tests.py 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594
  1. import unittest
  2. import logging
  3. import threading
  4. import time
  5. import sys
  6. import re
  7. import struct
  8. from struct import pack, unpack
  9. import ipaddress
  10. from ipaddress import IPv4Address as IPv4AddressIntern
  11. from ipaddress import IPv4Network as IPv4NetworkIntern
  12. import utility
  13. import scanner_wrapper
  14. from group import Group
  15. import attack_logic
  16. from main_monitor_simulator import MonitorSimulator
  17. from ipv4_address import IPv4Address, IPv4Network
  18. from pypacker.layer12 import ethernet
  19. from pypacker.layer3 import ip
  20. from pypacker.layer4 import tcp
  21. from pypacker.psocket import SocketHndl
  22. from pypacker.checksum import fletcher32
  23. logging.basicConfig(format="%(levelname)s (%(funcName)s): %(message)s")
  24. logger = logging.getLogger("proberesponseattack")
  25. logger.setLevel(logging.DEBUG)
  26. class TestStaticMethods(unittest.TestCase):
  27. def test_ip_to_str(self):
  28. ip_zero = utility.int_to_ip_str(0)
  29. self.assertEqual("0.0.0.0", ip_zero)
  30. ip_one = utility.int_to_ip_str(1)
  31. self.assertEqual("0.0.0.1", ip_one)
  32. ip256 = utility.int_to_ip_str(256)
  33. self.assertEqual("0.0.1.0", ip256)
  34. ip512 = utility.int_to_ip_str(512)
  35. self.assertEqual("0.0.2.0", ip512)
  36. ipmax = utility.int_to_ip_str(2 ** 31)
  37. self.assertEqual("128.0.0.0", ipmax)
  38. groupsize_stage1 = int((265 ** 4) / 65536)
  39. ipend1 = utility.int_to_ip_str(groupsize_stage1)
  40. print(ipend1)
  41. self.assertEqual("0.1.37.241", ipend1)
  42. class TestScanner(unittest.TestCase):
  43. def test_scanlocalhost(self):
  44. def ready_callback(obj):
  45. logger.warning("callback: scanner finished")
  46. # this should scan an empty target
  47. scanner = scanner_wrapper.ZmapWrapper(["127.0.0.1"],
  48. 80,
  49. ip_source="127.0.0.1",
  50. ready_callback=ready_callback)
  51. scanner.start()
  52. def test_scanouter(self):
  53. def ready_callback(obj):
  54. logger.warning("callback: scanner finished")
  55. # this should scan an empty target
  56. scanner = scanner_wrapper.ZmapWrapper(["173.194.44.88/16"],
  57. 80,
  58. ready_callback=ready_callback)
  59. threading.Thread(target=scanner.start).start()
  60. logger.debug("sleeping until stopping process")
  61. for x in range(10):
  62. time.sleep(1)
  63. scanner.get_rest_time()
  64. logger.debug("now stopping scan")
  65. scanner.stop()
  66. class ZmapWrapperTest(unittest.TestCase):
  67. def test_send(self):
  68. def read_callback(obj):
  69. print("zmap has finished!")
