164 lines
4.2 KiB
Python
164 lines
4.2 KiB
Python
"""
|
|
©AngelaMos | 2026
|
|
test_processor.py
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from src.processor import (
|
|
_decode_comm,
|
|
_decode_filename,
|
|
_ipv4_to_str,
|
|
should_include,
|
|
)
|
|
|
|
|
|
class TestDecodeComm:
|
|
"""
|
|
Tests for comm field decoding
|
|
"""
|
|
|
|
def test_normal_string(self):
|
|
"""
|
|
Decodes a normal null-terminated comm
|
|
"""
|
|
raw = b"bash\x00\x00\x00\x00"
|
|
assert _decode_comm(raw) == "bash"
|
|
|
|
def test_full_length(self):
|
|
"""
|
|
Handles comm at max length without null
|
|
"""
|
|
raw = b"long_process_nm"
|
|
assert _decode_comm(raw) == "long_process_nm"
|
|
|
|
def test_empty(self):
|
|
"""
|
|
Handles empty comm
|
|
"""
|
|
raw = b"\x00" * 16
|
|
assert _decode_comm(raw) == ""
|
|
|
|
|
|
class TestDecodeFilename:
|
|
"""
|
|
Tests for filename field decoding
|
|
"""
|
|
|
|
def test_normal_path(self):
|
|
"""
|
|
Decodes a normal filepath
|
|
"""
|
|
raw = b"/usr/bin/ls\x00"
|
|
assert _decode_filename(raw) == "/usr/bin/ls"
|
|
|
|
def test_empty(self):
|
|
"""
|
|
Handles empty filename
|
|
"""
|
|
raw = b"\x00" * 256
|
|
assert _decode_filename(raw) == ""
|
|
|
|
|
|
class TestIpv4ToStr:
|
|
"""
|
|
Tests for IPv4 address conversion
|
|
"""
|
|
|
|
def test_localhost(self):
|
|
"""
|
|
Converts 127.0.0.1 in network byte order
|
|
"""
|
|
assert _ipv4_to_str(0x0100007F) == "127.0.0.1"
|
|
|
|
def test_ten_network(self):
|
|
"""
|
|
Converts 10.0.0.1 in network byte order
|
|
"""
|
|
assert _ipv4_to_str(0x0100000A) == "10.0.0.1"
|
|
|
|
def test_zero(self):
|
|
"""
|
|
Returns empty string for zero address
|
|
"""
|
|
assert _ipv4_to_str(0) == ""
|
|
|
|
|
|
class TestShouldInclude:
|
|
"""
|
|
Tests for event filtering logic
|
|
"""
|
|
|
|
def test_passes_all_defaults(self, make_event):
|
|
"""
|
|
Event passes with default filters
|
|
"""
|
|
event = make_event()
|
|
assert should_include(event, "LOW", None, None, "all", False)
|
|
|
|
def test_severity_filter(self, make_event):
|
|
"""
|
|
Filters events below minimum severity
|
|
"""
|
|
event = make_event(severity="LOW")
|
|
assert not should_include(event, "MEDIUM", None, None, "all",
|
|
False)
|
|
|
|
def test_severity_passes(self, make_event):
|
|
"""
|
|
Passes events at or above minimum severity
|
|
"""
|
|
event = make_event(severity="HIGH")
|
|
assert should_include(event, "MEDIUM", None, None, "all", False)
|
|
|
|
def test_pid_filter_match(self, make_event):
|
|
"""
|
|
Passes when PID matches filter
|
|
"""
|
|
event = make_event(pid=1234)
|
|
assert should_include(event, "LOW", 1234, None, "all", False)
|
|
|
|
def test_pid_filter_mismatch(self, make_event):
|
|
"""
|
|
Filters when PID does not match
|
|
"""
|
|
event = make_event(pid=1234)
|
|
assert not should_include(event, "LOW", 5678, None, "all", False)
|
|
|
|
def test_comm_filter_match(self, make_event):
|
|
"""
|
|
Passes when comm matches filter
|
|
"""
|
|
event = make_event(comm="bash")
|
|
assert should_include(event, "LOW", None, "bash", "all", False)
|
|
|
|
def test_comm_filter_mismatch(self, make_event):
|
|
"""
|
|
Filters when comm does not match
|
|
"""
|
|
event = make_event(comm="bash")
|
|
assert not should_include(event, "LOW", None, "python", "all",
|
|
False)
|
|
|
|
def test_type_filter(self, make_event):
|
|
"""
|
|
Filters events outside requested category
|
|
"""
|
|
event = make_event(category="process")
|
|
assert not should_include(event, "LOW", None, None, "network",
|
|
False)
|
|
|
|
def test_detections_only_with_detection(self, make_event):
|
|
"""
|
|
Passes events with detections in detections mode
|
|
"""
|
|
event = make_event()
|
|
event.detection = "Test Detection"
|
|
assert should_include(event, "LOW", None, None, "all", True)
|
|
|
|
def test_detections_only_without_detection(self, make_event):
|
|
"""
|
|
Filters events without detections in detections mode
|
|
"""
|
|
event = make_event()
|
|
assert not should_include(event, "LOW", None, None, "all", True)
|