synapse 2.164.0__py311-none-any.whl → 2.166.0__py311-none-any.whl

synapse/tests/test_model_risk.py

@@ -394,6 +394,7 @@ class RiskModelTest(s_t_utils.SynTest):
                     :sophistication=high
                     :merged:time = 20230111
                     :merged:isnow = {[ risk:threat=* ]}
+                    :mitre:attack:group=G0001
                 ]
             ''')
             self.len(1, nodes)
@@ -414,10 +415,12 @@ class RiskModelTest(s_t_utils.SynTest):
             self.eq(1673395200000, nodes[0].get('merged:time'))
             self.eq(1643673600000, nodes[0].get('reporter:discovered'))
             self.eq(1675209600000, nodes[0].get('reporter:published'))
+            self.eq('G0001', nodes[0].get('mitre:attack:group'))
 
             self.len(1, nodes[0].get('goals'))
             self.len(1, nodes[0].get('techniques'))
             self.len(1, await core.nodes('risk:threat:merged:isnow -> risk:threat'))
+            self.len(1, await core.nodes('risk:threat -> it:mitre:attack:group'))
 
             nodes = await core.nodes('''[ risk:leak=*
                 :name="WikiLeaks ACME      Leak"
@@ -432,6 +435,8 @@ class RiskModelTest(s_t_utils.SynTest):
                 :public:url=https://wikileaks.org/acme
                 :reporter={ gen.ou.org vertex }
                 :reporter:name=vertex
+                :size:bytes=99
+                :extortion=*
             ]''')
             self.len(1, nodes)
             self.eq('wikileaks acme leak', nodes[0].get('name'))
@@ -439,9 +444,11 @@ class RiskModelTest(s_t_utils.SynTest):
             self.eq(1698883200000, nodes[0].get('disclosed'))
             self.eq('public.', nodes[0].get('type'))
             self.eq(1, nodes[0].get('public'))
+            self.eq(99, nodes[0].get('size:bytes'))
             self.eq('https://wikileaks.org/acme', nodes[0].get('public:url'))
             self.eq('vertex', nodes[0].get('reporter:name'))
 
+            self.len(1, await core.nodes('risk:leak -> risk:extortion'))
             self.len(1, await core.nodes('risk:leak -> risk:leak:type:taxonomy'))
             self.len(1, await core.nodes('risk:leak :owner -> ps:contact +:orgname=acme'))
             self.len(1, await core.nodes('risk:leak :leaker -> ps:contact +:orgname=wikileaks'))
@@ -451,6 +458,7 @@ class RiskModelTest(s_t_utils.SynTest):
 
             nodes = await core.nodes('''[ risk:extortion=*
                 :demanded=20231102
+                :deadline=20240329
                 :name="APT99 Extorted     ACME"
                 :desc="APT99 extorted ACME for a zillion vertex coins."
                 :type=fingain
@@ -471,6 +479,7 @@ class RiskModelTest(s_t_utils.SynTest):
             self.eq('apt99 extorted acme', nodes[0].get('name'))
             self.eq('APT99 extorted ACME for a zillion vertex coins.', nodes[0].get('desc'))
             self.eq(1698883200000, nodes[0].get('demanded'))
+            self.eq(1711670400000, nodes[0].get('deadline'))
             self.eq('fingain.', nodes[0].get('type'))
             self.eq(1, nodes[0].get('public'))
             self.eq(1, nodes[0].get('success'))
@@ -501,25 +510,41 @@ class RiskModelTest(s_t_utils.SynTest):
             self.len(1, await core.nodes('risk:technique:masquerade :node -> * +inet:fqdn=microsoft-verify.com'))
             self.len(1, await core.nodes('risk:technique:masquerade :target -> * +inet:fqdn=microsoft.com'))
 
