Skip to content

Commit

Permalink
Code review: 331630043: Refactored timestamp checks in tests log2time…
Browse files Browse the repository at this point in the history
  • Loading branch information
joachimmetz committed Feb 21, 2018
1 parent eebe16a commit c1d00d1
Show file tree
Hide file tree
Showing 22 changed files with 122 additions and 290 deletions.
4 changes: 2 additions & 2 deletions config/dpkg/changelog
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
plaso (20180220-1) unstable; urgency=low
plaso (20180221-1) unstable; urgency=low

* Auto-generated

-- Log2Timeline <log2timeline-dev@googlegroups.com> Tue, 20 Feb 2018 17:18:35 -0500
-- Log2Timeline <log2timeline-dev@googlegroups.com> Wed, 21 Feb 2018 10:38:30 -0500
2 changes: 1 addition & 1 deletion plaso/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,4 +8,4 @@

from __future__ import unicode_literals

__version__ = '20180220'
__version__ = '20180221'
5 changes: 1 addition & 4 deletions tests/parsers/pls_recall.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
import unittest

from plaso.formatters import pls_recall as _ # pylint: disable=unused-import
from plaso.lib import timelib
from plaso.parsers import pls_recall

from tests import test_lib as shared_test_lib
Expand All @@ -30,9 +29,7 @@ def testParse(self):

event = events[0]

timestamp_expected = timelib.Timestamp.CopyFromString(
'2013-06-18 19:50:00.550')
self.assertEqual(event.timestamp, timestamp_expected)
self.CheckTimestamp(event.timestamp, '2013-06-18 19:50:00.550000')

self.assertEqual(event.sequence_number, 206)
self.assertEqual(event.username, 'tsltmp')
Expand Down
52 changes: 17 additions & 35 deletions tests/parsers/popcontest.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@

from plaso.formatters import popcontest as _ # pylint: disable=unused-import
from plaso.lib import definitions
from plaso.lib import timelib
from plaso.parsers import popcontest

from tests import test_lib as shared_test_lib
Expand All @@ -30,10 +29,8 @@ def testParse(self):

event = events[0]

self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 05:41:41')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2010-06-22 05:41:41.000000')
self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)

expected_message = (
'Session 0 start '
Expand All @@ -43,21 +40,19 @@ def testParse(self):

event = events[1]

self.CheckTimestamp(event.timestamp, '2010-06-22 07:34:42.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 07:34:42')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = 'mru [/usr/sbin/atd] package [at]'
expected_short_message = '/usr/sbin/atd'
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[3]

self.CheckTimestamp(event.timestamp, '2010-06-22 07:34:43.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 07:34:43')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = (
'mru [/usr/lib/python2.5/lib-dynload/_struct.so] '
Expand All @@ -67,10 +62,9 @@ def testParse(self):

event = events[5]

self.CheckTimestamp(event.timestamp, '2010-05-30 05:26:20.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-05-30 05:26:20')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = (
'mru [/usr/bin/empathy] package [empathy] tag [RECENT-CTIME]')
Expand All @@ -79,11 +73,9 @@ def testParse(self):

event = events[6]

self.CheckTimestamp(event.timestamp, '2010-05-30 05:27:43.000000')
self.assertEqual(
event.timestamp_desc,
definitions.TIME_DESCRIPTION_ENTRY_MODIFICATION)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-05-30 05:27:43')
self.assertEqual(event.timestamp, expected_timestamp)
event.timestamp_desc, definitions.TIME_DESCRIPTION_ENTRY_MODIFICATION)

expected_message = (
'mru [/usr/bin/empathy] package [empathy] tag [RECENT-CTIME]')
Expand All @@ -92,32 +84,27 @@ def testParse(self):

event = events[11]

self.CheckTimestamp(event.timestamp, '2010-05-12 07:58:33.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-05-12 07:58:33')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = 'mru [/usr/bin/orca] package [gnome-orca] tag [OLD]'
expected_short_message = '/usr/bin/orca'
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[13]

self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 05:41:41')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2010-06-22 05:41:41.000000')
self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)

expected_message = 'Session 0 end'
expected_short_message = expected_message
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[14]

self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 05:41:41')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2010-06-22 05:41:41.000000')
self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)

expected_message = (
'Session 1 start '
Expand All @@ -127,43 +114,38 @@ def testParse(self):

