shadowbq-threatinator 0.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (389) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +66 -0
  3. data/CONTRIBUTING.md +119 -0
  4. data/Gemfile +38 -0
  5. data/LICENSE +165 -0
  6. data/README.md +101 -0
  7. data/Rakefile +47 -0
  8. data/VERSION +1 -0
  9. data/bin/threatinator +5 -0
  10. data/bin/threatinator_loader +21 -0
  11. data/feeds/ET_block-ip_reputation.feed +27 -0
  12. data/feeds/ET_compromised-ip_reputation.feed +20 -0
  13. data/feeds/ET_openbadlist-ip_reputation.feed +36 -0
  14. data/feeds/alienvault-ip_reputation.feed +39 -0
  15. data/feeds/arbor_fastflux-domain_reputation.feed +19 -0
  16. data/feeds/arbor_ssh-ip_reputation.feed +24 -0
  17. data/feeds/autoshun_shunlist.feed +17 -0
  18. data/feeds/bambenek_c2_masterlist-domain_reputation.feed +16 -0
  19. data/feeds/bambenek_c2_masterlist-ip_reputation.feed +16 -0
  20. data/feeds/bambenek_dga_feed-domain_reputation.feed +16 -0
  21. data/feeds/berkeley-ip_reputation.feed +25 -0
  22. data/feeds/bitcash_cz_blacklist.feed +22 -0
  23. data/feeds/blocklist_de_apache-ip_reputation.feed +26 -0
  24. data/feeds/blocklist_de_bots-ip_reputation.feed +26 -0
  25. data/feeds/blocklist_de_ftp-ip_reputation.feed +25 -0
  26. data/feeds/blocklist_de_imap-ip_reputation.feed +25 -0
  27. data/feeds/blocklist_de_pop3-ip_reputation.feed +26 -0
  28. data/feeds/blocklist_de_proftpd-ip_reputation.feed +26 -0
  29. data/feeds/blocklist_de_sip-ip_reputation.feed +25 -0
  30. data/feeds/blocklist_de_ssh-ip_reputation.feed +25 -0
  31. data/feeds/blocklist_de_strongips-ip_reputation.feed +25 -0
  32. data/feeds/botscout-ip_reputation.feed +25 -0
  33. data/feeds/cert_mxpoison-ip_reputation.feed +22 -0
  34. data/feeds/chaosreigns-ip_reputation.feed +37 -0
  35. data/feeds/ciarmy-ip_reputation.feed +20 -0
  36. data/feeds/cruzit-ip_reputation.feed +30 -0
  37. data/feeds/cydef_torexit-ip_reputation.feed +25 -0
  38. data/feeds/dan_me_uk_torlist-ip_reputation.feed +25 -0
  39. data/feeds/danger_bruteforce-ip_reputation.feed +24 -0
  40. data/feeds/dshield_attackers-top1000.feed +34 -0
  41. data/feeds/falconcrest-ip_reputation.feed +19 -0
  42. data/feeds/feodo-domain_reputation.feed +19 -0
  43. data/feeds/feodo-ip_reputation.feed +20 -0
  44. data/feeds/h3x_asprox.feed +18 -0
  45. data/feeds/hosts-file_hphostspartial-domain_reputation.feed +19 -0
  46. data/feeds/infiltrated-ip_reputation.feed +26 -0
  47. data/feeds/infiltrated_vabl-ip_reputation.feed +30 -0
  48. data/feeds/isc_suspicious_high-domain_reputation.feed +26 -0
  49. data/feeds/isc_suspicious_low-domain_reputation.feed +26 -0
  50. data/feeds/isc_suspicious_medium-domain_reputation.feed +26 -0
  51. data/feeds/malc0de-domain_reputation.feed +24 -0
  52. data/feeds/malc0de-ip_reputation.feed +26 -0
  53. data/feeds/malwaredomainlist-url_reputation.feed +18 -0
  54. data/feeds/malwaredomains-domain_reputation.feed +29 -0
  55. data/feeds/malwaredomains_dyndns-domain_reputation.feed +29 -0
  56. data/feeds/malwaredomains_justdomains-domain_reputation.feed +20 -0
  57. data/feeds/mirc-domain_reputation.feed +30 -0
  58. data/feeds/multiproxy-ip_reputation.feed +22 -0
  59. data/feeds/nothink_irc-ip_reputation.feed +23 -0
  60. data/feeds/nothink_ssh-ip_reputation.feed +21 -0
  61. data/feeds/openbl-ip_reputation.feed +21 -0
  62. data/feeds/openphish-url_reputation.feed +24 -0
  63. data/feeds/packetmail_perimeterbad-ip_reputation.feed +28 -0
  64. data/feeds/palevo-domain_reputation.feed +22 -0
  65. data/feeds/palevo-ip_reputation.feed +23 -0
  66. data/feeds/phishtank.feed +22 -0
  67. data/feeds/sigmaproject_atma.feed +27 -0
  68. data/feeds/sigmaproject_spyware.feed +28 -0
  69. data/feeds/sigmaproject_webexploit.feed +26 -0
  70. data/feeds/snort_bpf-ip_reputation.feed +19 -0
  71. data/feeds/spyeye-domain_reputation.feed +18 -0
  72. data/feeds/spyeye-ip_reputation.feed +19 -0
  73. data/feeds/steeman-ip_reputation.feed +20 -0
  74. data/feeds/t-arend-de_ssh-ip_reputation.feed +20 -0
  75. data/feeds/the_haleys_ssh-ip_reputation.feed +20 -0
  76. data/feeds/trustedsec-ip_reputation.feed +18 -0
  77. data/feeds/virbl-ip_reputation.feed +25 -0
  78. data/feeds/vxvault-url_reputation.feed +23 -0
  79. data/feeds/yourcmc_ssh-ip_reputation.feed +20 -0
  80. data/feeds/yoyo_adservers-domain_reputation.feed +17 -0
  81. data/feeds/zeus-domain_reputation.feed +19 -0
  82. data/feeds/zeus-ip_reputation.feed +21 -0
  83. data/lib/threatinator/action.rb +14 -0
  84. data/lib/threatinator/actions/list/action.rb +97 -0
  85. data/lib/threatinator/actions/list/config.rb +12 -0
  86. data/lib/threatinator/actions/list.rb +2 -0
