77 lines
1.9 KiB
Go
77 lines
1.9 KiB
Go
package ingest
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.apinb.com/ops/logs/internal/models"
|
|
"github.com/gosnmp/gosnmp"
|
|
)
|
|
|
|
func TestParseSyslogPayloadPri(t *testing.T) {
|
|
p := parseSyslogPayload([]byte("<34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8"))
|
|
if p.Priority != 34 {
|
|
t.Fatalf("priority=%d", p.Priority)
|
|
}
|
|
}
|
|
|
|
func TestParseSyslogPayloadRFC3164Hostname(t *testing.T) {
|
|
p := parseSyslogPayload([]byte("Oct 11 22:14:15 mymachine su: failed"))
|
|
if p.Hostname != "mymachine" {
|
|
t.Fatalf("hostname=%q", p.Hostname)
|
|
}
|
|
if p.Tag != "su" {
|
|
t.Fatalf("tag=%q", p.Tag)
|
|
}
|
|
if p.Message != "failed" {
|
|
t.Fatalf("message=%q", p.Message)
|
|
}
|
|
}
|
|
|
|
func TestForwardAlertBodyIncludesRawData(t *testing.T) {
|
|
raw := []byte(`{"source":"syslog","parsed":{}}`)
|
|
b := AlertReceiveBody{
|
|
AlertName: "a",
|
|
RawData: raw,
|
|
}
|
|
data, err := json.Marshal(b)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var dec map[string]json.RawMessage
|
|
if err := json.Unmarshal(data, &dec); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if string(dec["raw_data"]) != string(raw) {
|
|
t.Fatalf("raw_data %s", dec["raw_data"])
|
|
}
|
|
}
|
|
|
|
func TestInTimeWindowsInvalidJSONReturnsFalse(t *testing.T) {
|
|
now := time.Date(2026, 1, 1, 10, 0, 0, 0, time.Local)
|
|
if inTimeWindows(now, "{invalid") {
|
|
t.Fatal("invalid json should not be treated as always effective")
|
|
}
|
|
}
|
|
|
|
func TestTrapShieldedAllowsEmptySourceIPCIDR(t *testing.T) {
|
|
e := &Engine{
|
|
shields: []models.TrapShield{
|
|
{
|
|
Enabled: true,
|
|
SourceIPCIDR: "",
|
|
OIDPrefix: "1.3.6.1.4.1",
|
|
InterfaceHint: "",
|
|
TimeWindowsJSON: "",
|
|
},
|
|
},
|
|
}
|
|
addr := &net.UDPAddr{IP: net.ParseIP("10.0.0.1"), Port: 162}
|
|
pkt := &gosnmp.SnmpPacket{}
|
|
if !trapShielded(e, addr, "1.3.6.1.4.1.999", pkt) {
|
|
t.Fatal("shield should match when source_ip_cidr is empty and other conditions match")
|
|
}
|
|
}
|