BasicBroParser extends BasicParser { @Override @SuppressWarnings("unchecked") public List<JSONObject> parse(byte[] msg) { _LOG.trace("[Metron] Starting to parse incoming message"); String rawMessage = null; List<JSONObject> messages = new ArrayList<>(); try { rawMessage = new String(msg, getReadCharset()); _LOG.trace("[Metron] Received message: {}", rawMessage); JSONObject cleanedMessage = cleaner.clean(rawMessage); _LOG.debug("[Metron] Cleaned message: {}", cleanedMessage); if (cleanedMessage == null || cleanedMessage.isEmpty()) { throw new Exception("Unable to clean message: " + rawMessage); } String key; JSONObject payload; if (cleanedMessage.containsKey("type")) { key = cleanedMessage.get("type").toString(); payload = cleanedMessage; } else { key = cleanedMessage.keySet().iterator().next().toString(); if (key == null) { throw new Exception("Unable to retrieve key for message: " + rawMessage); } payload = (JSONObject) cleanedMessage.get(key); } if (payload == null) { throw new Exception("Unable to retrieve payload for message: " + rawMessage); } String originalString = key.toUpperCase() + " |"; for (Object k : payload.keySet()) { Object raw = payload.get(k); String value = raw.toString(); if (raw instanceof Double) { value = DECIMAL_FORMAT.get().format(raw); } originalString += " " + k.toString() + ":" + value; } payload.put("original_string", originalString); replaceKey(payload, Constants.Fields.TIMESTAMP.getName(), new String[]{ "ts" }); long timestamp = 0L; if (payload.containsKey(Constants.Fields.TIMESTAMP.getName())) { try { Double broTimestamp = ((Number) payload.get(Constants.Fields.TIMESTAMP.getName())).doubleValue(); String broTimestampFormatted = DECIMAL_FORMAT.get().format(broTimestamp); timestamp = convertToMillis(broTimestamp); payload.put(Constants.Fields.TIMESTAMP.getName(), timestamp); payload.put("bro_timestamp", broTimestampFormatted); _LOG.trace("[Metron] new bro record - timestamp : {}", () -> payload.get(Constants.Fields.TIMESTAMP.getName())); } catch (NumberFormatException nfe) { _LOG.error("[Metron] timestamp is invalid: {}", payload.get("timestamp")); payload.put(Constants.Fields.TIMESTAMP.getName(), 0); } } boolean ipSrcReplaced = replaceKey(payload, Constants.Fields.SRC_ADDR.getName(), new String[]{"source_ip", "id.orig_h"}); if (!ipSrcReplaced) { replaceKeyArray(payload, Constants.Fields.SRC_ADDR.getName(), new String[]{ "tx_hosts" }); } boolean ipDstReplaced = replaceKey(payload, Constants.Fields.DST_ADDR.getName(), new String[]{"dest_ip", "id.resp_h"}); if (!ipDstReplaced) { replaceKeyArray(payload, Constants.Fields.DST_ADDR.getName(), new String[]{ "rx_hosts" }); } replaceKey(payload, Constants.Fields.SRC_PORT.getName(), new String[]{"source_port", "id.orig_p"}); replaceKey(payload, Constants.Fields.DST_PORT.getName(), new String[]{"dest_port", "id.resp_p"}); payload.put(Constants.Fields.PROTOCOL.getName(), key); _LOG.debug("[Metron] Returning parsed message: {}", payload); messages.add(payload); return messages; } catch (Exception e) { String message = "Unable to parse Message: " + rawMessage; _LOG.error(message, e); throw new IllegalStateException(message, e); } }  @Override void configure(Map<String, Object> parserConfig); @Override void init(); @Override @SuppressWarnings("unchecked") List<JSONObject> parse(byte[] msg); static final ThreadLocal<NumberFormat> DECIMAL_FORMAT; }
@Test public void testUnwrappedBroMessage() throws ParseException { JSONObject rawJson = (JSONObject)jsonParser.parse(unwrappedBroMessage); JSONObject broJson = broParser.parse(unwrappedBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1449511228.474"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1449511228474"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port"), rawJson.get("id.orig_p")); assertEquals(broJson.get("ip_dst_port"), rawJson.get("id.resp_p")); assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); assertEquals(broJson.get("sensor").toString(), rawJson.get("sensor").toString()); assertEquals(broJson.get("type").toString(), rawJson.get("type").toString()); assertEquals(broJson.get("rcode").toString(), rawJson.get("rcode").toString()); assertEquals(broJson.get("rcode_name").toString(), rawJson.get("rcode_name").toString()); assertTrue(broJson.get("original_string").toString().startsWith("DNS")); }
@SuppressWarnings("rawtypes") @Test public void testHttpBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(httpBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(httpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1402307733.473"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1402307733473"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); assertEquals(broJson.get("resp_mime_types").toString(), rawJson.get("resp_mime_types").toString()); assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); }
