gfwleak/stellar-stellar
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add socks_decoder, stratum_decoder and session_flags

Browse Source
This commit is contained in:
root
2024-09-03 07:01:58 +00:00
parent a8206cffc0
commit 6f1ac6b36b
160 changed files with 11861 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
test/CMakeLists.txt
View File

@@ -3,3 +3,6 @@ add_subdirectory(packet_tool)
add_subdirectory(debug_plugin)
add_subdirectory(lpi_plugin)
add_subdirectory(decoders/http)
add_subdirectory(decoders/socks)
add_subdirectory(decoders/stratum)
add_subdirectory(decoders/session_flags)

56
test/decoders/session_flags/CMakeLists.txt Normal file
View File

@@ -0,0 +1,56 @@
set(DECODER_NAME session_flags)
add_library(${DECODER_NAME}_test SHARED session_flags_test_plugin.cpp)
add_dependencies(${DECODER_NAME}_test ${DECODER_NAME})
set_target_properties(${DECODER_NAME}_test PROPERTIES PREFIX "")
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/testing)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/src)
include_directories(${CMAKE_BINARY_DIR}/vendors/cjson/src/cjson/include)
include_directories(${PROJECT_SOURCE_DIR}/decoders/session_flags)
include_directories(${PROJECT_SOURCE_DIR}/include/stellar)
add_executable(gtest_session_flags_pcap session_flags_pcap_test.cpp
dummy.c
${PROJECT_SOURCE_DIR}/decoders/session_flags/fet.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/onlinemean.c
${PROJECT_SOURCE_DIR}/decoders/session_flags/session_flags_plugin.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/session_flags.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/tunneling.cpp)
target_link_libraries(gtest_session_flags_pcap gtest pcap hyperscan_static hyperscan_runtime_static logger cjson-static libmesa_sts)
add_executable(gtest_session_flags_static session_flags_static_test.cpp
dummy.c
${PROJECT_SOURCE_DIR}/decoders/session_flags/fet.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/onlinemean.c
${PROJECT_SOURCE_DIR}/decoders/session_flags/session_flags_plugin.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/session_flags.cpp
${PROJECT_SOURCE_DIR}/decoders/session_flags/tunneling.cpp)
target_link_libraries(gtest_session_flags_static gtest pcap hyperscan_static hyperscan_runtime_static logger cjson-static libmesa_sts)
add_executable(session_flags_test_main plugin_test_main.cpp)
set_target_properties(session_flags_test_main
PROPERTIES
LINK_OPTIONS
"-rdynamic"
)
set_target_properties(session_flags_test_main
PROPERTIES
LINK_FLAGS
"-rdynamic"
)
set(LINK_FLAGS "-rdynamic")
target_link_libraries(session_flags_test_main PUBLIC gtest cjson-static stellar_lib -Wl,--whole-archive packet_parser -Wl,--no-whole-archive)
add_subdirectory(test_based_on_stellar)
#copy pcap file folder to build directory
file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/pcap DESTINATION ${CMAKE_BINARY_DIR}/test/decoders/session_flags)
file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/test_based_on_stellar/env/session_flags.toml DESTINATION ${CMAKE_BINARY_DIR}/test/decoders/session_flags/etc/session_flags/)
include(GoogleTest)
gtest_discover_tests(gtest_session_flags_pcap)
gtest_discover_tests(gtest_session_flags_static)

167
test/decoders/session_flags/dummy.c Normal file
View File

@@ -0,0 +1,167 @@
#include <stdlib.h>
#include <string.h>
#include "dummy.h"
#define UNUSED(x) (void)(x)
struct session g_sess;
void session_set_current_payload(struct session *sess, char *payload, int payload_len)
{
UNUSED(sess);
g_sess.payload_len = payload_len;
g_sess.payload = payload;
}
int session_exdata_set(struct session *sess, int idx, void *ex_ptr)
{
UNUSED(sess);
UNUSED(idx);
UNUSED(ex_ptr);
return 0;
}
struct logger *stellar_get_logger(struct stellar *st)
{
UNUSED(st);
return (struct logger *)1;
}
void *session_exdata_get(struct session *sess, int idx)
{
UNUSED(sess);
UNUSED(idx);
return NULL;
}
const struct packet *session_get0_current_packet(const struct session *sess)
{
UNUSED(sess);
return NULL;
}
uint16_t packet_get_payload_len(const struct packet *pkt)
{
UNUSED(pkt);
return g_sess.payload_len;
}
const char *packet_get_payload(const struct packet *pkt)
{
UNUSED(pkt);
return g_sess.payload;
}
enum session_direction session_get_direction(const struct session *sess)
{
UNUSED(sess);
return SESSION_DIRECTION_OUTBOUND;
}
enum flow_type session_get_flow_type(const struct session *sess)
{
UNUSED(sess);
return FLOW_TYPE_C2S;
}
const char *session_get0_readable_addr(const struct session *sess)
{
UNUSED(sess);
return NULL;
}
uint16_t packet_get_raw_len(const struct packet *pkt)
{
UNUSED(pkt);
return 0;
}
const struct timeval *packet_get_timeval(const struct packet *pkt)
{
UNUSED(pkt);
return NULL;
}
void stellar_session_plugin_dettach_current_session(struct session *sess)
{
UNUSED(sess);
}
int session_mq_publish_message(struct session *sess, int topic_id, void *msg)
{
UNUSED(sess);
UNUSED(topic_id);
UNUSED(msg);
return 0;
}
int stellar_exdata_new_index(struct stellar *st, const char *name, stellar_exdata_free *free_func,void *arg)
{
UNUSED(st);
UNUSED(name);
UNUSED(free_func);
UNUSED(arg);
return 0;
}
int stellar_mq_create_topic(struct stellar *st, const char *topic_name, stellar_msg_free_cb_func *msg_free_cb, void *msg_free_arg)
{
UNUSED(st);
UNUSED(topic_name);
UNUSED(msg_free_cb);
UNUSED(msg_free_arg);
return 0;
}
int stellar_mq_get_topic_id(struct stellar *st, const char *topic_name)
{
UNUSED(st);
if (strcmp(topic_name, TOPIC_TCP_INPUT) == 0)
{
return DUMMY_TCP_TOPIC_ID;
}
else if (strcmp(topic_name, TOPIC_UDP_INPUT) == 0)
{
return DUMMY_UDP_TOPIC_ID;
}
else
{
return -1;
}
}
int stellar_session_mq_subscribe(struct stellar *st, int topic_id, on_session_msg_cb_func *plugin_on_msg_cb, int plugin_id)
{
UNUSED(st);
UNUSED(topic_id);
UNUSED(plugin_on_msg_cb);
UNUSED(plugin_id);
return 0;
}
int stellar_session_plugin_register(struct stellar *st, session_ctx_new_func session_ctx_new, session_ctx_free_func session_ctx_free, void *plugin_env)
{
UNUSED(st);
UNUSED(session_ctx_new);
UNUSED(session_ctx_free);
UNUSED(plugin_env);
return 0;
}

18
test/decoders/session_flags/dummy.h Normal file
View File

@@ -0,0 +1,18 @@
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
#define DUMMY_TCP_TOPIC_ID 1
#define DUMMY_UDP_TOPIC_ID 2
struct session //stub just for test
{
int payload_len;
char *payload;
};
void session_set_current_payload(struct session *sess, char *payload, int payload_len);
void *session_flags_plugin_init(struct stellar *st);
void session_flags_plugin_exit(void *arg);

BIN
test/decoders/session_flags/pcap/1-dtls.192.168.44.32.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/192.168.56.19.56554.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4}",
"common_flags_2": 2123980808,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"common_flags_3": 2123980936,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":21,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"common_flags_4": 2123981960,
"common_flags_str_4": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":4,\"frequency\":6,\"runs\":6,\"longest_run\":6,\"overlapping_template_matching\":6,\"random_excursions\":6,\"random_excursions_variant\":6,\"poker_detect\":6,\"runs_distribution\":6,\"self_correlation\":6,\"binary_derivative\":6}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.56.19.56555-47.93.59.84.443_869284834001082715.pcapng Normal file
View File

Binary file not shown.

17
test/decoders/session_flags/pcap/192.168.56.31.58530.json Normal file
View File

@@ -0,0 +1,17 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 1185898504,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"common_flags_3": 1185898632,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":34,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.56.31.58530.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/192.168.64.61.62275.asymmetric.pcapng Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/192.168.64.61.62275.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1453269000,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"block_frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"runs_distribution\":3,\"binary_derivative\":3}",
"common_flags_2": 1453269001,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":10,\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"block_frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"runs_distribution\":3,\"binary_derivative\":3}",
"name": "base_0"
}
]

14
test/decoders/session_flags/pcap/192.168.64.67.53813.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126340104,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340232,
"common_flags_str_2": "[Client is Local,Inbound]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":18,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/192.168.64.67.53813.pcapng Normal file
View File

Binary file not shown.

11
test/decoders/session_flags/pcap/1_result.json Normal file
View File

@@ -0,0 +1,11 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local,C2S]",
"common_flags_identify_info_0": "1,1,",
"common_flags_1": 24592,
"common_flags_str_1": "[Server is Local,C2S,S2C]",
"common_flags_identify_info_1": "1,1,2,",
"name": "session_flags_test"
}
]

BIN
test/decoders/session_flags/pcap/bilibili-dtls.pcap Normal file
View File

Binary file not shown.

23
test/decoders/session_flags/pcap/bilibili.json Normal file
View File

@@ -0,0 +1,23 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1}",
"common_flags_2": 1585602568,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_3": 1585602696,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":25,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_4": 1585603720,
"common_flags_str_4": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Inbound\":25,\"Streaming\":186,\"C2S\":2,\"S2C\":1,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"common_flags_5": 1585636488,
"common_flags_str_5": "[Client is Local,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_5": "{\"Client is Local\":1,\"Inbound\":25,\"Streaming\":186,\"C2S\":2,\"S2C\":1,\"Bidirectional\":8551,\"block_frequency\":5,\"overlapping_template_matching\":5,\"random_excursions\":5,\"random_excursions_variant\":5,\"poker_detect\":5,\"runs_distribution\":5,\"binary_derivative\":5}",
"name": "base_0"
}
]

14
test/decoders/session_flags/pcap/dns_asymmetric.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 8209,
"common_flags_str_1": "[Asymmetric,Server is Local]",
"common_flags_identify_info_1": "{\"Asymmetric\":10,\"Server is Local\":1,\"C2S\":1}",
"common_flags_2": 24593,
"common_flags_str_2": "[Asymmetric,Server is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":10,\"Server is Local\":1,\"C2S\":1,\"S2C\":12}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/dns_asymmetric.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/douyin.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 2124242952,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_3": 2124244104,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":6036,\"Streaming\":6036,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_4": 2124244650,
"common_flags_str_4": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":6042,\"Client is Local\":1,\"Download\":6042,\"Inbound\":6036,\"Pseudo Unidirectional\":6042,\"Streaming\":6036,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/douyin.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/ftp-data.pcap Normal file
View File

Binary file not shown.

26
test/decoders/session_flags/pcap/https_download.json Normal file
View File

@@ -0,0 +1,26 @@
[{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local,C2S]",
"common_flags_identify_info_0": "1,1,",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local,C2S,S2C]",
"common_flags_identify_info_1": "1,1,2,",
"common_flags_2": 28680,
"common_flags_str_2": "[Client is Local,Random Looking,C2S,S2C]",
"common_flags_identify_info_2": "1,4,1,2,",
"common_flags_3": 28808,
"common_flags_str_3": "[Client is Local,Inbound,Random Looking,C2S,S2C]",
"common_flags_identify_info_3": "1,1188,4,1,2,",
"common_flags_4": 29832,
"common_flags_str_4": "[Client is Local,Inbound,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_4": "1,1188,1662,4,1,2,",
"common_flags_5": 30344,
"common_flags_str_5": "[Client is Local,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_5": "1,1188,3546,1662,4,1,2,",
"common_flags_6": 30346,
"common_flags_str_6": "[Bulky,Client is Local,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_6": "4095,1,1188,3546,1662,4,1,2,",
"common_flags_7": 30378,
"common_flags_str_7": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming,Random Looking,C2S,S2C]",
"common_flags_identify_info_7": "4095,1,4201,1188,3546,1662,4,1,2,"
}]

BIN
test/decoders/session_flags/pcap/https_download.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/mix-quic-ssl-quic-mail.pcap Normal file
View File

Binary file not shown.

65
test/decoders/session_flags/pcap/mix.json Normal file
View File

@@ -0,0 +1,65 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 109076488,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4}",
"common_flags_3": 109078186,
"common_flags_str_3": "[Bulky,Client is Local,Download,Inbound,Pseudo Unidirectional,Streaming]",
"common_flags_identify_info_3": "{\"Bulky\":2250,\"Client is Local\":1,\"Download\":2250,\"Inbound\":2250,\"Pseudo Unidirectional\":2250,\"Streaming\":2250,\"C2S\":1,\"S2C\":2,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4}",
"name": "base_0"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1451237384,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"overlapping_template_matching\":10,\"random_excursions\":10,\"random_excursions_variant\":10,\"runs_distribution\":10,\"binary_derivative\":10}",
"common_flags_2": 1451237385,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":4168,\"Client is Local\":1,\"C2S\":1,\"overlapping_template_matching\":10,\"random_excursions\":10,\"random_excursions_variant\":10,\"runs_distribution\":10,\"binary_derivative\":10}",
"name": "base_1"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126323720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340104,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":6,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126340232,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":29,\"C2S\":1,\"S2C\":6,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_2"
},
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1186291720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_2": 1186291848,
"common_flags_str_2": "[Client is Local,Inbound]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":21,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_3": 1186292872,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_4": 1186292874,
"common_flags_str_4": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":430,\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"common_flags_5": 1186292878,
"common_flags_str_5": "[Bulky,CBR Streaming,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_5": "{\"Bulky\":430,\"CBR Streaming\":6984,\"Client is Local\":1,\"Inbound\":21,\"Streaming\":100,\"C2S\":1,\"S2C\":2,\"frequency\":2,\"cumulative_sums\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"binary_derivative\":2}",
"name": "base_3"
}
]

17
test/decoders/session_flags/pcap/quic_asymmetric.json Normal file
View File

@@ -0,0 +1,17 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2126323720,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126340104,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":14,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126340232,
"common_flags_str_3": "[Client is Local,Inbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":84,\"C2S\":1,\"S2C\":14,\"frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_asymmetric.pcapng Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/quic_asymmetric_1.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 1452294152,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"S2C\":1,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"binary_derivative\":2}",
"common_flags_2": 1452294153,
"common_flags_str_2": "[Asymmetric,Client is Local]",
"common_flags_identify_info_2": "{\"Asymmetric\":37,\"Client is Local\":1,\"S2C\":1,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_asymmetric_1.pcap Normal file
View File

Binary file not shown.

