Rename Concelier Source modules to Connector
This commit is contained in:
master
@@ -0,0 +1,18 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<title>ACME Corp controllers multiple vulnerabilities</title>
|
||||
</head>
|
||||
<body>
|
||||
<article>
|
||||
<h1>ACME Corp controllers multiple vulnerabilities</h1>
|
||||
<p>Researchers identified that ACME Corp ICS controller models X100 and X200 are affected by improper access controls.</p>
|
||||
<p>Exploitation of CVE-2024-7777 can allow authenticated attackers to execute arbitrary commands. Additional details are provided in CVE-2024-8888.</p>
|
||||
<ul>
|
||||
<li>Vendor: ACME Corp</li>
|
||||
<li>Affected models: X100, X200</li>
|
||||
</ul>
|
||||
</article>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,515 @@
|
||||
{
|
||||
"advisoryKey": "acme-controller-2024",
|
||||
"affectedPackages": [
|
||||
{
|
||||
"identifier": "2024",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "2024"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "2024"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "2024"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "7777 can allow authenticated attackers to execute arbitrary commands",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "7777 can allow authenticated attackers to execute arbitrary commands"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "7777 can allow authenticated attackers to execute arbitrary commands"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "7777 can allow authenticated attackers to execute arbitrary commands"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "7777)",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "7777)"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "7777)"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "7777)"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "8888",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "8888"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "8888"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "8888"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "ACME Corp",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "ACME Corp"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "ACME Corp Affected models",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp Affected models"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "ACME Corp Affected models"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp Affected models"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "ACME Corp industrial",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp industrial"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "ACME Corp industrial"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "ACME Corp industrial"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "Additional details are provided in CVE",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Additional details are provided in CVE"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "Additional details are provided in CVE"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Additional details are provided in CVE"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "Exploitation of CVE",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Exploitation of CVE"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "Exploitation of CVE"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Exploitation of CVE"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "Vendor",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Vendor"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "Vendor"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "Vendor"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"identifier": "X100, X200",
|
||||
"platform": null,
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "X100, X200"
|
||||
}
|
||||
],
|
