mirror/librenms-librenms
1
0
Fork 0
mirror of https://github.com/librenms/librenms.git synced 2024-10-07 16:52:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added Fortinet SNMP Trap handlers (#10148)

Browse Source
This commit is contained in:
h-barnhart
2019-04-27 13:34:15 -05:00
committed by PipoCanaja
parent b102cedc5c
commit 27ff49fb1d
12 changed files with 647 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
LibreNMS/Snmptrap/Handlers/FgTrapAvOversize.php Normal file
View File

@@ -0,0 +1,50 @@
<?php
/**
* FgTrapAvOversize.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* The Fortigate received a file that is larger than the proxy buffer for
* AV scanning. Nothing to do.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 Heath Barnhart
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapAvOversize implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
Log::event("$device->hostname received a file that exceeds proxy buffer, skipping AV scan", $device->device_id, 'trap', 2);
}
}

51
LibreNMS/Snmptrap/Handlers/FgTrapIpsAnomaly.php Normal file
View File

@@ -0,0 +1,51 @@
<?php
/**
* FgTrapIpsAnomaly.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Fortigate DDoS Policy tripped.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapIpsAnomaly implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
$srcIp = $trap->getOidData($trap->findOid('FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp'));
$proto = $trap->getOidData($trap->findOid('FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg'));
Log::event("DDoS prevention triggered. Source: $srcIp Protocol: $proto", $device->device_id, 'trap', 4);
}
}

49
LibreNMS/Snmptrap/Handlers/FgTrapIpsPkgUpdate.php Normal file
View File

@@ -0,0 +1,49 @@
<?php
/**
* FgTrapIpsPkgUpdate.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Trap sent when Fortigate IPS signature database was updated.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 KanREN, Inc.
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapIpsPkgUpdate implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
Log::event("IPS package updated on $device->hostname", $device->device_id, 'trap', 2);
}
}

52
LibreNMS/Snmptrap/Handlers/FgTrapIpsSignature.php Normal file
View File

@@ -0,0 +1,52 @@
<?php
/**
* FgTrapIpsSignature.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Traffic pattern matches Fortigate IPS signature.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 Heath Barnhart
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapIpsSignature implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
$srcIp = $trap->getOidData($trap->findOid('FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp'));
$sigNum = $trap->getOidData($trap->findOid('FORTINET-FORTIGATE-MIB::fgIpsTrapSigId'));
$sigName = $trap->getOidData($trap->findOid('FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg'));
Log::event("IPS signature $sigName detected from $srcIp with Fortiguard ID $sigNum", $device->device_id, 'trap', 4);
}
}

51
LibreNMS/Snmptrap/Handlers/FgTrapVpnTunDown.php Normal file
View File

@@ -0,0 +1,51 @@
<?php
/**
* FgTrapVpnTunDown.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Fortigate VPN IPSec Tunnel UP.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 KanREN, Inc.
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapVpnTunDown implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
$remoteGw = $trap->getOidData($trap->findOid('FORTIGATE-MIB::fgVpnTrapRemoteGateway'));
$tunName = $trap->getOidData($trap->findOid('FORTIGATE-MIB::fgVpnTrapPhase1Name'));
Log::event("VPN tunnel $tunName to $remoteGw is down", $device->device_id, 'trap', 3);
}
}

51
LibreNMS/Snmptrap/Handlers/FgTrapVpnTunUp.php Normal file
View File

@@ -0,0 +1,51 @@
<?php
/**
* FgTrapVpnTunDown.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Fortigate VPN IPSec Tunnel UP.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2018 KanREN, Inc.
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FgTrapVpnTunUp implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
$remoteGw = $trap->getOidData($trap->findOid('FORTIGATE-MIB::fgVpnTrapRemoteGateway'));
$tunName = $trap->getOidData($trap->findOid('FORTIGATE-MIB::fgVpnTrapPhase1Name'));
Log::event("VPN tunnel $tunName to $remoteGw is up", $device->device_id, 'trap', 1);
}
}