@SuppressWarnings("rawtypes") @Test public void testHttpBroMessageWithZeroDecimalTruncation() throws ParseException { { String rawMessage = "{\"http\": {\"ts\":1467657279,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http: Map rawMessageMap = (Map) jsonParser.parse(rawMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedTimestamp = "1467657279000"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); String expectedBroTimestamp = "1467657279.0"; assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); } { String rawMessage = "{\"http\": {\"ts\":1467657279.0,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http: Map rawMessageMap = (Map) jsonParser.parse(rawMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedTimestamp = "1467657279000"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); String expectedBroTimestamp = "1467657279.0"; assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); } { String rawMessage = "{\"http\": {\"ts\":1467657279.1,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http: Map rawMessageMap = (Map) jsonParser.parse(rawMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedTimestamp = "1467657279100"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); String expectedBroTimestamp = "1467657279.1"; assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); } { String rawMessage = "{\"http\": {\"ts\":1467657279.11,\"uid\":\"CMYLzP3PKiwZAgBa51\",\"id.orig_h\":\"192.168.138.158\",\"id.orig_p\":49206,\"id.resp_h\":\"95.163.121.204\"," + "\"id.resp_p\":80,\"trans_depth\":2,\"method\":\"GET\",\"host\":\"7oqnsnzwwnm6zb7y.gigapaysun.com\",\"uri\":\"/img/flags/it.png\",\"referrer\":\"http: Map rawMessageMap = (Map) jsonParser.parse(rawMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(rawMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedTimestamp = "1467657279110"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); String expectedBroTimestamp = "1467657279.11"; assertEquals(broJson.get("bro_timestamp").toString(), expectedBroTimestamp); } }
@SuppressWarnings("rawtypes") @Test public void testHttpBroDecimalMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(httpBroDecimalMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(httpBroDecimalMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1457149494.166991"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1457149494166"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); assertEquals(broJson.get("resp_mime_types").toString(), rawJson.get("resp_mime_types").toString()); assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); }
@SuppressWarnings("rawtypes") @Test public void testDnsBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(dnsBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(dnsBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1402308259.609"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1402308259609"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("qtype").toString(), rawJson.get("qtype").toString()); assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); assertTrue(broJson.get("original_string").toString().startsWith("DNS")); }
@SuppressWarnings("rawtypes") @Test public void testFilesBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(filesBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(filesBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1425845251.334"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1425845251334"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), ((JSONArray)rawJson.get("tx_hosts")).get(0).toString()); assertEquals(broJson.get("ip_dst_addr").toString(), ((JSONArray)rawJson.get("rx_hosts")).get(0).toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("fuid").toString(), rawJson.get("fuid").toString()); assertEquals(broJson.get("md5").toString(), rawJson.get("md5").toString()); assertEquals(broJson.get("analyzers").toString(), rawJson.get("analyzers").toString()); assertTrue(broJson.get("original_string").toString().startsWith("FILES")); }
