Skip to content

Commit

Permalink
Move/merge some deterministic ID tests from the observed-data SDO
Browse files Browse the repository at this point in the history 
test suite to the test suite specific to testing deterministic
IDs.  This keeps the tests for that specific system in one place.
  • Loading branch information
@chisholm
chisholm committed Jun 5, 2020
1 parent f17f782 commit 5a5484d
Show file tree
Hide file tree
Showing 2 changed files with 136 additions and 159 deletions.
165 changes: 136 additions & 29 deletions stix2/test/v21/test_deterministic_ids.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
IntegerProperty, ListProperty, StringProperty, TimestampProperty,
TypeProperty,
)
import stix2.v21.base
import stix2.v21

SCO_DET_ID_NAMESPACE = uuid.UUID("00abedb4-aa42-466c-9c01-fed23315a9b7")

Expand Down Expand Up @@ -43,7 +43,7 @@ def _make_uuid5(name):

def test_no_contrib_props_defined():

class SomeSCO(stix2.v21.base._Observable):
class SomeSCO(stix2.v21._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
Expand All @@ -63,31 +63,8 @@ class SomeSCO(stix2.v21.base._Observable):
assert uuid_.version == 4


def test_no_contrib_props_given():

class SomeSCO(stix2.v21.base._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
('id', IDProperty(_type, spec_version='2.1')),
(
'extensions', ExtensionsProperty(
spec_version='2.1', enclosing_type=_type,
),
),
('value', StringProperty()),
))
_id_contributing_properties = ['value']

sco = SomeSCO()
uuid_ = _uuid_from_id(sco["id"])

assert uuid_.variant == uuid.RFC_4122
assert uuid_.version == 4


def test_json_compatible_prop_values():
class SomeSCO(stix2.v21.base._Observable):
class SomeSCO(stix2.v21._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
Expand Down Expand Up @@ -127,7 +104,7 @@ class SomeSCO(stix2.v21.base._Observable):


def test_json_incompatible_timestamp_value():
class SomeSCO(stix2.v21.base._Observable):
class SomeSCO(stix2.v21._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
Expand Down Expand Up @@ -163,7 +140,7 @@ class SubObj(stix2.base._STIXBase):
('value', StringProperty()),
))

class SomeSCO(stix2.v21.base._Observable):
class SomeSCO(stix2.v21._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
Expand Down Expand Up @@ -194,7 +171,7 @@ class SomeSCO(stix2.v21.base._Observable):


def test_empty_hash():
class SomeSCO(stix2.v21.base._Observable):
class SomeSCO(stix2.v21._Observable):
_type = "some-sco"
_properties = OrderedDict((
('type', TypeProperty(_type, spec_version='2.1')),
Expand Down Expand Up @@ -228,3 +205,133 @@ def test_json_unescaping(json_escaped, expected_unescaped):
def test_json_unescaping_bad_escape():
with pytest.raises(ValueError):
stix2.base._un_json_escape(r"\x")


def test_deterministic_id_same_extra_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

assert email_addr_1.id == email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_diff_extra_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Janey Doe",
)

assert email_addr_1.id == email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_diff_contributing_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Janey Doe",
)

assert email_addr_1.id != email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_no_contributing_props():
email_msg_1 = stix2.v21.EmailMessage(
is_multipart=False,
)

email_msg_2 = stix2.v21.EmailMessage(
is_multipart=False,
)

assert email_msg_1.id != email_msg_2.id

uuid_obj_1 = uuid.UUID(email_msg_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 4

uuid_obj_2 = uuid.UUID(email_msg_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 4


def test_id_gen_recursive_dict_conversion_1():
file_observable = stix2.v21.File(
name="example.exe",
size=68 * 1000,
magic_number_hex="50000000",
hashes={
"SHA-256": "841a8921140aba50671ebb0770fecc4ee308c4952cfeff8de154ab14eeef4649",
},
extensions={
"windows-pebinary-ext": stix2.v21.WindowsPEBinaryExt(
pe_type="exe",
machine_hex="014c",
sections=[
stix2.v21.WindowsPESection(
name=".data",
size=4096,
entropy=7.980693,
hashes={"SHA-256": "6e3b6f3978e5cd96ba7abee35c24e867b7e64072e2ecb22d0ee7a6e6af6894d0"},
),
],
),
},
)

assert file_observable.id == "file--ced31cd4-bdcb-537d-aefa-92d291bfc11d"


def test_id_gen_recursive_dict_conversion_2():
wrko = stix2.v21.WindowsRegistryKey(
values=[
stix2.v21.WindowsRegistryValueType(
name="Foo",
data="qwerty",
),
stix2.v21.WindowsRegistryValueType(
name="Bar",
data="42",
),
],
)

assert wrko.id == "windows-registry-key--36594eba-bcc7-5014-9835-0e154264e588"
130 changes: 0 additions & 130 deletions stix2/test/v21/test_observed_data.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1469,133 +1469,3 @@ def test_objects_deprecation():
},
},
)


def test_deterministic_id_same_extra_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

assert email_addr_1.id == email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_diff_extra_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Janey Doe",
)

assert email_addr_1.id == email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_diff_contributing_prop_vals():
email_addr_1 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Johnny Doe",
)

email_addr_2 = stix2.v21.EmailAddress(
value="[email protected]",
display_name="Janey Doe",
)

assert email_addr_1.id != email_addr_2.id

uuid_obj_1 = uuid.UUID(email_addr_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 5

uuid_obj_2 = uuid.UUID(email_addr_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 5


def test_deterministic_id_no_contributing_props():
email_msg_1 = stix2.v21.EmailMessage(
is_multipart=False,
)

email_msg_2 = stix2.v21.EmailMessage(
is_multipart=False,
)

assert email_msg_1.id != email_msg_2.id

uuid_obj_1 = uuid.UUID(email_msg_1.id[-36:])
assert uuid_obj_1.variant == uuid.RFC_4122
assert uuid_obj_1.version == 4

uuid_obj_2 = uuid.UUID(email_msg_2.id[-36:])
assert uuid_obj_2.variant == uuid.RFC_4122
assert uuid_obj_2.version == 4


def test_id_gen_recursive_dict_conversion_1():
file_observable = stix2.v21.File(
name="example.exe",
size=68 * 1000,
magic_number_hex="50000000",
hashes={
"SHA-256": "841a8921140aba50671ebb0770fecc4ee308c4952cfeff8de154ab14eeef4649",
},
extensions={
"windows-pebinary-ext": stix2.v21.WindowsPEBinaryExt(
pe_type="exe",
machine_hex="014c",
sections=[
stix2.v21.WindowsPESection(
name=".data",
size=4096,
entropy=7.980693,
hashes={"SHA-256": "6e3b6f3978e5cd96ba7abee35c24e867b7e64072e2ecb22d0ee7a6e6af6894d0"},
),
],
),
},
)

assert file_observable.id == "file--ced31cd4-bdcb-537d-aefa-92d291bfc11d"


def test_id_gen_recursive_dict_conversion_2():
wrko = stix2.v21.WindowsRegistryKey(
values=[
stix2.v21.WindowsRegistryValueType(
name="Foo",
data="qwerty",
),
stix2.v21.WindowsRegistryValueType(
name="Bar",
data="42",
),
],
)

assert wrko.id == "windows-registry-key--36594eba-bcc7-5014-9835-0e154264e588"

0 comments on commit 5a5484d

Please sign in to comment.