||||
"statuses": [],
|
||||
"type": "ics-vendor",
|
||||
"versionRanges": [
|
||||
{
|
||||
"fixedVersion": null,
|
||||
"introducedVersion": null,
|
||||
"lastAffectedVersion": null,
|
||||
"primitives": {
|
||||
"evr": null,
|
||||
"hasVendorExtensions": true,
|
||||
"nevra": null,
|
||||
"semVer": null,
|
||||
"vendorExtensions": {
|
||||
"ics.vendor": "X100, X200"
|
||||
}
|
||||
},
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "affected",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "X100, X200"
|
||||
},
|
||||
"rangeExpression": null,
|
||||
"rangeKind": "vendor"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2024-7777",
|
||||
"CVE-2024-8888",
|
||||
"acme-controller-2024"
|
||||
],
|
||||
"cvssMetrics": [],
|
||||
"exploitKnown": false,
|
||||
"language": "en",
|
||||
"modified": "2024-10-15T10:00:00+00:00",
|
||||
"provenance": [
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "document",
|
||||
"recordedAt": "2024-10-20T00:00:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "https://ics-cert.example/advisories/acme-controller-2024/"
|
||||
},
|
||||
{
|
||||
"fieldMask": [],
|
||||
"kind": "mapping",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "acme-controller-2024"
|
||||
}
|
||||
],
|
||||
"published": "2024-10-15T10:00:00+00:00",
|
||||
"references": [
|
||||
{
|
||||
"kind": "advisory",
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "reference",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "https://ics-cert.example/advisories/acme-controller-2024/"
|
||||
},
|
||||
"sourceTag": "kaspersky-ics",
|
||||
"summary": null,
|
||||
"url": "https://ics-cert.example/advisories/acme-controller-2024/"
|
||||
},
|
||||
{
|
||||
"kind": "advisory",
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "reference",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "https://www.cve.org/CVERecord?id=CVE-2024-7777"
|
||||
},
|
||||
"sourceTag": "CVE-2024-7777",
|
||||
"summary": null,
|
||||
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7777"
|
||||
},
|
||||
{
|
||||
"kind": "advisory",
|
||||
"provenance": {
|
||||
"fieldMask": [],
|
||||
"kind": "reference",
|
||||
"recordedAt": "2024-10-20T00:01:00+00:00",
|
||||
"source": "ics-kaspersky",
|
||||
"value": "https://www.cve.org/CVERecord?id=CVE-2024-8888"
|
||||
},
|
||||
"sourceTag": "CVE-2024-8888",
|
||||
"summary": null,
|
||||
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8888"
|
||||
}
|
||||
],
|
||||
"severity": null,
|
||||
"summary": "ACME Corp industrial controllers allow remote compromise (CVE-2024-7777).",
|
||||
"title": "ACME Corp controllers multiple vulnerabilities"
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<rss version="2.0"
|
||||
xmlns:content="http://purl.org/rss/1.0/modules/content/"
|
||||
xmlns:dc="http://purl.org/dc/elements/1.1/">
|
||||
<channel>
|
||||
<title>Kaspersky ICS CERT - Advisories</title>
|
||||
<link>https://ics-cert.kaspersky.com/feed-advisories/</link>
|
||||
<description>Test feed</description>
|
||||
<item>
|
||||
<title>ACME Corp controllers multiple vulnerabilities</title>
|
||||
<link>https://ics-cert.example/advisories/acme-controller-2024/</link>
|
||||
<description><![CDATA[ACME Corp industrial controllers allow remote compromise (CVE-2024-7777).]]></description>
|
||||
<pubDate>Tue, 15 Oct 2024 10:00:00 +0000</pubDate>
|
||||
<dc:creator>Kaspersky ICS CERT</dc:creator>
|
||||
</item>
|
||||
</channel>
|
||||
</rss>
|
||||
@@ -0,0 +1,346 @@
|
||||
using System.Collections.Generic;
|
||||
using System.Globalization;
|
||||
using System.IO;
|
||||
using System.Net;
|
||||
using System.Net.Http;
|
||||
using System.Net.Http.Headers;
|
||||
using System.Text;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.Extensions.Http;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Microsoft.Extensions.Options;
|
||||
using Microsoft.Extensions.Time.Testing;