@SuppressWarnings("rawtypes") @Test public void testConnBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(connBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(connBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1166289883.163553"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1166289883163"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); assertEquals(broJson.get("service").toString(), rawJson.get("service").toString()); assertEquals(broJson.get("duration").toString(), rawJson.get("duration").toString()); assertEquals(broJson.get("orig_bytes").toString(), rawJson.get("orig_bytes").toString()); assertEquals(broJson.get("resp_bytes").toString(), rawJson.get("resp_bytes").toString()); assertEquals(broJson.get("conn_state").toString(), rawJson.get("conn_state").toString()); assertEquals(broJson.get("missed_bytes").toString(), rawJson.get("missed_bytes").toString()); assertEquals(broJson.get("history").toString(), rawJson.get("history").toString()); assertEquals(broJson.get("orig_pkts").toString(), rawJson.get("orig_pkts").toString()); assertEquals(broJson.get("orig_ip_bytes").toString(), rawJson.get("orig_ip_bytes").toString()); assertEquals(broJson.get("resp_pkts").toString(), rawJson.get("resp_pkts").toString()); assertEquals(broJson.get("resp_ip_bytes").toString(), rawJson.get("resp_ip_bytes").toString()); assertEquals(broJson.get("tunnel_parents").toString(), rawJson.get("tunnel_parents").toString()); assertTrue(broJson.get("original_string").toString().startsWith("CONN")); }
@SuppressWarnings("rawtypes") @Test public void testDpdBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(dpdBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(dpdBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216704078.712276"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216704078712"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); assertEquals(broJson.get("analyzer").toString(), rawJson.get("analyzer").toString()); assertEquals(broJson.get("failure_reason").toString(), rawJson.get("failure_reason").toString()); assertTrue(broJson.get("original_string").toString().startsWith("DPD")); }
@SuppressWarnings("rawtypes") @Test public void testFtpBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(ftpBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(ftpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1166289883.164645"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1166289883164"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("user").toString(), rawJson.get("user").toString()); assertEquals(broJson.get("password").toString(), rawJson.get("password").toString()); assertEquals(broJson.get("command").toString(), rawJson.get("command").toString()); assertEquals(broJson.get("arg").toString(), rawJson.get("arg").toString()); assertEquals(broJson.get("mime_type").toString(), rawJson.get("mime_type").toString()); assertEquals(broJson.get("file_size").toString(), rawJson.get("file_size").toString()); assertEquals(broJson.get("reply_code").toString(), rawJson.get("reply_code").toString()); assertEquals(broJson.get("reply_msg").toString(), rawJson.get("reply_msg").toString()); assertEquals(broJson.get("fuid").toString(), rawJson.get("fuid").toString()); assertTrue(broJson.get("original_string").toString().startsWith("FTP")); }
@SuppressWarnings("rawtypes") @Test public void testKnownCertsBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(knownCertsBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(knownCertsBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216706999.896836"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216706999896"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); assertEquals(broJson.get("port_num").toString(), rawJson.get("port_num").toString()); assertEquals(broJson.get("subject").toString(), rawJson.get("subject").toString()); assertEquals(broJson.get("issuer_subject").toString(), rawJson.get("issuer_subject").toString()); assertEquals(broJson.get("serial").toString(), rawJson.get("serial").toString()); assertTrue(broJson.get("original_string").toString().startsWith("KNOWN_CERTS")); }
@SuppressWarnings("rawtypes") @Test public void testSmtpBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(smtpBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(smtpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1258568059.130219"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1258568059130"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("trans_depth").toString(), rawJson.get("trans_depth").toString()); assertEquals(broJson.get("helo").toString(), rawJson.get("helo").toString()); assertEquals(broJson.get("last_reply").toString(), rawJson.get("last_reply").toString()); assertEquals(broJson.get("path").toString(), rawJson.get("path").toString()); assertEquals(broJson.get("tls").toString(), rawJson.get("tls").toString()); assertEquals(broJson.get("fuids").toString(), rawJson.get("fuids").toString()); assertEquals(broJson.get("is_webmail").toString(), rawJson.get("is_webmail").toString()); assertTrue(broJson.get("original_string").toString().startsWith("SMTP")); }