  87. data/lib/threatinator/actions/run/action.rb +57 -0
  88. data/lib/threatinator/actions/run/config.rb +32 -0
  89. data/lib/threatinator/actions/run/coverage_observer.rb +59 -0
  90. data/lib/threatinator/actions/run/output_config.rb +59 -0
  91. data/lib/threatinator/actions/run/status_observer.rb +37 -0
  92. data/lib/threatinator/actions/run.rb +2 -0
  93. data/lib/threatinator/cli/action_builder.rb +33 -0
  94. data/lib/threatinator/cli/list_action_builder.rb +19 -0
  95. data/lib/threatinator/cli/parser.rb +123 -0
  96. data/lib/threatinator/cli/run_action_builder.rb +41 -0
  97. data/lib/threatinator/cli.rb +19 -0
  98. data/lib/threatinator/config/base.rb +35 -0
  99. data/lib/threatinator/config/feed_search.rb +25 -0
  100. data/lib/threatinator/config/logger.rb +14 -0
  101. data/lib/threatinator/config.rb +7 -0
  102. data/lib/threatinator/decoder.rb +24 -0
  103. data/lib/threatinator/decoders/gzip.rb +30 -0
  104. data/lib/threatinator/event.rb +63 -0
  105. data/lib/threatinator/event_builder.rb +70 -0
  106. data/lib/threatinator/exceptions.rb +58 -0
  107. data/lib/threatinator/feed.rb +88 -0
  108. data/lib/threatinator/feed_builder.rb +161 -0
  109. data/lib/threatinator/feed_registry.rb +47 -0
  110. data/lib/threatinator/feed_runner.rb +177 -0
  111. data/lib/threatinator/fetcher.rb +22 -0
  112. data/lib/threatinator/fetchers/http.rb +50 -0
  113. data/lib/threatinator/filter.rb +12 -0
  114. data/lib/threatinator/filters/block.rb +18 -0
  115. data/lib/threatinator/filters/comments.rb +16 -0
  116. data/lib/threatinator/filters/whitespace.rb +19 -0
  117. data/lib/threatinator/logger.rb +66 -0
  118. data/lib/threatinator/logging.rb +20 -0
  119. data/lib/threatinator/model/base.rb +23 -0
  120. data/lib/threatinator/model/collection.rb +89 -0
  121. data/lib/threatinator/model/observables/fqdn_collection.rb +15 -0
  122. data/lib/threatinator/model/observables/ipv4.rb +33 -0
  123. data/lib/threatinator/model/observables/ipv4_collection.rb +14 -0
  124. data/lib/threatinator/model/observables/url_collection.rb +16 -0
  125. data/lib/threatinator/model/validations/type.rb +21 -0
  126. data/lib/threatinator/model/validations.rb +1 -0
  127. data/lib/threatinator/output.rb +50 -0
  128. data/lib/threatinator/parser.rb +23 -0
  129. data/lib/threatinator/parsers/csv/parser.rb +77 -0
  130. data/lib/threatinator/parsers/csv.rb +7 -0
  131. data/lib/threatinator/parsers/getline/parser.rb +45 -0
  132. data/lib/threatinator/parsers/getline.rb +8 -0
  133. data/lib/threatinator/parsers/json/adapters/oj.rb +65 -0
  134. data/lib/threatinator/parsers/json/parser.rb +45 -0
  135. data/lib/threatinator/parsers/json/record.rb +20 -0
  136. data/lib/threatinator/parsers/json.rb +8 -0
  137. data/lib/threatinator/parsers/xml/node.rb +79 -0
  138. data/lib/threatinator/parsers/xml/node_builder.rb +39 -0
  139. data/lib/threatinator/parsers/xml/parser.rb +44 -0
  140. data/lib/threatinator/parsers/xml/path.rb +70 -0
  141. data/lib/threatinator/parsers/xml/pattern.rb +53 -0
  142. data/lib/threatinator/parsers/xml/record.rb +14 -0
  143. data/lib/threatinator/parsers/xml/sax_document.rb +64 -0
  144. data/lib/threatinator/parsers/xml.rb +8 -0
  145. data/lib/threatinator/plugin_loader.rb +115 -0
  146. data/lib/threatinator/plugins/output/amqp/config.rb +18 -0
  147. data/lib/threatinator/plugins/output/amqp.rb +41 -0
  148. data/lib/threatinator/plugins/output/csv.rb +58 -0
  149. data/lib/threatinator/plugins/output/json/config.rb +14 -0
  150. data/lib/threatinator/plugins/output/json.rb +53 -0
  151. data/lib/threatinator/plugins/output/null.rb +17 -0
  152. data/lib/threatinator/plugins/output/rubydebug.rb +16 -0
  153. data/lib/threatinator/record.rb +22 -0
  154. data/lib/threatinator/registry.rb +53 -0
  155. data/lib/threatinator/util.rb +15 -0
  156. data/lib/threatinator.rb +3 -0
  157. data/spec/feeds/ET_block-ip_reputation_spec.rb +50 -0
  158. data/spec/feeds/ET_compromised-ip_reputation_spec.rb +47 -0
  159. data/spec/feeds/ET_openbadlist-ip_reputation_spec.rb +56 -0
  160. data/spec/feeds/alienvault-ip_reputation_spec.rb +46 -0
  161. data/spec/feeds/arbor_fastflux-domain_reputation_spec.rb +46 -0
  162. data/spec/feeds/arbor_ssh-ip_reputation_spec.rb +46 -0
  163. data/spec/feeds/autoshun_shunlist_spec.rb +38 -0
  164. data/spec/feeds/bambenek_c2_masterlist-domain_reputation_spec.rb +38 -0
  165. data/spec/feeds/bambenek_c2_masterlist-ip_reputation_spec.rb +39 -0
  166. data/spec/feeds/bambenek_dga_feed-domain_reputation_spec.rb +39 -0
  167. data/spec/feeds/berkeley-ip_reputation_spec.rb +47 -0
  168. data/spec/feeds/bitcash_cz_blacklist-ip_reputation_spec.rb +50 -0