  70. wrapper = scanner_wrapper.ZmapWrapper(mac_gw="00:13:e8:63:f3:8f",
  71. mac_source=None,
  72. interface_name="lo",
  73. marker_encoding=7,
  74. markervalue=4294967296,
  75. markerbits_value=32,
  76. markerbits_checksum=32,
  77. target_addresses="192.168.178.0/24",
  78. ready_callback=read_callback)
  79. wrapper.start()
  80. class ZmapEncoderTest(unittest.TestCase):
  81. def _test_encode_decode_checksum_allmarker(self):
  82. # config: all marker (32 Bit), full checksum (32 Bit)
  83. wrapper = scanner_wrapper.ZmapWrapper(
  84. mac_gw="24:65:11:85:e9:ac",
  85. mac_source="00:13:e8:63:f3:8f",
  86. interface_name="lo",
  87. filename_blacklist_target_ip="./test_files/blacklist_minimal.conf",
  88. marker_encoding=7,
  89. markervalue=4294967294,
  90. #port_dst=12345,
  91. markerbits_value=32,
  92. markerbits_checksum=32,
  93. verbosity=3,
  94. target_addresses="127.0.0.1/32",
  95. )
  96. def start_wrapper_delayed():
  97. time.sleep(2)
  98. wrapper.start()
  99. scanthread = threading.Thread(target=start_wrapper_delayed)
  100. sockethandler = SocketHndl(timeout=5)
  101. scanthread.start()
  102. found = False
  103. for bts in sockethandler:
  104. pkt = ethernet.Ethernet(bts)
  105. logger.info("got packet")
  106. dport = pkt[tcp.TCP].dport
  107. ip_src = pkt[ip.IP].src
  108. sport = pkt[tcp.TCP].sport
  109. #print(fletcher32(b"\xFF\xFF\xFF\xFE", 2))
  110. # 0xFFFF FFFEFFFE FFFE
  111. if dport == 0xFFFF and ip_src == b"\xFF\xFE\xFF\xFE" and sport == 0xFFFE:
  112. logger.info("found encoded packet")
  113. ip_from_marker = pack(">H", dport) + ip_src[:2]
  114. checksum_new = fletcher32(ip_from_marker, 2)
  115. logger.debug(" checksum(%r) = %r" % (ip_from_marker, checksum_new))
  116. checksum_given = unpack(">I", ip_src[2:] + pack(">H", sport))[0]
  117. logger.info("checksums: %r == %r ???" % (checksum_new, checksum_given))
  118. self.assertEqual(checksum_new, checksum_given)
  119. found = True
  120. break
  121. else:
  122. logger.debug("%0X %r %0X" % (dport, ip_src, sport))
  123. self.assertTrue(found)
  124. sockethandler.close()
  125. def test_encode_decode_checksum_onlyports(self):
  126. # config: port marker: dport 16 Bit/sport 8 Bit (24 Bit), checksum (8 Bit)
  127. wrapper = scanner_wrapper.ZmapWrapper(
  128. mac_gw="24:65:11:85:e9:ac",
  129. mac_source="00:13:e8:63:f3:8f",
  130. filename_blacklist_target_ip="./test_files/blacklist_minimal.conf",
  131. interface_name="lo",
  132. marker_encoding=5,
  133. markervalue=4294967294,
  134. markerbits_value=24,
  135. markerbits_checksum=8,
  136. verbosity=3,
  137. target_addresses="127.0.0.1/32",
  138. )
  139. def start_wrapper_delayed():
  140. time.sleep(2)
  141. wrapper.start()
  142. scanthread = threading.Thread(target=start_wrapper_delayed)
  143. sockethandler = SocketHndl(timeout=5)
  144. scanthread.start()
  145. found = False
  146. for bts in sockethandler:
  147. pkt = ethernet.Ethernet(bts)
  148. dport = pkt[tcp.TCP].dport
  149. sport = pkt[tcp.TCP].sport
  150. # Encoding via: destination + source port
  151. # marker value: 0xFFFFFFFE -3 Bytes-> 0xFFFFFF00 -> checksum: 0xFF]00FF00
  152. # -> marker: FFFF FFFF = (dport, sport)
  153. if dport == 0xFFFF and sport == 0xFFFF:
  154. logger.info("!!!!! found encoded packet")