26
test/decoders/session_flags/pcap/quic_online_streaming.json Normal file
View File

@@ -0,0 +1,26 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 2124226568,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_2": 2124242952,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_3": 2124244104,
"common_flags_str_3": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_4": 2124244106,
"common_flags_str_4": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":630,\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_5": 2124276874,
"common_flags_str_5": "[Bulky,Client is Local,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_5": "{\"Bulky\":630,\"Client is Local\":1,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"Bidirectional\":7315,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"common_flags_6": 2124276938,
"common_flags_str_6": "[Bulky,Client is Local,Interactive,Inbound,Streaming,Bidirectional]",
"common_flags_identify_info_6": "{\"Bulky\":630,\"Client is Local\":1,\"Interactive\":25786,\"Inbound\":291,\"Streaming\":291,\"C2S\":1,\"S2C\":4,\"Bidirectional\":7315,\"frequency\":3,\"cumulative_sums\":3,\"runs\":3,\"longest_run\":3,\"overlapping_template_matching\":3,\"random_excursions\":3,\"random_excursions_variant\":3,\"poker_detect\":3,\"runs_distribution\":3,\"self_correlation\":3,\"binary_derivative\":3}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/quic_online_streaming.pcap Normal file
View File

Binary file not shown.

29
test/decoders/session_flags/pcap/ssh-interactive.json Normal file
View File

@@ -0,0 +1,29 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 24592,
"common_flags_str_1": "[Server is Local]",
"common_flags_identify_info_1": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 111173648,
"common_flags_str_2": "[Server is Local]",
"common_flags_identify_info_2": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"common_flags_3": 111173904,
"common_flags_str_3": "[Server is Local,Outbound]",
"common_flags_identify_info_3": "{\"Server is Local\":1,\"Outbound\":40,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"common_flags_4": 111173968,
"common_flags_str_4": "[Server is Local,Interactive,Outbound]",
"common_flags_identify_info_4": "{\"Server is Local\":1,\"Interactive\":52,\"Outbound\":40,\"C2S\":1,\"S2C\":2,\"rank\":7,\"overlapping_template_matching\":7,\"random_excursions\":7,\"random_excursions_variant\":7}",
"name": "base_0"
},
{
"common_flags_0": 16400,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"S2C\":1}",
"common_flags_1": 16401,
"common_flags_str_1": "[Asymmetric,Server is Local]",
"common_flags_identify_info_1": "{\"Asymmetric\":2,\"Server is Local\":1,\"S2C\":1}",
"name": "base_1"
}
]

BIN
test/decoders/session_flags/pcap/ssh-interactive.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/telegram_mtproto_ipv4_key_1.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/telegram_mtproto_ipv6_key_1.pcap Normal file
View File

Binary file not shown.

23
test/decoders/session_flags/pcap/tencent_meeting_video.json Normal file
View File

@@ -0,0 +1,23 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 2126462984,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2126471176,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":5,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2126471432,
"common_flags_str_3": "[Client is Local,Outbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 2126504200,
"common_flags_str_4": "[Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"Bidirectional\":2448,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_5": 2126504204,
"common_flags_str_5": "[CBR Streaming,Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_5": "{\"CBR Streaming\":4095,\"Client is Local\":1,\"Outbound\":414,\"C2S\":5,\"S2C\":1,\"Bidirectional\":2448,\"frequency\":2,\"block_frequency\":2,\"cumulative_sums\":2,\"runs\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/tencent_meeting_video.pcapng Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/tencent_meeting_voice.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 16392,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"S2C\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1}",
"common_flags_2": 2123980808,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":2,\"S2C\":1,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_3": 2123981064,
"common_flags_str_3": "[Client is Local,Outbound]",
"common_flags_identify_info_3": "{\"Client is Local\":1,\"Outbound\":21,\"C2S\":2,\"S2C\":1,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"common_flags_4": 2124013832,
"common_flags_str_4": "[Client is Local,Outbound,Bidirectional]",
"common_flags_identify_info_4": "{\"Client is Local\":1,\"Outbound\":21,\"C2S\":2,\"S2C\":1,\"Bidirectional\":606,\"frequency\":4,\"runs\":4,\"longest_run\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"poker_detect\":4,\"runs_distribution\":4,\"self_correlation\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/tencent_meeting_voice.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls1.2.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls1.2_no_reuse.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/tls_over_tls_1.2_no_reuse.pcap Normal file
View File

Binary file not shown.

14
test/decoders/session_flags/pcap/unidirectional.json Normal file
View File

@@ -0,0 +1,14 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 24584,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2}",
"common_flags_2": 1185898504,
"common_flags_str_2": "[Client is Local]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"frequency\":4,\"block_frequency\":4,\"cumulative_sums\":4,\"runs\":4,\"rank\":4,\"overlapping_template_matching\":4,\"random_excursions\":4,\"random_excursions_variant\":4,\"binary_derivative\":4}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/unidirectional.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/wechat_voice_call.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8208,
"common_flags_str_0": "[Server is Local]",
"common_flags_identify_info_0": "{\"Server is Local\":1,\"C2S\":1}",
"common_flags_1": 2123390992,
"common_flags_str_1": "[Server is Local]",
"common_flags_identify_info_1": "{\"Server is Local\":1,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 2123391120,
"common_flags_str_2": "[Server is Local,Inbound]",
"common_flags_identify_info_2": "{\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 2123391124,
"common_flags_str_3": "[CBR Streaming,Server is Local,Inbound]",
"common_flags_identify_info_3": "{\"CBR Streaming\":3634,\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 2123423892,
"common_flags_str_4": "[CBR Streaming,Server is Local,Inbound,Bidirectional]",
"common_flags_identify_info_4": "{\"CBR Streaming\":3634,\"Server is Local\":1,\"Inbound\":83,\"C2S\":1,\"S2C\":2,\"Bidirectional\":3808,\"longest_run\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"poker_detect\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

BIN
test/decoders/session_flags/pcap/wechat_voice_call.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/session_flags/pcap/youtube-quic.pcap Normal file
View File

Binary file not shown.

20
test/decoders/session_flags/pcap/youtube.json Normal file
View File

@@ -0,0 +1,20 @@
[
{
"common_flags_0": 8200,
"common_flags_str_0": "[Client is Local]",
"common_flags_identify_info_0": "{\"Client is Local\":1,\"C2S\":1}",
"common_flags_1": 1991270408,
"common_flags_str_1": "[Client is Local]",
"common_flags_identify_info_1": "{\"Client is Local\":1,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_2": 1991271560,
"common_flags_str_2": "[Client is Local,Inbound,Streaming]",
"common_flags_identify_info_2": "{\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_3": 1991271562,
"common_flags_str_3": "[Bulky,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_3": "{\"Bulky\":635,\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"common_flags_4": 1991271566,
"common_flags_str_4": "[Bulky,CBR Streaming,Client is Local,Inbound,Streaming]",
"common_flags_identify_info_4": "{\"Bulky\":635,\"CBR Streaming\":7070,\"Client is Local\":1,\"Inbound\":633,\"Streaming\":633,\"C2S\":1,\"S2C\":2,\"longest_run\":2,\"rank\":2,\"overlapping_template_matching\":2,\"random_excursions\":2,\"random_excursions_variant\":2,\"runs_distribution\":2,\"self_correlation\":2,\"binary_derivative\":2}",
"name": "base_0"
}
]

135
test/decoders/session_flags/plugin_test_main.cpp Normal file
View File

@@ -0,0 +1,135 @@
#include "cJSON.h"
#include <gtest/gtest.h>
#include <unistd.h>
#include <stdio.h>
#include <assert.h>
#ifdef __cplusplus
extern "C"
{
#endif
#include "stellar/stellar.h"
#ifdef __cplusplus
}
#endif
// #define IGNORE_PRINTF
#ifdef IGNORE_PRINTF
#define printf(fmt, ...) (0)
#endif
static cJSON *g_test_result_root = NULL;
static cJSON *g_load_result_root = NULL;
static const char *result_json_path = NULL;
extern "C" int commit_test_result_json(cJSON *node, const char *name)
{
(void)name;
if (g_test_result_root)
{
// cJSON_AddItemToObject(g_test_result_root, name, node);
// cJSON_AddStringToObject(node, "name", name);
cJSON_AddItemToArray(g_test_result_root, node);
return 0;
}
return -1;
}
static cJSON *load_result_from_jsonfile(const char *json_path)
{
if (json_path == NULL)
return NULL;
long file_len = 0;
char *file_content = NULL;
FILE *fp = NULL;
fp = fopen(json_path, "r+");
if (NULL == fp)
{
return NULL;
}
fseek(fp, 0, SEEK_END);
file_len = ftell(fp);
fseek(fp, 0, SEEK_SET);
if (file_len == 0)
{
fclose(fp);
return NULL;
}
file_content = (char *)malloc(file_len + 1);
fread(file_content, file_len, 1, fp);
file_content[file_len] = '\0';
cJSON *load = cJSON_Parse(file_content);
free(file_content);
fclose(fp);
return load;
}
TEST(PROTOCOL, compare_result_json)
{
EXPECT_EQ(cJSON_GetArraySize(g_test_result_root), cJSON_GetArraySize(g_load_result_root));
int ret = cJSON_Compare(g_test_result_root, g_load_result_root, 0);
EXPECT_EQ(1, ret);
if (ret != 1)
{
char *load_json_str = cJSON_Print(g_load_result_root);
printf("LOAD Raw:\n%s\n", load_json_str);
free(load_json_str);
char *result_json_str = cJSON_Print(g_test_result_root);
printf("TEST Raw:\n%s\n", result_json_str);
free(result_json_str);
cJSON *t_load = g_load_result_root->child, *t_test = g_test_result_root->child;
while (t_load != NULL)
{
ret = cJSON_Compare(t_load, t_test, 0);
if (ret != 1)
{
load_json_str = cJSON_Print(t_load);
printf("LOAD Diff:\n%s\n", load_json_str);
free(load_json_str);
result_json_str = cJSON_Print(t_test);
printf("TEST Diff:\n%s\n", result_json_str);
free(result_json_str);
goto fail;
}
t_load = t_load->next;
t_test = t_test->next;
}
}
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
fail:
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
}
int main(int argc, char *argv[])
{
int ret = 0;
if (argc < 2)
{
printf("Usage: %s <result_json_path>\n", argv[0]);
result_json_path = NULL;
}
else
{
result_json_path = argv[1];
g_test_result_root = cJSON_CreateArray();
g_load_result_root = load_result_from_jsonfile(result_json_path);
assert(g_load_result_root != NULL && g_test_result_root != NULL);
}
::testing::InitGoogleTest(&argc, argv);
struct stellar *st = stellar_new("./conf/stellar.toml", "./plugin/spec.toml", "./conf/log.toml");
stellar_run(st);
if (result_json_path != NULL)
{
ret = RUN_ALL_TESTS();
}
stellar_free(st);
return ret;
}

630
test/decoders/session_flags/session_flags_pcap_test.cpp Normal file
View File