  169. data/spec/feeds/blocklist_de_apache-ip_reputation_spec.rb +47 -0
  170. data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb +47 -0
  171. data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb +47 -0
  172. data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb +47 -0
  173. data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb +47 -0
  174. data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb +47 -0
  175. data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb +47 -0
  176. data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb +47 -0
  177. data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb +47 -0
  178. data/spec/feeds/botscout-ip_reputation_spec.rb +50 -0
  179. data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb +47 -0
  180. data/spec/feeds/chaosreigns-ip_reputation_spec.rb +50 -0
  181. data/spec/feeds/ciarmy-ip_reputation_spec.rb +47 -0
  182. data/spec/feeds/cruzit-ip_reputation_spec.rb +47 -0
  183. data/spec/feeds/cydef_torexit-ip_reputation_spec.rb +47 -0
  184. data/spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb +47 -0
  185. data/spec/feeds/danger_bruteforce-ip_reputation_spec.rb +47 -0
  186. data/spec/feeds/data/ET_block-ip_reputation.txt +80 -0
  187. data/spec/feeds/data/ET_compromised-ip_reputation.txt +11 -0
  188. data/spec/feeds/data/ET_openbadlist-ip_reputation.txt +62 -0
  189. data/spec/feeds/data/alienvault-ip_reputation.txt +18 -0
  190. data/spec/feeds/data/arbor_domainlist.txt +11 -0
  191. data/spec/feeds/data/arbor_ssh.txt +16 -0
  192. data/spec/feeds/data/autoshun_shunlist.csv +20 -0
  193. data/spec/feeds/data/bambenek_c2-dommasterlist.csv +30 -0
  194. data/spec/feeds/data/bambenek_c2-ipmasterlist.csv +27 -0
  195. data/spec/feeds/data/bambenek_dga_feed.csv +42 -0
  196. data/spec/feeds/data/berkeley.txt +29 -0
  197. data/spec/feeds/data/bitcash_cz_blacklist.txt +7 -0
  198. data/spec/feeds/data/blocklist_de_apache-ip-reputation.txt +17 -0
  199. data/spec/feeds/data/blocklist_de_bots-ip-reputation.txt +15 -0
  200. data/spec/feeds/data/blocklist_de_ftp-ip-reputation.txt +7 -0
  201. data/spec/feeds/data/blocklist_de_imap-ip-reputation.txt +8 -0
  202. data/spec/feeds/data/blocklist_de_pop3-ip-reputation.txt +11 -0
  203. data/spec/feeds/data/blocklist_de_proftpd-ip-reputation.txt +12 -0
  204. data/spec/feeds/data/blocklist_de_sip-ip-reputation.txt +9 -0
  205. data/spec/feeds/data/blocklist_de_ssh-ip-reputation.txt +10 -0
  206. data/spec/feeds/data/blocklist_de_strongips-ip-reputation.txt +11 -0
  207. data/spec/feeds/data/botscout-ip-reputation.txt +713 -0
  208. data/spec/feeds/data/cert_mxpoison-ip_reputation.txt +17 -0
  209. data/spec/feeds/data/chaosreigns-ip-reputation.txt +26 -0
  210. data/spec/feeds/data/ciarmy-ip-reputation.txt +11 -0
  211. data/spec/feeds/data/cruzit-ip-reputation.txt +14 -0
  212. data/spec/feeds/data/cydef_torexit-ip_reputation.txt +27 -0
  213. data/spec/feeds/data/dan_me_uk_torlist-ip-reputation.txt +11 -0
  214. data/spec/feeds/data/danger_bruteforce-ip_reputation.txt +12 -0
  215. data/spec/feeds/data/dshield_topattackers.xml +4 -0
  216. data/spec/feeds/data/falconcrest_iplist.txt +345 -0
  217. data/spec/feeds/data/feodo_domainlist.txt +18 -0
  218. data/spec/feeds/data/feodo_iplist.txt +20 -0
  219. data/spec/feeds/data/h3x_asprox.txt +20 -0
  220. data/spec/feeds/data/hosts-file_hphostspartial_domainlist.txt +24 -0
  221. data/spec/feeds/data/infiltrated_iplist.txt +16 -0
  222. data/spec/feeds/data/infiltrated_vabl_iplist.txt +33 -0
  223. data/spec/feeds/data/isc_suspicious_high_domainlist.txt +26 -0
  224. data/spec/feeds/data/isc_suspicious_low_domainlist.txt +34 -0
  225. data/spec/feeds/data/isc_suspicious_medium_domainlist.txt +32 -0
  226. data/spec/feeds/data/malc0de_domainlist.txt +18 -0
  227. data/spec/feeds/data/malc0de_iplist.txt +14 -0
  228. data/spec/feeds/data/malwaredomainlist-url-reputation.txt +8 -0
  229. data/spec/feeds/data/malwaredomains_domainlist.txt +24 -0
  230. data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt +34 -0
  231. data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt +18 -0
  232. data/spec/feeds/data/mirc_domainlist.txt +31 -0
  233. data/spec/feeds/data/multiproxy_iplist.txt +15 -0
  234. data/spec/feeds/data/nothink_irc_iplist.txt +14 -0
  235. data/spec/feeds/data/nothink_ssh_iplist.txt +10 -0
  236. data/spec/feeds/data/openbl_iplist.txt +12 -0
  237. data/spec/feeds/data/openphish-url-reputation.txt +16 -0
  238. data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt +44 -0
  239. data/spec/feeds/data/palevo_domainlist.txt +25 -0
