wg-metasploit_data_models 4.1.4.01 → 4.1.4.02

data/spec/app/models/mdm/host_spec.rb

@@ -0,0 +1,1139 @@
+RSpec.describe Mdm::Host, type: :model do
+  include_context 'Rex::Text'
+
+  subject(:host) do
+    FactoryBot.build(:mdm_host)
+  end
+
+  let(:architectures) do
+    [
+        'armbe',
+        'armle',
+        'cbea',
+        'cbea64',
+        'cmd',
+        'java',
+        'mips',
+        'mipsbe',
+        'mipsle',
+        'php',
+        'ppc',
+        'ppc64',
+        'ruby',
+        'sparc',
+        'tty',
+        'x64',
+        'x86',
+        'x86_64',
+        '',
+        'Unknown',
+    ]
+  end
+
+  let(:states) do
+    [
+        'alive',
+        'down',
+        'unknown'
+    ]
+  end
+
+  it_should_behave_like 'Metasploit::Concern.run'
+
+  context 'factory' do
+    context 'mdm_host' do
+      subject(:mdm_host) {
+        FactoryBot.build(:mdm_host)
+      }
+
+      it { is_expected.to be_valid }
+    end
+  end
+
+  context 'Constants' do
+    subject(:max_nmap_certainty) { described_class::MAX_NMAP_CERTAINTY }
+    it { is_expected.to eq(0.84) }
+  end
+
+  describe 'MAC address format validation' do
+    context 'when colon delimited' do
+      it 'is valid' do
+        host = FactoryBot.build(:mdm_host, mac: '1a:2B:3c:4D:5e:6f')
+        expect(host).to be_valid
+      end
+    end
+
+    context 'when hyphen delimited' do
+      it 'is valid' do
+        host = FactoryBot.build(:mdm_host, mac: '1a-2B-3c-4D-5e-6f')
+        expect(host).to be_valid
+      end
+    end
+
+    context 'when mixed colon-hyphen delimited ' do
+      it 'is invalid' do
+        host = FactoryBot.build(:mdm_host, mac: '1a:2B:3c-4D:5e:6f')
+        expect(host).to be_invalid
+      end
+    end
+  end
+
+  context '#destroy' do
+    it 'should successfully destroy the object and the dependent objects' do
+      host = FactoryBot.create(:mdm_host)
+      exploit_attempt = FactoryBot.create(:mdm_exploit_attempt, :host => host)
+      exploited_host = FactoryBot.create(:mdm_exploited_host, :host => host)
+      host_detail = FactoryBot.create(:mdm_host_detail, :host => host)
+      loot = FactoryBot.create(:mdm_loot, :host => host)
+      task_host = FactoryBot.create(:mdm_task_host, :host => host)
+      note = FactoryBot.create(:mdm_note, :host => host)
+      svc = FactoryBot.create(:mdm_service, :host => host)
+      session = FactoryBot.create(:mdm_session, :host => host)
+      vuln = FactoryBot.create(:mdm_vuln, :host => host)
+
+
+      expect {
+        host.destroy
+      }.to_not raise_error
+      expect {
+        host.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        exploit_attempt.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        exploited_host.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        host_detail.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        loot.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        task_host.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        note.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        svc.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        session.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+      expect {
+        vuln.reload
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
+  context 'associations' do
+    it { is_expected.to have_many(:creds).class_name('Mdm::Cred').through(:services) }
+    it { is_expected.to have_many(:clients).class_name('Mdm::Client').dependent(:destroy) }
+    it { is_expected.to have_many(:exploit_attempts).class_name('Mdm::ExploitAttempt').dependent(:destroy) }
+    it { is_expected.to have_many(:exploited_hosts).class_name('Mdm::ExploitedHost').dependent(:destroy) }
+    it { is_expected.to have_many(:host_details).class_name('Mdm::HostDetail').dependent(:destroy) }
+    it { is_expected.to have_many(:hosts_tags).class_name('Mdm::HostTag') }
+    it { is_expected.to have_many(:loots).class_name('Mdm::Loot').dependent(:destroy).order('loots.created_at DESC') }
+    it { is_expected.to have_many(:module_runs).class_name('MetasploitDataModels::ModuleRun') }
+    it { is_expected.to have_many(:task_hosts).class_name('Mdm::TaskHost').dependent(:destroy) }
+    it { is_expected.to have_many(:tasks).class_name('Mdm::Task').through(:task_hosts) }
+
+    context 'module_details' do
+      it { is_expected.to have_many(:module_details).class_name('Mdm::Module::Detail').through(:module_refs) }
+
+      context 'with Mdm::Vulns' do
+        let!(:vulns) do
+          FactoryBot.create_list(
+              :mdm_vuln,
+              2,
+              :host => host
+          )
+        end
+
+        context 'with Mdm::Ref' do
+          let(:name) do
+            FactoryBot.generate :mdm_ref_name