@@ -0,0 +1,630 @@
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <stdio.h>
#include <stdlib.h>
#include <stellar/session.h>
#include <time.h>
#include <pcap/pcap.h>
#include <pcap/sll.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include "session_flags_internal.h"
#include "gtest/gtest.h"
extern "C" {
#include "dummy.h"
}
#define MAC_FRAME_HEADER_LEN 14
#define IP_HEADER_LEN 20
#define TCP_HEADER_LEN 20
#define UDP_HEADER_LEN 8
#define LINUX_COOKED_CAPTURE 20
struct pcap_loop_arg
{
pcap_t *pcap_handle;
struct session_flags_ctx *ctx;
};
struct session_flags_plugin_info *sf_plugin_info = NULL;
extern int MESA_dir_link_to_human(int link_route_dir);
extern char *session_flags_generate_firewall_message(uint64_t flags, uint32_t identify[session_flags_all_mask]);
static inline size_t ts2ms(const timeval *ts)
{
return ts->tv_sec * 1000 + ts->tv_usec / 1000;
}
static void pcap_handle_cb(pcap_loop_arg *userarg, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
struct pcap_loop_arg *arg = (struct pcap_loop_arg *)userarg;
struct session sess;
int payload_len = 0;
char *payload = NULL;
unsigned short sport, dport;
unsigned short eth_proto_type;
unsigned char *ip_header;
int topic_id = 0;
memset(&sess, 0, sizeof(sess));
int data_link_type = pcap_datalink(arg->pcap_handle);
switch (data_link_type) {
case DLT_EN10MB:
eth_proto_type = ntohs(*(unsigned short *)(packet + 12));
ip_header = (unsigned char *)(packet + sizeof(struct ethhdr));
break;
case 276://DLT_LINUX_SLL2
eth_proto_type = ntohs(*(unsigned short *)packet);
ip_header = (unsigned char *)(packet + LINUX_COOKED_CAPTURE);
break;
default:
return;
}
if (eth_proto_type == ETH_P_IP) {
int l4_proto = *(unsigned char *)(ip_header + 9);
if (l4_proto == IPPROTO_TCP) {
topic_id = DUMMY_TCP_TOPIC_ID;
int ip_total_len = ntohs(*(unsigned short *)(ip_header + 2));
int ip_header_len = (*(unsigned char *)ip_header & 0x0f) * 4;
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(iphdr) + 12) & 0xf0) >> 4);
payload_len = ip_total_len - ip_header_len - tcp_header_len;
payload = (char *)ip_header + ip_header_len + tcp_header_len;
} else if (l4_proto == IPPROTO_UDP) {
topic_id = DUMMY_UDP_TOPIC_ID;
payload_len = pkthdr->caplen - (ip_header - packet) - sizeof(iphdr) - sizeof(struct udphdr);
payload = (char *)ip_header + sizeof(iphdr) + sizeof(struct udphdr);
} else {
return;
}
sport = ntohs(*(unsigned short *)(ip_header + sizeof(iphdr) + 0));
dport = ntohs(*(unsigned short *)(ip_header + sizeof(iphdr) + 2));
} else if (eth_proto_type == ETH_P_IPV6) {
int l4_proto = *(unsigned char *)(ip_header + 6);
if (l4_proto == IPPROTO_TCP) {
topic_id = DUMMY_TCP_TOPIC_ID;
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(struct ip6_hdr) + 12) & 0xf0) >> 4);
payload_len = pkthdr->caplen - (ip_header - packet) - sizeof(struct ip6_hdr) - tcp_header_len;
payload = (char *)ip_header + sizeof(struct ip6_hdr) + tcp_header_len;
} else if (l4_proto == IPPROTO_UDP) {
topic_id = DUMMY_UDP_TOPIC_ID;
payload_len = pkthdr->caplen - (ip_header - packet) - sizeof(struct ip6_hdr) - sizeof(struct udphdr);
payload = (char *)ip_header + sizeof(struct ip6_hdr) + sizeof(struct udphdr);
} else {
return;
}
sport = ntohs(*(unsigned short *)(ip_header + sizeof(struct ip6_hdr) + 0));
dport = ntohs(*(unsigned short *)(ip_header + sizeof(struct ip6_hdr) + 2));
} else {
return;
}
session_set_current_payload(&sess, payload, payload_len);
if (sport > dport)
{
session_flags(sf_plugin_info, arg->ctx, &sess, topic_id, pkthdr->caplen, FLOW_TYPE_C2S, ts2ms(&pkthdr->ts));
}
else
{
session_flags(sf_plugin_info, arg->ctx, &sess, topic_id, pkthdr->caplen, FLOW_TYPE_S2C, ts2ms(&pkthdr->ts));
}
}
TEST(session_flags, bulky_and_download)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_BULKY, SESSION_FLAGS_BULKY);
EXPECT_EQ(flags_info->identify[session_flags_bulky_mask], 2333);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_DOWNLOAD, SESSION_FLAGS_DOWNLOAD);
EXPECT_EQ(flags_info->identify[session_flags_download_mask], 2333);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, CBR)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/youtube-quic.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
EXPECT_EQ(flags_info->identify[session_flags_cbr_mask], 3351);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, not_CBR_ftp)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, not_CBR_dtls)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/bilibili-dtls.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, server_is_local)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
// session_flags_ip(sf, inet_addr("192.168.1.1"), inet_addr("127.0.0.1"), inet_addr("192.168.1.1"));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_INBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_LOCAL_SERVER, SESSION_FLAGS_LOCAL_SERVER);
EXPECT_EQ(flags_info->identify[session_flags_local_server_mask], 1);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_LOCAL_CLIENT, SESSION_FLAGS_LOCAL_CLIENT);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, client_is_local)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_LOCAL_SERVER, SESSION_FLAGS_LOCAL_SERVER);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_LOCAL_CLIENT, SESSION_FLAGS_LOCAL_CLIENT);
EXPECT_EQ(flags_info->identify[session_flags_local_client_mask], 1);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, inbound)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_LOCAL_CLIENT, SESSION_FLAGS_LOCAL_CLIENT);
EXPECT_EQ(flags_info->identify[session_flags_local_client_mask], 1);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_INBOUND, SESSION_FLAGS_INBOUND);
EXPECT_EQ(flags_info->identify[session_flags_inbound_mask], 1834);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_OUTBOUND, SESSION_FLAGS_OUTBOUND);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_LOCAL_SERVER, SESSION_FLAGS_LOCAL_SERVER);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, outbound)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_INBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_LOCAL_SERVER, SESSION_FLAGS_LOCAL_SERVER);
EXPECT_EQ(flags_info->identify[session_flags_local_server_mask], 1);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_OUTBOUND, SESSION_FLAGS_OUTBOUND);
EXPECT_EQ(flags_info->identify[session_flags_outbound_mask], 1834);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_LOCAL_CLIENT, SESSION_FLAGS_LOCAL_CLIENT);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_INBOUND, SESSION_FLAGS_INBOUND);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, not_streaming)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/1-dtls.192.168.44.32.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_STREAMING, SESSION_FLAGS_STREAMING);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL, SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_UNIDIRECTIONAL, SESSION_FLAGS_UNIDIRECTIONAL);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, streaming_pseudo_unidirectional_unidirectional)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ftp-data.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_STREAMING, SESSION_FLAGS_STREAMING);
EXPECT_EQ(flags_info->identify[session_flags_streaming_mask], 2333);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL, SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_pseudo_unidirectional_mask], 2333);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_UNIDIRECTIONAL, SESSION_FLAGS_UNIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_unidirectional_mask], 1834);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, interactive)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/ssh-interactive.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_INTERACTIVE, SESSION_FLAGS_INTERACTIVE);
EXPECT_EQ(flags_info->identify[session_flags_interactive_mask], 52);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, not_interactive)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/youtube-quic.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_INTERACTIVE, SESSION_FLAGS_INTERACTIVE);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, random_looking_flags_telegram_mtproto_ipv4_key_1)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/telegram_mtproto_ipv4_key_1.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_RANDOM_LOOKING, SESSION_FLAGS_RANDOM_LOOKING);
#if 0
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_FREQUENCY, SESSION_FLAGS_FREQUENCY);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_BLOCK_FREQUENCY, SESSION_FLAGS_BLOCK_FREQUENCY);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_CUMULATIVE_SUMS, SESSION_FLAGS_CUMULATIVE_SUMS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RUNS, SESSION_FLAGS_RUNS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_LONGEST_RUN, SESSION_FLAGS_LONGEST_RUN);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANK, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_NON_OVERLAPPING_TEMPLATE_MATCHING, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_OVERLAPPING_TEMPLATE_MATCHING, SESSION_FLAGS_OVERLAPPING_TEMPLATE_MATCHING);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_UNIVERSAL, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANDOM_EXCURSIONS, SESSION_FLAGS_RANDOM_EXCURSIONS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANDOM_EXCURSIONS_VARIANT, SESSION_FLAGS_RANDOM_EXCURSIONS_VARIANT);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_POKER_DETECT, SESSION_FLAGS_POKER_DETECT);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RUNS_DISTRIBUTION, SESSION_FLAGS_RUNS_DISTRIBUTION);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_SELF_CORRELATION, SESSION_FLAGS_SELF_CORRELATION);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_BINARY_DERIVATIVE, SESSION_FLAGS_BINARY_DERIVATIVE);
#endif
pcap_close(handle);
free(ctx);
}
TEST(session_flags, random_looking_flags_telegram_mtproto_ipv6_key_1)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t * handle = pcap_open_offline("pcap/telegram_mtproto_ipv6_key_1.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_RANDOM_LOOKING, SESSION_FLAGS_RANDOM_LOOKING);
#if 0
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_FREQUENCY, SESSION_FLAGS_FREQUENCY);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_BLOCK_FREQUENCY, SESSION_FLAGS_BLOCK_FREQUENCY);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_CUMULATIVE_SUMS, SESSION_FLAGS_CUMULATIVE_SUMS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RUNS, SESSION_FLAGS_RUNS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_LONGEST_RUN, SESSION_FLAGS_LONGEST_RUN);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANK, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_NON_OVERLAPPING_TEMPLATE_MATCHING, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_OVERLAPPING_TEMPLATE_MATCHING, SESSION_FLAGS_OVERLAPPING_TEMPLATE_MATCHING);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_UNIVERSAL, 0);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANDOM_EXCURSIONS, SESSION_FLAGS_RANDOM_EXCURSIONS);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RANDOM_EXCURSIONS_VARIANT, SESSION_FLAGS_RANDOM_EXCURSIONS_VARIANT);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_POKER_DETECT, SESSION_FLAGS_POKER_DETECT);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_RUNS_DISTRIBUTION, SESSION_FLAGS_RUNS_DISTRIBUTION);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_SELF_CORRELATION, SESSION_FLAGS_SELF_CORRELATION);
EXPECT_EQ(flags_info->random_looking_flags & SESSION_FLAGS_BINARY_DERIVATIVE, SESSION_FLAGS_BINARY_DERIVATIVE);
#endif
pcap_close(handle);
free(ctx);
}
TEST(session_flags, bidirectional)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t *handle = pcap_open_offline("pcap/wechat_voice_call.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_INBOUND);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_BIDIRECTIONAL, SESSION_FLAGS_BIDIRECTIONAL);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, tunneling_tls_fet)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t *handle = pcap_open_offline("pcap/tls1.2_no_reuse.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
tunneling_hs_stream_init(sf_plugin_info, ctx);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_TUNNELING, SESSION_FLAGS_TUNNELING);
tunneling_hs_stream_free(ctx);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, tunneling_tls_over_tls)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t *handle = pcap_open_offline("pcap/tls_over_tls_1.2_no_reuse.pcap", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
tunneling_hs_stream_init(sf_plugin_info, ctx);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_TUNNELING, SESSION_FLAGS_TUNNELING);
tunneling_hs_stream_free(ctx);
pcap_close(handle);
free(ctx);
}
TEST(session_flags, tunneling_tls)
{
char error[100];
struct pcap_loop_arg arg;
struct session_flags_ctx *ctx = (struct session_flags_ctx *)calloc(1, sizeof(struct session_flags_ctx));
pcap_t *handle = pcap_open_offline("pcap/tls1.2.pcapng", error);
ASSERT_NE(handle, nullptr);
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
tunneling_hs_stream_init(sf_plugin_info, ctx);
memset(&arg, 0, sizeof(arg));
arg.ctx = ctx;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_TUNNELING, SESSION_FLAGS_TUNNELING);
tunneling_hs_stream_free(ctx);
pcap_close(handle);
free(ctx);
}
int main(int argc, char **argv)
{
testing::InitGoogleTest(&argc, argv);
sf_plugin_info = (struct session_flags_plugin_info *)session_flags_plugin_init(NULL);
sf_plugin_info->log_handle = NULL;
int result = RUN_ALL_TESTS();
session_flags_plugin_exit(sf_plugin_info);
return result;
}

494
test/decoders/session_flags/session_flags_static_test.cpp Normal file
View File