@SuppressWarnings("rawtypes") @Test public void testSslBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(sslBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(sslBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216706999.444925"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216706999444"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("version").toString(), rawJson.get("version").toString()); assertEquals(broJson.get("cipher").toString(), rawJson.get("cipher").toString()); assertEquals(broJson.get("server_name").toString(), rawJson.get("server_name").toString()); assertEquals(broJson.get("resumed").toString(), rawJson.get("resumed").toString()); assertEquals(broJson.get("established").toString(), rawJson.get("established").toString()); assertEquals(broJson.get("cert_chain_fuids").toString(), rawJson.get("cert_chain_fuids").toString()); assertEquals(broJson.get("client_cert_chain_fuids").toString(), rawJson.get("client_cert_chain_fuids").toString()); assertEquals(broJson.get("subject").toString(), rawJson.get("subject").toString()); assertEquals(broJson.get("issuer").toString(), rawJson.get("issuer").toString()); assertEquals(broJson.get("validation_status").toString(), rawJson.get("validation_status").toString()); assertTrue(broJson.get("original_string").toString().startsWith("SSL")); }
@SuppressWarnings("rawtypes") @Test public void testWeirdBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(weirdBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(weirdBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216706886.239896"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216706886239"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); assertEquals(broJson.get("notice").toString(), rawJson.get("notice").toString()); assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); assertTrue(broJson.get("original_string").toString().startsWith("WEIRD")); }
@SuppressWarnings("rawtypes") @Test public void testNoticeBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(noticeBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(noticeBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216706377.196728"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216706377196"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("proto").toString(), rawJson.get("proto").toString()); assertEquals(broJson.get("note").toString(), rawJson.get("note").toString()); assertEquals(broJson.get("msg").toString(), rawJson.get("msg").toString()); assertEquals(broJson.get("sub").toString(), rawJson.get("sub").toString()); assertEquals(broJson.get("src").toString(), rawJson.get("src").toString()); assertEquals(broJson.get("dst").toString(), rawJson.get("dst").toString()); assertEquals(broJson.get("p").toString(), rawJson.get("p").toString()); assertEquals(broJson.get("peer_descr").toString(), rawJson.get("peer_descr").toString()); assertEquals(broJson.get("actions").toString(), rawJson.get("actions").toString()); assertEquals(broJson.get("suppress_for").toString(), rawJson.get("suppress_for").toString()); assertEquals(broJson.get("dropped").toString(), rawJson.get("dropped").toString()); assertTrue(broJson.get("original_string").toString().startsWith("NOTICE")); }
@SuppressWarnings("rawtypes") @Test public void testDhcpBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(dhcpBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(dhcpBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1258567562.944638"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1258567562944"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("mac").toString(), rawJson.get("mac").toString()); assertEquals(broJson.get("assigned_ip").toString(), rawJson.get("assigned_ip").toString()); assertEquals(broJson.get("lease_time").toString(), rawJson.get("lease_time").toString()); assertEquals(broJson.get("trans_id").toString(), rawJson.get("trans_id").toString()); assertTrue(broJson.get("original_string").toString().startsWith("DHCP")); }
@SuppressWarnings("rawtypes") @Test public void testSshBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(sshBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(sshBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1320435870.747967"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1320435870747"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("version").toString(), rawJson.get("version").toString()); assertEquals(broJson.get("auth_success").toString(), rawJson.get("auth_success").toString()); assertEquals(broJson.get("client").toString(), rawJson.get("client").toString()); assertEquals(broJson.get("server").toString(), rawJson.get("server").toString()); assertEquals(broJson.get("cipher_alg").toString(), rawJson.get("cipher_alg").toString()); assertEquals(broJson.get("mac_alg").toString(), rawJson.get("mac_alg").toString()); assertEquals(broJson.get("compression_alg").toString(), rawJson.get("compression_alg").toString()); assertEquals(broJson.get("kex_alg").toString(), rawJson.get("kex_alg").toString()); assertEquals(broJson.get("host_key_alg").toString(), rawJson.get("host_key_alg").toString()); assertEquals(broJson.get("host_key").toString(), rawJson.get("host_key").toString()); assertTrue(broJson.get("original_string").toString().startsWith("SSH")); }