+          end
+
+          let!(:ref) do
+            FactoryBot.create(:mdm_ref, :name => name)
+          end
+
+          context 'with Mdm::VulnRefs' do
+            let!(:vuln_refs) do
+              vulns.collect { |vuln|
+                FactoryBot.create(:mdm_vuln_ref, :ref => ref, :vuln => vuln)
+              }
+            end
+
+            context 'with Mdm::Module::Detail' do
+              let!(:module_detail) do
+                FactoryBot.create(
+                    :mdm_module_detail
+                )
+              end
+
+              context 'with Mdm::Module::Ref with same name as Mdm::Ref' do
+                let!(:module_ref) do
+                  FactoryBot.create(
+                      :mdm_module_ref,
+                      :detail => module_detail,
+                      :name => name
+                  )
+                end
+
+                it 'should list unique Mdm::Module::Detail' do
+                  expect(host.module_details).to match_array([module_detail])
+                end
+
+                it 'should have duplicate Mdm::Module::Details if collected through chain' do
+                  vuln_refs = []
+
+                  host.vulns.each do |vuln|
+                    # @todo https://www.pivotaltracker.com/story/show/49004623
+                    vuln_refs += vuln.vulns_refs
+                  end
+
+                  refs = []
+
+                  vuln_refs.each do |vuln_ref|
+                    refs << vuln_ref.ref
+                  end
+
+                  module_refs = []
+
+                  refs.each do |ref|
+                    module_refs += ref.module_refs
+                  end
+
+                  module_details = []
+
+                  module_refs.each do |module_ref|
+                    module_details << module_ref.detail
+                  end
+
+        expect(architectures).to include('mips')
+                  expect(module_details.uniq.count).to eq(host.module_details.count)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+
+    it { is_expected.to have_many(:module_refs).class_name('Mdm::Module::Ref').through(:refs) }
+    it { is_expected.to have_many(:notes).class_name('Mdm::Note').dependent(:delete_all).order('notes.created_at') }
+    it { is_expected.to have_many(:refs).class_name('Mdm::Ref').through(:vuln_refs) }
+    it { is_expected.to have_many(:services).class_name('Mdm::Service').dependent(:destroy).order('services.port, services.proto') }
+    it { is_expected.to have_many(:service_notes).through(:services) }
+    it { is_expected.to have_many(:sessions).class_name('Mdm::Session').dependent(:destroy).order('sessions.opened_at') }
+    it { is_expected.to have_many(:tags).class_name('Mdm::Tag').through(:hosts_tags) }
+    it { is_expected.to have_many(:vulns).class_name('Mdm::Vuln').dependent(:delete_all) }
+    it { is_expected.to have_many(:vuln_refs).class_name('Mdm::VulnRef') }
+    it { is_expected.to have_many(:web_sites).class_name('Mdm::WebSite').through(:services) }
+    it { is_expected.to belong_to(:workspace).class_name('Mdm::Workspace') }
+  end
+
+  context 'CONSTANTS' do
+    context 'ARCHITECTURES' do
+      subject(:architectures) do
+        described_class::ARCHITECTURES
+      end
+
+      it 'should be an Array<String>' do
+        expect(architectures).to include('mips')
+
+        architectures.each do |architecture|
+        expect(architectures).to include('mips')
+        end
+      end
+
+      it 'should include both endians of ARM' do
+        expect(architectures).to include('mips')
+        expect(architectures).to include('mips')
+      end
+
+      it 'should include 32-bit and 64-bit versions of Cell Broadband Engine Architecture' do
+        expect(architectures).to include('mips')
+        expect(architectures).to include('mips')
+      end
+
+      it 'should include cmd for command shell' do
+        expect(architectures).to include('mips')
+      end
+
+      it 'should include java for Java Virtual Machine' do
+        expect(architectures).to include('mips')
+      end
+
+      it 'should include plain and endian-ware MIPS' do
+        expect(architectures).to include('mips')
+        expect(architectures).to include('mipsbe')
+        expect(architectures).to include('mipsle')
+      end
+
+      it 'should include php for PHP code' do
+        expect(architectures).to include('php')
+      end
+
+      it 'should include 32-bit and 64-bit PowerPC' do
+        expect(architectures).to include('ppc')
+        expect(architectures).to include('ppc64')
+      end
+
+      it 'should include ruby for Ruby code' do
+        expect(architectures).to include('ruby')
+      end
+
+      it 'should include sparc for Sparc' do
+        expect(architectures).to include('sparc')