|
||||
using MongoDB.Bson;
|
||||
using StellaOps.Concelier.Models;
|
||||
using StellaOps.Concelier.Connector.Common.Fetch;
|
||||
using StellaOps.Concelier.Connector.Common.Http;
|
||||
using StellaOps.Concelier.Connector.Common.Testing;
|
||||
using StellaOps.Concelier.Connector.Common;
|
||||
using StellaOps.Concelier.Connector.Ics.Kaspersky;
|
||||
using StellaOps.Concelier.Connector.Ics.Kaspersky.Configuration;
|
||||
using StellaOps.Concelier.Storage.Mongo;
|
||||
using StellaOps.Concelier.Storage.Mongo.Advisories;
|
||||
using StellaOps.Concelier.Storage.Mongo.Documents;
|
||||
using StellaOps.Concelier.Storage.Mongo.Dtos;
|
||||
using StellaOps.Concelier.Testing;
|
||||
|
||||
namespace StellaOps.Concelier.Connector.Ics.Kaspersky.Tests;
|
||||
|
||||
[Collection("mongo-fixture")]
|
||||
public sealed class KasperskyConnectorTests : IAsyncLifetime
|
||||
{
|
||||
private readonly MongoIntegrationFixture _fixture;
|
||||
private readonly FakeTimeProvider _timeProvider;
|
||||
private readonly CannedHttpMessageHandler _handler;
|
||||
private ServiceProvider? _serviceProvider;
|
||||
|
||||
public KasperskyConnectorTests(MongoIntegrationFixture fixture)
|
||||
{
|
||||
_fixture = fixture;
|
||||
_timeProvider = new FakeTimeProvider(new DateTimeOffset(2024, 10, 20, 0, 0, 0, TimeSpan.Zero));
|
||||
_handler = new CannedHttpMessageHandler();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task FetchParseMap_CreatesSnapshot()
|
||||
{
|
||||
var options = new KasperskyOptions
|
||||
{
|
||||
FeedUri = new Uri("https://ics-cert.example/feed-advisories/", UriKind.Absolute),
|
||||
WindowSize = TimeSpan.FromDays(30),
|
||||
WindowOverlap = TimeSpan.FromDays(1),
|
||||
MaxPagesPerFetch = 1,
|
||||
RequestDelay = TimeSpan.Zero,
|
||||
};
|
||||
|
||||
await EnsureServiceProviderAsync(options);
|
||||
var provider = _serviceProvider!;
|
||||
|
||||
_handler.Clear();
|
||||
|
||||
_handler.AddTextResponse(options.FeedUri, ReadFixture("feed-page1.xml"), "application/rss+xml");
|
||||
var detailUri = new Uri("https://ics-cert.example/advisories/acme-controller-2024/");
|
||||
_handler.AddTextResponse(detailUri, ReadFixture("detail-acme-controller-2024.html"), "text/html");
|
||||
|
||||
var connector = new KasperskyConnectorPlugin().Create(provider);
|
||||
|
||||
await connector.FetchAsync(provider, CancellationToken.None);
|
||||
|
||||
_timeProvider.Advance(TimeSpan.FromMinutes(1));
|
||||
await connector.ParseAsync(provider, CancellationToken.None);
|
||||
|
||||
await connector.MapAsync(provider, CancellationToken.None);
|
||||
|
||||
var advisoryStore = provider.GetRequiredService<IAdvisoryStore>();
|
||||
var advisories = await advisoryStore.GetRecentAsync(5, CancellationToken.None);
|
||||
Assert.Single(advisories);
|
||||
var canonical = SnapshotSerializer.ToSnapshot(advisories.Single());
|
||||
var expected = ReadFixture("expected-advisory.json");
|
||||
var normalizedExpected = NormalizeLineEndings(expected);
|
||||
var normalizedActual = NormalizeLineEndings(canonical);
|
||||
if (!string.Equals(normalizedExpected, normalizedActual, StringComparison.Ordinal))
|
||||
{
|
||||
var actualPath = Path.Combine(AppContext.BaseDirectory, "Source", "Ics", "Kaspersky", "Fixtures", "expected-advisory.actual.json");
|
||||
Directory.CreateDirectory(Path.GetDirectoryName(actualPath)!);
|
||||
File.WriteAllText(actualPath, canonical);
|
||||
}
|
||||
|
||||
Assert.Equal(normalizedExpected, normalizedActual);
|
||||
|
||||
var documentStore = provider.GetRequiredService<IDocumentStore>();
|
||||
var document = await documentStore.FindBySourceAndUriAsync(KasperskyConnectorPlugin.SourceName, detailUri.ToString(), CancellationToken.None);
|
||||
Assert.NotNull(document);
|
||||
Assert.Equal(DocumentStatuses.Mapped, document!.Status);
|
||||
|
||||
var stateRepository = provider.GetRequiredService<ISourceStateRepository>();
