from positive_test_suite import PositiveTestSuite
from negative_test_suite import NegativeTestSuite

import os
import sys
sys.path.append(os.path.join(os.path.dirname(__file__), "../../lib"))
from query_models import QueryStringMatch


hostname_test_regex = 'hostname: /(.*\.)*(groupa|groupb)\.(.*\.)*subdomain\.(.*\.)*.*/'
filename_matcher = 'summary: /.*\.(exe|sh)/'
ip_matcher = 'destination: /(http:\/\/|https:\/\/)?\d+\.\d+\.\d+\.\d+.*/'


class TestQueryStringMatchPositiveTestSuite(PositiveTestSuite):
    def query_tests(self):
        tests = {
            QueryStringMatch('summary: test'): [
                {'summary': 'test'},
            ],

            QueryStringMatch('summary: test conf'): [
                {'summary': 'test'},
                {'summary': 'conf'},
                {'summary': 'test conf'},
            ],

            QueryStringMatch(hostname_test_regex): [
                {'hostname': 'host.groupa.test.def.subdomain.company.com'},
                {'hostname': 'host.groupa.test.def.subdomain.company.com'},
                {'hostname': 'host.groupa.subdomain.domain.company.com'},
                {'hostname': 'host.groupa.subdomain.domain1.company.com'},
                {'hostname': 'host.groupa.subdomain.company.com'},
                {'hostname': 'host1.groupa.subdomain.company.com'},
                {'hostname': 'host1.groupa.test.subdomain.company.com'},
                {'hostname': 'host-1.groupa.test.subdomain.domain.company.com'},
                {'hostname': 'host-v2-test6.groupa.test.subdomain.domain.company.com'},
                {'hostname': 'host1.groupa.subdomain.domain.company.com'},
                {'hostname': 'someotherhost1.hgi.groupa.subdomain.domain1.company.com'},
                {'hostname': 'host2.groupb.subdomain.domain.company.com'},
            ],

            QueryStringMatch(filename_matcher): [
                {'summary': 'test.exe'},
                {'summary': 'test.sh'},
            ],

            QueryStringMatch(ip_matcher): [
                {'destination': 'http://1.2.3.4/somepath'},
                {'destination': 'https://1.2.3.4/somepath'},
                {'destination': '1.2.3.4:443'},
                {'destination': '1.2.3.4:80'},

            ],
        }
        return tests


class TestQueryStringMatchNegativeTestSuite(NegativeTestSuite):
    def query_tests(self):
        tests = {
            QueryStringMatch('summary: test'): [
                {'summary': 'example summary'},
                {'summary': 'example summary tes'},
                {'summary': 'testing'},
                {'note': 'test'},
            ],

            QueryStringMatch('summary: test conf'): [
                {'summary': 'testing'},
                {'summary': 'configuration'},
                {'summary': 'testing configuration'},
            ],

            QueryStringMatch(hostname_test_regex): [
                {'hostname': ''},
                {'hostname': 'host.subdomain.company.com'},
                {'hostname': 'host.subdomain.domain1.company.com'},
                {'hostname': 'groupa.abc.company.com'},
                {'hostname': 'asub.subdomain.company.com'},
                {'hostname': 'example.com'},
                {'hostname': 'abc.company.com'},
                {'hostname': 'host1.groupa.asubdomain.company.com'},
                {'hostname': 'host1.groupa.subdomaina.company.com'},
                {'hostname': 'host1.groupaa.subdomain.company.com'},
                {'hostname': 'host1.agroupb.subdomain.company.com'},
            ],

            QueryStringMatch(filename_matcher): [
                {'summary': 'test.exe.abcd'},
                {'summary': 'testexe'},
                {'summary': 'test.1234'},
                {'summary': '.exe.test'},
            ],

            QueryStringMatch(ip_matcher): [
                {'destination': 'http://example.com/somepath'},
                {'destination': 'https://foo.bar.example.com/somepath'},
                {'destination': 'example.com:443'},
                {'destination': 'foo.bar.example.com:80'},

            ],
        }
        return tests

@@ -366,79 +366,183 @@
 )/'%0A
-ip_matcher = 'destination: /(http:%5C/%5C/%7Chttps:%5C/%5C/)?%5Cd+%5C.%5Cd+%5C.%5Cd+%5C.%5Cd+
+%0A# Note that this has potential for over-matching on foo.bar.baz.com, which needs further validation in alerts%0Aip_matcher = 'destination: /.*%5C..%7B1,3%7D%5C..%7B1,3%7D%5C..%7B1,3%7D(:.*%7C%5C/
 .*
+)
 /'%0A%0A
@@ -2281,78 +2281,391 @@
 .3.4
-:443'%7D,%0A                %7B'destination': '1.2.3.4:80'%7D,%0A%0A            %5D,
+/somepath'%7D,%0A                %7B'destination': '1.2.3.4/somepath'%7D,%0A                %7B'destination': '1.2.3.4:443'%7D,%0A                %7B'destination': '1.2.3.4:80'%7D,%0A                # Over-match examples (which need to be validated further in alerts)%0A                %7B'destination': 'https://foo.bar.baz.com/somepath'%7D,%0A                %7B'destination': 'foo.bar.baz.com:80'%7D,%0A            %5D
 %0A   
@@ -4290,18 +4290,27 @@
 http
+s
 ://
-example
+foo.bar.mozilla
 .com
@@ -4359,44 +4359,30 @@
 ': '
-https://foo.bar.example.com/somepath
+foo.bar.mozilla.com:80
 '%7D,%0A
@@ -4410,24 +4410,31 @@
 tination': '
+http://
 example.com:
@@ -4432,20 +4432,25 @@
 mple.com
-:443
+/somepath
 '%7D,%0A    
@@ -4478,24 +4478,16 @@
 tion': '
-foo.bar.
 example.
@@ -4490,22 +4490,21 @@
 ple.com:
-80'%7D,%0A
+443'%7D
 %0A       

Add test cases for query string match to validate IP match pattern