  155. marker_valuer = pack(">H", dport) + pack(">H", sport & 0xFF00)
  156. checksum_new = fletcher32(marker_valuer, 2) >> 24
  157. logger.debug("checksum(%r) = %r" % (marker_valuer, checksum_new))
  158. checksum_given = sport & 0xFF
  159. logger.info("checksums: %r == %r ???" % (checksum_new, checksum_given))
  160. self.assertEqual(checksum_new, checksum_given)
  161. found = True
  162. break
  163. else:
  164. logger.debug("dport/sport = %0X / %0X" % (dport, sport))
  165. self.assertTrue(found)
  166. sockethandler.close()
  167. pack_checksum_4bytes = struct.Struct(">I").pack
  168. class ProbeResponseAttackLogicTest(unittest.TestCase):
  169. def test_multiple(self):
  170. logger.debug("1")
  171. logic = attack_logic.ProbeResponseAttackLogic(
  172. markerbits_value=24,
  173. markerbits_checksum=8,
  174. base_dir_zmap="../zmap",
  175. base_dir_save="./test_files"
  176. )
  177. logic._read_scanner_feedback_addresses()
  178. # 3 bytes will be padded by b"\x00"
  179. bts = b"\01\02\03"
  180. checksum_gen = logic._create_checksum(bts)
  181. checksum_correct = pack_checksum_4bytes(fletcher32(b"\x00" + bts, 2))
  182. self.assertEqual(checksum_gen, checksum_correct)
  183. #
  184. logger.debug("2")
  185. marker = logic._report_values_to_marker("1.2.3.4", 65535, 1024)
  186. self.assertEqual(marker, b"\x04\x00" + b"\01\x02\x03\x04" + b"\xFF\xFF")
  187. #
  188. logger.debug("3")
  189. marker = logic._create_marker(7593)
  190. marker_value = b"\x00\x1d\xa9"
  191. self.assertEqual(marker[0:3], marker_value)
  192. checksum = pack_checksum_4bytes(fletcher32(b"\x00" + marker_value, 2))[-1:]
  193. self.assertEqual(marker, marker_value + checksum)
  194. logger.debug("4")
  195. logic._save_state()
  196. logic._read_state()
  197. class GroupTest(unittest.TestCase):
  198. def test_init(self):
  199. group = Group(ip_network_bytes=b"\01\02\03\00", cidr_bits=31)
  200. group.create_subgroups(2)
  201. self.assertEqual(len(group.subgroups), 2)
  202. group = Group(ip_network_bytes=b"\01\02\03\00", cidr_bits=24)
  203. group.create_subgroups(5)
  204. self.assertEqual(len(group.subgroups), 5)
  205. # 3 valid addresses in range 1.2.3.0/24
  206. ip_objs = [IPv4Address(ip_str)
  207. for ip_str in ["1.2.3.4", "1.2.3.5", "1.2.3.6", "9.9.9.9"]
  208. ]
  209. group = Group(ip_network_bytes=b"\01\02\03\00", cidr_bits=24)
  210. group.create_subgroups(5, ipv4_addresses=ip_objs)
  211. class ChecksumTest(unittest.TestCase):
  212. def test_fletcher32(self):
  213. pack_checksum = struct.Struct(">I").pack
  214. checksum = fletcher32(b"\x00\x00\x00\x00", 2)
  215. checksum_packed = pack_checksum_4bytes(checksum)
  216. self.assertEqual(checksum_packed, b"\xFF\xFF\xFF\xFF")
  217. checksum = fletcher32(b"\xFF\xFF\xFF\xFE", 2)
  218. checksum_packed = pack_checksum_4bytes(checksum)
  219. self.assertEqual(checksum_packed, b"\xFF\xFE\xFF\xFE")
  220. checksum = fletcher32(b"\x00\x02\x03\x04", 2)
  221. checksum_packed = pack_checksum_4bytes(checksum)
  222. self.assertEqual(checksum_packed, b"\x03\x08\x03\x06")
  223. def test_fletcher32_iterate(self):
  224. print("starting to iterate")
  225. pack_4bytes = struct.Struct(">I").pack
  226. for x in range(10100, 10600):
  227. value = pack_4bytes(x << 4)
