mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added Fortinet SNMP Trap handlers (#10148)

Browse Source
This commit is contained in:
h-barnhart
2019-04-27 13:34:15 -05:00
committed by PipoCanaja
parent b102cedc5c
commit 27ff49fb1d
12 changed files with 647 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
tests/Feature/SnmpTraps/FgTrapAvOversizeTest.php Normal file
View File

@@ -0,0 +1,52 @@
<?php
/*
* FgTrapAvOversizeTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate FgTrapAvOversized.php
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapAvOversizeTest extends LaravelTestCase
{
public function testAvOversize()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapAvOversize
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname";
$message = "$device->hostname received a file that exceeds proxy buffer, skipping AV scan";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsAvOversize');
}
}

97
tests/Feature/SnmpTraps/FgTrapIpsTest.php Normal file
View File

@@ -0,0 +1,97 @@
<?php
/*
* FgTrapIpsTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate IPS SNMP trap handlers (FgTrapIps*)
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use App\Models\Ipv4Address;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapIpsTest extends LaravelTestCase
{
public function testIpsAnomaly()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsAnomaly
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgIpsTrapSigId.0 2
FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg.0 tcp_src_session";
$message = "DDoS prevention triggered. Source: $ipv4->ipv4_address Protocol: tcp_src_session";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 4);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsAnomaly trap');
}
public function testIpsPkgUdate()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsPkgUpdate
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname";
$message = "IPS package updated on $device->hostname";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsPkgUpdate trap');
}
public function testIpsSignature()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsSignature
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgIpsTrapSigId.0 47173
FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg.0 UPnP.SSDP.M.Search.Anomaly";
$message = "IPS signature UPnP.SSDP.M.Search.Anomaly detected from $ipv4->ipv4_address with Fortiguard ID 47173";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 4);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsSignature trap');
}
}

78
tests/Feature/SnmpTraps/FgTrapVpnTunTest.php Normal file
View File

@@ -0,0 +1,78 @@
<?php
/**
* FgTrapVpnTunTest.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 Tony Murray
* @author Tony Murray <murraytony@gmail.com>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use App\Models\Ipv4Address;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapVpnTunTest extends LaravelTestCase
{
public function testVpnTunDown()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapVpnTunDown
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgVpnTrapLocalGateway.0 $device->ip
FORTINET-FORTIGATE-MIB::fgVpnTrapRemoteGateway.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgVpnTrapPhase1Name.0 test_tunnel_down";
$message = "VPN tunnel test_tunnel_down to $ipv4->ipv4_address is down";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 3);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapVpnTunDown');
}
public function testVpnTunUp()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapVpnTunUp
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgVpnTrapLocalGateway.0 $device->ip
FORTINET-FORTIGATE-MIB::fgVpnTrapRemoteGateway.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgVpnTrapPhase1Name.0 test_tunnel_up";
$message = "VPN tunnel test_tunnel_up to $ipv4->ipv4_address is up";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 1);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapVpnTunUp');
}
}

55
tests/Feature/SnmpTraps/FmTrapLogRateThresholdTest.php Normal file
View File

@@ -0,0 +1,55 @@
<?php
/*
* FmTrapLogRateThresholdTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate FmTrapLogRateThreshold.php
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapLogRateThresholdTest extends LaravelTestCase
{
public function testAvOversize()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmTrapLogRateThreshold
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRate.0 315
FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRateThreshold.0 260";
$message = "Recommended log rate exceeded. Current Rate: 315 Recommended Rate: 260";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 3);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fmTrapLogRateThreshold trap');
}
}