@@ -0,0 +1,494 @@
#include <cstring>
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#include <stellar/session.h>
#include "session_flags_internal.h"
#include "gtest/gtest.h"
extern "C" {
#include "dummy.h"
}
struct session_flags_plugin_info *sf_plugin_info = NULL;
TEST(session_flags_static, bulky)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
int cur_time_ms = 1;
for (int i = 0; i < 100; i++)
{
for (int j = 0; j < 96; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 1001, FLOW_TYPE_C2S, cur_time_ms);
cur_time_ms++;
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
for (int j = 0; j < 4; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 100, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_BULKY, SESSION_FLAGS_BULKY);
EXPECT_EQ(flags_info->identify[session_flags_bulky_mask], 6001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Bulky\":196,\"Client is Local\":1,\"Outbound\":196,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, download_gt_95)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
int cur_time_ms = 1;
for (int i = 0; i < 100; i++)
{
for (int j = 0; j < 96; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 1001, FLOW_TYPE_C2S, cur_time_ms);
cur_time_ms++;
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
for (int j = 0; j < 4; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 100, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_DOWNLOAD, SESSION_FLAGS_DOWNLOAD);
EXPECT_EQ(flags_info->identify[session_flags_download_mask], 6001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Bulky\":195,\"Client is Local\":1,\"Outbound\":195,\"Streaming\":195,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, download_lt_95)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
int cur_time_ms = 1;
for (int i = 0; i < 100; i++)
{
for (int j = 0; j < 94; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 1001, FLOW_TYPE_C2S, cur_time_ms);
cur_time_ms++;
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
for (int j = 0; j < 6; j++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 100, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_DOWNLOAD, SESSION_FLAGS_DOWNLOAD);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Bulky\":195,\"Client is Local\":1,\"Outbound\":195,\"Streaming\":195,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, CBR_lt_1s)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
int std_bytes = 1000;
int cur_time_ms = 1;
for (int i = 0; i < 100; i++)
{
long delta = random() % 200;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, std_bytes + delta, FLOW_TYPE_C2S, cur_time_ms++);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms++);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Bulky\":200,\"Client is Local\":1,\"Download\":200,\"Outbound\":200,\"Pseudo Unidirectional\":200,\"Streaming\":200,\"Unidirectional\":200,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, CBR)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
for (uint64_t cur_time_ms = 1; cur_time_ms < 11000; cur_time_ms += 10)
{
long delta = random() % 200;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 1000 + delta, FLOW_TYPE_C2S, cur_time_ms);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
EXPECT_EQ(flags_info->identify[session_flags_cbr_mask], 1001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Bulky\":201,\"CBR Streaming\":2021,\"Client is Local\":1,\"Download\":201,\"Outbound\":201,\"Pseudo Unidirectional\":201,\"Streaming\":201,\"Unidirectional\":201,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, not_CBR)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
for (uint64_t cur_time_ms = 1, i = 0; cur_time_ms < 10000; cur_time_ms += 500)
{
int delta = (i++ % 10) * 100;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100 + delta, FLOW_TYPE_C2S, cur_time_ms);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Client is Local\":1,\"Outbound\":21,\"Pseudo Unidirectional\":21,\"Unidirectional\":21,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, interactive)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
uint64_t cur_time_ms = 1;
while(cur_time_ms < 60000)
{
long delta = random() % 100;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 1000 + delta, FLOW_TYPE_C2S, cur_time_ms++);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms++);
}
while(cur_time_ms < 200000)
{
cur_time_ms += 10000;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 80, FLOW_TYPE_C2S, cur_time_ms);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 66, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_INTERACTIVE, SESSION_FLAGS_INTERACTIVE);
EXPECT_EQ(flags_info->identify[session_flags_interactive_mask], 60009);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Bulky\":1001,\"CBR Streaming\":10021,\"Client is Local\":1,\"Download\":1001,\"Interactive\":60009,\"Outbound\":1001,\"Pseudo Unidirectional\":1001,\"Streaming\":1001,\"Unidirectional\":1001,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, streaming_gt_90)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
session_set_current_payload(&sess, NULL, 100);
for (uint64_t cur_time_ms = 1; cur_time_ms < 10000; cur_time_ms++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 861, FLOW_TYPE_C2S, cur_time_ms);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 139, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_STREAMING, SESSION_FLAGS_STREAMING);
EXPECT_EQ(flags_info->identify[session_flags_streaming_mask], 12001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Client is Local\":1,\"Outbound\":668,\"Streaming\":669,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, streaming_lt_90)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
session_set_current_payload(&sess, NULL, 100);
for (uint64_t cur_time_ms = 1; cur_time_ms < 10000; cur_time_ms++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 859, FLOW_TYPE_C2S, cur_time_ms);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 141, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_STREAMING, 0);
EXPECT_EQ(flags_info->identify[session_flags_streaming_mask], 0);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Client is Local\":1,\"Outbound\":668,\"Streaming\":669,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, presu_unidirectional_gt_95)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
uint64_t cur_time_ms = 1;
session_set_current_payload(&sess, NULL, 100);
for (int i = 0; i < 100; i++)
{
for (int j = 0; j < 96; j++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_C2S, cur_time_ms);
cur_time_ms++;
}
for (int j = 0; j < 4; j++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL, SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_pseudo_unidirectional_mask], 6001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Client is Local\":1,\"Outbound\":1002,\"Pseudo Unidirectional\":1002,\"Streaming\":1002,\"C2S\":1,\"S2C\":99}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, presu_unidirectional_lt_95)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
uint64_t cur_time_ms = 1;
session_set_current_payload(&sess, NULL, 100);
for (int i = 0; i < 100; i++)
{
for (int j = 0; j < 94; j++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_C2S, cur_time_ms);
cur_time_ms++;
}
for (int j = 0; j < 6; j++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_S2C, cur_time_ms);
cur_time_ms++;
}
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL, 0);
EXPECT_EQ(flags_info->identify[session_flags_pseudo_unidirectional_mask], 0);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Client is Local\":1,\"Outbound\":1002,\"Pseudo Unidirectional\":1002,\"Streaming\":1002,\"C2S\":1,\"S2C\":99}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, Unidirectional)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
for (uint64_t cur_time_ms = 1; cur_time_ms < 10000; cur_time_ms++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_C2S, cur_time_ms);
session_set_current_payload(&sess, NULL, 0);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 80, FLOW_TYPE_S2C, cur_time_ms);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_UNIDIRECTIONAL, SESSION_FLAGS_UNIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_unidirectional_mask], 10001);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL, SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_pseudo_unidirectional_mask], 12001);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ("{\"Client is Local\":1,\"Outbound\":668,\"Pseudo Unidirectional\":669,\"Unidirectional\":669,\"C2S\":1,\"S2C\":2}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, not_unidirectional)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
srandom(time(NULL));
uint64_t cur_time_ms = 1;
session_set_current_payload(&sess, NULL, 100);
for (int i = 1; i < 10000; i++)
{
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100 + random() % 1000, FLOW_TYPE_C2S, cur_time_ms++);
}
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 80, FLOW_TYPE_S2C, cur_time_ms++);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_UNIDIRECTIONAL, SESSION_FLAGS_UNIDIRECTIONAL);
struct session_flags_message *msg = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Client is Local\":1, \"Outbound\":10000, \"C2S\":1,\"S2C\":10000}", identify_str);
EXPECT_EQ(msg->packet_sequence_array[0], 1);
EXPECT_EQ(msg->packet_sequence_array[1], 10000);
EXPECT_EQ(msg->packet_sequence_array[2], 1);
EXPECT_EQ(msg->packet_sequence_array[3], 10000);
free(msg->packet_sequence_array);
free(msg);
free(ctx);
}
TEST(session_flags_static, dns)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
uint64_t cur_time_ms = 1000;
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 72, FLOW_TYPE_C2S, cur_time_ms);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 72, FLOW_TYPE_C2S, cur_time_ms);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 72, FLOW_TYPE_C2S, cur_time_ms+10000);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 72, FLOW_TYPE_C2S, cur_time_ms+10000);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 146, FLOW_TYPE_S2C, cur_time_ms+15000);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_UDP_TOPIC_ID, 72, FLOW_TYPE_C2S, cur_time_ms+15000);
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_NE(flags_info->flags & SESSION_FLAGS_CBR, SESSION_FLAGS_CBR);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_LOCAL_CLIENT, SESSION_FLAGS_LOCAL_CLIENT);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_C2S, SESSION_FLAGS_C2S);
EXPECT_EQ(flags_info->identify[session_flags_c2s_mask], 1);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_S2C, SESSION_FLAGS_S2C);
EXPECT_EQ(flags_info->identify[session_flags_s2c_mask], 5);
//char *identify_str = session_flags_generate_firewall_message(flags_info->flags, flags_info->identify);
//EXPECT_STREQ( "{\"Client is Local\":1,\"Outbound\":6,\"C2S\":1,\"S2C\":5}", identify_str);
//free(identify_str);
free(ctx);
}
TEST(session_flags_static, bidirectional)
{
struct session_flags_ctx *ctx = (struct session_flags_ctx*)calloc(1, sizeof(struct session_flags_ctx));
struct session sess;
memset(&sess, 0, sizeof(sess));
session_flags_stat_init(&ctx->stat, SESSION_DIRECTION_OUTBOUND);
int cur_time_ms = 1;
session_set_current_payload(&sess, NULL, 100);
for (int i = 0; i < 5000; i++)
{
session_set_current_payload(&sess, NULL, 100);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 100, FLOW_TYPE_C2S, cur_time_ms++);
session_set_current_payload(&sess, NULL, 99);
session_flags(sf_plugin_info, ctx, &sess, DUMMY_TCP_TOPIC_ID, 99, FLOW_TYPE_S2C, cur_time_ms++);
}
struct session_flags_result *flags_info = session_flags_get_flags(&ctx->stat);
EXPECT_EQ(flags_info->flags & SESSION_FLAGS_BIDIRECTIONAL, SESSION_FLAGS_BIDIRECTIONAL);
EXPECT_EQ(flags_info->identify[session_flags_bidirectional_mask], 6001);
free(ctx);
}
int main(int argc, char **argv)
{
testing::InitGoogleTest(&argc, argv);
//testing::GTEST_FLAG(filter) = "";
sf_plugin_info = (struct session_flags_plugin_info *)session_flags_plugin_init(NULL);
sf_plugin_info->log_handle = NULL;
int result = RUN_ALL_TESTS();
session_flags_plugin_exit(sf_plugin_info);
return result;
}

210
test/decoders/session_flags/session_flags_test_plugin.cpp Normal file
View File

@@ -0,0 +1,210 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "cJSON.h"
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
#include "stellar/session_flags.h"
#ifdef __cplusplus
extern "C"
{
int commit_test_result_json(cJSON *node, const char *name);
}
#endif
#define unused(x) ((void)(x))
int g_test_session_flags_plugin_id;
int g_session_flags_topic_id;
int g_receive_msg_count = 0;
static void session_flags_2_str(uint64_t flags, char *str, int str_len)
{
if (str == NULL || str_len == 0)
return;
int offset = 0;
str[0] = '[';
offset += 1;
if (flags & SESSION_FLAGS_BULKY && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Bulky,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_CBR && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "CBR Streaming,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_LOCAL_CLIENT && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Client is Local,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_LOCAL_SERVER && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Server is Local,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_DOWNLOAD && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Download,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_INTERACTIVE && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Interactive,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_INBOUND && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Inbound,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_OUTBOUND && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Outbound,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_PSEUDO_UNIDIRECTIONAL && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Pseudo Unidirectional,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_STREAMING && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Streaming,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_UNIDIRECTIONAL && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Unidirectional,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_RANDOM_LOOKING && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Random Looking,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_C2S && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "C2S,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_S2C && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "S2C,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_BIDIRECTIONAL && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Bidirectional,");
offset = strlen(str);
}
if (flags & SESSION_FLAGS_TUNNELING && str_len > offset)
{
snprintf(&str[offset], str_len-offset, "Tunneling,");
offset = strlen(str);
}
str[offset-1] = ']';
}
static void append_json(cJSON *root, struct session_flags_message *sf_message)
{
char key[128] = {0};
snprintf(key, 128, "common_flags_%d", g_receive_msg_count);
cJSON_AddNumberToObject(root, (const char *)key, sf_message->flags);
char str[1024] = {0};
session_flags_2_str(sf_message->flags, str, 1024);
snprintf(key, 128, "common_flags_str_%d", g_receive_msg_count);
cJSON_AddStringToObject(root, (const char *)key, str);
char identify_str[1024] = {0};
int offset = 0;
for (unsigned int i = 0; i < sf_message->array_num; i++)
{
offset += snprintf(identify_str + offset, 1024-offset, "%u,", sf_message->packet_sequence_array[i]);
}
snprintf(key, 128, "common_flags_identify_info_%d", g_receive_msg_count);
cJSON_AddStringToObject(root, (const char *)key, identify_str);
g_receive_msg_count++;
}
void test_session_flags_entry(struct session *session, int topic_id, const void *msg, void *per_session_ctx, void *plugin_env)
{
unused(plugin_env);
unused(session);
unused(topic_id);
if (msg == NULL)
{
return;
}
struct session_flags_message *sf_message = (struct session_flags_message *)msg;
cJSON *json_root = (cJSON *)per_session_ctx;
append_json(json_root, sf_message);
}
void *ctx_new(struct session *session, void *plugin_env)
{
unused(plugin_env);
unused(session);
cJSON *root = cJSON_CreateObject();
return (void *)root;
}
void ctx_free(struct session *sess, void *session_ctx, void *plugin_env)
{
unused(sess);
unused(plugin_env);
commit_test_result_json((cJSON *)session_ctx, "session_flags_test");
}
extern "C" void *SESSION_FLAGS_TEST_PLUG_INIT(struct stellar *st)
{
g_test_session_flags_plugin_id = stellar_session_plugin_register(st, ctx_new, ctx_free, NULL);
g_session_flags_topic_id = stellar_mq_get_topic_id(st, SESSION_FLAGS_MESSAGE_TOPIC);
stellar_session_mq_subscribe(st, g_session_flags_topic_id, test_session_flags_entry, g_test_session_flags_plugin_id);
return NULL;
}
extern "C" void SESSION_FLAGS_TEST_PLUG_DESTROY(void *ctx)
{
unused(ctx);
return;
}

37
test/decoders/session_flags/test_based_on_stellar/CMakeLists.txt Normal file
View File

@@ -0,0 +1,37 @@
set(DECODER_NAME session_flags)
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/test/decoders/session_flags)
set(SAPP_DEVEL_DIR ${TEST_RUN_DIR}/lib)
set(TEST_MAIN session_flags_test_main)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/test)
include_directories(/usr/local/include/cjson)
include_directories(/opt/tsg/framework/include/stellar)
include_directories(/opt/MESA/include/MESA)
include_directories(/opt/tsg/stellar/include/)
#various ways to add -rdynamic for centos7, centos8, and different cmake version
add_definitions(-rdynamic)
link_directories(${SAPP_DEVEL_DIR})
# assemble test env
add_test(NAME SESSION_FLAGS_MKDIR_METRIC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/metrics; mkdir -p ${TEST_RUN_DIR}/plugin; mkdir -p ${TEST_RUN_DIR}/log; mkdir -p ${TEST_RUN_DIR}/pcap")
add_test(NAME SESSION_FLAGS_COPY_SPEC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/plugin/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/spec.toml ${TEST_RUN_DIR}/plugin/spec.toml")
add_test(NAME SESSION_FLAGS_COPY_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/stellar.toml ${TEST_RUN_DIR}/conf/stellar.toml")
add_test(NAME SESSION_FLAGS_COPY_LOG_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/log.toml ${TEST_RUN_DIR}/conf/log.toml")
# update plugin to be tested
add_test(NAME SESSION_FLAGS_CP_DECODER_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/decoders/session_flags/session_flags_dyn.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}.so")
add_test(NAME SESSION_FLAGS_CP_DECODER_GTEST_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/test/decoders/session_flags/${DECODER_NAME}_test.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}_test.so")
set_tests_properties(SESSION_FLAGS_MKDIR_METRIC SESSION_FLAGS_COPY_SPEC
SESSION_FLAGS_COPY_CONF SESSION_FLAGS_COPY_LOG_CONF
SESSION_FLAGS_CP_DECODER_SO SESSION_FLAGS_CP_DECODER_GTEST_SO
PROPERTIES FIXTURES_SETUP TestFixture)
set(TEST_PCAP_DIR ${PROJECT_SOURCE_DIR}/test/decoders/session_flags/pcap)
# run tests
add_test(NAME SESSION_FLAGS_PLUGIN_TEST COMMAND sh -c "ln -sf ${TEST_PCAP_DIR}/https_download.pcap ${TEST_RUN_DIR}/pcap/test.pcap; ./${TEST_MAIN} ${TEST_PCAP_DIR}/https_download.json" WORKING_DIRECTORY ${TEST_RUN_DIR})