+      end
+
+      it 'should include tty for Terminals' do
+        expect(architectures).to include('tty')
+      end
+
+      it 'should include 32-bit and 64-bit x86' do
+        expect(architectures).to include('x64')
+        expect(architectures).to include('x86')
+        expect(architectures).to include('x86_64')
+      end
+
+      it 'should include blank string to indicate no detection has happened' do
+        expect(architectures).to include('')
+      end
+
+      it 'should include "Unknown" for failed detection attempts' do
+        expect(architectures).to include('Unknown')
+      end
+
+    end
+
+    context 'SEARCH_FIELDS' do
+      subject(:search_fields) do
+        described_class::SEARCH_FIELDS
+      end
+
+      it 'should be an Array<String>' do
+        expect(search_fields).to be_an Array
+
+        search_fields.each { |search_field|
+          expect(search_field).to be_a String
+        }
+      end
+
+      it 'should cast address to text' do
+        expect(search_fields).to include('address::text')
+      end
+
+      it { is_expected.to include('comments') }
+      it { is_expected.to include('mac') }
+      it { is_expected.to include('name') }
+      it { is_expected.to include('os_flavor') }
+      it { is_expected.to include('os_name') }
+      it { is_expected.to include('os_sp') }
+      it { is_expected.to include('purpose') }
+    end
+
+    it 'should define STATES in any order' do
+      expect(described_class::STATES).to match_array(states)
+    end
+  end
+
+  context 'database' do
+    context 'columns' do
+      it { is_expected.to have_db_column(:address).of_type(:inet).with_options(:null => false) }
+      it { is_expected.to have_db_column(:arch).of_type(:string) }
+      it { is_expected.to have_db_column(:comm).of_type(:string) }
+      it { is_expected.to have_db_column(:comments).of_type(:text) }
+      it { is_expected.to have_db_column(:info).of_type(:string).with_options(:limit => 2 ** 16) }
+      it { is_expected.to have_db_column(:mac).of_type(:string) }
+      it { is_expected.to have_db_column(:name).of_type(:string) }
+      it { is_expected.to have_db_column(:os_family).of_type(:string) }
+      it { is_expected.to have_db_column(:os_flavor).of_type(:string) }
+      it { is_expected.to have_db_column(:os_lang).of_type(:string) }
+      it { is_expected.to have_db_column(:os_name).of_type(:string) }
+      it { is_expected.to have_db_column(:os_sp).of_type(:string) }
+      it { is_expected.to have_db_column(:purpose).of_type(:text) }
+      it { is_expected.to have_db_column(:scope).of_type(:text) }
+      it { is_expected.to have_db_column(:state).of_type(:string) }
+      it { is_expected.to have_db_column(:virtual_host).of_type(:text) }
+      it { is_expected.to have_db_column(:workspace_id).of_type(:integer).with_options(:null => false) }
+
+      context 'counter caches' do
+        it { is_expected.to have_db_column(:exploit_attempt_count).of_type(:integer).with_options(:default => 0) }
+        it { is_expected.to have_db_column(:host_detail_count).of_type(:integer).with_options(:default => 0) }
+        it { is_expected.to have_db_column(:note_count).of_type(:integer).with_options(:default => 0) }
+        it { is_expected.to have_db_column(:service_count).of_type(:integer).with_options(:default => 0) }
+        it { is_expected.to have_db_column(:vuln_count).of_type(:integer).with_options(:default => 0) }
+      end
+
+      context 'timestamps' do
+        it { is_expected.to have_db_column(:created_at).of_type(:datetime) }
+        it { is_expected.to have_db_column(:updated_at).of_type(:datetime) }
+      end
+    end
+
+    context 'indices' do
+      it { is_expected.to have_db_index([:workspace_id, :address]).unique(true) }
+      it { is_expected.to have_db_index(:name) }
+      it { is_expected.to have_db_index(:os_flavor) }
+      it { is_expected.to have_db_index(:os_name) }
+      it { is_expected.to have_db_index(:purpose) }
+      it { is_expected.to have_db_index(:state) }
+    end
+  end
+
+  context 'factories' do
+    context 'full_mdm_host' do
+      subject(:full_mdm_host) do
+        FactoryBot.build(:full_mdm_host)
+      end
+
+      it { is_expected.to be_valid }
+    end
+
+    context 'mdm_host' do
+      subject(:mdm_host) do
+        FactoryBot.build(:mdm_host)
+      end
+
+      it { is_expected.to be_valid }
+    end
+  end
+
+  context 'validations' do
+    context 'address' do
+      it { is_expected.to validate_presence_of(:address) }
+
+      # can't use validate_uniqueness_of(:address).scoped_to(:workspace_id) because it will attempt to set workspace_id
+      # to `nil`, which will make the `:null => false` constraint on hosts.workspace_id to fail.