+            nodes = await core.nodes('''
+                [ risk:vulnerable=*
+                    :period=(2022, ?)
+                    :node=(inet:fqdn, vertex.link)
+                    :vuln={[ risk:vuln=* :name=redtree ]}
+                ]
+            ''')
+            self.len(1, nodes)
+            self.nn(nodes[0].get('vuln'))
+            self.eq((1640995200000, 9223372036854775807), nodes[0].get('period'))
+            self.eq(('inet:fqdn', 'vertex.link'), nodes[0].get('node'))
+            self.len(1, await core.nodes('risk:vulnerable -> risk:vuln'))
+            self.len(1, await core.nodes('risk:vuln:name=redtree -> risk:vulnerable :node -> *'))
+
     async def test_model_risk_mitigation(self):
         async with self.getTestCore() as core:
             nodes = await core.nodes('''[
                 risk:mitigation=*
                     :vuln=*
-                    :name=FooBar
+                    :name="  FooBar  "
                     :desc=BazFaz
                     :hardware=*
                     :software=*
                     :reporter:name=vertex
                     :reporter = { gen.ou.org vertex }
+                    :mitre:attack:mitigation=M1036
             ]''')
-            self.eq('FooBar', nodes[0].props['name'])
+            self.eq('foobar', nodes[0].props['name'])
             self.eq('BazFaz', nodes[0].props['desc'])
             self.eq('vertex', nodes[0].get('reporter:name'))
             self.nn(nodes[0].get('reporter'))
             self.len(1, await core.nodes('risk:mitigation -> risk:vuln'))
             self.len(1, await core.nodes('risk:mitigation -> it:prod:softver'))
             self.len(1, await core.nodes('risk:mitigation -> it:prod:hardware'))
+            self.len(1, await core.nodes('risk:mitigation -> it:mitre:attack:mitigation'))
 
     async def test_model_risk_tool_software(self):
 
@@ -536,6 +561,7 @@ class RiskModelTest(s_t_utils.SynTest):
                     :reporter:published=202302
                     :techniques=(*,)
                     :tag=cno.mal.cobaltstrike
+                    :mitre:attack:software=S0001
 
                     :sophistication=high
                     :availability=public
@@ -551,6 +577,7 @@ class RiskModelTest(s_t_utils.SynTest):
             self.eq((1325376000000, 9223372036854775807), nodes[0].get('used'))
             self.eq(1643673600000, nodes[0].get('reporter:discovered'))
             self.eq(1675209600000, nodes[0].get('reporter:published'))
+            self.eq('S0001', nodes[0].get('mitre:attack:software'))
 
             self.eq('cobaltstrike', nodes[0].get('soft:name'))
             self.eq(('beacon',), nodes[0].get('soft:names'))
@@ -560,6 +587,7 @@ class RiskModelTest(s_t_utils.SynTest):
             self.len(1, await core.nodes('risk:tool:software -> it:prod:soft'))
             self.len(1, await core.nodes('risk:tool:software -> ou:technique'))
             self.len(1, await core.nodes('risk:tool:software -> syn:tag'))
+            self.len(1, await core.nodes('risk:tool:software -> it:mitre:attack:software'))
 