  240. data/spec/feeds/data/palevo_iplist.txt +24 -0
  241. data/spec/feeds/data/phishtank-sample.json.gz +0 -0
  242. data/spec/feeds/data/sigmaproject_atma.return.gz +0 -0
  243. data/spec/feeds/data/sigmaproject_spyware.return.gz +0 -0
  244. data/spec/feeds/data/sigmaproject_webexploit.return.gz +0 -0
  245. data/spec/feeds/data/snort_bpf-ip_reputation.txt +16 -0
  246. data/spec/feeds/data/spyeye_domainlist.txt +16 -0
  247. data/spec/feeds/data/spyeye_iplist.txt +19 -0
  248. data/spec/feeds/data/steeman-ip-reputation.txt +13 -0
  249. data/spec/feeds/data/t-arend-de_ssh_iplist.txt +17 -0
  250. data/spec/feeds/data/the_haleys_ssh_iplist.txt +12 -0
  251. data/spec/feeds/data/trustedsec-ip-reputation.txt +12 -0
  252. data/spec/feeds/data/valid.json +2908 -0
  253. data/spec/feeds/data/virbl-ip_reputation.txt +14 -0
  254. data/spec/feeds/data/vxvault-url-reputation.txt +15 -0
  255. data/spec/feeds/data/yourcmc_ssh-ip_reputation.txt +27 -0
  256. data/spec/feeds/data/yoyo_adservers.txt +25 -0
  257. data/spec/feeds/data/zeus-ip_reputation.txt +285 -0
  258. data/spec/feeds/data/zeus_domainlist.txt +27 -0
  259. data/spec/feeds/dshield_attackers-top1000_spec.rb +39 -0
  260. data/spec/feeds/falconcrest-ip_reputation_spec.rb +39 -0
  261. data/spec/feeds/feodo-domain_reputation_spec.rb +47 -0
  262. data/spec/feeds/feodo-ip_reputation_spec.rb +47 -0
  263. data/spec/feeds/h3x_asprox-ip_reputation_spec.rb +50 -0
  264. data/spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb +47 -0
  265. data/spec/feeds/infiltrated-ip_reputation_spec.rb +47 -0
  266. data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb +47 -0
  267. data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb +47 -0
  268. data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb +47 -0
  269. data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb +47 -0
  270. data/spec/feeds/malc0de-domain_reputation_spec.rb +47 -0
  271. data/spec/feeds/malc0de-ip_reputation_spec.rb +47 -0
  272. data/spec/feeds/malwaredomainlist_url_reputation_spec.rb +50 -0
  273. data/spec/feeds/malwaredomains-domain_reputation_spec.rb +47 -0
  274. data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb +47 -0
  275. data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb +47 -0
  276. data/spec/feeds/mirc-domain_reputation_spec.rb +47 -0
  277. data/spec/feeds/multiproxy-ip_reputation_spec.rb +47 -0
  278. data/spec/feeds/nothink_irc-ip_reputation_spec.rb +47 -0
  279. data/spec/feeds/nothink_ssh-ip_reputation_spec.rb +47 -0
  280. data/spec/feeds/openbl-ip_reputation_spec.rb +47 -0
  281. data/spec/feeds/openphish_url_reputation_spec.rb +50 -0
  282. data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb +47 -0
  283. data/spec/feeds/palevo-domain_reputation_spec.rb +47 -0
  284. data/spec/feeds/palevo-ip_reputation_spec.rb +47 -0
  285. data/spec/feeds/phishtank_spec.rb +41 -0
  286. data/spec/feeds/sigmaproject_atma_spec.rb +62 -0
  287. data/spec/feeds/sigmaproject_spyware_spec.rb +63 -0
  288. data/spec/feeds/sigmaproject_webexploit_spec.rb +62 -0
  289. data/spec/feeds/snort_bpf-ip_reputation_spec.rb +47 -0
  290. data/spec/feeds/spyeye-domain_reputation_spec.rb +47 -0
  291. data/spec/feeds/spyeye-ip_reputation_spec.rb +47 -0
  292. data/spec/feeds/steeman-ip_reputation_spec.rb +50 -0
  293. data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb +47 -0
  294. data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb +47 -0
  295. data/spec/feeds/trustedsec-ip_reputation_spec.rb +47 -0
  296. data/spec/feeds/virbl-ip_reputation_spec.rb +47 -0
  297. data/spec/feeds/vxvault_url_reputation_spec.rb +50 -0
  298. data/spec/feeds/yourcmc_ssh-ip_reputation_spec.rb +47 -0
  299. data/spec/feeds/yoyo_adservers_spec.rb +47 -0
  300. data/spec/feeds/zeus-domain_reputation_spec.rb +47 -0
  301. data/spec/feeds/zeus-ip_reputation_spec.rb +47 -0
  302. data/spec/fixtures/feed/provider1/feed1.feed +6 -0
  303. data/spec/fixtures/parsers/test.xml +13 -0
  304. data/spec/fixtures/parsers/test_self_closing.xml +20 -0
  305. data/spec/fixtures/plugins/bad/threatinator/plugins/test_error1/plugin.rb +1 -0
  306. data/spec/fixtures/plugins/bad/threatinator/plugins/test_missing1/plugin.rb +0 -0
  307. data/spec/fixtures/plugins/fake.rb +19 -0
  308. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_a.rb +8 -0
  309. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_b.rb +8 -0
  310. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_c.rb +8 -0
  311. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_d.rb +8 -0
  312. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_e.rb +8 -0