+      it 'should validate uniqueness of address scoped to workspace_id' do
+        address = '192.168.0.1'
+
+        workspace = FactoryBot.create(:mdm_workspace)
+        FactoryBot.create(:mdm_host, :address => address, :workspace => workspace)
+
+        duplicate_host = FactoryBot.build(:mdm_host, :address => address, :workspace => workspace)
+
+        expect(duplicate_host).not_to be_valid
+        expect(duplicate_host.errors[:address]).to include('has already been taken')
+      end
+    end
+
+    context 'arch' do
+      let(:workspace) { FactoryBot.create(:mdm_workspace) }
+      let(:address) { '192.168.0.1' }
+      let(:host) { FactoryBot.create(:mdm_host, :address => address, :workspace => workspace, :arch => arch) }
+      context 'with an unknown architecture' do
+        let(:arch) { "asdfasdf" }
+        it 'should normalize to Unknown' do
+          expect(host).to be_valid
+          expect(host.arch).to eq described_class::UNKNOWN_ARCHITECTURE
+        end
+      end
+      described_class::ARCHITECTURES.each do |arch|
+        context "with known architecture '#{arch}'" do
+          let(:arch) { arch }
+          it { is_expected.to be_valid }
+        end
+      end
+    end
+
+    it { is_expected.to validate_inclusion_of(:state).in_array(states).allow_nil }
+    it { is_expected.to validate_presence_of(:workspace) }
+  end
+
+  context 'search scope' do
+    subject(:full_mdm_host) do
+      FactoryBot.create(:full_mdm_host)
+    end
+
+    def search_for(str)
+      Mdm::Host.search(str)
+    end
+
+    context 'searching for an empty string' do
+      it 'should return any hosts in the database' do
+        expect(search_for('')).to include(subject)
+      end
+    end
+
+    context 'searching for an existing Host\'s name' do
+      it 'should return the host' do
+        expect(search_for(subject.name)).to include(subject)
+      end
+    end
+  end
+
+  context 'os normalization' do
+    context '#get_arch_from_string' do
+      context "should return 'x86_64'" do
+        it "when the string contains 'x64'" do
+          expect(host.send(:get_arch_from_string, 'blahx64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'X64'" do
+          expect(host.send(:get_arch_from_string, 'blahX64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'x86_64'" do
+          expect(host.send(:get_arch_from_string, 'blahx86_64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'X86_64'" do
+          expect(host.send(:get_arch_from_string, 'blahX86_64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'amd64'" do
+          expect(host.send(:get_arch_from_string, 'blahamd64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'AMD64'" do
+          expect(host.send(:get_arch_from_string, 'blahAMD64blah')).to eq('x86_64')
+        end
+
+        it "when the string contains 'aMd64'" do
+          expect(host.send(:get_arch_from_string, 'blahamd64blah')).to eq('x86_64')
+        end
+      end
+
+      context "should return 'x86'" do
+        it "when the string contains 'x86'" do
+          expect(host.send(:get_arch_from_string, 'blahx86blah')).to eq('x86')
+        end
+
+        it "when the string contains 'X86'" do
+          expect(host.send(:get_arch_from_string, 'blahX86blah')).to eq('x86')
+        end
+
+        it "when the string contains 'i386'" do
+          expect(host.send(:get_arch_from_string, 'blahi386blah')).to eq('x86')
+        end
+
+        it "when the string contains 'I386'" do
+          expect(host.send(:get_arch_from_string, 'blahI386blah')).to eq('x86')
+        end
+
+        it "when the string contains 'i486'" do
+          expect(host.send(:get_arch_from_string, 'blahi486blah')).to eq('x86')
+        end
+
+        it "when the string contains 'i586'" do
+          expect(host.send(:get_arch_from_string, 'blahi586blah')).to eq('x86')
+        end
+
+        it "when the string contains 'i686'" do
+          expect(host.send(:get_arch_from_string, 'blahi386blah')).to eq('x86')
+        end
+      end
+
+      context "should return 'PowerPC'" do
+        it "when the string contains 'PowerPC'" do
+          expect(host.send(:get_arch_from_string, 'blahPowerPCblah')).to eq('PowerPC')
+        end
+
+        it "when the string contains 'PPC'" do
+          expect(host.send(:get_arch_from_string, 'blahPPCblah')).to eq('PowerPC')
+        end
+
+        it "when the string contains 'POWER'" do
+          expect(host.send(:get_arch_from_string, 'blahPOWERblah')).to eq('PowerPC')
+        end
+
+        it "when the string contains 'ppc'" do
+          expect(host.send(:get_arch_from_string, 'blahppcblah')).to eq('PowerPC')
+        end
+      end
+
+      context 'should return nil' do
+        it 'when PowerPC is cased incorrectly' do
+          expect(host.send(:get_arch_from_string, 'powerPC')).to eq(nil)
+          expect(host.send(:get_arch_from_string, 'Powerpc')).to eq(nil)
+        end
+
+        it 'when no recognized arch string is present' do
+          expect(host.send(:get_arch_from_string, 'blahblah')).to eq(nil)
+        end
+      end
+
+      it "should return 'Sparc' if the string contains SPARC, regardless of case" do
+        expect(host.send(:get_arch_from_string, 'blahSPARCblah')).to eq('Sparc')
+        expect(host.send(:get_arch_from_string, 'blahSPaRCblah')).to eq('Sparc')
+        expect(host.send(:get_arch_from_string, 'blahsparcblah')).to eq('Sparc')
+      end
+
+      it "should return 'ARM' if the string contains 'ARM', regardless of case" do
+        expect(host.send(:get_arch_from_string, 'blahARMblah')).to eq('ARM')
+        expect(host.send(:get_arch_from_string, 'blahArMblah')).to eq('ARM')
+        expect(host.send(:get_arch_from_string, 'blaharmblah')).to eq('ARM')
+      end
+