52
LibreNMS/Snmptrap/Handlers/FmTrapLogRateThreshold.php Normal file
View File

@@ -0,0 +1,52 @@
<?php
/**
* FmTrapLogRateThreshold.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* FortiAnalyzer will send this trap when the received log rate
* exceeds the suggested rate for the daily rate license.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc.
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Snmptrap\Handlers;
use App\Models\Device;
use LibreNMS\Interfaces\SnmptrapHandler;
use LibreNMS\Snmptrap\Trap;
use Log;
class FmTrapLogRateThreshold implements SnmptrapHandler
{
/**
* Handle snmptrap.
* Data is pre-parsed and delivered as a Trap.
*
* @param Device $device
* @param Trap $trap
* @return void
*/
public function handle(Device $device, Trap $trap)
{
$logRate = $trap->getOidData($trap->findOid('FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRate'));
$logThresh = $trap->getOidData($trap->findOid('FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRateThreshold'));
Log::event("Recommended log rate exceeded. Current Rate: $logRate Recommended Rate: $logThresh", $device->device_id, 'trap', 3);
}
}

9
config/snmptraps.php
View File

@@ -19,5 +19,14 @@ return [
'MG-SNMP-UPS-MIB::upsmgUtilityRestored' => \LibreNMS\Snmptrap\Handlers\UpsmgUtilityRestored::class,
'EQUIPMENT-MIB::equipStatusTrap' => \LibreNMS\Snmptrap\Handlers\EquipStatusTrap::class,
'LOG-MIB::logTrap' => \LibreNMS\Snmptrap\Handlers\LogTrap::class,
'FORTINET-FORTIGATE-MIB::fgTrapVpnTunDown' => \LibreNMS\Snmptrap\Handlers\FgTrapVpnTunDown::class,
'FORTINET-FORTIGATE-MIB::fgTrapVpnTunUp' => \LibreNMS\Snmptrap\Handlers\FgTrapVpnTunUp::class,
'FORTINET-FORTIGATE-MIB::fgTrapIpsSignature' => \LibreNMS\Snmptrap\Handlers\FgTrapIpsSignature::class,
'FORTINET-FORTIGATE-MIB::fgTrapIpsAnomaly' => \LibreNMS\Snmptrap\Handlers\FgTrapIpsAnomaly::class,
'FORTINET-FORTIGATE-MIB::fgTrapAvOversize' => \LibreNMS\Snmptrap\Handlers\FgTrapAvOversize::class,
'FORTINET-FORTIGATE-MIB::fgTrapIpsPkgUpdate' => \LibreNMS\Snmptrap\Handlers\FgTrapIpsPkgUpdate::class,
'FORTINET-CORE-MIB::fnTrapMemThreshold' => \LibreNMS\Snmptrap\Handlers\FnTrapMemThreshold::class,
'FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmTrapLogRateThreshold' => \LibreNMS\Snmptrap\Handlers\FmTrapLogRateThreshold::class,
'FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmTrapLogAlert' => \LibreNMS\Snmptrap\Handlers\FmTrapLogAlert::class,
]
];

52
tests/Feature/SnmpTraps/FgTrapAvOversizeTest.php Normal file
View File

@@ -0,0 +1,52 @@
<?php
/*
* FgTrapAvOversizeTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate FgTrapAvOversized.php
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapAvOversizeTest extends LaravelTestCase
{
public function testAvOversize()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapAvOversize
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname";
$message = "$device->hostname received a file that exceeds proxy buffer, skipping AV scan";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsAvOversize');
}
}

