |
| * "result":"failed" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String radiusBroMessageFailed; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testRadiusBroMessageFailed() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(radiusBroMessageFailed); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(radiusBroMessageFailed.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1440447766.441298"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1440447766441"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("username").toString(), rawJson.get("username").toString()); |
| assertEquals(broJson.get("result").toString(), rawJson.get("result").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("RADIUS")); |
| } |
| |
| /** |
| * { |
| * "radius": { |
| * "ts":1440447839.947956, |
| * "uid":"CHb5MF3GTmyPniTage", |
| * "id.orig_h":"127.0.0.1", |
| * "id.orig_p":65443, |
| * "id.resp_h":"127.0.0.1", |
| * "id.resp_p":1812, |
| * "username":"steve", |
| * "result":"success" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String radiusBroMessageSuccess; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testRadiusBroMessageSuccess() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(radiusBroMessageSuccess); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(radiusBroMessageSuccess.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1440447839.947956"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1440447839947"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("username").toString(), rawJson.get("username").toString()); |
| assertEquals(broJson.get("result").toString(), rawJson.get("result").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("RADIUS")); |
| } |
| |
| /** |
| * { |
| * "x509": { |
| * "ts":1216706999.661483, |
| * "id":"FPrzYN1SuBqHflXZId", |
| * "certificate.version":3, |
| * "certificate.serial":"5B7759C61784E15EC727C0329529286B", |
| * "certificate.subject":"CN=VeriSign Class 3 Extended Validation SSL CA,OU=Terms of use at https://www.verisign.com/rpa (c)06,OU=VeriSign Trust Network,O=VeriSign\u005c, Inc.,C=US","certificate.issuer":"CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=(c) 2006 VeriSign\u005c, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\u005c, Inc.,C=US", |
| * "certificate.not_valid_before":1162944000.0, |
| * "certificate.not_valid_after":1478563199.0, |
| * "certificate.key_alg":"rsaEncryption", |
| * "certificate.sig_alg":"sha1WithRSAEncryption", |
| * "certificate.key_type":"rsa", |
| * "certificate.key_length":2048, |
| * "certificate.exponent":"65537", |
| * "basic_constraints.ca":true, |
| * "basic_constraints.path_len":0 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String x509BroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testX509BroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(x509BroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(x509BroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216706999.661483"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216706999661"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("id").toString(), rawJson.get("id").toString()); |
| assertEquals(broJson.get("certificate.version").toString(), rawJson.get("certificate.version").toString()); |
| assertEquals(broJson.get("certificate.serial").toString(), rawJson.get("certificate.serial").toString()); |
| assertEquals(broJson.get("certificate.subject").toString(), rawJson.get("certificate.subject").toString()); |
| assertEquals(broJson.get("certificate.issuer").toString(), rawJson.get("certificate.issuer").toString()); |
| assertEquals(broJson.get("certificate.not_valid_before").toString(), rawJson.get("certificate.not_valid_before").toString()); |
| assertEquals(broJson.get("certificate.not_valid_after").toString(), rawJson.get("certificate.not_valid_after").toString()); |
| assertEquals(broJson.get("certificate.key_alg").toString(), rawJson.get("certificate.key_alg").toString()); |
| assertEquals(broJson.get("certificate.sig_alg").toString(), rawJson.get("certificate.sig_alg").toString()); |
| assertEquals(broJson.get("certificate.key_type").toString(), rawJson.get("certificate.key_type").toString()); |
| assertEquals(broJson.get("certificate.key_length").toString(), rawJson.get("certificate.key_length").toString()); |