+      it "should return 'MIPS' if the string contains 'MIPS', regardless of case" do
+        expect(host.send(:get_arch_from_string, 'blahMIPSblah')).to eq('MIPS')
+        expect(host.send(:get_arch_from_string, 'blahMiPslah')).to eq('MIPS')
+        expect(host.send(:get_arch_from_string, 'blahmipsblah')).to eq('MIPS')
+      end
+    end
+
+    context '#parse_windows_os_str' do
+      it 'should always return the os_name as Windows' do
+        result = host.send(:parse_windows_os_str, '')
+        expect(result['os.product']).to eq('Windows')
+      end
+
+      context 'arch' do
+        it 'should return a value for arch if there is one' do
+          result = host.send(:parse_windows_os_str, 'Windows x64')
+          expect(result['os.arch']).to eq('x86_64')
+        end
+
+        it "should not have an arch key if we don't know the arch" do
+          result = host.send(:parse_windows_os_str, 'Windows')
+          expect(result.has_key?('os.arch')).to eq(false)
+        end
+      end
+
+      context 'Service Pack' do
+        it 'should be returned if we see Service Pack X' do
+          result = host.send(:parse_windows_os_str, 'Windows XP Service Pack 1')
+          expect(result['os.version']).to eq('SP1')
+        end
+
+        it 'should be returned if we see SPX' do
+          result = host.send(:parse_windows_os_str, 'Windows XP SP3')
+          expect(result['os.version']).to eq('SP3')
+        end
+      end
+
+      context 'os product' do
+
+         it "should appear as Windows 95 for 'Windows 95" do
+          result = host.send(:parse_windows_os_str, 'Windows 95')
+          expect(result['os.product']).to eq('Windows 95')
+        end
+
+        it "should appear as Windows NT 3.51 for 'Windows NT 3.51" do
+          result = host.send(:parse_windows_os_str, 'Windows NT 3.51')
+          expect(result['os.product']).to eq('Windows NT 3.51')
+        end
+
+        it "should appear as Windows NT 4.0 for 'Windows NT 4.0" do
+          result = host.send(:parse_windows_os_str, 'Windows NT 4.0')
+          expect(result['os.product']).to eq('Windows NT 4.0')
+        end
+
+        it "should appear as Windows 98 for 'Windows 98" do
+          result = host.send(:parse_windows_os_str, 'Windows 98')
+          expect(result['os.product']).to eq('Windows 98')
+        end
+
+        it "should appear as Windows ME for 'Windows ME" do
+          result = host.send(:parse_windows_os_str, 'Windows ME')
+          expect(result['os.product']).to eq('Windows ME')
+        end
+
+        it "should appear as Windows 2003 for '.NET Server'" do
+          result = host.send(:parse_windows_os_str, 'Windows .NET Server')
+          expect(result['os.product']).to eq('Windows Server 2003')
+        end
+
+        it 'should be recognized for Windows XP' do
+          result = host.send(:parse_windows_os_str, 'Windows XP')
+          expect(result['os.product']).to eq('Windows XP')
+        end
+
+        it 'should be recognized for Windows Server 2000' do
+          result = host.send(:parse_windows_os_str, 'Windows 2000')
+          expect(result['os.product']).to eq('Windows Server 2000')
+        end
+
+        it 'should be recognized for Windows Server 2003' do
+          result = host.send(:parse_windows_os_str, 'Windows 2003')
+          expect(result['os.product']).to eq('Windows Server 2003')
+        end
+
+        it 'should be recognized for Windows 2008' do
+          result = host.send(:parse_windows_os_str, 'Windows 2008')
+          expect(result['os.product']).to eq('Windows Server 2008')
+        end
+
+        it 'should be recognized for Windows 2012' do
+          result = host.send(:parse_windows_os_str, 'Windows 2012')
+          expect(result['os.product']).to eq('Windows Server 2012')
+        end
+
+        it 'should be recognized for Windows Vista' do
+          result = host.send(:parse_windows_os_str, 'Windows Vista')
+          expect(result['os.product']).to eq('Windows Vista')
+        end
+
+        it 'should be recognized for Windows Server 2000' do
+          result = host.send(:parse_windows_os_str, 'Windows 2000 Advanced Server')
+          expect(result['os.product']).to eq('Windows Server 2000')
+        end
+
+        it 'should be recognized for Windows 7' do
+          result = host.send(:parse_windows_os_str, 'Windows 7')
+          expect(result['os.product']).to eq('Windows 7')
+        end
+
+        it 'should be recognized for Windows 7 Ultimate Edition' do
+          result = host.send(:parse_windows_os_str, 'Windows 7 Ultimate Edition')
+          expect(result['os.product']).to eq('Windows 7')
+          expect(result['os.edition']).to eq('Ultimate')
+        end
+
+        it 'should be recognized for Windows 8' do
+          result = host.send(:parse_windows_os_str, 'Windows 8')
+          expect(result['os.product']).to eq('Windows 8')
+        end
+
+        it 'should be recognized for Windows 8.1' do
+          result = host.send(:parse_windows_os_str, 'Windows 8.1')
+          expect(result['os.product']).to eq('Windows 8.1')
+        end
+
+        it 'should be recognized for Windows 8.2' do
+          result = host.send(:parse_windows_os_str, 'Windows 8.2')
+          expect(result['os.product']).to eq('Windows 8.2')
+        end
+
+        it 'should be recognized as Windows XP, Build 2600, SP3' do
+          result = host.send(:parse_windows_os_str, 'Windows XP (Build 2600, Service Pack 3).')
+          expect(result['os.product']).to eq('Windows XP')
+          expect(result['os.build']).to eq('2600')
+          expect(result['os.version']).to eq('SP3')
+        end
+
+        it 'should be recognized as Windows Server 2003, Build 3790' do
+          result = host.send(:parse_windows_os_str, 'Windows .NET Server (Build 3790).')