             nodes = await core.nodes('''
                 [ risk:vuln:soft:range=*

synapse/tests/test_model_science.py

@@ -0,0 +1,59 @@
+import synapse.exc as s_exc
+import synapse.common as s_common
+import synapse.tests.utils as s_t_utils
+
+class SciModelTest(s_t_utils.SynTest):
+
+    async def test_model_sci(self):
+
+        async with self.getTestCore() as core:
+
+            nodes = await core.nodes('''
+                [ sci:hypothesis=*
+                    :name="Light  travels as a WAVE"
+                    :type=physics.quantum
+                    :summary="Light travels as a wave not a particle."
+                ]
+            ''')
+            self.len(1, nodes)
+            self.eq('physics.quantum.', nodes[0].get('type'))
+            self.eq('light travels as a wave', nodes[0].get('name'))
+            self.eq('Light travels as a wave not a particle.', nodes[0].get('summary'))
+
+            nodes = await core.nodes('''
+                [ sci:experiment=*
+                    :name=double-slit
+                    :time=2024-03-19
+                    :type=lab.light
+                    :summary="Foo bar baz."
+                ]
+            ''')
+            self.len(1, nodes)
+            self.eq(1710806400000, nodes[0].get('time'))
+            self.eq('lab.light.', nodes[0].get('type'))
+            self.eq('double-slit', nodes[0].get('name'))
+            self.eq('Foo bar baz.', nodes[0].get('summary'))
+
+            nodes = await core.nodes('''
+                [ sci:evidence=*
+                    :observation={[ sci:observation=*
+                        :time=2024-03-19
+                        :experiment={sci:experiment:name=double-slit}
+                        :summary="Shadows cast on the wall in a diffusion pattern."
+                    ]}
+                    :hypothesis={ sci:hypothesis:name="light travels as a wave" }
+                    :summary="Shadows in wave diffusion pattern support the hypothesis."
+                    :refutes=(false)
+                ]
+            ''')
+            self.len(1, nodes)
+            self.nn(nodes[0].get('hypothesis'))
+            self.nn(nodes[0].get('observation'))
+            self.eq(False, nodes[0].get('refutes'))
+            self.eq("Shadows in wave diffusion pattern support the hypothesis.", nodes[0].get('summary'))
+
+            nodes = await core.nodes('sci:observation')
+            self.len(1, nodes)
+            self.nn(nodes[0].get('experiment'))
+            self.eq(1710806400000, nodes[0].get('time'))
+            self.eq("Shadows cast on the wall in a diffusion pattern.", nodes[0].get('summary'))

synapse/tests/test_model_syn.py

@@ -11,7 +11,6 @@ class TestService(s_stormsvc.StormSvc):
         {
             'name': 'foo',
             'version': (0, 0, 1),
-            'synapse_minversion': [2, 144, 0],
             'synapse_version': '>=2.8.0,<3.0.0',
             'commands': (
                 {

synapse/tests/test_telepath.py

@@ -831,15 +831,17 @@ class TeleTest(s_t_utils.SynTest):
 
             await targ.waitready()
 
-            self.eq(110, await targ.dostuff(100))
+            prox00 = await targ.proxy(timeout=12)
+            self.eq(110, await prox00.dostuff(100))
+
             self.eq(1, fail0.count)
             self.eq(0, fail1.count)
 
-            _prox = await targ.proxy()
             await dmon0.fini()
-            self.true(await _prox.waitfini(10))
+            self.true(await prox00.waitfini(10))
 
-            self.eq(110, await targ.dostuff(100))
+            prox01 = await targ.proxy(timeout=12)
+            self.eq(110, await prox01.dostuff(100))
             self.eq(1, fail0.count)
             self.eq(1, fail1.count)
 
@@ -855,15 +857,36 @@ class TeleTest(s_t_utils.SynTest):
                 mesgs = stream.read()
                 self.notin('password', mesgs)
 
-            self.eq(110, await targ.dostuff(100))
+            prox00 = await targ.proxy(timeout=12)
+            self.eq(110, await prox00.dostuff(100))
 
             self.eq(1, fail0.count)
             self.eq(2, fail1.count)
 
         async with await s_telepath.open(url1) as targ:
-            await targ.waitready()
-            self.eq(110, await targ.dostuff(100))
+            await targ.waitready(timeout=12)
+            prox00 = await targ.proxy(timeout=12)
+            self.eq(110, await prox00.dostuff(100))
+
+        async def onlink(proxy, urlinfo):
+            self.eq(110, await proxy.dostuff(100))
+            _url = s_telepath.zipurl(urlinfo)
+            logger.info(f'Connected to url={_url}')
+
+        with self.getAsyncLoggerStream('synapse.tests.test_telepath',
+                                       f'Connected to url=tcp://127.0.0.1:{addr1[1]}/foo') as stream:
+            async with await s_telepath.open(url1, onlink=onlink) as targ:
+                self.true(await stream.wait(timeout=12))
+
+        # Coverage
+        async def badonlink(proxy, urlinfo):
+            raise ValueError('oopsie')
+
+        with self.getAsyncLoggerStream('synapse.telepath', 'onlink: ') as stream:
+            async with await s_telepath.open(url1, onlink=badonlink) as targ:
+                self.true(await stream.wait(timeout=12))
 