| assertEquals(broJson.get("certificate.exponent").toString(), rawJson.get("certificate.exponent").toString()); |
| assertEquals(broJson.get("basic_constraints.ca").toString(), rawJson.get("basic_constraints.ca").toString()); |
| assertEquals(broJson.get("basic_constraints.path_len").toString(), rawJson.get("basic_constraints.path_len").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("X509")); |
| } |
| |
| /** |
| * { |
| * "known_devices": { |
| * "ts":1258532046.693816, |
| * "mac":"00:0b:db:4f:6b:10", |
| * "dhcp_host_name":"m57-charlie" |
| * } |
| * } |
| */ |
| @Multiline |
| public static String knownDevicesBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testKnownDevicesBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(knownDevicesBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(knownDevicesBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1258532046.693816"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1258532046693"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("mac").toString(), rawJson.get("mac").toString()); |
| assertEquals(broJson.get("dhcp_host_name").toString(), rawJson.get("dhcp_host_name").toString()); |
| |
| assertTrue(broJson.get("original_string").toString().startsWith("KNOWN_DEVICES")); |
| } |
| |
| /** |
| * { |
| * "rfb": { |
| * "ts":1328634261.675248, |
| * "uid":"CGhHbC1P1kuJYtR4Ul", |
| * "id.orig_h":"192.168.1.10", |
| * "id.orig_p":10254, |
| * "id.resp_h":"192.168.1.114", |
| * "id.resp_p":5900, |
| * "client_major_version":"003", |
| * "client_minor_version":"007", |
| * "server_major_version":"003", |
| * "server_minor_version":"007", |
| * "authentication_method":"VNC", |
| * "auth":true, |
| * "share_flag":false, |
| * "desktop_name":"aneagles@localhost.localdomain", |
| * "width":1280, |
| * "height":800 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String rfbBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testRfbBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(rfbBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(rfbBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1328634261.675248"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1328634261675"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertEquals(broJson.get("client_major_version").toString(), rawJson.get("client_major_version").toString()); |
| assertEquals(broJson.get("client_minor_version").toString(), rawJson.get("client_minor_version").toString()); |
| assertEquals(broJson.get("server_major_version").toString(), rawJson.get("server_major_version").toString()); |
| assertEquals(broJson.get("server_minor_version").toString(), rawJson.get("server_minor_version").toString()); |
| assertEquals(broJson.get("authentication_method").toString(), rawJson.get("authentication_method").toString()); |
| assertEquals(broJson.get("auth").toString(), rawJson.get("auth").toString()); |
| assertEquals(broJson.get("share_flag").toString(), rawJson.get("share_flag").toString()); |
| assertEquals(broJson.get("desktop_name").toString(), rawJson.get("desktop_name").toString()); |
| assertEquals(broJson.get("width").toString(), rawJson.get("width").toString()); |
| assertEquals(broJson.get("height").toString(), rawJson.get("height").toString()); |
| } |
| |
| /** |
| * { |
| * "stats": { |
| * "ts":1440447766.440305 |
| * "peer":"bro", |
| * "mem":55, |
| * "pkts_proc":1, |
| * "bytes_recv":119, |
| * "events_proc":392, |
| * "events_queued":15, |
| * "active_tcp_conns":0, |
| * "active_udp_conns":1, |
| * "active_icmp_conns":0, |
| * "tcp_conns":0, |
| * "udp_conns":1, |
| * "icmp_conns":0, |
| * "timers":34, |
| * "active_timers":31, |
| * "files":0, |
| * "active_files":0, |
| * "dns_requests":0, |
| * "active_dns_requests":0, |
| * "reassem_tcp_size":0, |
| * "reassem_file_size":0, |
| * "reassem_frag_size":0, |
| * "reassem_unknown_size":0 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String statsBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testStatsBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(statsBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(statsBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1440447766.440305"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1440447766440"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); |
| assertEquals(broJson.get("mem").toString(), rawJson.get("mem").toString()); |
