Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

'#1754: TorTc Parser Tests developed and TorTc Parser improvements. #1772

Merged
merged 5 commits into from
Aug 3, 2023
Merged

'#1754: TorTc Parser Tests developed and TorTc Parser improvements. #1772

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a2a09d9
'#1754: TorTc Parser Tests developed and TorTc Parser improvements.
felipecostadesousa Jul 14, 2023
f2f1076
'#1754: simplify test including extracted quotes in expected values
lfcnassif Jul 14, 2023
dc50a51
'#1754: fix indentation
lfcnassif Aug 3, 2023
e3806e8
fix #1795: remove trailing new lines from item text
lfcnassif Aug 3, 2023
9509ae0
'#1754: expected/actual values were swapped causing confusion on failure
lfcnassif Aug 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/tor/TorTcParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,15 @@ public class TorTcParser extends AbstractParser {
private static final long serialVersionUID = 1L;
private static final MediaType TOR_TC_MIME = MediaType.application("x-tor-tc-fragment");
private static final Set<MediaType> SUPPORTED_TYPES = Collections.singleton(TOR_TC_MIME);
private static final String TORTC_PREFIX = "TORTC:";
public static final String TORTC_PREFIX = "TORTC:";
public static final String TORTC_BUILD_FLAGS = TORTC_PREFIX + "BUILD_FLAGS";
public static final String TORTC_PURPOSE = TORTC_PREFIX + "PURPOSE";
public static final String TORTC_REND_QUERY = TORTC_PREFIX + "REND_QUERY";
public static final String TORTC_TIME_CREATED = TORTC_PREFIX + "TIME_CREATED";
public static final String TORTC_SOCKS_USERNAME = TORTC_PREFIX + "SOCKS_USERNAME";
public static final String TORTC_SOCKS_PASSWORD = TORTC_PREFIX + "SOCKS_PASSWORD";
public static final String TORTC_CIRCUIT_STATUS = TORTC_PREFIX + "CircuitStatus";
public static final String TORTC_CIRCUIT_ID = TORTC_PREFIX + "CircuitId";
private static final int MAX_BUFFER_SIZE = 1 << 24;
private static final List<String> dateMetadatas = Arrays.asList("TIME_CREATED");

Expand Down Expand Up @@ -78,25 +86,27 @@ public void parse(InputStream stream, ContentHandler handler, Metadata metadata,
String itemText = readInputStream(stream);

if (itemText != null) {
if (itemText.indexOf("\r\n") > 2) {
itemText = itemText.substring(0, itemText.indexOf("\r\n"));
int idx = itemText.indexOf("\n");
if (idx > 2) {
itemText = itemText.substring(0, idx);
}
itemText = itemText.stripTrailing();

if (!(itemText.contains("BUILD_FLAGS") || itemText.contains("SOCKS") || itemText.contains("HS_STATE"))) {
throw new TikaException("Invalid or incomplete TOR TC carved fragment");
}

int nextSpace = itemText.indexOf(" ");
if (nextSpace != -1) {
metadata.add(TORTC_PREFIX + "CircuitStatus", itemText.substring(0, nextSpace));
metadata.add(TORTC_CIRCUIT_STATUS, itemText.substring(0, nextSpace));
itemText = itemText.substring(nextSpace + 1);
}

nextSpace = itemText.indexOf(" ");
if (nextSpace != -1) {
String circuitId = itemText.substring(0, nextSpace);
if (circuitId.indexOf("BUILD_FLAGS") > 2) {
metadata.add(TORTC_PREFIX + "CircuitId", circuitId);
metadata.add(TORTC_CIRCUIT_ID, circuitId);
}
}

Expand Down
57 changes: 57 additions & 0 deletions iped-parsers/iped-parsers-impl/src/test/java/iped/parsers/tor/TorParserTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
package iped.parsers.tor;

import java.io.IOException;
import java.io.InputStream;

import org.apache.tika.exception.TikaException;
import org.apache.tika.metadata.Metadata;
import org.apache.tika.parser.ParseContext;
import org.apache.tika.sax.BodyContentHandler;
import org.junit.Test;
import org.xml.sax.ContentHandler;
import org.xml.sax.SAXException;

import junit.framework.TestCase;

public class TorParserTest extends TestCase {

private static InputStream getStream(String name) {
return Thread.currentThread().getContextClassLoader().getResourceAsStream(name);
}