+          expect(result['os.product']).to eq('Windows Server 2003')
+          expect(result['os.build']).to eq('3790')
+        end
+
+        it 'should be recognized as Windows Server 2008, Build 6001, SP1' do
+          result = host.send(:parse_windows_os_str, 'Windows 2008 (Build 6001, Service Pack 1).')
+          expect(result['os.product']).to eq('Windows Server 2008')
+          expect(result['os.build']).to eq('6001')
+          expect(result['os.version']).to eq('SP1')
+        end
+
+        it 'should default to Windows <name> if all else fails' do
+            result = host.send(:parse_windows_os_str, 'Windows Foobar Service Pack 3')
+            expect(result['os.product']).to eq('Windows Foobar')
+            expect(result['os.version']).to eq('SP3')
+        end
+      end
+    end
+
+    context '#validate_fingerprint_data' do
+      it 'should return false for an empty hash' do
+        fingerprint= FactoryBot.build(:mdm_note, :data => {})
+        expect(host.validate_fingerprint_data(fingerprint)).to eq(false)
+      end
+
+      it 'should return false for postgresql fingerprints' do
+        fingerprint= FactoryBot.build(:mdm_note, :ntype => 'postgresql.fingerprint', :data => {})
+        expect(host.validate_fingerprint_data(fingerprint)).to eq(false)
+      end
+
+      it 'should return false if the fingerprint does not contain a hash' do
+        fingerprint= FactoryBot.build(:mdm_note, :data => 'this is not a fingerprint')
+        expect(host.validate_fingerprint_data(fingerprint)).to eq(false)
+      end
+    end
+
+
+    context '#apply_match_to_host' do
+      it 'should set host.mac when host.mac is present' do
+        match = { 'host.mac' => '00:11:22:33:44:55' }
+        host.send(:apply_match_to_host, match)
+        expect(host.mac).to eq('00:11:22:33:44:55')
+      end
+
+      it 'should set host.name when host.name is present' do
+        match = { 'host.name' => 'webbyweb' }
+        host.send(:apply_match_to_host, match)
+        expect(host.name).to eq('webbyweb')
+      end
+
+      it 'should set host.arch when os.arch is present' do
+        match = { 'os.arch' => 'x86' }
+        host.send(:apply_match_to_host, match)
+        expect(host.arch).to eq('x86')
+      end
+
+      it 'should set host.name to an escaped hex value when host.name contains high bytes' do
+        match = { 'host.name' => "HighBytes\xff\xf0".force_encoding('binary') }
+        host.send(:apply_match_to_host, match)
+        expect(host.name).to eq("HighBytes\\xff\\xf0")
+      end
+
+      it 'should set host.purpose to client when os.product is Windows XP' do
+        match = { 'os.product' => 'Windows XP' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_name).to eq('Windows XP')
+        expect(host.purpose).to eq('client')
+      end
+
+      it 'should set host.purpose to server when os.product is Windows 2012' do
+        match = { 'os.product' => 'Windows 2012' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_name).to eq('Windows 2012')
+        expect(host.purpose).to eq('server')
+      end
+
+      it 'should set host.purpose to printer when os.device is Print server' do
+        match = { 'os.device' => 'Print server' }
+        host.send(:apply_match_to_host, match)
+        expect(host.purpose).to eq('printer')
+      end
+
+      it 'should set host.os_lang to English when os.language is English' do
+        match = { 'os.language' => 'English' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_lang).to eq('English')
+      end
+
+      it 'should set host.os_name to Windows 8.1 when os.product is Windows 8.1' do
+        match = { 'os.product' => 'Windows 8.1' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_name).to eq('Windows 8.1')
+      end
+
+      it 'should set host.os_name to Windows when os.product is not set and os.family is Windows' do
+        match = { 'os.family' => 'Windows' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_name).to eq('Windows')
+      end
+
+      it 'should set host.os_flavor to Professional when os.edition is Professional' do
+        match = { 'os.edition' => 'Professional' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_flavor).to eq('Professional')
+      end
+
+      it 'should set host.os_sp to SP2 when os.version is SP2' do
+        match = { 'os.version' => 'SP2' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_sp).to eq('SP2')
+      end
+
+      it 'should set host.os_sp to 3.2.11 when os.version is nil and linux.kernel.version is 3.2.11' do
+        match = { 'linux.kernel.version' => '3.2.11' }
+        host.send(:apply_match_to_host, match)
+        expect(host.os_sp).to eq('3.2.11')
+      end
+    end
+
+    context '#normalize_match' do
+
+      it 'should convert Service Pack X to SPX' do
+        match = { 'os.version' => 'Service Pack 2' }
+        result = host.send(:normalize_match, match)
+        expect(result['os.version']).to eq('SP2')
+      end
+
+      it 'should not convert No Service Pack to SP' do
+        match = { 'os.version' => 'No Service Pack' }
+        result = host.send(:normalize_match, match)
+        expect(result['os.version']).to eq('No Service Pack')
+      end
+
+      it 'should convert Apple Mac OS X to Mac OS X' do
+        match = { 'os.product' => 'Apple Mac OS X' }
+        result = host.send(:normalize_match, match)
+        expect(result['os.product']).to eq('Mac OS X')
+        expect(result['os.vendor']).to eq('Apple')
+      end
+
+      it 'should convert Microsoft Windows to Windows' do
