import os import pytest from CommonServerPython import CommandResults from magic import Magic from PcapFileExtractor import EXCLUSIVE, INCLUSIVE, filter_files, upload_files from pytest import raises # noqa: PT013 OUTPUTS = [ { "FileMD5": "dca7766edd1e4976cac5e64fcaeec1fd", "FileSHA1": "e1a60d05cd5b6b1bae28e7e5c0b368be6b48c2b5", "FileSHA256": "39c9534e5fa6fecd3ac083ffd6256c2cc9a58f9f1058cb2e472d1782040231f9", "FileName": "rfc1350.txt", "FileSize": 24599, "FileExtension": ".txt", } ] def test_extract_files(tmpdir): """ Given - Valid Pcap File. When - Extracting the file from the pcap. Then - ensure file is being extracted correctly. - ensure outputs are correct. """ file_path = "./TestData/tftp_rrq.pcap" results = upload_files(file_path, tmpdir) if type(results) is CommandResults: # Otherwise 'results' has not 'readable_output' or 'outputs' attributes. assert "Pcap Extracted Files" in results.readable_output assert results.outputs == OUTPUTS assert os.path.isfile(os.path.join(tmpdir, "rfc1350.txt")) class TestFilter: @pytest.mark.parametrize( "files, types, type_from_magic, exclusive_or_inclusive, expected", [ (["./png_file.png"], ["image/png"], "image/png", EXCLUSIVE, []), (["./png_file.png"], ["image/png"], "image/png", INCLUSIVE, ["./png_file.png"]), (["./png_file.mp3"], ["sound/mp3"], "image/png", INCLUSIVE, []), ], ) def test_types(self, files, types, type_from_magic, exclusive_or_inclusive, expected, mocker): """ Given: - inputs to filter_files concentrating on the types branch, as well with excepted files output When: - filtering files Then: - Validate the file list that got back is the same as expected. """ mocker.patch.object(Magic, "from_file", return_value=type_from_magic) assert expected == filter_files("/.", files, types=types, inclusive_or_exclusive=exclusive_or_inclusive) @pytest.mark.parametrize( "files, extensions, exclusive_or_inclusive, expected", [ (["./png_file.png"], {".png"}, EXCLUSIVE, []), (["./png_file.png"], {".png"}, INCLUSIVE, ["./png_file.png"]), (["./png_file.mp3"], {"sound/mp3"}, INCLUSIVE, []), ], ) def test_extensions(self, files, extensions, exclusive_or_inclusive, expected): """ Given: - inputs to filter_files concentrating on the extensions branch, as well with excepted files output When: - filtering files Then: - Validate the file list that got back is the same as expected. """ assert expected == filter_files("/.", files, extensions=extensions, inclusive_or_exclusive=exclusive_or_inclusive) def test_decryption_wpa_pwd(tmpdir): """ Given: - A PCAP file protected with WPA-PWD - A password to the file When: - Running PcapFileExtractor with WPA-PWD protected file Then: - Validate results output that the files are exported and returned to CortexSOAR """ file_path = "./TestData/wpa-Induction.pcap" password = "Induction" results = upload_files(file_path, tmpdir, wpa_pwd=password) assert len(results.outputs) == 5 def test_decryption_rsa(tmpdir): """ Given: - A PCAP file with ssl encryption - A Key file for the pcap When: - Running PcapFileExtractor with TLS protected file and key Then: - Validate results output that the files are exported and returned to CortexSOAR """ file_path = "./TestData/rsa.cap" key_path = "./TestData/rsa.key" results = upload_files(file_path, tmpdir, rsa_path=key_path) assert len(results.outputs) == 5 def test_assertion_types_and_extension(tmpdir): """ Given: - both types and extensions arguments When: - Running script Then: - Validate AssertionError is raises as you shouldn't supply them both. """ with raises(AssertionError): upload_files("", tmpdir, types="1,2,3", extensions="1,2,3")