|
||||
var state = await stateRepository.TryGetAsync(KasperskyConnectorPlugin.SourceName, CancellationToken.None);
|
||||
Assert.NotNull(state);
|
||||
var pendingDocuments = state!.Cursor.TryGetValue("pendingDocuments", out var pending)
|
||||
? pending.AsBsonArray
|
||||
: new BsonArray();
|
||||
Assert.Empty(pendingDocuments);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task FetchFailure_RecordsBackoff()
|
||||
{
|
||||
var options = new KasperskyOptions
|
||||
{
|
||||
FeedUri = new Uri("https://ics-cert.example/feed-advisories/", UriKind.Absolute),
|
||||
WindowSize = TimeSpan.FromDays(30),
|
||||
WindowOverlap = TimeSpan.FromDays(1),
|
||||
MaxPagesPerFetch = 1,
|
||||
RequestDelay = TimeSpan.Zero,
|
||||
};
|
||||
|
||||
await EnsureServiceProviderAsync(options);
|
||||
var provider = _serviceProvider!;
|
||||
_handler.Clear();
|
||||
_handler.AddResponse(options.FeedUri, () => new HttpResponseMessage(HttpStatusCode.InternalServerError)
|
||||
{
|
||||
Content = new StringContent("feed error", Encoding.UTF8, "text/plain"),
|
||||
});
|
||||
|
||||
var connector = new KasperskyConnectorPlugin().Create(provider);
|
||||
|
||||
await Assert.ThrowsAsync<HttpRequestException>(() => connector.FetchAsync(provider, CancellationToken.None));
|
||||
|
||||
var stateRepository = provider.GetRequiredService<ISourceStateRepository>();
|
||||
var state = await stateRepository.TryGetAsync(KasperskyConnectorPlugin.SourceName, CancellationToken.None);
|
||||
Assert.NotNull(state);
|
||||
Assert.Equal(1, state!.FailCount);
|
||||
Assert.NotNull(state.LastFailureReason);
|
||||
Assert.Contains("500", state.LastFailureReason, StringComparison.Ordinal);
|
||||
Assert.True(state.BackoffUntil.HasValue);
|
||||
Assert.True(state.BackoffUntil!.Value > _timeProvider.GetUtcNow());
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Fetch_NotModifiedMaintainsDocumentState()
|
||||
{
|
||||
var options = new KasperskyOptions
|
||||
{
|
||||
FeedUri = new Uri("https://ics-cert.example/feed-advisories/", UriKind.Absolute),
|
||||
WindowSize = TimeSpan.FromDays(30),
|
||||
WindowOverlap = TimeSpan.FromDays(1),
|
||||
MaxPagesPerFetch = 1,
|
||||
RequestDelay = TimeSpan.Zero,
|
||||
};
|
||||
|
||||
await EnsureServiceProviderAsync(options);
|
||||
var provider = _serviceProvider!;
|
||||
_handler.Clear();
|
||||
|
||||
var feedXml = ReadFixture("feed-page1.xml");
|
||||
var detailUri = new Uri("https://ics-cert.example/advisories/acme-controller-2024/");
|
||||
var detailHtml = ReadFixture("detail-acme-controller-2024.html");
|
||||
var etag = new EntityTagHeaderValue("\"ics-2024-acme\"");
|
||||
var lastModified = new DateTimeOffset(2024, 10, 15, 10, 0, 0, TimeSpan.Zero);
|
||||
|
||||
_handler.AddTextResponse(options.FeedUri, feedXml, "application/rss+xml");
|
||||
_handler.AddResponse(detailUri, () =>
|
||||
{
|
||||
var response = new HttpResponseMessage(HttpStatusCode.OK)
|
||||
{
|
||||
Content = new StringContent(detailHtml, Encoding.UTF8, "text/html"),
|
||||
};
|
||||
response.Headers.ETag = etag;
|
||||
response.Content.Headers.LastModified = lastModified;
|
||||
return response;
|
||||
});
|
||||
|
||||
var connector = new KasperskyConnectorPlugin().Create(provider);
|
||||
|
||||
await connector.FetchAsync(provider, CancellationToken.None);
|
||||
_timeProvider.Advance(TimeSpan.FromMinutes(1));
|
||||
await connector.ParseAsync(provider, CancellationToken.None);
|
||||
await connector.MapAsync(provider, CancellationToken.None);
|
||||
|
||||
var documentStore = provider.GetRequiredService<IDocumentStore>();
|
||||
var document = await documentStore.FindBySourceAndUriAsync(KasperskyConnectorPlugin.SourceName, detailUri.ToString(), CancellationToken.None);
|
||||
Assert.NotNull(document);
|
||||
Assert.Equal(DocumentStatuses.Mapped, document!.Status);
|
||||
|
||||
_handler.AddTextResponse(options.FeedUri, feedXml, "application/rss+xml");
