Added scan_epmd test

intelmq/tests/bots/parsers/shadowserver/test_scan_epmd.py

@@ -0,0 +1,114 @@
+# SPDX-FileCopyrightText: 2022 Shadowserver Foundation
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+# -*- coding: utf-8 -*-
+
+import os
+import unittest
+
+import intelmq.lib.test as test
+import intelmq.lib.utils as utils
+from intelmq.bots.parsers.shadowserver.parser import ShadowserverParserBot
+
+with open(os.path.join(os.path.dirname(__file__),
+                       'testdata/scan_epmd.csv')) as handle:
+    EXAMPLE_FILE = handle.read()
+EXAMPLE_LINES = EXAMPLE_FILE.splitlines()
+
+EXAMPLE_REPORT = {'feed.name': 'Accessible Erlang Port Mapper Daemon',
+                  "raw": utils.base64_encode(EXAMPLE_FILE),
+                  "__type": "Report",
+                  "time.observation": "2010-02-10T00:00:00+00:00",
+                  "extra.file_name": "2010-02-10-scan_epmd-test.csv",
+                  }
+EVENTS = [
+{
+   '__type' : 'Event',
+   'classification.identifier' : 'open-epmd',
+   'classification.taxonomy' : 'other',
+   'classification.type' : 'other',
+   'extra.nodes' : 'ns_1,21100',
+   'extra.tag' : 'epmd',
+   'feed.name' : 'Accessible Erlang Port Mapper Daemon',
+   'protocol.application' : 'erlang port mapper daemon',
+   'protocol.transport' : 'tcp',
+   'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[1]])),
+   'source.asn' : 64512,
+   'source.geolocation.cc' : 'ZZ',
+   'source.geolocation.city' : 'City',
+   'source.geolocation.region' : 'Region',
+   'source.ip' : '192.168.0.1',
+   'source.port' : 4369,
+   'source.reverse_dns' : 'node01.example.com',
+   'time.observation' : '2010-02-10T00:00:00+00:00',
+   'time.source' : '2010-02-10T00:00:00+00:00'
+},
+
+{
+   '__type' : 'Event',
+   'classification.identifier' : 'open-epmd',
+   'classification.taxonomy' : 'other',
+   'classification.type' : 'other',
+   'extra.nodes' : 'rabbit,25672',
+   'extra.source.sector' : 'Retail Trade',
+   'extra.tag' : 'epmd',
+   'feed.name' : 'Accessible Erlang Port Mapper Daemon',
+   'protocol.application' : 'erlang port mapper daemon',
+   'protocol.transport' : 'tcp',
+   'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[2]])),
+   'source.asn' : 64512,
+   'source.geolocation.cc' : 'ZZ',
+   'source.geolocation.city' : 'City',
+   'source.geolocation.region' : 'Region',
+   'source.ip' : '192.168.0.2',
+   'source.port' : 4369,
+   'source.reverse_dns' : 'node02.example.com',
+   'time.observation' : '2010-02-10T00:00:00+00:00',
+   'time.source' : '2010-02-10T00:00:01+00:00'
+},
+
+{
+   '__type' : 'Event',
+   'classification.identifier' : 'open-epmd',
+   'classification.taxonomy' : 'other',
+   'classification.type' : 'other',
+   'extra.nodes' : 'vpnu-radius,36657',
+   'extra.source.sector' : 'Communications, Service Provider, and Hosting Service',
+   'extra.tag' : 'epmd',
+   'feed.name' : 'Accessible Erlang Port Mapper Daemon',
+   'protocol.application' : 'erlang port mapper daemon',
+   'protocol.transport' : 'tcp',
+   'raw' : utils.base64_encode('\n'.join([EXAMPLE_LINES[0], EXAMPLE_LINES[3]])),
+   'source.asn' : 64512,
+   'source.geolocation.cc' : 'ZZ',
+   'source.geolocation.city' : 'City',
+   'source.geolocation.region' : 'Region',
+   'source.ip' : '192.168.0.3',
+   'source.port' : 4369,
+   'source.reverse_dns' : 'node03.example.com',
+   'time.observation' : '2010-02-10T00:00:00+00:00',
+   'time.source' : '2010-02-10T00:00:02+00:00'
+}
+]
+
+
+class TestShadowserverParserBot(test.BotTestCase, unittest.TestCase):
+    """
+    A TestCase for a ShadowserverParserBot.
+    """
+
+    @classmethod
+    def set_bot(cls):
+        cls.bot_reference = ShadowserverParserBot
+        cls.default_input_message = EXAMPLE_REPORT
+
+    def test_event(self):
+        """ Test if correct Event has been produced. """
+        self.run_bot()
+        for i, EVENT in enumerate(EVENTS):
+            self.assertMessageEqual(i, EVENT)
+
+
+if __name__ == '__main__':  # pragma: no cover
+    unittest.main()

intelmq/tests/bots/parsers/shadowserver/testdata/scan_epmd.csv

@@ -0,0 +1,4 @@
+"timestamp","ip","protocol","port","hostname","tag","asn","geo","region","city","naics","sic","sector","nodes"
+"2010-02-10 00:00:00",192.168.0.1,tcp,4369,node01.example.com,epmd,64512,ZZ,Region,City,0,0,,"ns_1,21100"
+"2010-02-10 00:00:01",192.168.0.2,tcp,4369,node02.example.com,epmd,64512,ZZ,Region,City,0,0,"Retail Trade","rabbit,25672"
+"2010-02-10 00:00:02",192.168.0.3,tcp,4369,node03.example.com,epmd,64512,ZZ,Region,City,0,0,"Communications, Service Provider, and Hosting Service","vpnu-radius,36657"

intelmq/tests/bots/parsers/shadowserver/testdata/scan_epmd.csv.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: 2022 The Shadowserver Foundation
+SPDX-License-Identifier: AGPL-3.0-or-later