hidden-hippo 0.1.0

data/spec/extractors/dns_history_extractor_spec.rb

@@ -0,0 +1,52 @@
+require 'thread'
+require 'hidden_hippo/packets/dns'
+require 'hidden_hippo/extractors/dns_history_extractor'
+
+describe HiddenHippo::Extractors::DnsHistoryExtractor do
+  let(:queue) {Queue.new}
+  let(:extractor) {HiddenHippo::Extractors::DnsHistoryExtractor.new queue}
+
+  describe '#call' do
+    it 'should find the query_name/hostname in response' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 53
+      packet.response = true
+      packet.eth_mac_src = 'some mac'
+      packet.eth_mac_dest = 'some other mac'
+      packet.dns_qry_name = 'dns resolution'
+
+      extractor.call packet
+
+      out = queue.pop true
+      expect(out).not_to be_nil
+      expect(out.mac_address).to eq 'some other mac'
+      expect(out.fields).to eq({history: 'dns resolution'})
+    end
+
+    it 'should find the query_name/hostname in query' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 53
+      packet.response = false
+      packet.eth_mac_src = 'some mac'
+      packet.eth_mac_dest = 'some other mac'
+      packet.dns_qry_name = 'dns resolution'
+
+      extractor.call packet
+
+      out = queue.pop true
+      expect(out).not_to be_nil
+      expect(out.mac_address).to eq 'some mac'
+      expect(out.fields).to eq({history: 'dns resolution'})
+    end
+
+    it 'should ignore packets not on port 53' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 42
+      packet.response = true
+
+      extractor.call packet
+
+      expect(queue.size).to eq 0
+    end
+  end
+end

data/spec/extractors/dns_llmnr_extractor_spec.rb

@@ -0,0 +1,45 @@
+require 'thread'
+require 'hidden_hippo/packets/dns'
+require 'hidden_hippo/extractors/dns_llmnr_extractor'
+
+describe HiddenHippo::Extractors::DnsLlmnrExtractor do
+  let(:queue) {Queue.new}
+  let(:extractor) {HiddenHippo::Extractors::DnsLlmnrExtractor.new queue}
+
+  describe '#call' do
+    it 'should find the query_name/hostname in response' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 5355
+      packet.response = false
+      packet.eth_mac_src = 'some mac'
+      packet.dns_qry_name = 'the host name'
+
+      extractor.call packet
+
+      out = queue.pop true
+      expect(out).not_to be_nil
+      expect(out.mac_address).to eq 'some mac'
+      expect(out.fields).to eq({hostname: 'the host name'})
+    end
+
+    it 'should ignore packets not on port 5355' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 42
+      packet.response = true
+
+      extractor.call packet
+
+      expect(queue.size).to eq 0
+    end
+
+    it 'should ignore non request' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 5353
+      packet.response = true
+
+      extractor.call packet
+
+      expect(queue.size).to eq 0
+    end
+  end
+end

data/spec/extractors/http_request_url_extractor_spec.rb

@@ -0,0 +1,23 @@
+require 'thread'
+require 'hidden_hippo/packets/http'
+require 'hidden_hippo/extractors/http_request_url_extractor'
+
+describe HiddenHippo::Extractors::HttpRequestUrlExtractor do
+  let(:queue) {Queue.new}
+  let(:extractor) {HiddenHippo::Extractors::HttpRequestUrlExtractor.new queue}
+
+  describe '#call' do
+    it 'should have an url' do
+      packet = HiddenHippo::Packets::Http.new
+      packet.eth_mac_src = 'http some mac'
+      packet.full_uri = 'blob.com/totolatulipe?$=0.com'
+
+      extractor.call packet
+
+      out = queue.pop true
+      expect(out.mac_address).to eq 'http some mac'
+      expect(out.fields).to eq({history: 'blob.com/totolatulipe?$=0.com'})
+    end
+  end
+
+end