|
||||
_handler.AddResponse(detailUri, () =>
|
||||
{
|
||||
var response = new HttpResponseMessage(HttpStatusCode.NotModified);
|
||||
response.Headers.ETag = etag;
|
||||
return response;
|
||||
});
|
||||
|
||||
await connector.FetchAsync(provider, CancellationToken.None);
|
||||
await connector.ParseAsync(provider, CancellationToken.None);
|
||||
await connector.MapAsync(provider, CancellationToken.None);
|
||||
|
||||
document = await documentStore.FindBySourceAndUriAsync(KasperskyConnectorPlugin.SourceName, detailUri.ToString(), CancellationToken.None);
|
||||
Assert.NotNull(document);
|
||||
Assert.Equal(DocumentStatuses.Mapped, document!.Status);
|
||||
|
||||
var stateRepository = provider.GetRequiredService<ISourceStateRepository>();
|
||||
var state = await stateRepository.TryGetAsync(KasperskyConnectorPlugin.SourceName, CancellationToken.None);
|
||||
Assert.NotNull(state);
|
||||
Assert.True(state!.Cursor.TryGetValue("pendingDocuments", out var pendingDocs));
|
||||
Assert.Equal(0, pendingDocs.AsBsonArray.Count);
|
||||
Assert.True(state.Cursor.TryGetValue("pendingMappings", out var pendingMappings));
|
||||
Assert.Equal(0, pendingMappings.AsBsonArray.Count);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Fetch_DuplicateContentSkipsRequeue()
|
||||
{
|
||||
var options = new KasperskyOptions
|
||||
{
|
||||
FeedUri = new Uri("https://ics-cert.example/feed-advisories/", UriKind.Absolute),
|
||||
WindowSize = TimeSpan.FromDays(30),
|
||||
WindowOverlap = TimeSpan.FromDays(1),
|
||||
MaxPagesPerFetch = 1,
|
||||
RequestDelay = TimeSpan.Zero,
|
||||
};
|
||||
|
||||
await EnsureServiceProviderAsync(options);
|
||||
var provider = _serviceProvider!;
|
||||
_handler.Clear();
|
||||
|
||||
var feedXml = ReadFixture("feed-page1.xml");
|
||||
var detailUri = new Uri("https://ics-cert.example/advisories/acme-controller-2024/");
|
||||
var detailHtml = ReadFixture("detail-acme-controller-2024.html");
|
||||
|
||||
_handler.AddTextResponse(options.FeedUri, feedXml, "application/rss+xml");
|
||||
_handler.AddTextResponse(detailUri, detailHtml, "text/html");
|
||||
|
||||
var connector = new KasperskyConnectorPlugin().Create(provider);
|
||||
|
||||
await connector.FetchAsync(provider, CancellationToken.None);
|
||||
_timeProvider.Advance(TimeSpan.FromMinutes(1));
|
||||
await connector.ParseAsync(provider, CancellationToken.None);
|
||||
await connector.MapAsync(provider, CancellationToken.None);
|
||||
|
||||
var documentStore = provider.GetRequiredService<IDocumentStore>();
|
||||
var document = await documentStore.FindBySourceAndUriAsync(KasperskyConnectorPlugin.SourceName, detailUri.ToString(), CancellationToken.None);
|
||||
Assert.NotNull(document);
|
||||
Assert.Equal(DocumentStatuses.Mapped, document!.Status);
|
||||
|
||||
_handler.AddTextResponse(options.FeedUri, feedXml, "application/rss+xml");
|
||||
_handler.AddTextResponse(detailUri, detailHtml, "text/html");
|
||||
|
||||
await connector.FetchAsync(provider, CancellationToken.None);
|
||||
await connector.ParseAsync(provider, CancellationToken.None);
|
||||
await connector.MapAsync(provider, CancellationToken.None);
|
||||
|
||||
document = await documentStore.FindBySourceAndUriAsync(KasperskyConnectorPlugin.SourceName, detailUri.ToString(), CancellationToken.None);
|
||||
Assert.NotNull(document);
|
||||
Assert.Equal(DocumentStatuses.Mapped, document!.Status);
|
||||
|
||||
var stateRepository = provider.GetRequiredService<ISourceStateRepository>();
|
||||
var state = await stateRepository.TryGetAsync(KasperskyConnectorPlugin.SourceName, CancellationToken.None);
|
||||
Assert.NotNull(state);
|
||||
var pendingDocs = state!.Cursor.TryGetValue("pendingDocuments", out var pendingDocsValue)
|
||||
? pendingDocsValue.AsBsonArray
|
||||
: new BsonArray();
|
||||
Assert.Empty(pendingDocs);
|
||||