97
tests/Feature/SnmpTraps/FgTrapIpsTest.php Normal file
View File

@@ -0,0 +1,97 @@
<?php
/*
* FgTrapIpsTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate IPS SNMP trap handlers (FgTrapIps*)
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use App\Models\Ipv4Address;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapIpsTest extends LaravelTestCase
{
public function testIpsAnomaly()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsAnomaly
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgIpsTrapSigId.0 2
FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg.0 tcp_src_session";
$message = "DDoS prevention triggered. Source: $ipv4->ipv4_address Protocol: tcp_src_session";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 4);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsAnomaly trap');
}
public function testIpsPkgUdate()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsPkgUpdate
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname";
$message = "IPS package updated on $device->hostname";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 2);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsPkgUpdate trap');
}
public function testIpsSignature()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapIpsSignature
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgIpsTrapSigId.0 47173
FORTINET-FORTIGATE-MIB::fgIpsTrapSrcIp.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgIpsTrapSigMsg.0 UPnP.SSDP.M.Search.Anomaly";
$message = "IPS signature UPnP.SSDP.M.Search.Anomaly detected from $ipv4->ipv4_address with Fortiguard ID 47173";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 4);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapIpsSignature trap');
}
}

78
tests/Feature/SnmpTraps/FgTrapVpnTunTest.php Normal file
View File

@@ -0,0 +1,78 @@
<?php
/**
* FgTrapVpnTunTest.php
*
* -Description-
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 Tony Murray
* @author Tony Murray <murraytony@gmail.com>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use App\Models\Ipv4Address;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapVpnTunTest extends LaravelTestCase
{
public function testVpnTunDown()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapVpnTunDown
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgVpnTrapLocalGateway.0 $device->ip
FORTINET-FORTIGATE-MIB::fgVpnTrapRemoteGateway.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgVpnTrapPhase1Name.0 test_tunnel_down";
$message = "VPN tunnel test_tunnel_down to $ipv4->ipv4_address is down";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 3);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapVpnTunDown');
}
public function testVpnTunUp()
{
$device = factory(Device::class)->create();
$ipv4 = factory(Ipv4Address::class)->make();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIGATE-MIB::fgTrapVpnTunUp
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIGATE-MIB::fgVpnTrapLocalGateway.0 $device->ip
FORTINET-FORTIGATE-MIB::fgVpnTrapRemoteGateway.0 $ipv4->ipv4_address
FORTINET-FORTIGATE-MIB::fgVpnTrapPhase1Name.0 test_tunnel_up";
$message = "VPN tunnel test_tunnel_up to $ipv4->ipv4_address is up";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 1);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fgTrapVpnTunUp');
}
}

55
tests/Feature/SnmpTraps/FmTrapLogRateThresholdTest.php Normal file
View File

@@ -0,0 +1,55 @@
<?php
/*
* FmTrapLogRateThresholdTest.php
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* Unit tests for Fortigate FmTrapLogRateThreshold.php
*
* @package LibreNMS
* @link http://librenms.org
* @copyright 2019 KanREN, Inc
* @author Heath Barnhart <hbarnhart@kanren.net>
*/
namespace LibreNMS\Tests\Feature\SnmpTraps;
use App\Models\Device;
use LibreNMS\Snmptrap\Dispatcher;
use LibreNMS\Snmptrap\Trap;
use LibreNMS\Tests\LaravelTestCase;
class FgTrapLogRateThresholdTest extends LaravelTestCase
{
public function testAvOversize()
{
$device = factory(Device::class)->create();
$trapText = "$device->hostname
UDP: [$device->ip]:57602->[192.168.5.5]:162
DISMAN-EVENT-MIB::sysUpTimeInstance 302:12:56:24.81
SNMPv2-MIB::snmpTrapOID.0 FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmTrapLogRateThreshold
FORTINET-CORE-MIB::fnSysSerial.0 $device->serial
SNMPv2-MIB::sysName.0 $device->hostname
FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRate.0 315
FORTINET-FORTIMANAGER-FORTIANALYZER-MIB::fmLogRateThreshold.0 260";
$message = "Recommended log rate exceeded. Current Rate: 315 Recommended Rate: 260";
\Log::shouldReceive('event')->once()->with($message, $device->device_id, 'trap', 3);
$trap = new Trap($trapText);
$this->assertTrue(Dispatcher::handle($trap), 'Could not handle fmTrapLogRateThreshold trap');
}
}