  313. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_f.rb +8 -0
  314. data/spec/spec_helper.rb +54 -0
  315. data/spec/support/bad_feeds/missing_fetcher.feed +7 -0
  316. data/spec/support/bad_feeds/missing_name.feed +6 -0
  317. data/spec/support/bad_feeds/missing_parser.feed +3 -0
  318. data/spec/support/bad_feeds/missing_provider.feed +5 -0
  319. data/spec/support/factories/event.rb +31 -0
  320. data/spec/support/factories/feed.rb +59 -0
  321. data/spec/support/factories/feed_builder.rb +65 -0
  322. data/spec/support/factories/feed_registry.rb +8 -0
  323. data/spec/support/factories/ipv4.rb +36 -0
  324. data/spec/support/factories/output.rb +11 -0
  325. data/spec/support/factories/record.rb +17 -0
  326. data/spec/support/factories/url.rb +34 -0
  327. data/spec/support/factories/xml_node.rb +33 -0
  328. data/spec/support/helpers/io.rb +11 -0
  329. data/spec/support/helpers/models.rb +13 -0
  330. data/spec/support/shared/action_builder.rb +47 -0
  331. data/spec/support/shared/decoder.rb +70 -0
  332. data/spec/support/shared/feed_runner_observer.rb +136 -0
  333. data/spec/support/shared/feeds.rb +233 -0
  334. data/spec/support/shared/fetcher.rb +48 -0
  335. data/spec/support/shared/filter.rb +14 -0
  336. data/spec/support/shared/io-like.rb +7 -0
  337. data/spec/support/shared/model/collection.rb +164 -0
  338. data/spec/support/shared/output.rb +120 -0
  339. data/spec/support/shared/parsers.rb +51 -0
  340. data/spec/support/shared/record.rb +111 -0
  341. data/spec/threatinator/actions/list/action_spec.rb +148 -0
  342. data/spec/threatinator/actions/run/action_spec.rb +106 -0
  343. data/spec/threatinator/actions/run/config_spec.rb +39 -0
  344. data/spec/threatinator/actions/run/coverage_observer_spec.rb +151 -0
  345. data/spec/threatinator/actions/run/output_config_spec.rb +89 -0
  346. data/spec/threatinator/actions/run/status_observer_spec.rb +86 -0
  347. data/spec/threatinator/cli/list_action_builder_spec.rb +57 -0
  348. data/spec/threatinator/cli/run_action_builder_spec.rb +133 -0
  349. data/spec/threatinator/cli_spec.rb +175 -0
  350. data/spec/threatinator/config/base_spec.rb +39 -0
  351. data/spec/threatinator/config/feed_search_spec.rb +76 -0
  352. data/spec/threatinator/decoders/gzip_spec.rb +75 -0
  353. data/spec/threatinator/event_builder_spec.rb +123 -0
  354. data/spec/threatinator/event_spec.rb +254 -0
  355. data/spec/threatinator/event_spec.rb.new +319 -0
  356. data/spec/threatinator/feed_builder_spec.rb +633 -0
  357. data/spec/threatinator/feed_registry_spec.rb +198 -0
  358. data/spec/threatinator/feed_runner_spec.rb +372 -0
  359. data/spec/threatinator/feed_spec.rb +169 -0
  360. data/spec/threatinator/fetcher_spec.rb +12 -0
  361. data/spec/threatinator/fetchers/http_spec.rb +32 -0
  362. data/spec/threatinator/filter_spec.rb +13 -0
  363. data/spec/threatinator/filters/block_spec.rb +16 -0
  364. data/spec/threatinator/filters/comments_spec.rb +13 -0
  365. data/spec/threatinator/filters/whitespace_spec.rb +12 -0
  366. data/spec/threatinator/logger_spec.rb +29 -0
  367. data/spec/threatinator/model/observables/fqdn_collection_spec.rb +41 -0
  368. data/spec/threatinator/model/observables/ipv4_collection_spec.rb +36 -0
  369. data/spec/threatinator/model/observables/ipv4_spec.rb +75 -0
  370. data/spec/threatinator/model/observables/url_collection_spec.rb +45 -0
  371. data/spec/threatinator/model/validations/type_spec.rb +37 -0
  372. data/spec/threatinator/parser_spec.rb +13 -0
  373. data/spec/threatinator/parsers/csv/parser_spec.rb +202 -0
  374. data/spec/threatinator/parsers/getline/parser_spec.rb +83 -0
  375. data/spec/threatinator/parsers/json/parser_spec.rb +106 -0
  376. data/spec/threatinator/parsers/json/record_spec.rb +30 -0
  377. data/spec/threatinator/parsers/xml/node_spec.rb +335 -0
  378. data/spec/threatinator/parsers/xml/parser_spec.rb +263 -0
  379. data/spec/threatinator/parsers/xml/path_spec.rb +209 -0
  380. data/spec/threatinator/parsers/xml/pattern_spec.rb +72 -0
  381. data/spec/threatinator/parsers/xml/record_spec.rb +27 -0
  382. data/spec/threatinator/plugin_loader_spec.rb +238 -0
  383. data/spec/threatinator/plugins/output/csv_spec.rb +47 -0
  384. data/spec/threatinator/plugins/output/null_spec.rb +17 -0
  385. data/spec/threatinator/plugins/output/rubydebug_spec.rb +37 -0
  386. data/spec/threatinator/record_spec.rb +19 -0
  387. data/spec/threatinator/registry_spec.rb +97 -0
  388. data/spec/threatinator/runner_spec.rb +273 -0
  389. metadata +674 -0
@@ -0,0 +1,97 @@
1
+ require 'spec_helper'
2
+ require 'threatinator/registry'
3
+
4
+ describe Threatinator::Registry do
5
+ let(:registry) { described_class.new }