data/spec/extractors/mdns_hostname_extractor_spec.rb

@@ -0,0 +1,45 @@
+require 'thread'
+require 'hidden_hippo/packets/dns'
+require 'hidden_hippo/extractors/mdns_hostname_extractor'
+
+describe HiddenHippo::Extractors::MdnsHostnameExtractor do
+  let(:queue) {Queue.new}
+  let(:extractor) {HiddenHippo::Extractors::MdnsHostnameExtractor.new queue}
+
+  describe '#call' do
+    it 'should find the hostname in a mdns ptr response' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 5353
+      packet.response = true
+      packet.eth_mac_src = 'some mac'
+      packet.ptr = 'the host name'
+
+      extractor.call packet
+
+      out = queue.pop true
+      expect(out).not_to be_nil
+      expect(out.mac_address).to eq 'some mac'
+      expect(out.fields).to eq({hostname: 'the host name'})
+    end
+
+    it 'should ignore packets not on port 5353' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 42
+      packet.response = true
+
+      extractor.call packet
+
+      expect(queue.size).to eq 0
+    end
+
+    it 'should ignore non responses' do
+      packet = HiddenHippo::Packets::Dns.new
+      packet.udp_dest_port = 5353
+      packet.response = false
+
+      extractor.call packet
+
+      expect(queue.size).to eq 0
+    end
+  end
+end

data/spec/gui_daemon_spec.rb

@@ -0,0 +1,7 @@
+require 'support/cli_controller_examples'
+
+describe 'hh gui', :noisy do
+  let(:name) {'gui'}
+
+  it_behaves_like 'cli daemon controller'
+end

data/spec/hidden_hippo_spec.rb

@@ -0,0 +1,32 @@
+require 'hidden_hippo'
+require 'mongoid'
+
+describe HiddenHippo do
+  it 'should have a version' do
+    expect(HiddenHippo::VERSION).not_to be_nil
+  end
+
+  describe '#pid_exists?' do
+    it 'should return true for an existing pid' do
+      expect(HiddenHippo.pid_exists? Process.pid).to be_truthy
+    end
+
+    it 'should return false for a non existing pid' do
+      expect(HiddenHippo.pid_exists? 99999).to be_falsey
+    end
+  end
+
+  describe '#gem_root' do
+    it 'should point to the root of the gem' do
+      expect(HiddenHippo.gem_root).to eq Pathname.new(__FILE__) + '../..'
+    end
+  end
+
+  describe '#configure_db!' do
+    it 'should configure mongoid' do
+      HiddenHippo.configure_db!
+
+      expect(Mongoid.configured?).to be_truthy
+    end
+  end
+end

data/spec/packet_spec.rb

@@ -0,0 +1,88 @@
+require 'hidden_hippo/packets/packet'
+
+describe HiddenHippo::Packets::Packet do
+
+  describe '#field' do
+    it 'should create accessors' do
+      packet_class = Class.new(HiddenHippo::Packets::Packet) do
+        field :foobar
+      end
+
+      instance = packet_class.new
+
+      expect(instance).to respond_to :foobar, :foobar=
+    end
+
+    it 'should add to the fields list' do
+      packet_class = Class.new(HiddenHippo::Packets::Packet) do
+        field :foobar
+      end
+
+      expect(packet_class.fields.map &:name).to include :foobar
+    end
+  end
+
+  describe '#parse' do
+    it 'should parse using the tshark fields' do
+      klass = Class.new HiddenHippo::Packets::Packet do
+        field :foobar, tshark: 'proto.foobar'
+      end
+
+      instance = klass.parse 'proto.foobar' => 'butthole'
+
+      expect(instance.foobar).to eq 'butthole'
+    end
+
+    it 'should convert when the converter is set' do
+      klass = Class.new HiddenHippo::Packets::Packet do
+        field :answer, tshark: 'magic.number', conv: ->(a) {a.to_i}
+      end
+
+      instance = klass.parse 'magic.number' => '42'
+
+      expect(instance.answer).to eq 42
+    end
+
+    it 'should convert with symbols' do
+      klass = Class.new HiddenHippo::Packets::Packet do
+        field :answer, tshark: 'magic.number', conv: :to_i
+      end
+
+      instance = klass.parse 'magic.number' => '42'
+
+      expect(instance.answer).to eq 42
+    end
+
+    it 'should ignore unknow fields' do
+      klass = Class.new HiddenHippo::Packets::Packet
+
+      expect{klass.parse 'not.there' => 'foobar'}.not_to raise_error
+    end
+  end
+
+  describe '#filter' do
+    it 'should return the filter set' do
+      klass = Class.new HiddenHippo::Packets::Packet do
+        filter 'foobarbaz'
+      end
+
+      expect(klass.filter).to eq 'foobarbaz'
+    end
+  end
+
+  describe '#tshark_fields' do
+    it 'should return the tshark fields for all the fields' do
+      klass = Class.new HiddenHippo::Packets::Packet do
+        field :thing, tshark: 'find.me'
+      end
+
+      expect(klass.tshark_fields).to include 'find.me'
+    end
+
+    it 'should have default mac address fields' do
+      klass = Class.new HiddenHippo::Packets::Packet
+
+      expect(klass.tshark_fields).to include 'eth.src', 'eth.dst', 'wlan.sa', 'wlan.da'
+    end
+  end
+end