+        await dmon0.fini()
         await dmon1.fini()
 
     async def test_telepath_poolsize(self):

synapse/tests/test_tools_modrole.py

@@ -2,6 +2,26 @@ import synapse.lib.output as s_output
 import synapse.tests.utils as s_test
 import synapse.tools.modrole as s_t_modrole
 
+rolelist = s_test.deguidify('''
+Roles:
+  ce6928dfe88cace918c405bbef51e72f - all
+  0f316b3f3e6ec970fcdb9a085fcd5b77 - visi
+'''.strip())
+
+roleinfo = s_test.deguidify('''
+Role: visi (145c3321a0cd0cd06de19174415a7aeb)
+
+  Rules:
+    [0  ] - !foo.bar.baz
+    [1  ] - foo.bar
+
+  Gates:
+    3ad191c63a201df3246c6d6ff81763ad
+      Admin: False
+      [0  ] - !bar.baz.faz
+      [1  ] - bar.baz
+'''.strip())
+
 class ModRoleTest(s_test.SynTest):
 
     async def test_tools_modrole(self):
@@ -40,6 +60,60 @@ class ModRoleTest(s_test.SynTest):
             self.true(bool(visi.allowed('foo.bar.gaz'.split('.'))))
             self.false(bool(visi.allowed('foo.bar.baz'.split('.'))))
 
+            gateiden = core.getLayer().iden
+            argv = (
+                '--svcurl', svcurl,
+                'visi',
+                '--allow', 'bar.baz',
+                '--deny', 'bar.baz.faz',
+                '--gate', gateiden,
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_modrole.main(argv, outp=outp))
+            self.isin(f'...adding allow rule: bar.baz on gate {gateiden}', str(outp))
+            self.isin(f'...adding deny rule: bar.baz.faz on gate {gateiden}', str(outp))
+
+            gate = await core.getAuthGate(gateiden)
+            for role in gate['roles']:
+                if role['iden'] == visi.iden:
+                    self.isin((True, ('bar', 'baz')), role['rules'])
+                    self.isin((False, ('bar', 'baz', 'faz')), role['rules'])
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_modrole.main(argv, outp=outp))
+            self.isin(rolelist, s_test.deguidify(str(outp)))
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+                'visi',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_modrole.main(argv, outp=outp))
+            self.isin(roleinfo, s_test.deguidify(str(outp)))
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+                'newprole',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_modrole.main(argv, outp=outp))
+            self.isin('ERROR: Role not found: newprole', str(outp))
+
+            argv = (
+                '--svcurl', svcurl,
+                'visi',
+                '--gate', 'newp',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_modrole.main(argv, outp=outp))
+            self.isin('ERROR: No auth gate found with iden: newp', str(outp))
+
             argv = (
                 '--svcurl', svcurl,
                 '--add',
@@ -59,3 +133,10 @@ class ModRoleTest(s_test.SynTest):
             self.eq(0, await s_t_modrole.main(argv, outp=outp))
             self.isin('...deleting role: visi', str(outp))
             self.none(await core.auth.getRoleByName('visi'))
+
+            argv = (
+                '--svcurl', svcurl,
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_modrole.main(argv, outp=outp))
+            self.isin('ERROR: A rolename argument is required when --list is not specified.', str(outp))

synapse/tests/test_tools_moduser.py

@@ -2,6 +2,32 @@ import synapse.lib.output as s_output
 import synapse.tests.utils as s_test
 import synapse.tools.moduser as s_t_moduser
 