4
test/decoders/session_flags/test_based_on_stellar/env/log.toml vendored Normal file
View File

@@ -0,0 +1,4 @@
[log]
output = "stderr" # stderr, file
file = "log/stellar.log"
level = "ERROR" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL

9
test/decoders/session_flags/test_based_on_stellar/env/session_flags.toml vendored Normal file
View File

@@ -0,0 +1,9 @@
[SESSION_FLAGS]
FET_ENABLED=1
INTERACTIVE_STARTTIME_MS = 10000
INTERACTIVE_PULSE_NUM = 4
INTERACTIVE_LATENCY_MS = 5000
MAIN_DIR_FRONT_N_PKTS = 100
LARGE_PKTS_INIT_SIZE = 1000
RANDOM_LOOKING_JUDGE_LIST="{\"random_looking_judge_list\":[ \"frequency\", \"block_frequency\", \"cumulative_sums\", \"runs\", \"longest_run\", \"rank\", \"non_overlapping_template_matching\", \"overlapping_template_matching\", \"universal\", \"random_excursions\", \"random_excursions_variant\", \"poker_detect\", \"runs_distribution\", \"self_correlation\", \"binary_derivative\" ]}"
TUNNELING_PCRE_LIST="{\"tunneling_pcre_list\":[\"(B|C)(d){3,5}(a|b|c|d)(A|B)b(A|B|C|D)\", \"(B|C)(d){3,5}(a|b|c|d)Aa(A|B|C|D)\", \"(B|C)(d){2}(b|c)(A|B)b(A|B|C|D)\", \"(B|C)(d){2}(b|c)Aa(A|B|C|D)\"]}"

9
test/decoders/session_flags/test_based_on_stellar/env/spec.toml vendored Normal file
View File

@@ -0,0 +1,9 @@
[[plugin]]
path = "./plugin/session_flags.so"
init = "session_flags_plugin_init"
exit = "session_flags_plugin_exit"
[[plugin]]
path = "./plugin/session_flags_test.so"
init = "SESSION_FLAGS_TEST_PLUG_INIT"
exit = "SESSION_FLAGS_TEST_PLUG_DESTROY"

64
test/decoders/session_flags/test_based_on_stellar/env/stellar.toml vendored Normal file
View File

@@ -0,0 +1,64 @@
[instance]
id = 1 # range: [0, 4095] (20 bit)
[packet_io]
mode = "pcapfile" # pcapfile, pcaplist, marsio
app_symbol = "stellar"
dev_symbol = "nf_0_fw"
pcap_path = "./pcap/test.pcap"
nr_worker_thread = 1 # range: [1, 256]
cpu_mask = [5, 6, 7, 8, 9, 10, 11, 12]
idle_yield_interval_ms = 90 # range: [0, 60000] (ms)
[ip_reassembly]
enable = 1
bucket_entries = 32 # range: [1, 4294967295] (must be power of 2)
bucket_num = 1024 # range: [1, 4294967295]
ip_frag_timeout_ms = 1000 # range: [1, 60000] (ms)
ip_frag_expire_polling_interval_ms = 0 # range: [0, 60000] (ms)
ip_frag_expire_polling_limit = 1024 # range: [1, 1024]
[session_manager]
tcp_session_max = 500
udp_session_max = 500
evict_old_on_tcp_table_limit = 1 # range: [0, 1]
evict_old_on_udp_table_limit = 1 # range: [0, 1]
expire_period_ms = 0 # range: [0, 60000] (ms)
expire_batch_max = 1024 # range: [1, 1024]
[session_manager.tcp_timeout_ms]
init = 500 # range: [1, 60000] (ms)
handshake = 500 # range: [1, 60000] (ms)
data = 500 # range: [1, 15999999000] (ms)
half_closed = 500 # range: [1, 604800000] (ms)
time_wait = 500 # range: [1, 600000] (ms)
discard_default = 1000 # range: [1, 15999999000] (ms)
unverified_rst = 500 # range: [1, 600000] (ms)
[session_manager.udp_timeout_ms]
data = 500 # range: [1, 15999999000] (ms)
discard_default = 500 # range: [1, 15999999000] (ms)
[session_manager.duplicated_packet_bloom_filter]
enable = 0
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.evicted_session_bloom_filter]
enable = 0 # range: [0, 1]
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.tcp_reassembly]
enable = 1 # range: [0, 1]
timeout_ms = 100 # range: [1, 60000] (ms)
buffered_segments_max = 256 # range: [2, 4096] per flow
[stat]
merge_interval_ms = 500 # range: [0, 60000] (ms)
output_interval_ms = 1000 # range: [0, 60000] (ms)

38
test/decoders/socks/CMakeLists.txt Normal file
View File

@@ -0,0 +1,38 @@
set(DECODER_NAME socks)
add_library(${DECODER_NAME}_test SHARED socks_decoder_test_plugin.cpp)
add_dependencies(${DECODER_NAME}_test ${DECODER_NAME})
set_target_properties(${DECODER_NAME}_test PROPERTIES PREFIX "")
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/testing)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/src)
include_directories(${CMAKE_BINARY_DIR}/vendors/cjson/src/cjson/include)
include_directories(${PROJECT_SOURCE_DIR}/decoders/socks)
include_directories(${PROJECT_SOURCE_DIR}/include/stellar)
add_executable(gtest_pcap_socks socks_decoder_pcap_gtest.cpp dummy.c ${PROJECT_SOURCE_DIR}/decoders/socks/socks_decoder.cpp)
target_link_libraries(gtest_pcap_socks gtest logger pcap)
add_executable(socks_test_main plugin_test_main.cpp)
set_target_properties(socks_test_main
PROPERTIES
LINK_OPTIONS
"-rdynamic"
)
set_target_properties(socks_test_main
PROPERTIES
LINK_FLAGS
"-rdynamic"
)
set(LINK_FLAGS "-rdynamic")
target_link_libraries(socks_test_main gtest cjson-static stellar_lib)
add_subdirectory(test_based_on_stellar)
#copy pcap file folder to build directory
file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/pcap DESTINATION ${CMAKE_BINARY_DIR}/test/decoders/socks)
include(GoogleTest)
gtest_discover_tests(gtest_pcap_socks)

151
test/decoders/socks/dummy.c Normal file
View File

@@ -0,0 +1,151 @@
#include "dummy.h"
#define UNUSED(x) (void)(x)
int direction;
void session_set_current_state(struct session *sess, enum session_state sess_state)
{
sess->sess_state = sess_state;
return;
}
enum session_state session_get_current_state(const struct session *sess)
{
return sess->sess_state;
}
void dummy_set_direction(int dir)
{
direction = dir;
}
struct logger *stellar_get_logger(struct stellar *st)
{
UNUSED(st);
return NULL;
}
enum flow_type session_get_flow_type(const struct session *sess)
{
UNUSED(sess);
return direction;
}
const struct packet *session_get0_current_packet(const struct session *sess)
{
UNUSED(sess);
return NULL;
}
const char *packet_get_payload(const struct packet *pkt)
{
UNUSED(pkt);
return NULL;
}
uint16_t packet_get_payload_len(const struct packet *pkt)
{
UNUSED(pkt);
return 0;
}
int session_mq_ignore_message(struct session *sess, int topic_id, int plugin_id)
{
UNUSED(sess);
UNUSED(topic_id);
UNUSED(plugin_id);
return 0;
}
int session_exdata_set(struct session *sess, int idx, void *ex_ptr)
{
UNUSED(sess);
UNUSED(idx);
UNUSED(ex_ptr);
return 0;
}
void *session_exdata_get(struct session *sess, int idx)
{
UNUSED(sess);
UNUSED(idx);
return NULL;
}
void stellar_session_plugin_dettach_current_session(struct session *sess)
{
UNUSED(sess);
}
int session_mq_publish_message(struct session *sess, int topic_id, void *msg)
{
UNUSED(sess);
UNUSED(topic_id);
UNUSED(msg);
return 0;
}
const char *session_get0_readable_addr(const struct session *sess)
{
UNUSED(sess);
return NULL;
}
int stellar_exdata_new_index(struct stellar *st, const char *name, stellar_exdata_free *free_func,void *arg)
{
UNUSED(st);
UNUSED(name);
UNUSED(free_func);
UNUSED(arg);
return 0;
}
int stellar_mq_create_topic(struct stellar *st, const char *topic_name, stellar_msg_free_cb_func *msg_free_cb, void *msg_free_arg)
{
UNUSED(st);
UNUSED(topic_name);
UNUSED(msg_free_cb);
UNUSED(msg_free_arg);
return 0;
}
int stellar_mq_get_topic_id(struct stellar *st, const char *topic_name)
{
UNUSED(st);
UNUSED(topic_name);
return 0;
}
int stellar_session_mq_subscribe(struct stellar *st, int topic_id, on_session_msg_cb_func *plugin_on_msg_cb, int plugin_id)
{
UNUSED(st);
UNUSED(topic_id);
UNUSED(plugin_on_msg_cb);
UNUSED(plugin_id);
return 0;
}
int stellar_session_plugin_register(struct stellar *st, session_ctx_new_func session_ctx_new, session_ctx_free_func session_ctx_free, void *plugin_env)
{
UNUSED(st);
UNUSED(session_ctx_new);
UNUSED(session_ctx_free);
UNUSED(plugin_env);
return 0;
}

14
test/decoders/socks/dummy.h Normal file
View File

@@ -0,0 +1,14 @@
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
struct session //stub just for test
{
enum session_state sess_state;
int payload_len;
char *payload;
};
void session_set_current_state(struct session *sess, enum session_state sess_state);
void dummy_set_direction(int dir);

7
test/decoders/socks/pcap/result.json Normal file
View File

@@ -0,0 +1,7 @@
[{
"socks_info": {
"version": "SOCKS4",
"dst_addr": "127.0.0.1",
"dst_port": 8888
}
}]

BIN
test/decoders/socks/pcap/socks4.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/socks/pcap/socks4_nest_socks4a.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/socks/pcap/socks4a_domain.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/socks/pcap/socks5_auth_failed.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/socks/pcap/socks5_auth_success.pcap Normal file
View File

Binary file not shown.

BIN
test/decoders/socks/pcap/socks5_no_auth.pcap Normal file
View File

Binary file not shown.

135
test/decoders/socks/plugin_test_main.cpp Normal file
View File

@@ -0,0 +1,135 @@
#include "cJSON.h"
#include <gtest/gtest.h>
#include <unistd.h>
#include <stdio.h>
#include <assert.h>
#ifdef __cplusplus
extern "C"
{
#endif
#include "stellar/stellar.h"
#ifdef __cplusplus
}
#endif
// #define IGNORE_PRINTF
#ifdef IGNORE_PRINTF
#define printf(fmt, ...) (0)
#endif
static cJSON *g_test_result_root = NULL;
static cJSON *g_load_result_root = NULL;
static const char *result_json_path = NULL;
extern "C" int commit_test_result_json(cJSON *node, const char *name)
{
(void)name;
if (g_test_result_root)
{
// cJSON_AddItemToObject(g_test_result_root, name, node);
// cJSON_AddStringToObject(node, "name", name);
cJSON_AddItemToArray(g_test_result_root, node);
return 0;
}
return -1;
}
static cJSON *load_result_from_jsonfile(const char *json_path)
{
if (json_path == NULL)
return NULL;
long file_len = 0;
char *file_content = NULL;
FILE *fp = NULL;
fp = fopen(json_path, "r+");
if (NULL == fp)
{
return NULL;
}
fseek(fp, 0, SEEK_END);
file_len = ftell(fp);
fseek(fp, 0, SEEK_SET);
if (file_len == 0)
{
fclose(fp);
return NULL;
}
file_content = (char *)malloc(file_len + 1);
fread(file_content, file_len, 1, fp);
file_content[file_len] = '\0';
cJSON *load = cJSON_Parse(file_content);
free(file_content);
fclose(fp);
return load;
}
TEST(PROTOCOL, compare_result_json)
{
EXPECT_EQ(cJSON_GetArraySize(g_test_result_root), cJSON_GetArraySize(g_load_result_root));
int ret = cJSON_Compare(g_test_result_root, g_load_result_root, 0);
EXPECT_EQ(1, ret);
if (ret != 1)
{
char *load_json_str = cJSON_Print(g_load_result_root);
printf("LOAD Raw:\n%s\n", load_json_str);
free(load_json_str);
char *result_json_str = cJSON_Print(g_test_result_root);
printf("TEST Raw:\n%s\n", result_json_str);
free(result_json_str);
cJSON *t_load = g_load_result_root->child, *t_test = g_test_result_root->child;
while (t_load != NULL)
{
ret = cJSON_Compare(t_load, t_test, 0);
if (ret != 1)
{
load_json_str = cJSON_Print(t_load);
printf("LOAD Diff:\n%s\n", load_json_str);
free(load_json_str);
result_json_str = cJSON_Print(t_test);
printf("TEST Diff:\n%s\n", result_json_str);
free(result_json_str);
goto fail;
}
t_load = t_load->next;
t_test = t_test->next;
}
}
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
fail:
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
}
int main(int argc, char *argv[])
{
int ret = 0;
if (argc < 2)
{
printf("Usage: %s <result_json_path>\n", argv[0]);
result_json_path = NULL;
}
else
{
result_json_path = argv[1];
g_test_result_root = cJSON_CreateArray();
g_load_result_root = load_result_from_jsonfile(result_json_path);
assert(g_load_result_root != NULL && g_test_result_root != NULL);
}
::testing::InitGoogleTest(&argc, argv);
struct stellar *st = stellar_new("./conf/stellar.toml", "./plugin/spec.toml", "./conf/log.toml");
stellar_run(st);
if (result_json_path != NULL)
{
ret = RUN_ALL_TESTS();
}
stellar_free(st);
return ret;
}

