83 lines
2.6 KiB
Go
83 lines
2.6 KiB
Go
// Copyright 2026 tamakyi. All rights reserved.
|
|
// Use of this source code is governed by a MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package db
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestHoneypotStore 覆盖蜜罐命中记录的写入、检索与聚合。
|
|
//
|
|
// 重点验证「只追加」的审计语义：DeleteBefore 只按时间删，不做软删除；
|
|
// 以及 TopCredentials 能把攻击者正在用的字典聚合出来。
|
|
func TestHoneypotStore(t *testing.T) {
|
|
database, cleanup := newTestDB(t)
|
|
ctx := context.Background()
|
|
|
|
t.Cleanup(func() {
|
|
if err := cleanup("honeypot_hits"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
|
|
store := NewHoneypotStore(database)
|
|
now := time.Now()
|
|
|
|
rows := []*HoneypotHit{
|
|
{IP: "1.2.3.4", Method: "GET", Path: "/wp-admin", Provider: "Azure", CreatedAt: now.Add(-3 * time.Hour)},
|
|
{IP: "1.2.3.4", Method: "POST", Path: "/wp-login.php", Username: "admin", Password: "admin123", HadFields: true, CreatedAt: now.Add(-2 * time.Hour)},
|
|
{IP: "1.2.3.4", Method: "POST", Path: "/wp-login.php", Username: "admin", Password: "admin123", HadFields: true, CreatedAt: now.Add(-time.Hour)},
|
|
{IP: "5.6.7.8", Method: "POST", Path: "/.ssh/id_rsa", Username: "root", Password: "toor", HadFields: true, CreatedAt: now.Add(-30 * time.Minute)},
|
|
}
|
|
for _, r := range rows {
|
|
require.NoError(t, store.Create(ctx, r))
|
|
}
|
|
|
|
since := now.Add(-4 * time.Hour)
|
|
|
|
total, err := store.CountSince(ctx, since)
|
|
require.NoError(t, err)
|
|
require.Equal(t, int64(4), total)
|
|
|
|
list, err := store.ListSince(ctx, since, 10)
|
|
require.NoError(t, err)
|
|
require.Len(t, list, 4)
|
|
// 倒序返回
|
|
require.Equal(t, "5.6.7.8", list[0].IP)
|
|
|
|
sources, err := store.TopSources(ctx, since, 10)
|
|
require.NoError(t, err)
|
|
require.Len(t, sources, 2)
|
|
require.Equal(t, "1.2.3.4", sources[0].IP)
|
|
require.Equal(t, int64(3), sources[0].Count)
|
|
require.Equal(t, "Azure", sources[0].Provider)
|
|
|
|
paths, err := store.TopPaths(ctx, since, 10)
|
|
require.NoError(t, err)
|
|
require.Len(t, paths, 3)
|
|
require.Equal(t, "/wp-login.php", paths[0].Path)
|
|
require.Equal(t, int64(2), paths[0].Count)
|
|
|
|
creds, err := store.TopCredentials(ctx, since, 10)
|
|
require.NoError(t, err)
|
|
require.Len(t, creds, 2)
|
|
require.Equal(t, "admin", creds[0].Username)
|
|
require.Equal(t, "admin123", creds[0].Password)
|
|
require.Equal(t, int64(2), creds[0].Count)
|
|
|
|
// 保留期清理
|
|
deleted, err := store.DeleteBefore(ctx, now.Add(-90*time.Minute))
|
|
require.NoError(t, err)
|
|
require.Equal(t, int64(2), deleted) // 3 小时前、2 小时前两条被清
|
|
|
|
total, err = store.CountSince(ctx, since)
|
|
require.NoError(t, err)
|
|
require.Equal(t, int64(2), total)
|
|
}
|