+userlist = '''
+Users:
+  root
+  visi
+'''.strip()
+
+userinfo = s_test.deguidify('''
+User: visi (04dddd4ff39e4ce00b36c7d526b9eac7)
+
+  Locked: False
+  Admin: False
+  Email: visi@test.com
+  Rules:
+    [0  ] - !foo.bar.baz
+    [1  ] - foo.bar
+
+  Roles:
+    576a948f9944c58d3953f0d36bc2da81 - all
+
+  Gates:
+    c7b276154c0c799430668cb3c4cd259d
+      Admin: False
+      [0  ] - !bar.baz.faz
+      [1  ] - bar.baz
+'''.strip())
+
 class ModUserTest(s_test.SynTest):
 
     async def test_tools_moduser(self):
@@ -124,6 +150,78 @@ class ModUserTest(s_test.SynTest):
             self.true(bool(visi.allowed('foo.bar.gaz'.split('.'))))
             self.false(bool(visi.allowed('foo.bar.baz'.split('.'))))
 
+            gateiden = core.getLayer().iden
+            argv = (
+                '--svcurl', svcurl,
+                'visi',
+                '--admin', 'true',
+                '--gate', gateiden,
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_moduser.main(argv, outp=outp))
+            self.isin(f'...setting admin: true on gate {gateiden}', str(outp))
+
+            gate = await core.getAuthGate(gateiden)
+            for user in gate['users']:
+                if user['iden'] == visi.iden:
+                    self.true(user['admin'])
+
+            gateiden = core.getLayer().iden
+            argv = (
+                '--svcurl', svcurl,
+                'visi',
+                '--admin', 'false',
+                '--allow', 'bar.baz',
+                '--deny', 'bar.baz.faz',
+                '--gate', gateiden,
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_moduser.main(argv, outp=outp))
+            self.isin(f'...setting admin: false on gate {gateiden}', str(outp))
+            self.isin(f'...adding allow rule: bar.baz on gate {gateiden}', str(outp))
+            self.isin(f'...adding deny rule: bar.baz.faz on gate {gateiden}', str(outp))
+
+            gate = await core.getAuthGate(gateiden)
+            for user in gate['users']:
+                if user['iden'] == visi.iden:
+                    self.isin((True, ('bar', 'baz')), user['rules'])
+                    self.isin((False, ('bar', 'baz', 'faz')), user['rules'])
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_moduser.main(argv, outp=outp))
+            self.isin(userlist, str(outp))
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+                'visi',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(0, await s_t_moduser.main(argv, outp=outp))
+            self.isin(userinfo, s_test.deguidify(str(outp)))
+
+            argv = (
+                '--svcurl', svcurl,
+                '--list',
+                'newpuser',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_moduser.main(argv, outp=outp))
+            self.isin('ERROR: User not found: newpuser', str(outp))
+
+            argv = (
+                '--svcurl', svcurl,
+                'visi',
+                '--gate', 'newp',
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_moduser.main(argv, outp=outp))
+            self.isin('ERROR: No auth gate found with iden: newp', str(outp))
+
             argv = (
                 '--svcurl', svcurl,
                 'visi',
@@ -151,3 +249,10 @@ class ModUserTest(s_test.SynTest):
             outp = s_output.OutPutStr()
             self.eq(1, await s_t_moduser.main(argv, outp=outp))
             self.isin('ERROR: User not found (need --add?): visi', str(outp))
+
+            argv = (
+                '--svcurl', svcurl,
+            )
+            outp = s_output.OutPutStr()
+            self.eq(1, await s_t_moduser.main(argv, outp=outp))
+            self.isin('ERROR: A username argument is required when --list is not specified.', str(outp))

synapse/tools/modrole.py

@@ -11,15 +11,34 @@ descr = '''
 Add or modify a role in a Synapse service.
 '''
 