246
test/decoders/socks/socks_decoder_pcap_gtest.cpp Normal file
View File

@@ -0,0 +1,246 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <netinet/ether.h>
#include <pcap/sll.h>
#include <pcap/pcap.h>
#include "gtest/gtest.h"
#include "socks_decoder_internal.h"
extern "C" {
#include "stellar/session.h"
#include "dummy.h"
}
#define LINUX_COOKED_CAPTURE 20
extern int socks_process(struct socks_decoder_info *socks_decoder_info, struct session *sess, struct socks_tunnel_stream *stream, const char *payload, size_t payload_len);
struct pcap_loop_arg
{
pcap_t *pcap_handle;
struct socks_tunnel_stream *stream;
};
struct socks_decoder_info *socks_decoder_info = NULL;
static void pcap_handle_cb(pcap_loop_arg *userarg, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
struct pcap_loop_arg *arg = (struct pcap_loop_arg *)userarg;
struct session sess;
int payload_len = 0;
char *payload = NULL;
unsigned short sport, dport;
unsigned short eth_proto_type;
unsigned char *ip_header;
memset(&sess, 0, sizeof(sess));
int data_link_type = pcap_datalink(arg->pcap_handle);
switch (data_link_type) {
case DLT_EN10MB:
eth_proto_type = ntohs(*(unsigned short *)(packet + 12));
ip_header = (unsigned char *)(packet + sizeof(struct ethhdr));
break;
case 276://DLT_LINUX_SLL2
eth_proto_type = ntohs(*(unsigned short *)packet);
ip_header = (unsigned char *)(packet + LINUX_COOKED_CAPTURE);
break;
default:
return;
}
if (eth_proto_type == ETH_P_IP) {
int l4_proto = *(unsigned char *)(ip_header + 9);
if (l4_proto == IPPROTO_TCP) {
int ip_total_len = ntohs(*(unsigned short *)(ip_header + 2));
int ip_header_len = (*(unsigned char *)ip_header & 0x0f) * 4;
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(iphdr) + 12) & 0xf0) >> 4);
payload_len = ip_total_len - ip_header_len - tcp_header_len;
payload = (char *)ip_header + ip_header_len + tcp_header_len;
} else {
return;
}
sport = ntohs(*(unsigned short *)(ip_header + sizeof(iphdr) + 0));
dport = ntohs(*(unsigned short *)(ip_header + sizeof(iphdr) + 2));
} else if (eth_proto_type == ETH_P_IPV6) {
int l4_proto = *(unsigned char *)(ip_header + 6);
if (l4_proto == IPPROTO_TCP) {
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(struct ip6_hdr) + 12) & 0xf0) >> 4);
payload_len = pkthdr->caplen - (ip_header - packet) - sizeof(struct ip6_hdr) - tcp_header_len;
payload = (char *)ip_header + sizeof(struct ip6_hdr) + tcp_header_len;
} else {
return;
}
sport = ntohs(*(unsigned short *)(ip_header + sizeof(struct ip6_hdr) + 0));
dport = ntohs(*(unsigned short *)(ip_header + sizeof(struct ip6_hdr) + 2));
} else {
return;
}
session_set_current_state(&sess, SESSION_STATE_ACTIVE);
if (sport > dport)
{
dummy_set_direction(FLOW_TYPE_C2S);
} else {
dummy_set_direction(FLOW_TYPE_S2C);
}
socks_process(socks_decoder_info, &sess, arg->stream, payload, payload_len);
}
TEST(socks_decoder, socks4)
{
char error[100];
struct pcap_loop_arg arg;
struct socks_tunnel_stream *stream = (struct socks_tunnel_stream *)calloc(1, sizeof(struct socks_tunnel_stream));
pcap_t * handle = pcap_open_offline("pcap/socks4.pcap", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.stream = stream;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
EXPECT_EQ(stream->info.version, SOCKS_VERSION_4);
EXPECT_EQ(stream->info.dst_addr.type, SOCKS_ADDR_IPV4);
EXPECT_EQ(stream->info.dst_addr.ipv4, inet_addr("93.184.216.119"));
EXPECT_EQ(stream->info.dst_addr.port, htons(80));
EXPECT_EQ(stream->info.user_name.iov_len, 0);
EXPECT_EQ(stream->info.password.iov_len, 0);
EXPECT_EQ(stream->client_state, SS_END);
EXPECT_EQ(stream->server_state, SS_END);
pcap_close(handle);
free(stream);
}
TEST(socks_decoder, socks4a_domain)
{
char error[100];
struct pcap_loop_arg arg;
struct socks_tunnel_stream *stream = (struct socks_tunnel_stream *)calloc(1, sizeof(struct socks_tunnel_stream));
pcap_t * handle = pcap_open_offline("pcap/socks4a_domain.pcap", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.stream = stream;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
EXPECT_EQ(stream->info.version, SOCKS_VERSION_4);
EXPECT_EQ(stream->info.dst_addr.type, SOCKS_ADDR_FQDN);
EXPECT_EQ(stream->info.dst_addr.fqdn.iov_len, strlen("www.example.com"));
EXPECT_STREQ("www.example.com", (char *)stream->info.dst_addr.fqdn.iov_base);
EXPECT_EQ(stream->info.dst_addr.port, htons(80));
EXPECT_EQ(stream->info.user_name.iov_len, 0);
EXPECT_EQ(stream->info.password.iov_len, 0);
EXPECT_EQ(stream->client_state, SS_END);
EXPECT_EQ(stream->server_state, SS_END);
pcap_close(handle);
free(stream->info.dst_addr.fqdn.iov_base);
free(stream);
}
TEST(socks_decoder, socks5_no_auth)
{
char error[100];
struct pcap_loop_arg arg;
struct socks_tunnel_stream *stream = (struct socks_tunnel_stream *)calloc(1, sizeof(struct socks_tunnel_stream));
pcap_t * handle = pcap_open_offline("pcap/socks5_no_auth.pcap", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.stream = stream;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
EXPECT_EQ(stream->info.version, SOCKS_VERSION_5);
EXPECT_EQ(stream->info.dst_addr.type, SOCKS_ADDR_IPV4);
EXPECT_EQ(stream->info.dst_addr.ipv4, inet_addr("93.184.216.119"));
EXPECT_EQ(stream->info.dst_addr.port, htons(80));
EXPECT_EQ(stream->info.user_name.iov_len, 0);
EXPECT_EQ(stream->info.password.iov_len, 0);
EXPECT_EQ(stream->client_state, SS_END);
EXPECT_EQ(stream->server_state, SS_END);
pcap_close(handle);
free(stream);
}
TEST(socks_decoder, socks5_auth_success)
{
char error[100];
struct pcap_loop_arg arg;
struct socks_tunnel_stream *stream = (struct socks_tunnel_stream *)calloc(1, sizeof(struct socks_tunnel_stream));
pcap_t * handle = pcap_open_offline("pcap/socks5_auth_success.pcap", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.stream = stream;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
EXPECT_EQ(stream->info.version, SOCKS_VERSION_5);
EXPECT_EQ(stream->info.dst_addr.type, SOCKS_ADDR_IPV4);
EXPECT_EQ(stream->info.dst_addr.ipv4, inet_addr("93.184.216.119"));
EXPECT_EQ(stream->info.dst_addr.port, htons(80));
EXPECT_EQ(stream->info.user_name.iov_len, strlen("testuser"));
EXPECT_STREQ("testuser", (char *)stream->info.user_name.iov_base);
EXPECT_EQ(stream->info.password.iov_len, strlen("testuser"));
EXPECT_STREQ("testuser", (char *)stream->info.password.iov_base);
EXPECT_EQ(stream->client_state, SS_END);
EXPECT_EQ(stream->server_state, SS_END);
pcap_close(handle);
free(stream->info.user_name.iov_base);
free(stream->info.password.iov_base);
free(stream);
}
TEST(socks_decoder, socks5_auth_fail)
{
char error[100];
struct pcap_loop_arg arg;
struct socks_tunnel_stream *stream = (struct socks_tunnel_stream *)calloc(1, sizeof(struct socks_tunnel_stream));
pcap_t * handle = pcap_open_offline("pcap/socks5_auth_failed.pcap", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.stream = stream;
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
EXPECT_EQ(stream->client_state, SS_SUB);
EXPECT_EQ(stream->server_state, SS_FAILED);
pcap_close(handle);
free(stream->info.user_name.iov_base);
free(stream->info.password.iov_base);
free(stream);
}
int main(int argc, char **argv)
{
testing::InitGoogleTest(&argc, argv);
socks_decoder_info = (struct socks_decoder_info *)calloc(1, sizeof(struct socks_decoder_info));
int result = RUN_ALL_TESTS();
free(socks_decoder_info);
return result;
}

88
test/decoders/socks/socks_decoder_test_plugin.cpp Normal file
View File

@@ -0,0 +1,88 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <arpa/inet.h>
extern "C" {
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
}
#include "cJSON.h"
#include "socks_decoder.h"
extern "C" int commit_test_result_json(cJSON *node, const char *name);
#define unused(x) ((void)(x))
int g_test_socks_decoder_plugin_id = 0;
int g_socks_message_topic_id = 0;
void *ctx_new(struct session *session, void *plugin_env)
{
unused(plugin_env);
unused(session);
cJSON *root = cJSON_CreateObject();
return (void *)root;
}
void ctx_free(struct session *sess, void *session_ctx, void *plugin_env)
{
unused(sess);
unused(plugin_env);
commit_test_result_json((cJSON *)session_ctx, "socks_decoder_test");
}
static void append_json(cJSON *root, struct socks_info *info)
{
cJSON *json_stream = cJSON_CreateObject();
cJSON_AddStringToObject(json_stream, "version", info->version == SOCKS_VERSION_4 ? "SOCKS4" : "SOCKS5");
char ip_str[INET6_ADDRSTRLEN] = {0};
if (info->dst_addr.type == SOCKS_ADDR_IPV4) {
inet_ntop(AF_INET, &info->dst_addr.ipv4, ip_str, INET_ADDRSTRLEN);
} else if (info->dst_addr.type == SOCKS_ADDR_IPV6) {
inet_ntop(AF_INET6, info->dst_addr.ipv6, ip_str, INET6_ADDRSTRLEN);
} else {
memcpy(ip_str, info->dst_addr.fqdn.iov_base, info->dst_addr.fqdn.iov_len);
}
cJSON_AddStringToObject(json_stream, "dst_addr", ip_str);
cJSON_AddNumberToObject(json_stream, "dst_port", ntohs(info->dst_addr.port));
cJSON_AddStringToObject(json_stream, "user_name", (char *)info->user_name.iov_base);
cJSON_AddStringToObject(json_stream, "password", (char *)info->password.iov_base);
cJSON_AddItemToObject(root, "socks_info", json_stream);
}
void test_socks_decoder_on_message(struct session *session, int topic_id, const void *msg, void *per_session_ctx, void *plugin_env)
{
unused(plugin_env);
unused(session);
unused(topic_id);
struct socks_info *info = (struct socks_info *)msg;
cJSON *json_root = (cJSON *)per_session_ctx;
append_json(json_root, info);
}
extern "C" void *SOCKS_DECODER_TEST_PLUG_INIT(struct stellar *st)
{
g_test_socks_decoder_plugin_id = stellar_session_plugin_register(st, ctx_new, ctx_free, NULL);
g_socks_message_topic_id = stellar_mq_get_topic_id(st, SOCKS_MESSAGE_TOPIC);
stellar_session_mq_subscribe(st, g_socks_message_topic_id, test_socks_decoder_on_message, g_test_socks_decoder_plugin_id);
return NULL;
}
extern "C" void SOCKS_DECODER_TEST_PLUG_DESTROY(void *plugin_env)
{
unused(plugin_env);
}

37
test/decoders/socks/test_based_on_stellar/CMakeLists.txt Normal file
View File

@@ -0,0 +1,37 @@
set(DECODER_NAME socks)
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/test/decoders/socks)
set(SAPP_DEVEL_DIR ${TEST_RUN_DIR}/lib)
set(TEST_MAIN socks_test_main)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/test)
include_directories(/usr/local/include/cjson)
include_directories(/opt/tsg/framework/include/stellar)
include_directories(/opt/MESA/include/MESA)
include_directories(/opt/tsg/stellar/include/)
#various ways to add -rdynamic for centos7, centos8, and different cmake version
add_definitions(-rdynamic)
link_directories(${SAPP_DEVEL_DIR})
# assemble test env
add_test(NAME SOCKS_MKDIR_METRIC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/metrics; mkdir -p ${TEST_RUN_DIR}/plugin; mkdir -p ${TEST_RUN_DIR}/log; mkdir -p ${TEST_RUN_DIR}/pcap")
add_test(NAME SOCKS_COPY_SPEC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/plugin/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/spec.toml ${TEST_RUN_DIR}/plugin/spec.toml")
add_test(NAME SOCKS_COPY_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/stellar.toml ${TEST_RUN_DIR}/conf/stellar.toml")
add_test(NAME SOCKS_COPY_LOG_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/log.toml ${TEST_RUN_DIR}/conf/log.toml")
# update plugin to be tested
add_test(NAME SOCKS_CP_DECODER_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/decoders/socks/socks_dyn.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}.so")
add_test(NAME SOCKS_CP_DECODER_GTEST_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/test/decoders/socks/${DECODER_NAME}_test.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}_test.so")
set_tests_properties(SOCKS_MKDIR_METRIC SOCKS_COPY_SPEC
SOCKS_COPY_CONF SOCKS_COPY_LOG_CONF
SOCKS_CP_DECODER_SO SOCKS_CP_DECODER_GTEST_SO
PROPERTIES FIXTURES_SETUP TestFixture)
set(TEST_PCAP_DIR ${PROJECT_SOURCE_DIR}/test/decoders/socks/pcap)
# run tests
add_test(NAME SOCKS_DECODER_PLUGIN_TEST COMMAND sh -c "ln -sf ${TEST_PCAP_DIR}/socks4_nest_socks4a.pcap ${TEST_RUN_DIR}/pcap/test.pcap; ./${TEST_MAIN} ${TEST_PCAP_DIR}/result.json" WORKING_DIRECTORY ${TEST_RUN_DIR})