+        match = { 'os.product' => 'Microsoft Windows 7' }
+        result = host.send(:normalize_match, match)
+        expect(result['os.product']).to eq('Windows 7')
+        expect(result['os.vendor']).to eq('Microsoft')
+      end
+
+      it 'should convert Windows Server 2012 to Windows 2012' do
+        match = { 'os.product' => 'Windows Server 2012' }
+        result = host.send(:normalize_match, match)
+        expect(result['os.product']).to eq('Windows 2012')
+      end
+    end
+
+    context '#normalize_match_family' do
+      it 'should set the family to Windows if the product contains Windows' do
+        match  = { 'os.product' => 'Microsoft Windows 7' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Windows'
+      end
+
+      it 'should set the family to Linux if the product contains Linux' do
+        match  = { 'os.product' => 'Linux (Ubuntu)' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Linux'
+      end
+
+      it 'should set the family to Solaris if the product contains Solaris' do
+        match  = { 'os.product' => 'Solaris' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'Solaris'
+      end
+
+      it 'should set the family to SunOS if the product contains SunOS' do
+        match  = { 'os.product' => 'SunOS' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'SunOS'
+      end
+
+      it 'should set the family to AIX if the product contains AIX' do
+        match  = { 'os.product' => 'AIX' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'AIX'
+      end
+
+      it 'should set the family to HP-UX if the product contains HP-UX' do
+        match  = { 'os.product' => 'HP-UX' }
+        result = host.normalize_match_family(match)
+        expect(result['os.family']).to eq 'HP-UX'
+      end
+    end
+
+    context '#guess_purpose_from_match' do
+
+      it 'should detect Windows XP as a client' do
+        match = { 'os.product' => 'Windows XP' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('client')
+      end
+
+      it 'should detect Windows 8.1 as a client' do
+        match = { 'os.product' => 'Windows 8.1' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('client')
+      end
+
+      it 'should detect Windows 2000 as a server' do
+        match = { 'os.product' => 'Windows 2000' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('server')
+      end
+
+      it 'should detect Windows Server 2012 as a server' do
+        match = { 'os.product' => 'Windows Server 2012' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('server')
+      end
+
+      it 'should detect Linux as a server' do
+        match = { 'os.product' => 'Linux' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('server')
+      end
+
+      it 'should detect JetDirect as a printer' do
+        match = { 'os.product' => 'JetDirect', 'os.device' => 'Print server' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('printer')
+      end
+
+      it 'should detect Unknown Printer as a printer' do
+        match = { 'os.product' => 'Unknown Printer' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('printer')
+      end
+
+      it 'should detect Linksys Router as a router' do
+        match = { 'os.product' => 'Linksys', 'os.device' => 'Router' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('router')
+      end
+
+      it 'should detect CheckPoint Firewall-1 as a firewall' do
+        match = { 'os.vendor' => 'Check Point', 'os.product' => 'Firewall-1' }
+        result = host.send(:guess_purpose_from_match, match)
+        expect(result).to eq('firewall')
+      end
+    end
+
+    context '#normalize_scanner_fp' do
+      context 'for session_fingerprint' do
+        it 'should return all the correct data for Windows XP SP3 x86' do
+          fingerprint = FactoryBot.build(:mdm_session_fingerprint, :host => host)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Windows XP')
+          expect(result['os.version']).to eq('SP3')
+          expect(result['os.arch']).to eq('x86')
+          expect(result['host.name']).to eq(nil)
+          expect(result['os.certainty'].to_f).to eq(0.8)
+        end
+
+        it 'should return all the correct data for Windows 2008 SP1 x64' do
+          fp_data = { :os => 'Microsoft Windows 2008 SP1', :arch => 'x64'}
+          fingerprint = FactoryBot.build(:mdm_session_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Windows Server 2008')
+          expect(result['os.version']).to eq('SP1')
+          expect(result['os.arch']).to eq('x64')
+          expect(result['host.name']).to eq(nil)
+          expect(result['os.certainty'].to_f).to eq(0.8)
+        end
+
+        it 'should fingerprint Metasploitable correctly' do
+          # Taken from an actual session_fingerprint of Metasploitable 2
+          fp_data = { :os => 'Linux 2.6.24-16-server (i386)', :name => 'metasploitable'}
+          fingerprint = FactoryBot.build(:mdm_session_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Linux')
+          expect(result['host.name']).to eq('metasploitable')
+          expect(result['os.version']).to eq('2.6.24-16-server')
+          expect(result['os.arch']).to eq('x86')
+          expect(result['os.certainty'].to_f).to eq(0.8)
+        end
+
+        it 'should just populate os_name if it is unsure' do
+          fp_data = { :os => 'Darwin 12.3.0 x86_64 i386'}
+          fingerprint = FactoryBot.build(:mdm_session_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Darwin 12.3.0 x86_64 i386')