  228. chk = fletcher32(value, 2)
  229. print("checksum(%s) = %d (%s)" % (value, chk >> 28, pack_4bytes(chk)))
  230. class SimulatorTest(unittest.TestCase):
  231. """The simulator is tested manually"""
  232. def test_simulator(self):
  233. pass
  234. class ZMapSinglePacket(unittest.TestCase):
  235. def test_zmap_single_packet(self):
  236. """
  237. Input/Output for checksum
  238. 0x00000000 0xFFFFFFFF
  239. 0xFFFFFFFF 0xFFFFFFFF
  240. 0xFFFFFFFE 0xFFFEFFFE
  241. 0x00020304 0x03080306
  242. """
  243. wrapper = scanner_wrapper.ZmapWrapper(
  244. mac_gw="24:65:11:85:e9:ac",
  245. mac_source="00:13:e8:63:f3:8f",
  246. interface_name="lo",
  247. rate=1,
  248. marker_encoding=7,
  249. filename_blacklist_target_ip="./test_files/blacklist_minimal.conf",
  250. #markervalue=4294967294,
  251. markervalue=0x00020304,
  252. markerbits_value=32,
  253. markerbits_checksum=32,
  254. verbosity=4,
  255. disable_monitor=1,
  256. target_addresses="127.0.0.1/32",
  257. )
  258. wrapper.start()
  259. class ZMapMassScan(unittest.TestCase):
  260. def test_zmap_single_packet(self):
  261. wrapper = scanner_wrapper.ZmapWrapper(
  262. mac_gw="9e:fd:12:61:48:09",
  263. #mac_source="",
  264. interface_name="eth10",
  265. rate_mbit_per_s=500,
  266. marker_encoding=0,
  267. filename_blacklist_target_ip="./test_files/blacklist_minimal.conf",
  268. markervalue=None,
  269. markerbits_value=32,
  270. markerbits_checksum=32,
  271. verbosity=0,
  272. disable_monitor=1,
  273. #target_addresses=["1.2.3.4/32", "5.6.7.8/32"]
  274. target_addresses=["1.0.0.0/8"]
  275. )
  276. wrapper.start()
  277. from pypacker.psocket import SocketHndl
  278. class TestNativeProbe(unittest.TestCase):
  279. """
  280. Scanning 17.000.000 addresses takes ~45 minutes on a 1,6GHz double core.
  281. Interpolated to a Quadcore with 3GHz this should give ~6 Minutes
  282. ((1/0.012287) * (1438961773.0532002 - 1438961740.421199)) / (60*2*4)
  283. """
  284. def test_send(self):
  285. basepacket = ethernet.Ethernet(dst_s="00:01:02:03:04:05", src_s="00:01:02:03:04:05") +\
  286. ip.IP(src_s="1.1.1.1", dst_s="1.2.3.4") +\
  287. tcp.TCP(sport=50821)
  288. hndl = SocketHndl(iface_name="eth10")
  289. send = hndl.send
  290. iterations = 256**3 - 500000
  291. ip_obj = basepacket.body_handler
  292. tcp_obj = ip_obj.body_handler
  293. basepacket_bin = basepacket.bin
  294. ether_ip_bytes = basepacket.header_bytes + ip_obj.header_bytes
  295. start = time.time()
  296. for cnt in range(iterations):
  297. if cnt % 10000 == 0:
  298. print("%f" % (cnt/(time.time()-start)))
  299. tcp_obj.dport = 1234
  300. #ip_obj.src = b"\x00\x11\x22\x33"
  301. tcp_obj.sport = 1234
  302. send(ether_ip_bytes + tcp_obj.bin())
  303. cnt += 1
  304. print(time.time())
  305. class IPv4AddressTest(unittest.TestCase):
  306. def test_ipv4address(self):
  307. nws = [[IPv4Network(nw_ip_int=0, prefixlen=30), IPv4NetworkIntern("0.0.0.0/30"), 1, IPv4Address(ip_int=3), IPv4AddressIntern("0.0.0.1")],
  308. [IPv4Network(nw_ip_int=0, prefixlen=30), IPv4NetworkIntern("0.0.0.0/30"), 2, IPv4Address(ip_int=2), IPv4AddressIntern("0.0.0.2")],
  309. [IPv4Network(nw_ip_int=0, prefixlen=31), IPv4NetworkIntern("0.0.0.0/31"), 1, IPv4Address(ip_int=1), IPv4AddressIntern("0.0.0.1")],