6
+ let(:ten_things) { {
7
+ a: Object.new,
8
+ b: Object.new,
9
+ c: Object.new,
10
+ d: Object.new,
11
+ e: Object.new,
12
+ f: Object.new,
13
+ g: Object.new,
14
+ h: Object.new,
15
+ i: Object.new,
16
+ j: Object.new
17
+ } }
18
+
19
+ describe "#clear" do
20
+ it "should remove all existing registrations" do
21
+ expect(registry.count).to eq(0)
22
+ registry.register(:foo, 123)
23
+ registry.register(:bar, 456)
24
+ expect(registry.count).to eq(2)
25
+ registry.clear
26
+ expect(registry.count).to eq(0)
27
+ end
28
+ end
29
+
30
+ describe "#keys" do
31
+ it "returns an array containing all of the keys" do
32
+ expect(registry.keys).to eq([])
33
+ registry.register(:foo, Object.new)
34
+ registry.register(:bar, Object.new)
35
+ registry.register(:woof, Object.new)
36
+ expect(registry.keys).to contain_exactly(:foo, :bar, :woof)
37
+ end
38
+ end
39
+
40
+ describe "#register" do
41
+ it "should register the provided object to the given key" do
42
+ obj = Object.new
43
+ registry.register(:foo, obj)
44
+ expect(registry.get(:foo)).to be(obj)
45
+ end
46
+
47
+ it "should return the object that was registered" do
48
+ obj = Object.new
49
+ expect(registry.register(:foo, obj)).to be(obj)
50
+ end
51
+
52
+ it "should raise a AlreadyRegisteredError if something is already registered with the the given key" do
53
+ obj = Object.new
54
+ registry.register(:foo, obj)
55
+ expect {
56
+ registry.register(:foo, obj)
57
+ }.to raise_error(Threatinator::Exceptions::AlreadyRegisteredError)
58
+ end
59
+ end
60
+
61
+ describe "#each" do
62
+ it "should enumerate through each key and registered object" do
63
+ ten_things.each_pair do |i, thing|
64
+ registry.register(i, thing)
65
+ end
66
+ found_objects = []
67
+ registry.each do |key, obj|
68
+ found_objects << [ key, obj ]
69
+ end
70
+ expect(found_objects).to match_array(ten_things.to_a)
71
+ end
72
+ end
73
+
74
+ describe "#count" do
75
+ it "should return the number of objects contained within the registry" do
76
+ expect(registry.count).to eq(0)
77
+ ten_things.each_pair do |i, thing|
78
+ registry.register(i, thing)
79
+ end
80
+ expect(registry.count).to eq(10)
81
+ end
82
+ end
83
+
84
+ describe "#get" do
85
+ it "should return nil if key isn't registered" do
86
+ expect(registry.get(:foo)).to be_nil
87
+ end
88
+
89
+ it "should return the correct feed for the key" do
90
+ ten_things.each_pair { |i, o| registry.register(i, o) }
91
+ obj = Object.new
92
+ registry.register(:foo, obj)
93
+ expect(registry.get(:foo)).to be(obj)
94
+ end
95
+ end
96
+ end
97
+
@@ -0,0 +1,273 @@
1
+ #require 'spec_helper'
2
+ #require 'threatinator/runner'
3
+ #
4
+ #describe Threatinator::Runner do
5
+ # let(:runner) { Threatinator::Runner.new }
6
+ #
7
+ # def generate_feedfile(filename, provider, name, url = "https://foobar/#{provider}/#{name}.data")
8
+ # File.open(filename, "w") do |fio|
9
+ # fio.write <<EOS
10
+ #provider "#{provider}"
11
+ #name "#{name}"
12
+ #fetch_http('#{url}')
13
+ #
14
+ #parse_eachline(:separator => "\n") do |builder, line|
15
+ #end
16
+ #EOS
17
+ # end
18
+ # end
19
+ #
20
+ # describe "#add_feed_path" do
21
+ # it "add the paths to #feed_paths" do
22
+ # expect(runner.feed_paths).to eq([])
23
+ # runner.add_feed_path("/foo/bar1")
24
+ # expect(runner.feed_paths).to eq(["/foo/bar1"])
25
+ # runner.add_feed_path("/foo/bar2")
26
+ # expect(runner.feed_paths).to eq(["/foo/bar1", "/foo/bar2"])
27
+ # end
28
+ # end
29
+ #
30
+ # describe "#_load_feeds" do
31
+ # before :each do
32
+ # @feed_path1 = Dir.mktmpdir
33
+ # @feed_path2 = Dir.mktmpdir
34
+ # end
35
+ #
36
+ # after :each do
37
+ # FileUtils.remove_entry_secure @feed_path1
38
+ # FileUtils.remove_entry_secure @feed_path2
39
+ # end
40
+ #
41
+ # context "with no feed paths" do
42
+ # it "should not have loaded any feeds" do
43
+ # runner._load_feeds
44
+ # expect(runner.registry.count).to eq(0)
45
+ # end
46
+ # end
47
+ #
48
+ # context "with paths added to the runner" do
49
+ # before :each do
50
+ # runner.add_feed_path(@feed_path1)
51
+ # runner.add_feed_path(@feed_path2)
52
+ # end
53
+ #
54
+ # it "should load feeds from all of the configured paths" do
55
+ # 5.times do |i|
56
+ # generate_feedfile(File.join(@feed_path1, "feed#{i}.feed"), "provider1", "feed#{i}")
57
+ # generate_feedfile(File.join(@feed_path2, "feed#{i}.feed"), "provider2", "feed#{i}")
58
+ # end
59
+ # runner._load_feeds
60
+ # expect(runner.registry.count).to eq(10)
61
+ # end
62
+ #
63
+ # it "should ignore files that don't end with .feed" do
64
+ # generate_feedfile(File.join(@feed_path1, "feed1.fee"), "provider1", "feed1")
65