4
test/decoders/socks/test_based_on_stellar/env/log.toml vendored Normal file
View File

@@ -0,0 +1,4 @@
[log]
output = "stderr" # stderr, file
file = "log/stellar.log"
level = "ERROR" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL

9
test/decoders/socks/test_based_on_stellar/env/spec.toml vendored Normal file
View File

@@ -0,0 +1,9 @@
[[plugin]]
path = "./plugin/socks.so"
init = "socks_decoder_init"
exit = "socks_decoder_exit"
[[plugin]]
path = "./plugin/socks_test.so"
init = "SOCKS_DECODER_TEST_PLUG_INIT"
exit = "SOCKS_DECODER_TEST_PLUG_DESTROY"

64
test/decoders/socks/test_based_on_stellar/env/stellar.toml vendored Normal file
View File

@@ -0,0 +1,64 @@
[instance]
id = 1 # range: [0, 4095] (20 bit)
[packet_io]
mode = "pcapfile" # pcapfile, pcaplist, marsio
app_symbol = "stellar"
dev_symbol = "nf_0_fw"
pcap_path = "./pcap/test.pcap"
nr_worker_thread = 1 # range: [1, 256]
cpu_mask = [5, 6, 7, 8, 9, 10, 11, 12]
idle_yield_interval_ms = 90 # range: [0, 60000] (ms)
[ip_reassembly]
enable = 1
bucket_entries = 32 # range: [1, 4294967295] (must be power of 2)
bucket_num = 1024 # range: [1, 4294967295]
ip_frag_timeout_ms = 1000 # range: [1, 60000] (ms)
ip_frag_expire_polling_interval_ms = 0 # range: [0, 60000] (ms)
ip_frag_expire_polling_limit = 1024 # range: [1, 1024]
[session_manager]
tcp_session_max = 500
udp_session_max = 500
evict_old_on_tcp_table_limit = 1 # range: [0, 1]
evict_old_on_udp_table_limit = 1 # range: [0, 1]
expire_period_ms = 0 # range: [0, 60000] (ms)
expire_batch_max = 1024 # range: [1, 1024]
[session_manager.tcp_timeout_ms]
init = 500 # range: [1, 60000] (ms)
handshake = 500 # range: [1, 60000] (ms)
data = 500 # range: [1, 15999999000] (ms)
half_closed = 500 # range: [1, 604800000] (ms)
time_wait = 500 # range: [1, 600000] (ms)
discard_default = 1000 # range: [1, 15999999000] (ms)
unverified_rst = 500 # range: [1, 600000] (ms)
[session_manager.udp_timeout_ms]
data = 500 # range: [1, 15999999000] (ms)
discard_default = 500 # range: [1, 15999999000] (ms)
[session_manager.duplicated_packet_bloom_filter]
enable = 0
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.evicted_session_bloom_filter]
enable = 0 # range: [0, 1]
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.tcp_reassembly]
enable = 1 # range: [0, 1]
timeout_ms = 100 # range: [1, 60000] (ms)
buffered_segments_max = 256 # range: [2, 4096] per flow
[stat]
merge_interval_ms = 500 # range: [0, 60000] (ms)
output_interval_ms = 1000 # range: [0, 60000] (ms)

41
test/decoders/stratum/CMakeLists.txt Normal file
View File

@@ -0,0 +1,41 @@
set(DECODER_NAME stratum)
add_library(${DECODER_NAME}_test SHARED stratum_test_plugin.cpp)
add_dependencies(${DECODER_NAME}_test ${DECODER_NAME})
set_target_properties(${DECODER_NAME}_test PROPERTIES PREFIX "")
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/testing)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/src)
include_directories(${CMAKE_SOURCE_DIR}/deps/toml)
include_directories(${CMAKE_BINARY_DIR}/vendors/cjson/src/cjson/include)
include_directories(${PROJECT_SOURCE_DIR}/decoders/stratum)
include_directories(${PROJECT_SOURCE_DIR}/include/stellar)
add_executable(gtest_pcap_stratum stratum_decoder_pcap_gtest.cpp dummy.c ${PROJECT_SOURCE_DIR}/decoders/stratum/stratum_decoder.cpp)
target_link_libraries(gtest_pcap_stratum gtest pcap cjson-static logger)
add_executable(stratum_test_main plugin_test_main.cpp)
set_target_properties(stratum_test_main
PROPERTIES
LINK_OPTIONS
"-rdynamic"
)
set_target_properties(stratum_test_main
PROPERTIES
LINK_FLAGS
"-rdynamic"
)
set(LINK_FLAGS "-rdynamic")
#target_link_options(stratum_test_main PRIVATE -Wl,--whole-archive logger -Wl,--no-whole-archive)
set(CMAKE_VERBOSE_MAKEFILE ON)
target_link_libraries(stratum_test_main gtest cjson-static logger stellar_lib)
add_subdirectory(test_based_on_stellar)
#copy pcap file folder to build directory
file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/pcap DESTINATION ${CMAKE_BINARY_DIR}/test/decoders/stratum)
include(GoogleTest)
gtest_discover_tests(gtest_pcap_stratum)

86
test/decoders/stratum/dummy.c Normal file
View File

@@ -0,0 +1,86 @@
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
#define UNUSED(x) (void)(x)
void stellar_session_plugin_dettach_current_session(struct session *sess)
{
UNUSED(sess);
}
const struct packet *session_get0_current_packet(const struct session *sess)
{
UNUSED(sess);
return NULL;
}
const char *packet_get_payload(const struct packet *pkt)
{
UNUSED(pkt);
return NULL;
}
uint16_t packet_get_payload_len(const struct packet *pkt)
{
UNUSED(pkt);
return 0;
}
struct logger *stellar_get_logger(struct stellar *st)
{
UNUSED(st);
return NULL;
}
int session_mq_publish_message(struct session *sess, int topic_id, void *msg)
{
UNUSED(sess);
UNUSED(topic_id);
UNUSED(msg);
return 0;
}
int stellar_mq_create_topic(struct stellar *st, const char *topic_name, stellar_msg_free_cb_func *msg_free_cb, void *msg_free_arg)
{
UNUSED(st);
UNUSED(topic_name);
UNUSED(msg_free_cb);
UNUSED(msg_free_arg);
return 0;
}
int stellar_mq_get_topic_id(struct stellar *st, const char *topic_name)
{
UNUSED(st);
UNUSED(topic_name);
return 0;
}
int stellar_session_mq_subscribe(struct stellar *st, int topic_id, on_session_msg_cb_func *plugin_on_msg_cb, int plugin_id)
{
UNUSED(st);
UNUSED(topic_id);
UNUSED(plugin_on_msg_cb);
UNUSED(plugin_id);
return 0;
}
int stellar_session_plugin_register(struct stellar *st, session_ctx_new_func session_ctx_new, session_ctx_free_func session_ctx_free, void *plugin_env)
{
UNUSED(st);
UNUSED(session_ctx_new);
UNUSED(session_ctx_free);
UNUSED(plugin_env);
return 0;
}

BIN
test/decoders/stratum/pcap/01-bch_f2pool_cpuminer_1.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/stratum/pcap/02-eth-antpool.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/stratum/pcap/03-xmr_f2pool_nanominer_1.pcapng Normal file
View File

Binary file not shown.

BIN
test/decoders/stratum/pcap/04-zec-antpool.pcapng Normal file
View File

Binary file not shown.

11
test/decoders/stratum/pcap/stratum_result.json Normal file
View File

@@ -0,0 +1,11 @@
[
{
"stratum":
{
"Tuple4": "192.168.50.243:58748-120.26.148.222:1228-6-0",
"type": "OTHER",
"mining_program": "cpuminer/2.5.1",
"mining_subscribe": "{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n"
}
}
]

135
test/decoders/stratum/plugin_test_main.cpp Normal file
View File

@@ -0,0 +1,135 @@
#include "cJSON.h"
#include <gtest/gtest.h>
#include <unistd.h>
#include <stdio.h>
#include <assert.h>
#ifdef __cplusplus
extern "C"
{
#endif
#include "stellar/stellar.h"
#ifdef __cplusplus
}
#endif
// #define IGNORE_PRINTF
#ifdef IGNORE_PRINTF
#define printf(fmt, ...) (0)
#endif
static cJSON *g_test_result_root = NULL;
static cJSON *g_load_result_root = NULL;
static const char *result_json_path = NULL;
extern "C" int commit_test_result_json(cJSON *node, const char *name)
{
(void)name;
if (g_test_result_root)
{
// cJSON_AddItemToObject(g_test_result_root, name, node);
// cJSON_AddStringToObject(node, "name", name);
cJSON_AddItemToArray(g_test_result_root, node);
return 0;
}
return -1;
}
static cJSON *load_result_from_jsonfile(const char *json_path)
{
if (json_path == NULL)
return NULL;
long file_len = 0;
char *file_content = NULL;
FILE *fp = NULL;
fp = fopen(json_path, "r+");
if (NULL == fp)
{
return NULL;
}
fseek(fp, 0, SEEK_END);
file_len = ftell(fp);
fseek(fp, 0, SEEK_SET);
if (file_len == 0)
{
fclose(fp);
return NULL;
}
file_content = (char *)malloc(file_len + 1);
fread(file_content, file_len, 1, fp);
file_content[file_len] = '\0';
cJSON *load = cJSON_Parse(file_content);
free(file_content);
fclose(fp);
return load;
}
TEST(PROTOCOL, compare_result_json)
{
EXPECT_EQ(cJSON_GetArraySize(g_test_result_root), cJSON_GetArraySize(g_load_result_root));
int ret = cJSON_Compare(g_test_result_root, g_load_result_root, 0);
EXPECT_EQ(1, ret);
if (ret != 1)
{
char *load_json_str = cJSON_Print(g_load_result_root);
printf("LOAD Raw:\n%s\n", load_json_str);
free(load_json_str);
char *result_json_str = cJSON_Print(g_test_result_root);
printf("TEST Raw:\n%s\n", result_json_str);
free(result_json_str);
cJSON *t_load = g_load_result_root->child, *t_test = g_test_result_root->child;
while (t_load != NULL)
{
ret = cJSON_Compare(t_load, t_test, 0);
if (ret != 1)
{
load_json_str = cJSON_Print(t_load);
printf("LOAD Diff:\n%s\n", load_json_str);
free(load_json_str);
result_json_str = cJSON_Print(t_test);
printf("TEST Diff:\n%s\n", result_json_str);
free(result_json_str);
goto fail;
}
t_load = t_load->next;
t_test = t_test->next;
}
}
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
fail:
cJSON_Delete(g_load_result_root);
cJSON_Delete(g_test_result_root);
return;
}
int main(int argc, char *argv[])
{
int ret = 0;
if (argc < 2)
{
printf("Usage: %s <result_json_path>\n", argv[0]);
result_json_path = NULL;
}
else
{
result_json_path = argv[1];
g_test_result_root = cJSON_CreateArray();
g_load_result_root = load_result_from_jsonfile(result_json_path);
assert(g_load_result_root != NULL && g_test_result_root != NULL);
}
::testing::InitGoogleTest(&argc, argv);
struct stellar *st = stellar_new("./conf/stellar.toml", "./plugin/spec.toml", "./conf/log.toml");
stellar_run(st);
if (result_json_path != NULL)
{
ret = RUN_ALL_TESTS();
}
stellar_free(st);
return ret;
}