  310. [IPv4Network(nw_ip_int=2**20 + 2**21, prefixlen=15), IPv4NetworkIntern("0.48.0.0/15"), 5, IPv4Address(ip_int=2**20 + 2**21 + 1), IPv4AddressIntern("0.48.0.1")]
  311. ]
  312. for nw in nws:
  313. logger.debug("%r <-> %r" % (nw[0], nw[1]))
  314. #logger.debug("%r <-> %r" % (len(nw[0]), len(l)))
  315. self.assertEqual(nw[0].compressed, nw[1].compressed)
  316. self.assertTrue(nw[3] in nw[0])
  317. self.assertTrue(nw[4] in nw[1])
  318. sn1 = nw[0].subnets(prefixlen_diff=nw[2])
  319. sn2 = nw[1].subnets(prefixlen_diff=nw[2])
  320. cnt = 0
  321. for sn in sn2:
  322. self.assertEqual(sn1[cnt].compressed, sn.compressed)
  323. cnt += 1
  324. self.assertEqual(cnt, len(sn1))
  325. print("----")
  326. nws = [[IPv4Network(nw_ip_bytes=b"\x00\x00\x00\x00", prefixlen=30), IPv4NetworkIntern("0.0.0.0/30"), 1, IPv4Address(ip_int=3), IPv4AddressIntern("0.0.0.1")],
  327. [IPv4Network(nw_ip_bytes=b"\x00\x00\x00\x00", prefixlen=30), IPv4NetworkIntern("0.0.0.0/30"), 2, IPv4Address(ip_bytes=b"\x00\x00\x00\x02"), IPv4AddressIntern("0.0.0.2")],
  328. [IPv4Network(nw_ip_bytes=b"\x00\x00\x00\x00", prefixlen=31), IPv4NetworkIntern("0.0.0.0/31"), 1, IPv4Address(ip_str="0.0.0.1"), IPv4AddressIntern("0.0.0.1")],
  329. [IPv4Network(nw_ip_int=2**20 + 2**21, prefixlen=15), IPv4NetworkIntern("0.48.0.0/15"), 5, IPv4Address(ip_int=2**20 + 2**21 + 1), IPv4AddressIntern("0.48.0.1")],
  330. [IPv4Network(nw_ip_str="1.2.3.128", prefixlen=31), IPv4NetworkIntern("1.2.3.128/31"), 1, IPv4Address(ip_str="1.2.3.129"), IPv4AddressIntern("1.2.3.129")]
  331. ]
  332. for nw in nws:
  333. logger.debug("%r <-> %r" % (nw[0], nw[1]))
  334. #logger.debug("%r <-> %r" % (len(nw[0]), len(l)))
  335. self.assertEqual(nw[0].compressed, nw[1].compressed)
  336. self.assertTrue(nw[3] in nw[0])
  337. self.assertTrue(nw[4] in nw[1])
  338. sn1 = nw[0].subnets(prefixlen_diff=nw[2])
  339. sn2 = nw[1].subnets(prefixlen_diff=nw[2])
  340. cnt = 0
  341. for sn in sn2:
  342. self.assertEqual(sn1[cnt].compressed, sn.compressed)
  343. cnt += 1
  344. self.assertEqual(cnt, len(sn1))
  345. self.assertEqual(len(IPv4Network(nw_ip_bytes=b"\x00\x00\x00\x00", prefixlen=30).hosts), 4)
  346. self.assertEqual(len(IPv4Network(nw_ip_bytes=b"\x00\x00\x00\x00", prefixlen=29).hosts), 8)
  347. #print("hosts: %r" % IPv4Network(nw_ip_bytes=b"\x00\x02\x00\x00", prefixlen=29).hosts)
  348. def _test_ipv4address_containsin_nwset(self):
  349. nwset = set(IPv4Network(nw_ip_str="1.0.0.0", prefixlen=30).subnets(2))
  350. ipv4addr = IPv4Address(ip_str="0.0.0.1")
  351. print(ipv4addr in nwset)
  352. def _test_ipv4address_performance(self):
  353. repeats = 2000
  354. start = time.time()
  355. for x in range(repeats):
  356. sn = IPv4NetworkIntern("1.2.3.0/24").subnets(5)
  357. for x in sn:
  358. y = x
  359. print("time diff: %f" % (time.time() - start))
  360. start = time.time()
  361. for x in range(repeats):
  362. sn = IPv4Network(nw_ip_str="1.2.3.0", prefixlen=24).subnets(prefixlen_diff=5)
  363. for x in sn:
  364. y = x
  365. print("time diff: %f (should be ~50 times faster)" % (time.time() - start))
  366. def _test_ipv4address_performance2(self):
  367. repeats = 500000
  368. start = time.time()
  369. nw = IPv4Network(nw_ip_str="1.2.3.0", prefixlen=24)
  370. for x in range(repeats):
