()
| 250 | } |
| 251 | |
| 252 | func (it *FilterTestSuite) TestAlwaysIncludeSubnets() { |
| 253 | t := it.T() |
| 254 | // set up file system interface |
| 255 | afs := afero.NewMemMapFs() |
| 256 | afs2 := afero.NewOsFs() |
| 257 | err := afero.WriteFile(afs, "testsuite_config3.hjson", []byte(` |
| 258 | { |
| 259 | filtering: { |
| 260 | filter_external_to_internal: true, |
| 261 | internal_subnets: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fd00::/8"], |
| 262 | never_included_subnets: ["10.0.0.0/8"], |
| 263 | always_included_subnets: ["10.55.100.0/24"] |
| 264 | }, |
| 265 | threat_intel: { |
| 266 | online_feeds: ["https://feodotracker.abuse.ch/downloads/ipblocklist.txt"], |
| 267 | custom_feeds_directory: "./deployment/threat_intel_feeds" |
| 268 | }, |
| 269 | http_extensions_file_path: "../deployment/http_extensions_list.csv" |
| 270 | } |
| 271 | `), 0755) |
| 272 | require.NoError(t, err) |
| 273 | |
| 274 | cfg, err := config.ReadFileConfig(afs, "testsuite_config3.hjson") |
| 275 | require.NoError(t, err) |
| 276 | cfg.Env.DBConnection = dockerInfo.clickhouseConnection |
| 277 | it.cfg = cfg |
| 278 | |
| 279 | require.Contains(t, cfg.Filtering.NeverIncludedSubnets, util.NewSubnet(&net.IPNet{IP: net.IP{10, 0, 0, 0}, Mask: net.IPMask{255, 0, 0, 0}}), "never included subnets should contain 10.0.0.0/8") |
| 280 | require.Contains(t, cfg.Filtering.AlwaysIncludedSubnets, util.NewSubnet(&net.IPNet{IP: net.IP{10, 55, 100, 0}, Mask: net.IPMask{255, 255, 255, 0}}), "always included subnets should contain 10.55.100.0/24") |
| 281 | |
| 282 | // // import data |
| 283 | _, err = cmd.RunImportCmd(time.Now(), cfg, afs2, "../test_data/valid_tsv", "always_include_subnet", false, true) |
| 284 | require.NoError(t, err) |
| 285 | |
| 286 | // connect to database |
| 287 | db, err := database.ConnectToDB(context.Background(), "always_include_subnet", cfg, nil) |
| 288 | require.NoError(t, err) |
| 289 | |
| 290 | var count uint64 |
| 291 | |
| 292 | // verify that not all connections in 10.0.0.0/8 were filtered |
| 293 | conn := 12591 |
| 294 | http := 1982 + 176 // regular http + http missing host |
| 295 | ssl := 5531 |
| 296 | |
| 297 | err = db.Conn.QueryRow(db.GetContext(), ` |
| 298 | SELECT count(DISTINCT hash) FROM conn |
| 299 | WHERE isIPAddressInRange(IPv6NumToString(src), '::ffff:10.0.0.0/104') OR isIPAddressInRange(IPv6NumToString(dst), '::ffff:10.0.0.0/104') |
| 300 | `).Scan(&count) |
| 301 | require.NoError(t, err) |
| 302 | require.EqualValues(t, conn, count, "conn table should contain %d entries in 10.0.0.0/8, got: %d", conn, count) |
| 303 | |
| 304 | err = db.Conn.QueryRow(db.GetContext(), ` |
| 305 | SELECT count(DISTINCT hash) FROM ssl |
| 306 | WHERE isIPAddressInRange(IPv6NumToString(src), '::ffff:10.0.0.0/104') OR isIPAddressInRange(IPv6NumToString(dst), '::ffff:10.0.0.0/104') |
| 307 | `).Scan(&count) |
| 308 | require.NoError(t, err) |
| 309 | require.EqualValues(t, ssl, count, "ssl table should contain %d entries in 10.0.0.0/8, got: %d", ssl, count) |
nothing calls this directly
no test coverage detected