var pendingMappings = state.Cursor.TryGetValue("pendingMappings", out var pendingMappingsValue)
|
||||
? pendingMappingsValue.AsBsonArray
|
||||
: new BsonArray();
|
||||
Assert.Empty(pendingMappings);
|
||||
}
|
||||
|
||||
private async Task EnsureServiceProviderAsync(KasperskyOptions template)
|
||||
{
|
||||
if (_serviceProvider is not null)
|
||||
{
|
||||
await ResetDatabaseAsync();
|
||||
return;
|
||||
}
|
||||
|
||||
await _fixture.Client.DropDatabaseAsync(_fixture.Database.DatabaseNamespace.DatabaseName);
|
||||
|
||||
var services = new ServiceCollection();
|
||||
services.AddLogging(builder => builder.AddProvider(NullLoggerProvider.Instance));
|
||||
services.AddSingleton<TimeProvider>(_timeProvider);
|
||||
services.AddSingleton(_handler);
|
||||
|
||||
services.AddMongoStorage(options =>
|
||||
{
|
||||
options.ConnectionString = _fixture.Runner.ConnectionString;
|
||||
options.DatabaseName = _fixture.Database.DatabaseNamespace.DatabaseName;
|
||||
options.CommandTimeout = TimeSpan.FromSeconds(5);
|
||||
});
|
||||
|
||||
services.AddSourceCommon();
|
||||
services.AddKasperskyIcsConnector(opts =>
|
||||
{
|
||||
opts.FeedUri = template.FeedUri;
|
||||
opts.WindowSize = template.WindowSize;
|
||||
opts.WindowOverlap = template.WindowOverlap;
|
||||
opts.MaxPagesPerFetch = template.MaxPagesPerFetch;
|
||||
opts.RequestDelay = template.RequestDelay;
|
||||
});
|
||||
|
||||
services.Configure<HttpClientFactoryOptions>(KasperskyOptions.HttpClientName, builderOptions =>
|
||||
{
|
||||
builderOptions.HttpMessageHandlerBuilderActions.Add(builder =>
|
||||
{
|
||||
builder.PrimaryHandler = _handler;
|
||||
});
|
||||
});
|
||||
|
||||
_serviceProvider = services.BuildServiceProvider();
|
||||
var bootstrapper = _serviceProvider.GetRequiredService<MongoBootstrapper>();
|
||||
await bootstrapper.InitializeAsync(CancellationToken.None);
|
||||
}
|
||||
|
||||
private Task ResetDatabaseAsync()
|
||||
=> _fixture.Client.DropDatabaseAsync(_fixture.Database.DatabaseNamespace.DatabaseName);
|
||||
|
||||
private static string ReadFixture(string filename)
|
||||
{
|
||||
var baseDirectory = AppContext.BaseDirectory;
|
||||
var primary = Path.Combine(baseDirectory, "Source", "Ics", "Kaspersky", "Fixtures", filename);
|
||||
if (File.Exists(primary))
|
||||
{
|
||||
return File.ReadAllText(primary);
|
||||
}
|
||||
|
||||
var fallback = Path.Combine(baseDirectory, "Kaspersky", "Fixtures", filename);
|
||||
return File.ReadAllText(fallback);
|
||||
}
|
||||
|
||||
private static string NormalizeLineEndings(string value)
|
||||
=> value.Replace("\r\n", "\n", StringComparison.Ordinal);
|
||||
|
||||
public Task InitializeAsync() => Task.CompletedTask;
|
||||
|
||||
public async Task DisposeAsync()
|
||||
{
|
||||
if (_serviceProvider is IAsyncDisposable asyncDisposable)
|
||||
{
|
||||
await asyncDisposable.DisposeAsync();
|
||||
}
|
||||
else
|
||||
{
|
||||
_serviceProvider?.Dispose();
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
<Project Sdk="Microsoft.NET.Sdk">
|
||||
<PropertyGroup>
|
||||
<TargetFramework>net10.0</TargetFramework>
|
||||
<ImplicitUsings>enable</ImplicitUsings>
|
||||
<Nullable>enable</Nullable>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<ProjectReference Include="../StellaOps.Concelier.Models/StellaOps.Concelier.Models.csproj" />
|
||||
<ProjectReference Include="../StellaOps.Concelier.Connector.Common/StellaOps.Concelier.Connector.Common.csproj" />
|
||||
<ProjectReference Include="../StellaOps.Concelier.Connector.Ics.Kaspersky/StellaOps.Concelier.Connector.Ics.Kaspersky.csproj" />
|
||||
<ProjectReference Include="../StellaOps.Concelier.Storage.Mongo/StellaOps.Concelier.Storage.Mongo.csproj" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<None Include="Kaspersky/Fixtures/**" CopyToOutputDirectory="Always" />
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
Reference in New Issue
Block a user