| assertEquals(broJson.get("pkts_proc").toString(), rawJson.get("pkts_proc").toString()); |
| assertEquals(broJson.get("bytes_recv").toString(), rawJson.get("bytes_recv").toString()); |
| assertEquals(broJson.get("events_proc").toString(), rawJson.get("events_proc").toString()); |
| assertEquals(broJson.get("events_queued").toString(), rawJson.get("events_queued").toString()); |
| assertEquals(broJson.get("active_tcp_conns").toString(), rawJson.get("active_tcp_conns").toString()); |
| assertEquals(broJson.get("active_udp_conns").toString(), rawJson.get("active_udp_conns").toString()); |
| assertEquals(broJson.get("active_icmp_conns").toString(), rawJson.get("active_icmp_conns").toString()); |
| assertEquals(broJson.get("tcp_conns").toString(), rawJson.get("tcp_conns").toString()); |
| assertEquals(broJson.get("udp_conns").toString(), rawJson.get("udp_conns").toString()); |
| assertEquals(broJson.get("icmp_conns").toString(), rawJson.get("icmp_conns").toString()); |
| assertEquals(broJson.get("timers").toString(), rawJson.get("timers").toString()); |
| assertEquals(broJson.get("active_timers").toString(), rawJson.get("active_timers").toString()); |
| assertEquals(broJson.get("files").toString(), rawJson.get("files").toString()); |
| assertEquals(broJson.get("active_files").toString(), rawJson.get("active_files").toString()); |
| assertEquals(broJson.get("dns_requests").toString(), rawJson.get("dns_requests").toString()); |
| assertEquals(broJson.get("active_dns_requests").toString(), rawJson.get("active_dns_requests").toString()); |
| assertEquals(broJson.get("reassem_tcp_size").toString(), rawJson.get("reassem_tcp_size").toString()); |
| assertEquals(broJson.get("reassem_file_size").toString(), rawJson.get("reassem_file_size").toString()); |
| assertEquals(broJson.get("reassem_frag_size").toString(), rawJson.get("reassem_frag_size").toString()); |
| assertEquals(broJson.get("reassem_unknown_size").toString(), rawJson.get("reassem_unknown_size").toString()); |
| } |
| |
| /** |
| * { |
| * "capture_loss": { |
| * "ts":1320435958.419451, |
| * "ts_delta":493.659207, |
| * "peer":"bro", |
| * "gaps":2, |
| * "acks":4854, |
| * "percent_lost":0.041203 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String captureLossBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testCaptureLossBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(captureLossBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(captureLossBroMessage.getBytes( |
| StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1320435958.419451"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1320435958419"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("ts_delta").toString(), rawJson.get("ts_delta").toString()); |
| assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); |
| assertEquals(broJson.get("gaps").toString(), rawJson.get("gaps").toString()); |
| assertEquals(broJson.get("acks").toString(), rawJson.get("acks").toString()); |
| assertEquals(broJson.get("percent_lost").toString(), rawJson.get("percent_lost").toString()); |
| } |
| |
| /** |
| * { |
| * "sip": { |
| * "ts":1216698441.346819, |
| * "uid":"Cf3LPS10DMyCqJMDv9", |
| * "id.orig_h":"192.168.1.64", |
| * "id.orig_p":1032, |
| * "id.resp_h":"216.115.20.143", |
| * "id.resp_p":10000, |
| * "trans_depth":0, |
| * "method":"REGISTER", |
| * "uri":"sip:t.voncp.com:10000", |
| * "request_from":"\\u002216178766111\\u0022 <sip:16178766111@t.voncp.com:10000>", |
| * "request_to":"\\u002216178766111\\u0022 <sip:16178766111@t.voncp.com:10000>", |
| * "response_from":"\\u002216178766111\\u0022 <sip:16178766111@t.voncp.com:10000>", |
| * "response_to":"\\u002216178766111\\u0022 <sip:16178766111@t.voncp.com:10000>", |
| * "call_id":"7757a70e218b95730dd2daeaac7d20b1@192.168.1.64", |
| * "seq":"1761527952 REGISTER", |
| * "request_path":["SIP/2.0/UDP 192.168.1.64:10000"], |
| * "response_path":["SIP/2.0/UDP 192.168.1.64:10000"], |
| * "user_agent":"VDV21 001DD92E4F61 2.8.1_1.4.7 LwooEk3GCD/bcm001DD92E4F61.xml", |
| * "status_code":200, |
| * "status_msg":"OK", |
| * "request_body_len":0, |
| * "response_body_len":0 |
| * } |
| * } |
| */ |
| @Multiline |