@SuppressWarnings("rawtypes") @Test public void testSoftwareBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(softwareBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(softwareBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216707079.49066"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216707079490"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); assertEquals(broJson.get("host_p").toString(), rawJson.get("host_p").toString()); assertEquals(broJson.get("software_type").toString(), rawJson.get("software_type").toString()); assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); assertEquals(broJson.get("version.major").toString(), rawJson.get("version.major").toString()); assertEquals(broJson.get("version.minor").toString(), rawJson.get("version.minor").toString()); assertEquals(broJson.get("version.minor2").toString(), rawJson.get("version.minor2").toString()); assertEquals(broJson.get("unparsed_version").toString(), rawJson.get("unparsed_version").toString()); assertTrue(broJson.get("original_string").toString().startsWith("SOFTWARE")); }
@SuppressWarnings("rawtypes") @Test public void testSoftwareBroMessage2() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(softwareBroMessage2); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(softwareBroMessage2.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216707079.518447"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216707079518"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("host").toString(), rawJson.get("host").toString()); assertEquals(broJson.get("host_p").toString(), rawJson.get("host_p").toString()); assertEquals(broJson.get("software_type").toString(), rawJson.get("software_type").toString()); assertEquals(broJson.get("name").toString(), rawJson.get("name").toString()); assertEquals(broJson.get("unparsed_version").toString(), rawJson.get("unparsed_version").toString()); assertTrue(broJson.get("original_string").toString().startsWith("SOFTWARE")); }
@SuppressWarnings("rawtypes") @Test public void testRadiusBroMessageFailed() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(radiusBroMessageFailed); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(radiusBroMessageFailed.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1440447766.441298"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1440447766441"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("username").toString(), rawJson.get("username").toString()); assertEquals(broJson.get("result").toString(), rawJson.get("result").toString()); assertTrue(broJson.get("original_string").toString().startsWith("RADIUS")); }
@SuppressWarnings("rawtypes") @Test public void testRadiusBroMessageSuccess() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(radiusBroMessageSuccess); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(radiusBroMessageSuccess.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1440447839.947956"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1440447839947"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("username").toString(), rawJson.get("username").toString()); assertEquals(broJson.get("result").toString(), rawJson.get("result").toString()); assertTrue(broJson.get("original_string").toString().startsWith("RADIUS")); }
@SuppressWarnings("rawtypes") @Test public void testX509BroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(x509BroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(x509BroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216706999.661483"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216706999661"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("id").toString(), rawJson.get("id").toString()); assertEquals(broJson.get("certificate.version").toString(), rawJson.get("certificate.version").toString()); assertEquals(broJson.get("certificate.serial").toString(), rawJson.get("certificate.serial").toString()); assertEquals(broJson.get("certificate.subject").toString(), rawJson.get("certificate.subject").toString()); assertEquals(broJson.get("certificate.issuer").toString(), rawJson.get("certificate.issuer").toString()); assertEquals(broJson.get("certificate.not_valid_before").toString(), rawJson.get("certificate.not_valid_before").toString()); assertEquals(broJson.get("certificate.not_valid_after").toString(), rawJson.get("certificate.not_valid_after").toString()); assertEquals(broJson.get("certificate.key_alg").toString(), rawJson.get("certificate.key_alg").toString()); assertEquals(broJson.get("certificate.sig_alg").toString(), rawJson.get("certificate.sig_alg").toString()); assertEquals(broJson.get("certificate.key_type").toString(), rawJson.get("certificate.key_type").toString()); assertEquals(broJson.get("certificate.key_length").toString(), rawJson.get("certificate.key_length").toString()); assertEquals(broJson.get("certificate.exponent").toString(), rawJson.get("certificate.exponent").toString()); assertEquals(broJson.get("basic_constraints.ca").toString(), rawJson.get("basic_constraints.ca").toString()); assertEquals(broJson.get("basic_constraints.path_len").toString(), rawJson.get("basic_constraints.path_len").toString()); assertTrue(broJson.get("original_string").toString().startsWith("X509")); }
@SuppressWarnings("rawtypes") @Test public void testKnownDevicesBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(knownDevicesBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(knownDevicesBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1258532046.693816"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1258532046693"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("mac").toString(), rawJson.get("mac").toString()); assertEquals(broJson.get("dhcp_host_name").toString(), rawJson.get("dhcp_host_name").toString()); assertTrue(broJson.get("original_string").toString().startsWith("KNOWN_DEVICES")); }
@SuppressWarnings("rawtypes") @Test public void testRfbBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(rfbBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(rfbBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1328634261.675248"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1328634261675"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertEquals(broJson.get("client_major_version").toString(), rawJson.get("client_major_version").toString()); assertEquals(broJson.get("client_minor_version").toString(), rawJson.get("client_minor_version").toString()); assertEquals(broJson.get("server_major_version").toString(), rawJson.get("server_major_version").toString()); assertEquals(broJson.get("server_minor_version").toString(), rawJson.get("server_minor_version").toString()); assertEquals(broJson.get("authentication_method").toString(), rawJson.get("authentication_method").toString()); assertEquals(broJson.get("auth").toString(), rawJson.get("auth").toString()); assertEquals(broJson.get("share_flag").toString(), rawJson.get("share_flag").toString()); assertEquals(broJson.get("desktop_name").toString(), rawJson.get("desktop_name").toString()); assertEquals(broJson.get("width").toString(), rawJson.get("width").toString()); assertEquals(broJson.get("height").toString(), rawJson.get("height").toString()); }
@SuppressWarnings("rawtypes") @Test public void testStatsBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(statsBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(statsBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1440447766.440305"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1440447766440"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); assertEquals(broJson.get("mem").toString(), rawJson.get("mem").toString()); assertEquals(broJson.get("pkts_proc").toString(), rawJson.get("pkts_proc").toString()); assertEquals(broJson.get("bytes_recv").toString(), rawJson.get("bytes_recv").toString()); assertEquals(broJson.get("events_proc").toString(), rawJson.get("events_proc").toString()); assertEquals(broJson.get("events_queued").toString(), rawJson.get("events_queued").toString()); assertEquals(broJson.get("active_tcp_conns").toString(), rawJson.get("active_tcp_conns").toString()); assertEquals(broJson.get("active_udp_conns").toString(), rawJson.get("active_udp_conns").toString()); assertEquals(broJson.get("active_icmp_conns").toString(), rawJson.get("active_icmp_conns").toString()); assertEquals(broJson.get("tcp_conns").toString(), rawJson.get("tcp_conns").toString()); assertEquals(broJson.get("udp_conns").toString(), rawJson.get("udp_conns").toString()); assertEquals(broJson.get("icmp_conns").toString(), rawJson.get("icmp_conns").toString()); assertEquals(broJson.get("timers").toString(), rawJson.get("timers").toString()); assertEquals(broJson.get("active_timers").toString(), rawJson.get("active_timers").toString()); assertEquals(broJson.get("files").toString(), rawJson.get("files").toString()); assertEquals(broJson.get("active_files").toString(), rawJson.get("active_files").toString()); assertEquals(broJson.get("dns_requests").toString(), rawJson.get("dns_requests").toString()); assertEquals(broJson.get("active_dns_requests").toString(), rawJson.get("active_dns_requests").toString()); assertEquals(broJson.get("reassem_tcp_size").toString(), rawJson.get("reassem_tcp_size").toString()); assertEquals(broJson.get("reassem_file_size").toString(), rawJson.get("reassem_file_size").toString()); assertEquals(broJson.get("reassem_frag_size").toString(), rawJson.get("reassem_frag_size").toString()); assertEquals(broJson.get("reassem_unknown_size").toString(), rawJson.get("reassem_unknown_size").toString()); }