+def printrole(role, outp):
+
+    outp.printf(f'Role: {role.get("name")} ({role.get("iden")})')
+    outp.printf('')
+    outp.printf('  Rules:')
+    for indx, rule in enumerate(role.get('rules')):
+        outp.printf(f'    [{str(indx).ljust(3)}] - {s_common.reprauthrule(rule)}')
+
+    outp.printf('')
+    outp.printf('  Gates:')
+    for gateiden, gateinfo in role.get('authgates', {}).items():
+        outp.printf(f'    {gateiden}')
+        outp.printf(f'      Admin: {gateinfo.get("admin") == True}')
+        for indx, rule in enumerate(gateinfo.get('rules', ())):
+            outp.printf(f'      [{str(indx).ljust(3)}] - {s_common.reprauthrule(rule)}')
+
 async def main(argv, outp=s_output.stdout):
 
     pars = argparse.ArgumentParser(prog='modrole', description=descr)
     pars.add_argument('--svcurl', default='cell:///vertex/storage', help='The telepath URL of the Synapse service.')
     pars.add_argument('--add', default=False, action='store_true', help='Add the role if they do not already exist.')
     pars.add_argument('--del', dest='delete', default=False, action='store_true', help='Delete the role if it exists.')
+    pars.add_argument('--list', default=False, action='store_true',
+                      help='List existing roles, or rules of a specific role.')
     pars.add_argument('--allow', default=[], action='append', help='A permission string to allow for the role.')
     pars.add_argument('--deny', default=[], action='append', help='A permission string to deny for the role.')
-    pars.add_argument('rolename', help='The rolename to add/edit.')
+    pars.add_argument('--gate', default=None, help='The iden of an auth gate to add/del rules on.')
+    pars.add_argument('rolename', nargs='?', help='The rolename to add/edit.')
 
     opts = pars.parse_args(argv)
 
@@ -31,6 +50,31 @@ async def main(argv, outp=s_output.stdout):
 
         async with await s_telepath.openurl(opts.svcurl) as cell:
 
+            if opts.list:
+                if opts.rolename:
+                    role = await cell.getRoleDefByName(opts.rolename)
+                    if role is None:
+                        outp.printf(f'ERROR: Role not found: {opts.rolename}')
+                        return 1
+
+                    printrole(role, outp)
+
+                else:
+                    outp.printf('Roles:')
+                    for role in await cell.getRoleDefs():
+                        outp.printf(f'  {role.get("iden")} - {role.get("name")}')
+
+                return 0
+            elif opts.rolename is None:
+                outp.printf(f'ERROR: A rolename argument is required when --list is not specified.')
+                return 1
+
+            if opts.gate:
+                gate = await cell.getAuthGate(opts.gate)
+                if gate is None:
+                    outp.printf(f'ERROR: No auth gate found with iden: {opts.gate}')
+                    return 1
+
             role = await cell.getRoleDefByName(opts.rolename)
             if role is not None:
                 outp.printf(f'Modifying role: {opts.rolename}')
@@ -52,15 +96,23 @@ async def main(argv, outp=s_output.stdout):
 
             for allow in opts.allow:
                 perm = allow.lower().split('.')
-                outp.printf(f'...adding allow rule: {allow}')
-                if not await cell.isRoleAllowed(roleiden, perm):
-                    await cell.addRoleRule(roleiden, (True, perm), indx=0)
+                mesg = f'...adding allow rule: {allow}'
+                if opts.gate:
+                    mesg += f' on gate {opts.gate}'
+
+                outp.printf(mesg)
+                if not await cell.isRoleAllowed(roleiden, perm, gateiden=opts.gate):
+                    await cell.addRoleRule(roleiden, (True, perm), indx=0, gateiden=opts.gate)
 
             for deny in opts.deny:
                 perm = deny.lower().split('.')
-                outp.printf(f'...adding deny rule: {deny}')
-                if await cell.isRoleAllowed(roleiden, perm):
-                    await cell.addRoleRule(roleiden, (False, perm), indx=0)
+                mesg = f'...adding deny rule: {deny}'
+                if opts.gate:
+                    mesg += f' on gate {opts.gate}'
+
+                outp.printf(mesg)
+                if await cell.isRoleAllowed(roleiden, perm, gateiden=opts.gate):
+                    await cell.addRoleRule(roleiden, (False, perm), indx=0, gateiden=opts.gate)
     return 0
 
 if __name__ == '__main__':  # pragma: no cover