179
test/decoders/stratum/stratum_decoder_pcap_gtest.cpp Normal file
View File

@@ -0,0 +1,179 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <netinet/ether.h>
#include <pcap/sll.h>
#include <pcap/pcap.h>
#include "gtest/gtest.h"
#include "stellar/stratum_decoder.h"
#include <stellar/session.h>
#define LINUX_COOKED_CAPTURE 20
struct pcap_loop_arg
{
pcap_t *pcap_handle;
void *ctx;
};
extern struct stratum_field *stratum_data_process(struct stratum_decoder_info *stratum_decoder_info, const char *tcpdata, size_t datalen);
extern void free_stratum_filed(struct stratum_field *stratum_field);
extern "C" void *stratum_decoder_init(struct stellar *st);
struct stratum_decoder_info *stratum_decoder_info = NULL;
static void pcap_handle_cb(pcap_loop_arg *userarg, const struct pcap_pkthdr *pkthdr, const u_char *packet)
{
struct pcap_loop_arg *arg = (struct pcap_loop_arg *)userarg;
int payload_len = 0;
char *payload = NULL;
unsigned short eth_proto_type;
unsigned char *ip_header;
int data_link_type = pcap_datalink(arg->pcap_handle);
switch (data_link_type) {
case DLT_EN10MB:
eth_proto_type = ntohs(*(unsigned short *)(packet + 12));
ip_header = (unsigned char *)(packet + sizeof(struct ethhdr));
break;
case 276://DLT_LINUX_SLL2
eth_proto_type = ntohs(*(unsigned short *)packet);
ip_header = (unsigned char *)(packet + LINUX_COOKED_CAPTURE);
break;
default:
return;
}
if (eth_proto_type == ETH_P_IP) {
int l4_proto = *(unsigned char *)(ip_header + 9);
if (l4_proto == IPPROTO_TCP) {
int ip_total_len = ntohs(*(unsigned short *)(ip_header + 2));
int ip_header_len = (*(unsigned char *)ip_header & 0x0f) * 4;
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(iphdr) + 12) & 0xf0) >> 4);
payload_len = ip_total_len - ip_header_len - tcp_header_len;
payload = (char *)ip_header + ip_header_len + tcp_header_len;
} else {
return;
}
} else if (eth_proto_type == ETH_P_IPV6) {
int l4_proto = *(unsigned char *)(ip_header + 6);
if (l4_proto == IPPROTO_TCP) {
int tcp_header_len = 4 * ((*(unsigned char *)(ip_header + sizeof(struct ip6_hdr) + 12) & 0xf0) >> 4);
payload_len = pkthdr->caplen - (ip_header - packet) - sizeof(struct ip6_hdr) - tcp_header_len;
payload = (char *)ip_header + sizeof(struct ip6_hdr) + tcp_header_len;
} else {
return;
}
} else {
return;
}
struct stratum_field *stratum = stratum_data_process(stratum_decoder_info, payload, payload_len);
if (stratum != NULL)
{
arg->ctx = stratum;
pcap_breakloop(arg->pcap_handle);
}
}
TEST(stratum_decoder, parse01)
{
char error[100];
struct pcap_loop_arg arg;
pcap_t *handle = pcap_open_offline("pcap/01-bch_f2pool_cpuminer_1.pcapng", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct stratum_field *stratum = (struct stratum_field *)arg.ctx;
EXPECT_EQ(stratum->type, OTHER);
EXPECT_STREQ((const char *)stratum->mining_program.iov_base, "cpuminer/2.5.1");
EXPECT_EQ(stratum->mining_pools.iov_len, 0);
EXPECT_STREQ((const char *)stratum->mining_subscribe.iov_base, "{\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n");
pcap_close(handle);
free_stratum_filed(stratum);
}
TEST(stratum_decoder, parse02)
{
char error[100];
struct pcap_loop_arg arg;
pcap_t *handle = pcap_open_offline("pcap/02-eth-antpool.pcapng", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct stratum_field *stratum = (struct stratum_field *)arg.ctx;
EXPECT_EQ(stratum->type, ETH);
EXPECT_STREQ((const char *)stratum->mining_program.iov_base, "lolMinerWorker");
EXPECT_EQ(stratum->mining_pools.iov_len, 0);
EXPECT_STREQ((const char *)stratum->mining_subscribe.iov_base, "{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"eth_submitLogin\",\"worker\":\"lolMinerWorker\",\"params\":[\"0xa0279Ad2aA6BDb440f041Aa0947178431d9Bd253.lolMinerWorker\", \"x\"]} \n");
pcap_close(handle);
free_stratum_filed(stratum);
}
TEST(stratum_decoder, parse03)
{
char error[100];
struct pcap_loop_arg arg;
pcap_t *handle = pcap_open_offline("pcap/03-xmr_f2pool_nanominer_1.pcapng", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct stratum_field *stratum = (struct stratum_field *)arg.ctx;
EXPECT_EQ(stratum->type, OTHER);
EXPECT_STREQ((const char *)stratum->mining_program.iov_base, "nanominer/3.3.5-cuda11");
EXPECT_EQ(stratum->mining_pools.iov_len, 0);
EXPECT_STREQ((const char *)stratum->mining_subscribe.iov_base, "{\"id\": 1, \"method\": \"login\", \"params\": { \"login\":\"yhzzhk.001.001\",\"pass\" : \"x\", \"agent\" : \"nanominer/3.3.5-cuda11\"}}\n");
pcap_close(handle);
free_stratum_filed(stratum);
}
TEST(stratum_decoder, parse04)
{
char error[100];
struct pcap_loop_arg arg;
pcap_t *handle = pcap_open_offline("pcap/04-zec-antpool.pcapng", error);
ASSERT_NE(handle, nullptr);
memset(&arg, 0, sizeof(arg));
arg.pcap_handle = handle;
pcap_loop(handle, -1, (pcap_handler)pcap_handle_cb, (u_char *)&arg);
struct stratum_field *stratum = (struct stratum_field *)arg.ctx;
EXPECT_EQ(stratum->type, OTHER);
EXPECT_STREQ((const char *)stratum->mining_program.iov_base, "nheqminer/0.5c");
EXPECT_STREQ((const char*)stratum->mining_pools.iov_base, "stratum-zec.antpool.com");
EXPECT_STREQ((const char *)stratum->mining_subscribe.iov_base, "{\"id\":1,\"method\":\"mining.subscribe\",\"params\":[\"nheqminer/0.5c\", null,\"stratum-zec.antpool.com\",\"8899\"]}\n");
pcap_close(handle);
free_stratum_filed(stratum);
}
int main(int argc, char **argv)
{
testing::InitGoogleTest(&argc, argv);
stratum_decoder_info = (struct stratum_decoder_info*)stratum_decoder_init(NULL);
int result = RUN_ALL_TESTS();
return result;
}

72
test/decoders/stratum/stratum_test_plugin.cpp Normal file
View File

@@ -0,0 +1,72 @@
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include "cJSON.h"
#include "stellar/stellar.h"
#include "stellar/session.h"
#include "stellar/stellar_mq.h"
#include "stellar/stellar_exdata.h"
#include "stratum_decoder.h"
#define unused(x) ((void)(x))
extern "C" int commit_test_result_json(cJSON *node, const char *name);
int g_test_stratum_decoder_plugin_id = 0;
int g_stratum_message_topic_id = 0;
void *ctx_new(struct session *session, void *plugin_env)
{
unused(plugin_env);
unused(session);
cJSON *root = cJSON_CreateObject();
return (void *)root;
}
void ctx_free(struct session *sess, void *session_ctx, void *plugin_env)
{
unused(sess);
unused(plugin_env);
commit_test_result_json((cJSON *)session_ctx, "socks_decoder_test");
}
void test_stratum_decoder_on_message(struct session *session, int topic_id, const void *msg, void *per_session_ctx, void *plugin_env)
{
unused(plugin_env);
unused(topic_id);
struct stratum_field *stratum = (struct stratum_field *)msg;
cJSON *root = (cJSON *)per_session_ctx;
cJSON *stratum_json = cJSON_CreateObject();
cJSON_AddItemToObject(root, "stratum", stratum_json);
cJSON_AddStringToObject(stratum_json, "Tuple4", session_get0_readable_addr(session));
cJSON_AddStringToObject(stratum_json, "type", stratum->type == ETH ? "ETH" : "OTHER");
cJSON_AddStringToObject(stratum_json, "mining_pools", (char *)stratum->mining_pools.iov_base);
cJSON_AddStringToObject(stratum_json, "mining_program", (char *)stratum->mining_program.iov_base);
cJSON_AddStringToObject(stratum_json, "mining_subscribe", (char *)stratum->mining_subscribe.iov_base);
}
extern "C" void *STRATUM_DECODER_TEST_PLUG_INIT(struct stellar *st)
{
g_test_stratum_decoder_plugin_id = stellar_session_plugin_register(st, ctx_new, ctx_free, NULL);
g_stratum_message_topic_id = stellar_mq_get_topic_id(st, STRATUM_MESSAGE_TOPIC);
if (stellar_session_mq_subscribe(st, g_stratum_message_topic_id, test_stratum_decoder_on_message, g_test_stratum_decoder_plugin_id) < 0)
{
printf("subscribe topic %s failed\n", STRATUM_MESSAGE_TOPIC);
return NULL;
}
return NULL;
}
extern "C" void STRATUM_DECODER_TEST_PLUG_DESTROY(void * plugin_env)
{
unused(plugin_env);
}

37
test/decoders/stratum/test_based_on_stellar/CMakeLists.txt Normal file
View File

@@ -0,0 +1,37 @@
set(DECODER_NAME stratum)
set(TEST_RUN_DIR ${CMAKE_BINARY_DIR}/test/decoders/stratum)
set(SAPP_DEVEL_DIR ${TEST_RUN_DIR}/lib)
set(TEST_MAIN stratum_test_main)
include_directories(${CMAKE_SOURCE_DIR}/include)
include_directories(${CMAKE_SOURCE_DIR}/test)
include_directories(/usr/local/include/cjson)
include_directories(/opt/tsg/framework/include/stellar)
include_directories(/opt/MESA/include/MESA)
include_directories(/opt/tsg/stellar/include/)
#various ways to add -rdynamic for centos7, centos8, and different cmake version
add_definitions(-rdynamic)
link_directories(${SAPP_DEVEL_DIR})
# assemble test env
add_test(NAME STRATUM_MKDIR_METRIC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/metrics; mkdir -p ${TEST_RUN_DIR}/plugin; mkdir -p ${TEST_RUN_DIR}/log; mkdir -p ${TEST_RUN_DIR}/pcap")
add_test(NAME STRATUM_COPY_SPEC COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/plugin/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/spec.toml ${TEST_RUN_DIR}/plugin/spec.toml")
add_test(NAME STRATUM_COPY_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/stellar.toml ${TEST_RUN_DIR}/conf/stellar.toml")
add_test(NAME STRATUM_COPY_LOG_CONF COMMAND sh -c "mkdir -p ${TEST_RUN_DIR}/conf/ && cp ${CMAKE_CURRENT_SOURCE_DIR}/env/log.toml ${TEST_RUN_DIR}/conf/log.toml")
# update plugin to be tested
add_test(NAME STRATUM_CP_DECODER_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/decoders/stratum/stratum_dyn.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}.so")
add_test(NAME STRATUM_CP_DECODER_GTEST_SO COMMAND sh -c "cp ${CMAKE_BINARY_DIR}/test/decoders/stratum/${DECODER_NAME}_test.so ${TEST_RUN_DIR}/plugin/${DECODER_NAME}_test.so")
set_tests_properties(STRATUM_MKDIR_METRIC STRATUM_COPY_SPEC
STRATUM_COPY_CONF STRATUM_COPY_LOG_CONF
STRATUM_CP_DECODER_SO STRATUM_CP_DECODER_GTEST_SO
PROPERTIES FIXTURES_SETUP TestFixture)
set(TEST_PCAP_DIR ${PROJECT_SOURCE_DIR}/test/decoders/stratum/pcap)
# run tests
add_test(NAME STRATUM_DECODER_PLUGIN_TEST COMMAND sh -c "ln -sf ${TEST_PCAP_DIR}/01-bch_f2pool_cpuminer_1.pcapng ${TEST_RUN_DIR}/pcap/test.pcap; ./${TEST_MAIN} ${TEST_PCAP_DIR}/stratum_result.json" WORKING_DIRECTORY ${TEST_RUN_DIR})

4
test/decoders/stratum/test_based_on_stellar/env/log.toml vendored Normal file
View File

@@ -0,0 +1,4 @@
[log]
output = "stderr" # stderr, file
file = "log/stellar.log"
level = "INFO" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL

9
test/decoders/stratum/test_based_on_stellar/env/spec.toml vendored Normal file
View File

@@ -0,0 +1,9 @@
[[plugin]]
path = "./plugin/stratum.so"
init = "stratum_decoder_init"
exit = "stratum_decoder_exit"
[[plugin]]
path = "./plugin/stratum_test.so"
init = "STRATUM_DECODER_TEST_PLUG_INIT"
exit = "STRATUM_DECODER_TEST_PLUG_DESTROY"

64
test/decoders/stratum/test_based_on_stellar/env/stellar.toml vendored Normal file
View File

@@ -0,0 +1,64 @@
[instance]
id = 1 # range: [0, 4095] (20 bit)
[packet_io]
mode = "pcapfile" # pcapfile, pcaplist, marsio
app_symbol = "stellar"
dev_symbol = "nf_0_fw"
pcap_path = "./pcap/test.pcap"
nr_worker_thread = 1 # range: [1, 256]
cpu_mask = [5, 6, 7, 8, 9, 10, 11, 12]
idle_yield_interval_ms = 90 # range: [0, 60000] (ms)
[ip_reassembly]
enable = 1
bucket_entries = 32 # range: [1, 4294967295] (must be power of 2)
bucket_num = 1024 # range: [1, 4294967295]
ip_frag_timeout_ms = 1000 # range: [1, 60000] (ms)
ip_frag_expire_polling_interval_ms = 0 # range: [0, 60000] (ms)
ip_frag_expire_polling_limit = 1024 # range: [1, 1024]
[session_manager]
tcp_session_max = 500
udp_session_max = 500
evict_old_on_tcp_table_limit = 1 # range: [0, 1]
evict_old_on_udp_table_limit = 1 # range: [0, 1]
expire_period_ms = 0 # range: [0, 60000] (ms)
expire_batch_max = 1024 # range: [1, 1024]
[session_manager.tcp_timeout_ms]
init = 500 # range: [1, 60000] (ms)
handshake = 500 # range: [1, 60000] (ms)
data = 500 # range: [1, 15999999000] (ms)
half_closed = 500 # range: [1, 604800000] (ms)
time_wait = 500 # range: [1, 600000] (ms)
discard_default = 1000 # range: [1, 15999999000] (ms)
unverified_rst = 500 # range: [1, 600000] (ms)
[session_manager.udp_timeout_ms]
data = 500 # range: [1, 15999999000] (ms)
discard_default = 500 # range: [1, 15999999000] (ms)
[session_manager.duplicated_packet_bloom_filter]
enable = 0
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.evicted_session_bloom_filter]
enable = 0 # range: [0, 1]
capacity = 1000000 # range: [1, 4294967295]
time_window_ms = 10000 # range: [1, 60000] (ms)
error_rate = 0.00001 # range: [0.0, 1.0]
[session_manager.tcp_reassembly]
enable = 1 # range: [0, 1]
timeout_ms = 100 # range: [1, 60000] (ms)
buffered_segments_max = 256 # range: [2, 4096] per flow
[stat]
merge_interval_ms = 500 # range: [0, 60000] (ms)
output_interval_ms = 1000 # range: [0, 60000] (ms)