data/spec/possibilities_spec.rb

@@ -0,0 +1,113 @@
+require 'hidden_hippo'
+require 'hidden_hippo/possibilities'
+
+describe HiddenHippo::Possibilities do
+  let(:possibilities) {HiddenHippo::Possibilities.new}
+
+  describe '#initialize' do
+    it 'should set the base counts' do
+      possibilities = HiddenHippo::Possibilities.new 'foo' => 3
+
+      expect(possibilities['foo']).to eq 3
+    end
+
+    it 'should ignore base counts that are not strings' do
+      possibilities = HiddenHippo::Possibilities.new 'foo' => 'potato'
+
+      expect(possibilities['foo']).to eq 0
+    end
+  end
+
+  describe '#<<' do
+    it 'should add a possible value' do
+      possibilities << 'foo'
+      possibilities << 'biz'
+      possibilities << 'baz'
+
+      expect(possibilities).to contain_exactly 'foo', 'biz', 'baz'
+    end
+
+    it 'should increment the support count of an existing value' do
+      possibilities << 'foo'
+      possibilities << 'foo'
+
+      expect(possibilities['foo']).to eq 2
+    end
+
+    it 'should convert values to string' do
+      possibilities << 42
+
+      expect(possibilities).to contain_exactly '42'
+    end
+
+    it 'should replace dots with underscores' do
+      possibilities << 'dat.thing'
+
+      expect(possibilities['dat.thing']).to eq 0
+      expect(possibilities['dat_thing']).to eq 1
+    end
+
+    it 'should replace dollar signs with underscores' do
+      possibilities << 'dat$thing'
+
+      expect(possibilities['dat$thing']).to eq 0
+      expect(possibilities['dat_thing']).to eq 1
+    end
+  end
+
+  describe '#[]' do
+    it 'should return the support count' do
+      5.times do
+        possibilities << 'foo'
+      end
+
+      expect(possibilities['foo']).to eq 5
+    end
+
+    it 'should return 0 when no support count' do
+      expect(possibilities['not there']).to eq 0
+    end
+  end
+
+  describe '#each' do
+    it 'should enumerate by support count' do
+      possibilities << 'fi'
+      possibilities << 'fo'
+      possibilities << 'fo'
+      possibilities << 'fum'
+      possibilities << 'fum'
+      possibilities << 'fum'
+
+      expect{|b| possibilities.each &b}.to yield_successive_args 'fum', 'fo', 'fi'
+    end
+
+    it 'should return an enumerator without a block' do
+      possibilities << 'fi'
+      possibilities << 'fo'
+      possibilities << 'fum'
+
+      expect(possibilities.each).to be_kind_of Enumerator
+    end
+  end
+
+  describe '#each_with_support' do
+    it 'should enumerate by and with support count' do
+      possibilities << 'fi'
+      possibilities << 'fo'
+      possibilities << 'fo'
+      possibilities << 'fum'
+      possibilities << 'fum'
+      possibilities << 'fum'
+
+      expect{|b| possibilities.each_with_support &b}.to yield_successive_args ['fum', 3], ['fo', 2], ['fi', 1]
+    end
+
+    it 'should return an enumerator without a block' do
+      possibilities << 'fi'
+      possibilities << 'fo'
+      possibilities << 'fum'
+
+      expect(possibilities.each_with_support).to be_kind_of Enumerator
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,33 @@
+require 'mongoid'
+require 'hidden_hippo'
+require 'shoulda-matchers'
+require 'rspec/retry'
+
+RSpec.configure do |config|
+  config.include Shoulda::Matchers::ActiveModel
+
+  stdout = $stdout
+  stderr = $stderr
+
+  config.before :each, noisy: true do
+    $stdout = StringIO.new
+    $stderr = StringIO.new
+  end
+
+  config.after :each, noisy: true do
+    $stdout = stdout
+    $stderr = stderr
+  end
+
+  config.before :all, db: true do
+    HiddenHippo.configure_db! :test
+  end
+
+  config.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  config.mock_with :rspec do |mocks|
+    mocks.verify_partial_doubles = true
+  end
+end