+          expect(result['os.version']).to eq(nil)
+          expect(result['os.arch']).to eq(nil)
+          expect(result['os.certainty']).to eq(0.8)
+        end
+      end
+
+      context 'for nmap_fingerprint' do
+        it 'should return OS name for a Windows XP fingerprint' do
+          fingerprint = FactoryBot.build(:mdm_nmap_fingerprint, :host => host)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Windows XP')
+          expect(result['os.certainty'].to_f).to eq(described_class::MAX_NMAP_CERTAINTY)
+        end
+
+        it 'should return OS name for a Metasploitable fingerprint' do
+          fp_data = {:os_vendor=>"Linux", :os_family=>"Linux", :os_version=>"2.6.X", :os_accuracy=>100}
+          fingerprint = FactoryBot.build(:mdm_nmap_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Linux')
+          expect(result['os.version']).to eq('2.6.X')
+          expect(result['os.certainty'].to_f).to eq(described_class::MAX_NMAP_CERTAINTY)
+        end
+
+        it 'should return OS name and flavor fo an OSX fingerprint' do
+          fp_data = {:os_vendor=>"Apple", :os_family=>"Mac OS X", :os_version=>"10.8.X", :os_accuracy=>100}
+          fingerprint = FactoryBot.build(:mdm_nmap_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Mac OS X')
+          expect(result['os.vendor']).to eq('Apple')
+          expect(result['os.version']).to eq('10.8.X')
+          expect(result['os.certainty'].to_f).to eq(described_class::MAX_NMAP_CERTAINTY)
+        end
+      end
+
+      context 'for nexpose_fingerprint' do
+        context 'of a Windows system' do
+          it 'should return a generic Windows fingerprint with no product info' do
+            fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host)
+            result = host.send(:normalize_scanner_fp, fingerprint).first
+            expect(result['os.product']).to eq('Windows')
+            expect(result['os.arch']).to eq('x86')
+            expect(result['os.certainty'].to_f).to eq(0.67)
+          end
+
+          it 'should recognize a Windows 7 fingerprint' do
+            fp_data = {:family=>"Windows", :certainty=>"0.67", :vendor=>"Microsoft", :arch=>"x86", :product => 'Windows 7', :version => 'SP1'}
+            fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host, :data => fp_data)
+            result = host.send(:normalize_scanner_fp, fingerprint).first
+            expect(result['os.product']).to eq('Windows 7')
+            expect(result['os.version']).to eq('SP1')
+            expect(result['os.arch']).to eq('x86')
+            expect(result['os.certainty'].to_f).to eq(0.67)
+          end
+        end
+
+        it 'should recognize an OSX fingerprint' do
+          fp_data = {:family=>"Mac OS X", :certainty=>"0.80", :vendor=>"Apple"}
+          fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Mac OS X')
+          expect(result['os.vendor']).to eq("Apple")
+        end
+
+        it 'should recognize a Cisco fingerprint' do
+          fp_data = {:family=>"IOS", :certainty=>"1.00", :vendor=>"Cisco", :version=>"11.2(8)SA2"}
+          fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('IOS')
+          expect(result['os.vendor']).to eq('Cisco')
+        end
+
+        it 'should recognize an embedded fingerprint' do
+          fp_data = {:family=>"embedded", :certainty=>"1.00", :vendor=>"Footek"}
+          fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Footek')
+        end
+
+        it 'should handle an unknown fingerprint' do
+          fp_data = {:certainty=>"1.00", :vendor=>"Footek"}
+          fingerprint = FactoryBot.build(:mdm_nexpose_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq('Footek')
+        end
+
+
+      end
+
+      context 'for retina_fingerprint' do
+        it 'should recognize a Windows fingerprint' do
+          fingerprint = FactoryBot.build(:mdm_retina_fingerprint, :host => host)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq( 'Windows Server 2003')
+          expect(result['os.arch']).to eq('x86_64')
+          expect(result['os.version']).to eq('SP2')
+          expect(result['os.certainty'].to_f).to eq(0.8)
+        end
+
+        it 'should otherwise jsut copy the fingerprint to os_name' do
+          fp_data = { :os => 'Linux 2.6.X (i386)'}
+          fingerprint = FactoryBot.build(:mdm_retina_fingerprint, :host => host, :data => fp_data)
+          result = host.send(:normalize_scanner_fp, fingerprint).first
+          expect(result['os.product']).to eq( 'Linux 2.6.X (i386)')
+          expect(result['os.certainty'].to_f).to eq(0.8)
+        end
+      end
+    end
+
+  end
+
+  context 'search' do
+    let(:base_class) {
+      described_class
+    }
+
+    context 'attributes' do
+
+      it_should_behave_like 'search_with',
+                            MetasploitDataModels::Search::Operator::IPAddress,
+                            name: :address
+      it_should_behave_like 'search_attribute',
+                            :name,
+                            type: :string
+      it_should_behave_like 'search_with',
+                            MetasploitDataModels::Search::Operator::Multitext,
+                            name: :os,
+                            operator_names: [
+                              :os_name,
+                              :os_flavor,
+                              :os_sp
+                            ]
+      it_should_behave_like 'search_attribute',
+                            :os_name,
+                            type: :string
+    end
+  end
+end