@SuppressWarnings("rawtypes") @Test public void testCaptureLossBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(captureLossBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(captureLossBroMessage.getBytes( StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1320435958.419451"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1320435958419"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("ts_delta").toString(), rawJson.get("ts_delta").toString()); assertEquals(broJson.get("peer").toString(), rawJson.get("peer").toString()); assertEquals(broJson.get("gaps").toString(), rawJson.get("gaps").toString()); assertEquals(broJson.get("acks").toString(), rawJson.get("acks").toString()); assertEquals(broJson.get("percent_lost").toString(), rawJson.get("percent_lost").toString()); }
@SuppressWarnings("rawtypes") @Test public void testSipBroMessage() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(sipBroMessage); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(sipBroMessage.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1216698441.346819"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1216698441346"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertTrue(broJson.get("original_string").toString().startsWith(rawMessageMap.keySet().iterator().next().toString().toUpperCase())); assertEquals(broJson.get("uid").toString(), rawJson.get("uid").toString()); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertEquals(broJson.get("trans_depth").toString(), rawJson.get("trans_depth").toString()); assertEquals(broJson.get("method").toString(), rawJson.get("method").toString()); assertEquals(broJson.get("uri").toString(), rawJson.get("uri").toString()); assertEquals(broJson.get("request_from").toString(), rawJson.get("request_from").toString()); assertEquals(broJson.get("request_to").toString(), rawJson.get("request_to").toString()); assertEquals(broJson.get("response_from").toString(), rawJson.get("response_from").toString()); assertEquals(broJson.get("response_to").toString(), rawJson.get("response_to").toString()); assertEquals(broJson.get("call_id").toString(), rawJson.get("call_id").toString()); assertEquals(broJson.get("seq").toString(), rawJson.get("seq").toString()); assertEquals(broJson.get("request_path").toString(), rawJson.get("request_path").toString()); assertEquals(broJson.get("response_path").toString(), rawJson.get("response_path").toString()); assertEquals(broJson.get("user_agent").toString(), rawJson.get("user_agent").toString()); assertEquals(broJson.get("status_code").toString(), rawJson.get("status_code").toString()); assertEquals(broJson.get("status_msg").toString(), rawJson.get("status_msg").toString()); assertEquals(broJson.get("request_body_len").toString(), rawJson.get("request_body_len").toString()); assertEquals(broJson.get("response_body_len").toString(), rawJson.get("response_body_len").toString()); }
@SuppressWarnings("rawtypes") @Test public void testProtocolKeyCleanedUp() throws ParseException { Map rawMessageMap = (Map) jsonParser.parse(protocolKeyCleanedUp); JSONObject rawJson = (JSONObject) rawMessageMap.get(rawMessageMap.keySet().iterator().next()); JSONObject broJson = broParser.parse(protocolKeyCleanedUp.getBytes(StandardCharsets.UTF_8)).get(0); String expectedBroTimestamp = "1402307733.473"; assertEquals(broJson.get("bro_timestamp"), expectedBroTimestamp); String expectedTimestamp = "1402307733473"; assertEquals(broJson.get("timestamp").toString(), expectedTimestamp); assertEquals(broJson.get("ip_src_addr").toString(), rawJson.get("id.orig_h").toString()); assertEquals(broJson.get("ip_dst_addr").toString(), rawJson.get("id.resp_h").toString()); assertEquals(broJson.get("ip_src_port").toString(), rawJson.get("id.orig_p").toString()); assertEquals(broJson.get("ip_dst_port").toString(), rawJson.get("id.resp_p").toString()); assertTrue(broJson.get("original_string").toString().startsWith("HTTP")); }
@Test public void testBadMessage() { assertThrows(IllegalStateException.class, () -> broParser.parse("{ \"foo\" : \"bar\"}".getBytes(StandardCharsets.UTF_8))); }
@Test public void testBadMessageNonJson() { assertThrows(IllegalStateException.class, () -> broParser.parse("foo bar".getBytes(StandardCharsets.UTF_8))); }