data/spec/support/cli_controller_examples.rb

@@ -0,0 +1,136 @@
+require 'hidden_hippo'
+require 'tmpdir'
+require 'pathname'
+
+# Shared examples for the daemon controller commands
+# it expects to have `name` defined. For example:
+#
+# describe 'hh thing' do
+#   let(:name) {'thing'}
+#   it_behaves_like 'cli daemon controller'
+# end
+shared_examples 'cli daemon controller' do
+  let(:home) { Pathname.new(Dir.mktmpdir) }
+  let(:pid_file) { home + 'pid' + "#{name}.pid" }
+  let(:log_file) { home + 'log' + "#{name}.log" }
+
+  def start
+    HiddenHippo::Cli::App.start [name, 'start']
+  end
+
+  def stop
+    HiddenHippo::Cli::App.start [name, 'stop']
+  end
+
+  def status
+    HiddenHippo::Cli::App.start [name, 'status']
+  end
+
+  before do
+    ENV['HIDDEN_HIPPO_HOME'] = home.to_s
+  end
+
+  after do
+    if pid_file.exist?
+      begin
+        pid = pid_file.read.to_i
+        Process.detach pid # keep the zombies at bay
+        Process.kill 9, pid
+      rescue
+        # do nothing
+      end
+    end
+
+    home.rmtree
+  end
+
+  describe 'start' do
+    it 'should start the daemon' do
+      start
+      pid = pid_file.read.to_i
+
+      expect(HiddenHippo.pid_exists? pid).to be_truthy
+    end
+
+    it 'should create a pid file' do
+      start
+
+      expect(pid_file).to exist
+    end
+
+    it 'should log to file', retry: 3 do
+      start
+      sleep 0.5
+
+      expect(log_file).to exist
+    end
+
+    it 'replace stale pid file' do
+      pid_file.dirname.mkpath
+      File.write pid_file, '12345'
+
+      start
+
+      expect(pid_file.read.to_i).not_to eq 12345
+    end
+
+    it 'should complain if daemon is already running' do
+      start
+
+      expect{start}.to raise_error SystemExit do |error|
+        expect(error.status).not_to eq 0
+      end
+    end
+  end
+
+  describe 'stop' do
+    it 'should kill the process', retry: 3 do
+      start
+      pid = pid_file.read.to_i
+      Process.detach pid # make sure we don't get a zombie
+
+      stop
+      sleep 0.5
+
+      expect(HiddenHippo.pid_exists? pid).to be_falsey
+    end
+
+    it 'should delete the pid file' do
+      start
+      stop
+
+      expect(pid_file).not_to exist
+    end
+
+    it 'should complain if the pid file is missing' do
+      expect{stop}.to raise_error SystemExit do |error|
+        expect(error.status).not_to eq 0
+      end
+    end
+  end
+
+  describe 'status' do
+    it 'should return 0 if running' do
+      start
+
+      expect{status}.to raise_error SystemExit do |error|
+        expect(error.status).to eq 0
+      end
+    end
+
+    it 'should return 1 if not running' do
+      expect{status}.to raise_error SystemExit do |error|
+        expect(error.status).to eq 1
+      end
+    end
+
+    it 'should return 2 if not running but pid file is present' do
+      pid_file.dirname.mkpath
+      File.write pid_file, '99999'
+
+      expect{status}.to raise_error SystemExit do |error|
+        expect(error.status).to eq 2
+      end
+    end
+  end
+end

data/spec/updator_spec.rb

@@ -0,0 +1,37 @@
+require 'hidden_hippo/dossier'
+require 'hidden_hippo/update'
+require 'hidden_hippo/updator'
+
+describe HiddenHippo::Updator, :db do
+  let(:queue) {Queue.new}
+  let(:updator) {HiddenHippo::Updator.new queue}
+
+  before do
+    HiddenHippo::Dossier.delete_all
+  end
+
+  after do
+    updator.stop
+  end
+
+  it 'should add the fields to the database from the queue' do
+    HiddenHippo::Dossier.create mac_address: 'find me'
+    queue << HiddenHippo::Update.new('find me', {name: 'John Doe'})
+
+    updator.start
+    sleep 0.5
+
+    dossier = HiddenHippo::Dossier.find 'find me'
+    expect(dossier.name['John Doe']).to eq 1
+  end
+
+  it 'should create the dossier if it is missing' do
+    queue << HiddenHippo::Update.new('not there', {hostname: 'Bobby-PC'})
+
+    updator.start
+    sleep 0.5
+
+    dossier = HiddenHippo::Dossier.find 'not there'
+    expect(dossier.hostname['Bobby-PC']).to eq 1
+  end
+end