+ # generate_feedfile(File.join(@feed_path1, "feed1.fed"), "provider1", "feed2")
66
+ # generate_feedfile(File.join(@feed_path1, "feed1.rb"), "provider1", "feed3")
67
+ # generate_feedfile(File.join(@feed_path1, "feed1.feed"), "real_provider", "my_feed")
68
+ # runner._load_feeds
69
+ # expect(runner.registry.count).to eq(1)
70
+ # expect(runner.registry.get("real_provider", "my_feed")).to be_a(Threatinator::Feed)
71
+ # expect(runner.registry.get("provider1", "feed1")).to be_nil
72
+ # expect(runner.registry.get("provider1", "feed2")).to be_nil
73
+ # expect(runner.registry.get("provider1", "feed3")).to be_nil
74
+ # end
75
+ #
76
+ # it "should recurse subdirectories, loading feeds from there" do
77
+ # level1 = File.join(@feed_path1, "level1")
78
+ # level2 = File.join(@feed_path1, "level1", "level2")
79
+ # level3 = File.join(@feed_path1, "level1", "level2", "level3")
80
+ # FileUtils.mkdir_p level1
81
+ # FileUtils.mkdir_p level2
82
+ # FileUtils.mkdir_p level3
83
+ # generate_feedfile(File.join(level1, "feed1.feed"), "provider1", "feed1")
84
+ # generate_feedfile(File.join(level2, "feed2.feed"), "provider1", "feed2")
85
+ # generate_feedfile(File.join(level3, "feed3.feed"), "provider1", "feed3")
86
+ # runner._load_feeds
87
+ # expect(runner.registry.count).to eq(3)
88
+ # end
89
+ #
90
+ # it "should raise an exception if the same feed provider/name combination appears in multiple files" do
91
+ # generate_feedfile(File.join(@feed_path1, "feed1.feed"), "provider1", "feed1")
92
+ # generate_feedfile(File.join(@feed_path1, "feed2.feed"), "provider1", "feed1")
93
+ # expect {
94
+ # runner._load_feeds
95
+ # }.to raise_error(Threatinator::Exceptions::AlreadyRegisteredError)
96
+ # end
97
+ #
98
+ # end
99
+ # end
100
+ #
101
+ # describe "#_register_feed_from_file" do
102
+ # let(:feedfile) {FEED_FIXTURES.join("provider1", "feed1.feed").to_s}
103
+ #
104
+ # it "should return the feed after parsing the file" do
105
+ # ret = runner._register_feed_from_file(feedfile)
106
+ # expect(ret).to be_a(Threatinator::Feed)
107
+ # expect(ret.provider).to eq("provider1")
108
+ # expect(ret.name).to eq("feed1")
109
+ # end
110
+ #
111
+ # it "should have registered the feed" do
112
+ # expect(runner.registry.count).to eq(0)
113
+ # feed = runner._register_feed_from_file(feedfile)
114
+ # expect(runner.registry.count).to eq(1)
115
+ # expect(runner.registry.get(feed.provider, feed.name)).to be(feed)
116
+ # end
117
+ # end
118
+ #
119
+ # describe "#list" do
120
+ # let(:io_out) { StringIO.new }
121
+ #
122
+ # before :each do
123
+ # @feed_path = Dir.mktmpdir
124
+ # runner.add_feed_path(@feed_path)
125
+ # end
126
+ #
127
+ # after :each do
128
+ # FileUtils.remove_entry_secure @feed_path
129
+ # end
130
+ #
131
+ # context "with no feed paths" do
132
+ # it "should output the header" do
133
+ # runner.list(io_out: io_out);
134
+ # lines = io_out.string.lines.to_a
135
+ # expect(lines[0]).to eq("provider name type link/path\n")
136
+ # expect(lines[1]).to eq("-------- ---- ---- ---------\n")
137
+ # end
138
+ #
139
+ # it "should output the footer with a total of 0" do
140
+ # runner.list(io_out: io_out);
141
+ # lines = io_out.string.lines.to_a
142
+ # expect(lines[-2]).to eq("-------- ---- ---- ---------\n")
143
+ # expect(lines[-1]).to eq("Total: 0\n")
144
+ # end
145
+ # end
146
+ #
147
+ # context "with paths added to the runner" do
148
+ # before :each do
149
+ # end
150
+ # describe "the header row, header separator, and footer separator" do
151
+ # it "should vary the width of 'provider' based on the longest provider name" do
152
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), "A" * 10, "x", "http://x")
153
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), "A" * 20, "x", "http://x")
154
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), "A" * 30, "x", "http://x")
155
+ #
156
+ # runner.list(io_out: io_out);
157
+ # lines = io_out.string.lines.to_a
158
+ # expect(lines[0]).to eq("provider name type link/path\n")
159
+ # expect(lines[1]).to eq("------------------------------ ---- ---- ---------\n")
160
+ # expect(lines[-2]).to eq("------------------------------ ---- ---- ---------\n")
161
+ # end
162
+ #
163
+ # it "should vary the width of 'name' based on the longest feed name" do
164
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', "A" * 10, "http://x")
165
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', "A" * 20, "http://x")
166
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', "A" * 30, "http://x")
167
+ #
168
+ # runner.list(io_out: io_out);
169
+ # lines = io_out.string.lines.to_a
170
+ # expect(lines[0]).to eq("provider name type link/path\n")
171