| public static String sipBroMessage; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testSipBroMessage() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(sipBroMessage); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(sipBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1216698441.346819"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1216698441346"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); |
| |
| assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertEquals(broJson.get("trans_depth").toString(), rawJson.get("trans_depth").toString()); |
| assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); |
| assertEquals(broJson.get("uri").toString(), rawJson.get("uri").toString()); |
| assertEquals(broJson.get("request_from").toString(), rawJson.get("request_from").toString()); |
| assertEquals(broJson.get("request_to").toString(), rawJson.get("request_to").toString()); |
| assertEquals(broJson.get("response_from").toString(), rawJson.get("response_from").toString()); |
| assertEquals(broJson.get("response_to").toString(), rawJson.get("response_to").toString()); |
| assertEquals(broJson.get("call_id").toString(), rawJson.get("call_id").toString()); |
| assertEquals(broJson.get("seq").toString(), rawJson.get("seq").toString()); |
| assertEquals(broJson.get("request_path").toString(), rawJson.get("request_path").toString()); |
| assertEquals(broJson.get("response_path").toString(), rawJson.get("response_path").toString()); |
| assertEquals(broJson.get("user_agent").toString(), rawJson.get("user_agent").toString()); |
| assertEquals(broJson.get("status_code").toString(), rawJson.get("status_code").toString()); |
| assertEquals(broJson.get("status_msg").toString(), rawJson.get("status_msg").toString()); |
| assertEquals(broJson.get("request_body_len").toString(), rawJson.get("request_body_len").toString()); |
| assertEquals(broJson.get("response_body_len").toString(), rawJson.get("response_body_len").toString()); |
| } |
| |
| /** |
| * { |
| * "ht*tp": { |
| * "ts":1402307733.473, |
| * "uid":"CTo78A11g7CYbbOHvj", |
| * "id.orig_h":"192.249.113.37", |
| * "id.orig_p":58808, |
| * "id.resp_h":"72.163.4.161", |
| * "id.resp_p":80, |
| * "trans_depth":1, |
| * "method":"GET", |
| * "host":"www.cisco.com", |
| * "uri":"/", |
| * "user_agent":"curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3", |
| * "request_body_len":0, |
| * "response_body_len":25523, |
| * "status_code":200, |
| * "status_msg":"OK", |
| * "tags":[], |
| * "resp_fuids":["FJDyMC15lxUn5ngPfd"], |
| * "resp_mime_types":["text/html"] |
| * } |
| * } |
| */ |
| @Multiline |
| public static String protocolKeyCleanedUp; |
| |
| @SuppressWarnings("rawtypes") |
| @Test |
| public void testProtocolKeyCleanedUp() throws ParseException { |
| Map rawMessageMap = (Map) jsonParser.parse(protocolKeyCleanedUp); |
| JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); |
| |
| JSONObject broJson = broParser.parse(protocolKeyCleanedUp.getBytes(StandardCharsets.UTF_8)).get(0); |
| String expectedBroTimestamp = "1402307733.473"; |
| assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); |
| String expectedTimestamp = "1402307733473"; |
| assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); |
| assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); |
| assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); |
| assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); |
| assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); |
| assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); |
| } |
| |
| @Test |
| public void testBadMessage() { |
| assertThrows(IllegalStateException.class, () -> broParser.parse("{ \"foo\" : \"bar\"}".getBytes(StandardCharsets.UTF_8))); |
| } |
| |
| @Test |
| public void testBadMessageNonJson() { |
| assertThrows(IllegalStateException.class, () -> broParser.parse("foo bar".getBytes(StandardCharsets.UTF_8))); |
| } |
| |
| @Test |
| public void getsReadCharsetFromConfig() { |
| Map<String, Object> config = new HashMap<>(); |
| config.put(MessageParser.READ_CHARSET, StandardCharsets.UTF_16.toString()); |
| broParser.configure(config); |
| assertThat(broParser.getReadCharset(), equalTo(StandardCharsets.UTF_16)); |
| } |
| |
| @Test |
| public void getsReadCharsetFromDefault() { |
| Map<String, Object> config = new HashMap<>(); |
| broParser.configure(config); |
| assertThat(broParser.getReadCharset(), equalTo(StandardCharsets.UTF_8)); |
| } |
| } |