  371. if x % 10000 == 0:
  372. print(x/repeats)
  373. sn = nw.subnets(prefixlen_diff=8)
  374. g = Group(ip_network_object=sn)
  375. def _test_ipv4address_memory(self):
  376. l = []
  377. total = 256**3
  378. for x in range(total):
  379. if x % 100000 == 0:
  380. print(x/total)
  381. nw = IPv4Network(nw_ip_int=256**3, prefixlen=24)
  382. g = Group(ip_network_object=nw)
  383. l.append(g)
  384. import hashlib
  385. class DShieldNoiseTest(unittest.TestCase):
  386. def test_noise(self):
  387. """
  388. Test noise resilience of various checksums
  389. """
  390. pack_port = struct.Struct(">H").pack
  391. split_tab = re.compile("\t").split
  392. #split_newline = re.compile("\r?\n").split
  393. pack_markervalue = struct.Struct(">I").pack
  394. unpack_4bytes = struct.Struct(">I").unpack
  395. markervalue_length = 28 # XXXX
  396. checksum_length = 4 # XXXX
  397. checksum_mask = (0xFFFFFFFFFFFFFFFF >> (64 - checksum_length))
  398. # Noise results on DShield data
  399. # Noise = amount of unique false values introduced, every unique marker value is counted once as
  400. # additional coutns just increase the response count for a group
  401. #
  402. # fletcher32:
  403. # 4 Bits Checksum = ~1,3% Noise
  404. # 6 Bits Checksum = ~0,6% Noise
  405. # 600 MB DShield report data = ~6.450.129 events -> 1,3% = ~82.861 events
  406. # MD5:
  407. # similar results (see above)
  408. md5 = hashlib.md5
  409. def get_checksum(bts):
  410. return unpack_4bytes(md5(bts).digest()[:4])[0]
  411. def _report_values_to_marker(ip_source, port_src, port_dst):
  412. """
  413. Combines all markers given by a report in the correct order. Unused parts are left out.
  414. return -- markervalue (int), markerchecksum (int), marker (bytes)
  415. """
  416. bts = []
  417. if port_dst is not None:
  418. bts.append(pack_port(port_dst))
  419. if ip_source is not None:
  420. bts.append(ip_str_to_bytes(ip_source))
  421. if port_src is not None:
  422. bts.append(pack_port(port_src))
  423. bts = b"".join(bts)
  424. markervalue_and_checksum = int.from_bytes(bts, "big")
  425. #logger.debug("report full marker: %s=%d" % (bts, markervalue_and_checksum))
  426. # marker value: b"AAAA AAAA AAAA AABB" -> b"00AA AAAA AAAA AAAA"
  427. # marker value: b"AAAA AAAA AAAA AABB" -> b"0000 0000 0000 00BB"
  428. marker_length = 32
  429. return (markervalue_and_checksum >> (marker_length - markervalue_length)),\
  430. markervalue_and_checksum & checksum_mask,\
  431. bts
  432. def _create_checksum_bitlevel(markervalue):
  433. """
  434. Create a checksum using value markervalue
  435. markervalue -- integer to create checksum from (non padded)
  436. return -- checksum as integer
  437. """
  438. marker_value_leftshifted = markervalue << checksum_length
  439. marker_value_bytes_forchecksum = pack_markervalue(marker_value_leftshifted)
  440. #logger.debug("padded marker value before checksum: %s" % marker_padded)
  441. #return pack_checksum(fletcher32(marker_padded, len(marker_padded)/2)), marker_padded
  442. #checksum_int = fletcher32(marker_value_bytes_forchecksum, len(marker_value_bytes_forchecksum)/2) & 0xFFFFFFFF
  443. return fletcher32(marker_value_bytes_forchecksum, 2) >> (32 - checksum_length)
  444. #return get_checksum(marker_value_bytes_forchecksum) >> (32 - checksum_length)