+ # expect(lines[1]).to eq("-------- ------------------------------ ---- ---------\n")
172
+ # expect(lines[-2]).to eq("-------- ------------------------------ ---- ---------\n")
173
+ # end
174
+ #
175
+ # it "should vary the width of 'link/path' based on the longest link name" do
176
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', 'b', "http://" + ("A" * 10))
177
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', 'b', "http://" + ("A" * 20))
178
+ # generate_feedfile(File.join(@feed_path, "feed.feed"), 'a', 'b', "http://" + ("A" * 30))
179
+ #
180
+ # runner.list(io_out: io_out);
181
+ # lines = io_out.string.lines.to_a
182
+ # expect(lines[0]).to eq("provider name type link/path \n")
183
+ # expect(lines[1]).to eq("-------- ---- ---- -------------------------------------\n")
184
+ # expect(lines[-2]).to eq("-------- ---- ---- -------------------------------------\n")
185
+ # end
186
+ # end
187
+ #
188
+ # describe "the list of feeds" do
189
+ # it "should be sorted by provider name and then feed name" do
190
+ # generate_feedfile(File.join(@feed_path, "feed1.feed"), 'provider_b', 'feed_c')
191
+ # generate_feedfile(File.join(@feed_path, "feed2.feed"), 'provider_a', 'feed_d')
192
+ # generate_feedfile(File.join(@feed_path, "feed3.feed"), 'provider_a', 'feed_a')
193
+ # generate_feedfile(File.join(@feed_path, "feed4.feed"), 'provider_b', 'feed_d')
194
+ # generate_feedfile(File.join(@feed_path, "feed5.feed"), 'provider_a', 'feed_c')
195
+ # generate_feedfile(File.join(@feed_path, "feed6.feed"), 'provider_b', 'feed_a')
196
+ # generate_feedfile(File.join(@feed_path, "feed7.feed"), 'provider_b', 'feed_b')
197
+ # generate_feedfile(File.join(@feed_path, "feed8.feed"), 'provider_a', 'feed_b')
198
+ #
199
+ # runner.list(io_out: io_out);
200
+ # lines = io_out.string.lines.to_a
201
+ # expect(lines[2]).to eq("provider_a feed_a http https://foobar/provider_a/feed_a.data\n")
202
+ # expect(lines[3]).to eq("provider_a feed_b http https://foobar/provider_a/feed_b.data\n")
203
+ # expect(lines[4]).to eq("provider_a feed_c http https://foobar/provider_a/feed_c.data\n")
204
+ # expect(lines[5]).to eq("provider_a feed_d http https://foobar/provider_a/feed_d.data\n")
205
+ #
206
+ # expect(lines[6]).to eq("provider_b feed_a http https://foobar/provider_b/feed_a.data\n")
207
+ # expect(lines[7]).to eq("provider_b feed_b http https://foobar/provider_b/feed_b.data\n")
208
+ # expect(lines[8]).to eq("provider_b feed_c http https://foobar/provider_b/feed_c.data\n")
209
+ # expect(lines[9]).to eq("provider_b feed_d http https://foobar/provider_b/feed_d.data\n")
210
+ # end
211
+ # end
212
+ #
213
+ # describe "the footer" do
214
+ # it "should indicate the number of feeds" do
215
+ # 20.times do |i|
216
+ # generate_feedfile(File.join(@feed_path, "feed#{i}.feed"), "a#{i}", 'b', "http://" + ("A" * 10))
217
+ # end
218
+ # runner.list(io_out: io_out);
219
+ # lines = io_out.string.lines.to_a
220
+ # expect(lines[-1]).to eq("Total: 20\n")
221
+ # end
222
+ # end
223
+ # end
224
+ # end
225
+ #
226
+ # describe "#run" do
227
+ # before :each do
228
+ # @feed_path = Dir.mktmpdir
229
+ # generate_feedfile(File.join(@feed_path, "feed1.feed"), "provider1", "feed1")
230
+ # runner.add_feed_path(@feed_path)
231
+ # allow(Threatinator::FeedRunner).to receive(:run)
232
+ # end
233
+ #
234
+ # after :each do
235
+ # FileUtils.remove_entry_secure @feed_path
236
+ # end
237
+ #
238
+ # let(:loader) {
239
+ # x = Threatinator::PluginLoader.new
240
+ # x.load_plugins(:output)
241
+ # x }
242
+ #
243
+ #
244
+ # let(:output) { loader[:output][:null] }
245
+ #
246
+ # it "parses all the feeds" do
247
+ # expect(runner).to receive(:_load_feeds).and_call_original
248
+ # runner.run("provider1", "feed1", output)
249
+ # end
250
+ #
251
+ # context "when called with a provider and feed name that does not match a feed" do
252
+ # it "raises Threatinator::Exceptions::UnknownFeed" do
253
+ # expect {
254
+ # runner.run("foobar", "bla", output)
255
+ # }.to raise_error(Threatinator::Exceptions::UnknownFeed)
256
+ # end
257
+ # end
258
+ #
259
+ # context "when called with a provider and feed name that matches a feed" do
260
+ # it "loads the feed by the given provider and name" do
261
+ # expect(runner.registry).to receive(:get).with("provider1", "feed1").and_call_original
262
+ # runner.run("provider1", "feed1", output)
263
+ # end
264
+ #
265
+ # it "runs the feed" do
266
+ # opts_hash = {foo: 123}
267
+ # expect(Threatinator::FeedRunner).to receive(:run).with(kind_of(Threatinator::Feed), output, opts_hash)
268
+ # runner.run("provider1", "feed1", output, opts_hash)
269
+ # end
270
+ # end
271
+ # end
272
+ #
273
+ #end