@Test
public void testTorParser1() throws IOException, SAXException, TikaException {
TorTcParser parser = new TorTcParser();
Metadata metadata = new Metadata();
ContentHandler handler = new BodyContentHandler();
ParseContext context = new ParseContext();
parser.getSupportedTypes(context);
try (InputStream stream = getStream("test-files/testTor1")) {
parser.parse(stream, handler, metadata, context);
assertEquals("IS_INTERNAL,NEED_CAPACITY", metadata.get(TorTcParser.TORTC_BUILD_FLAGS));
assertEquals("HS_CLIENT_REND", metadata.get(TorTcParser.TORTC_PURPOSE));
assertEquals("facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd", metadata.get(TorTcParser.TORTC_REND_QUERY));
assertEquals("2023-07-03T17:05:24.214215Z", metadata.get(TorTcParser.TORTC_TIME_CREATED));
assertEquals("\"facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion\"", metadata.get(TorTcParser.TORTC_SOCKS_USERNAME));
assertEquals("\"8b855a9b98c96ce9b877a17397d59945\"", metadata.get(TorTcParser.TORTC_SOCKS_PASSWORD));
}
}

@Test
public void testTorParser2() throws IOException, SAXException, TikaException {
TorTcParser parser = new TorTcParser();
Metadata metadata = new Metadata();
ContentHandler handler = new BodyContentHandler();
ParseContext context = new ParseContext();
parser.getSupportedTypes(context);
try (InputStream stream = getStream("test-files/testTor2")) {
parser.parse(stream, handler, metadata, context);
assertEquals("IS_INTERNAL,NEED_CAPACITY", metadata.get(TorTcParser.TORTC_BUILD_FLAGS));
assertEquals("HS_CLIENT_REND", metadata.get(TorTcParser.TORTC_PURPOSE));
assertEquals("facebook26qderizo52pigg5y4a2jsdhqz4odvvusaij4yhxehqngqad", metadata.get(TorTcParser.TORTC_REND_QUERY));
assertEquals("2023-07-03T17:04:59.965391Z", metadata.get(TorTcParser.TORTC_TIME_CREATED));
assertEquals("\"facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion\"", metadata.get(TorTcParser.TORTC_SOCKS_USERNAME));
assertEquals("\"8b855a9b98c96ce9b877a17397d59945\"", metadata.get(TorTcParser.TORTC_SOCKS_PASSWORD));
}
}
}
1 change: 1 addition & 0 deletions iped-parsers/iped-parsers-impl/src/test/resources/test-files/testTor1
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
BUILT $E22633FF1C9412ADED731F7B31A9B7532142C89B~Jubilee,$8330C8C52A4DC562135369D317D86887BBFE1685~derailleur,$79E3B585803DE805CCBC00C1EF36B1E74372861D~udeserveprivacy BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_REND HS_STATE=HSCR_JOINED REND_QUERY=facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd TIME_CREATED=2023-07-03T17:05:24.214215 SOCKS_USERNAME="facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion" SOCKS_PASSWORD="8b855a9b98c96ce9b877a17397d59945"
1 change: 1 addition & 0 deletions iped-parsers/iped-parsers-impl/src/test/resources/test-files/testTor2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
BUILT $E22633FF1C9412ADED731F7B31A9B7532142C89B~Jubilee,$132F529D2860B0DD4E7C272ED23DFE7E2FDEE2A3~SubjectDelta,$995362C04EAFB214BC96BE9D8F0F0B712D3BB763~bassblitzed BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY PURPOSE=HS_CLIENT_REND HS_STATE=HSCR_JOINED REND_QUERY=facebook26qderizo52pigg5y4a2jsdhqz4odvvusaij4yhxehqngqad TIME_CREATED=2023-07-03T17:04:59.965391 SOCKS_USERNAME="facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion" SOCKS_PASSWORD="8b855a9b98c96ce9b877a17397d59945"
Loading