  445. fd = open("./raw_data_dshield/dshield_report_2014_04_23.csv", "r")
  446. firstline = fd.readline()
  447. #print("skipping: %s" % firstline)
  448. cnt_total = 0
  449. cnt_matches = 0
  450. cnt_parsefail = 0
  451. parse_match = {}
  452. for line in fd:
  453. cnt_total += 1
  454. if cnt_total % 100000 == 0:
  455. print("count=%d, matches=%d, ratio=%f parse fail=%d" % (cnt_total, len(parse_match), (len(parse_match)/cnt_total), cnt_parsefail))
  456. columns = split_tab(line)
  457. #print(columns)
  458. try:
  459. ip_source, port_src, port_dst = None, int(columns[4]), int(columns[5])
  460. except:
  461. cnt_parsefail += 1
  462. continue
  463. marker_value_report_int, marker_checksum_report_int, marker_report = _report_values_to_marker(ip_source, port_src, port_dst)
  464. marker_checksum_gen = _create_checksum_bitlevel(marker_value_report_int)
  465. #time.sleep(1)
  466. #print("checking checksum: %d <-> %d" % (marker_checksum_report_int, marker_checksum_gen))
  467. if marker_checksum_report_int == marker_checksum_gen:
  468. #print("there was a match!!!!")
  469. parse_match[marker_value_report_int] = 1
  470. print("count=%d, matches=%d, ratio=%f parse fail=%d" % (cnt_total, cnt_matches, (cnt_matches/cnt_total), cnt_parsefail))
  471. fd.close()
  472. class TracingSimulator(unittest.TestCase):
  473. """
  474. Note:
  475. Test this by starting TraCINg (node index.js) -> connect via report fetcher
  476. (python reportfetcher.py, config for TraCINg) and execute test (python tests.py)
  477. """
  478. def test_tracing_event(self):
  479. monitorsimulator = MonitorSimulator(
  480. amount_monitors=1000,
  481. interface_name="eth10",
  482. buffer_size=10,
  483. url_tracing="https://localhost:443/")
  484. pkt = ethernet.Ethernet() + ip.IP(src_s="1.1.1.1", dst_s="1.2.3.4") + tcp.TCP()
  485. monitorsimulator._attack_reaction(pkt)
  486. import report_fetcher
  487. class DShieldNormalizerTest(unittest.TestCase):
  488. def test_ipnormalizer(self):
  489. print(report_fetcher.DShieldReportFetcher.ip_to_dshield_ip("1.2.3.4"))
  490. print(report_fetcher.DShieldReportFetcher.ip_to_dshield_ip(utility.get_external_ip()))
  491. suite = unittest.TestSuite()
  492. loader = unittest.defaultTestLoader
  493. # suite.addTests(loader.loadTestsFromTestCase(ZmapWrapperTest));
  494. # suite.addTests(loader.loadTestsFromTestCase(ZmapEncoderTest))
  495. # suite.addTests(loader.loadTestsFromTestCase(ProbeResponseAttackLogicTest))
  496. # suite.addTests(loader.loadTestsFromTestCase(GroupTest))
  497. # suite.addTests(loader.loadTestsFromTestCase(ChecksumTest))
  498. #suite.addTests(loader.loadTestsFromTestCase(DShieldNoiseTest))
  499. # suite.addTests(loader.loadTestsFromTestCase(ZMapSinglePacket))
  500. #suite.addTests(loader.loadTestsFromTestCase(ZMapMassScan))
  501. #suite.addTests(loader.loadTestsFromTestCase(TracingSimulator))
  502. #suite.addTests(loader.loadTestsFromTestCase(IPv4AddressTest))
  503. #suite.addTests(loader.loadTestsFromTestCase(TestNativeProbe))
  504. suite.addTests(loader.loadTestsFromTestCase(DShieldNormalizerTest))
  505. if __name__ == '__main__':
  506. logger.info("starting tests")
  507. # unittest.main()
  508. unittest.TextTestRunner().run(suite)