public void Test_AddThresholdMissingAction()
{
string evtName = Guid.NewGuid().ToString();
IntrusionDetector detector = Esapi.IntrusionDetector as IntrusionDetector;
Assert.IsNotNull(detector);
Threshold threshold = new Threshold(evtName, 1, 1, new[] { Guid.NewGuid().ToString() });
detector.AddThreshold(threshold);
}
public void Test_AddExceptionSecurityEvent()
{
string evtName = typeof(ArgumentException).FullName;
IntrusionDetector detector = Esapi.IntrusionDetector as IntrusionDetector;
Assert.IsNotNull(detector);
Threshold threshold = new Threshold(evtName, 1, 1, new[] { "log" });
detector.AddThreshold(threshold);
ArgumentException arg = new ArgumentException();
detector.AddException(arg);
}
/// <summary>
/// Get event threshold
/// </summary>
/// <param name="eventName"></param>
/// <returns></returns>
private Threshold GetEventThreshold(string eventName)
{
Threshold threshold;
this._thresholds.TryGetValue(eventName, out threshold);
// Event not found, create default
if (threshold == null)
{
threshold = new Threshold(eventName, 0, 0, null);
}
return threshold;
}
/// <summary>
/// Add event threshold
/// </summary>
/// <param name="threshold"></param>
public void AddThreshold(Threshold threshold)
{
if (threshold == null)
{
throw new ArgumentNullException("threshold");
}
if (this._thresholds.ContainsKey(threshold.Event))
{
throw new ArgumentException();
}
// Validate all required actions have been registered already
if (threshold.Actions != null)
{
foreach (string name in threshold.Actions)
{
if (!this._actionManager.Contains(name))
{
string message = string.Format(EM.IntrusionDetector_ActionNotFound1, name);
throw new ArgumentException(message, "threshold");
}
}
}
// Add threshold
this._thresholds.Add(threshold.Event, threshold);
}
public void Test_AddDuplicateThreshold()
{
string evtName = Guid.NewGuid().ToString();
IntrusionDetector detector = Esapi.IntrusionDetector as IntrusionDetector;
Assert.IsNotNull(detector);
Threshold threshold = new Threshold(evtName, 1, 1, new[] { BuiltinActions.FormsAuthenticationLogout });
detector.AddThreshold(threshold);
Threshold dup = new Threshold(evtName, 2, 2, null);
detector.AddThreshold(dup);
}
public void Test_IntrusionDetected()
{
string evtName = Guid.NewGuid().ToString();
IntrusionDetector detector = Esapi.IntrusionDetector as IntrusionDetector;
Assert.IsNotNull(detector);
Threshold threshold = new Threshold(evtName, 1, 1, new[] { "log"});
detector.AddThreshold(threshold);
Esapi.IntrusionDetector.AddEvent(evtName);
}
public void Test_RemoveThreshold()
{
string evtName = Guid.NewGuid().ToString();
IntrusionDetector detector = Esapi.IntrusionDetector as IntrusionDetector;
Assert.IsNotNull(detector);
Threshold threshold = new Threshold(evtName, 1, 1, new[] { "logout" });
detector.AddThreshold(threshold);
Assert.IsTrue( detector.RemoveThreshold(evtName));
}
/// <summary>
/// Load instrusion detector instance
/// </summary>
/// <param name="detectorConfig"></param>
/// <returns></returns>
internal static IIntrusionDetector LoadIntrusionDetector(IntrusionDetectorElement detectorConfig)
{
Debug.Assert(detectorConfig != null);
IIntrusionDetector detector = null;
if (!string.IsNullOrEmpty(detectorConfig.Type)) {
detector = ObjectBuilder.Build<IIntrusionDetector>(detectorConfig.Type);
}
else {
// Create default
detector = new IntrusionDetector();
}
// Load event thresholds
foreach (ThresholdElement e in detectorConfig.EventThresholds) {
string[] actions = e.Actions.Split(new char[] { ',' }, StringSplitOptions.RemoveEmptyEntries);
Threshold threshold = new Threshold(e.Name, e.Count, e.Interval, actions);
detector.AddThreshold(threshold);
}
return detector;
}
// FIXME: ENHANCE should read these quotas into a map and cache them
/// <summary>
/// The intrusion detection quota for a particular events.
/// </summary>
/// <param name="eventName">
/// The quote for a particular event name.
/// </param>
/// <returns> The threshold for the event.
/// </returns>
/// <seealso cref="Owasp.Esapi.Interfaces.ISecurityConfiguration.GetQuota(string)">
/// </seealso>
public Threshold GetQuota(string eventName)
{
int count = 0;
string countString = properties.Get(eventName + ".count");
if (countString != null)
{
count = Int32.Parse(countString);
}
int interval = 0;
string intervalString = properties.Get(eventName + ".interval");
if (intervalString != null)
{
interval = Int32.Parse(intervalString);
}
IList actions = new ArrayList();
string actionString = properties.Get(eventName + ".actions");
if (actionString != null)
{
string[] actionList = Regex.Split(actionString, ",");
actions = new ArrayList(actionList);
}
Threshold q = new Threshold(eventName, count, interval, actions);
return q;
}