event = events[15]

self.CheckTimestamp(event.timestamp, '2010-06-22 07:34:42.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 07:34:42')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = 'mru [/super/cool/plasuz] package [plaso]'
expected_short_message = '/super/cool/plasuz'
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[18]

self.CheckTimestamp(event.timestamp, '2010-04-06 12:25:42.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-04-06 12:25:42')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = 'mru [/super/cool/plasuz] package [miss_ctime]'
expected_short_message = '/super/cool/plasuz'
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[19]

self.CheckTimestamp(event.timestamp, '2010-05-12 07:58:33.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_LAST_ACCESS)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-05-12 07:58:33')
self.assertEqual(event.timestamp, expected_timestamp)

expected_message = 'mru [/super/cóól] package [plaso] tag [WRONG_TAG]'
expected_short_message = '/super/cóól'
self._TestGetMessageStrings(event, expected_message, expected_short_message)

event = events[21]

self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)
expected_timestamp = timelib.Timestamp.CopyFromString('2010-06-22 05:41:41')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2010-06-22 05:41:41.000000')
self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_ADDED)

expected_message = 'Session 1 end'
expected_short_message = expected_message
Expand Down
20 changes: 6 additions & 14 deletions tests/parsers/recycler.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@

from plaso.formatters import recycler as _ # pylint: disable=unused-import
from plaso.lib import definitions
from plaso.lib import timelib
from plaso.parsers import recycler

from tests import test_lib as shared_test_lib
Expand All @@ -30,13 +29,11 @@ def testParseVista(self):

event = events[0]

self.CheckTimestamp(event.timestamp, '2012-03-12 20:49:58.633000')

expected_filename = (
'C:\\Users\\nfury\\Documents\\Alloy Research\\StarFury.zip')
self.assertEqual(event.original_filename, expected_filename)

expected_timestamp = timelib.Timestamp.CopyFromString(
'2012-03-12 20:49:58.633')
self.assertEqual(event.timestamp, expected_timestamp)
self.assertEqual(event.file_size, 724919)

expected_message = '{0:s} (from drive: UNKNOWN)'.format(expected_filename)
Expand All @@ -55,13 +52,11 @@ def testParseWindows10(self):

event = events[0]

self.CheckTimestamp(event.timestamp, '2016-06-29 21:37:45.618000')

expected_filename = (
'C:\\Users\\random\\Downloads\\bunnies.jpg')
self.assertEqual(event.original_filename, expected_filename)

expected_timestamp = timelib.Timestamp.CopyFromString(
'2016-06-29 21:37:45.618')
self.assertEqual(event.timestamp, expected_timestamp)
self.assertEqual(event.file_size, 222255)

expected_message = '{0:s} (from drive: UNKNOWN)'.format(expected_filename)
Expand All @@ -84,11 +79,8 @@ def testParse(self):

event = events[0]

expected_timestamp = timelib.Timestamp.CopyFromString(
'2004-08-25 16:18:25.237')
self.assertEqual(event.timestamp, expected_timestamp)
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_DELETED)
self.CheckTimestamp(event.timestamp, '2004-08-25 16:18:25.237000')
self.assertEqual(event.timestamp_desc, definitions.TIME_DESCRIPTION_DELETED)

self.assertEqual(event.record_index, 1)

Expand Down
9 changes: 3 additions & 6 deletions tests/parsers/safari_cookies.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@

from plaso.formatters import safari_cookies as _ # pylint: disable=unused-import
from plaso.lib import definitions
from plaso.lib import timelib
from plaso.parsers import safari_cookies

from tests import test_lib as shared_test_lib
Expand Down Expand Up @@ -44,13 +43,11 @@ def testParseFile(self):

event = cookie_events[48]

self.assertEqual(event.flags, 0)
expected_timestamp = timelib.Timestamp.CopyFromString(
'2013-07-08 20:54:50')

self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2013-07-08 20:54:50.000000')
self.assertEqual(
event.timestamp_desc, definitions.TIME_DESCRIPTION_CREATION)

self.assertEqual(event.flags, 0)
self.assertEqual(event.cookie_name, 'nonsession')
self.assertEqual(event.path, '/')

Expand Down
21 changes: 8 additions & 13 deletions tests/parsers/sccm.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
import unittest

from plaso.formatters import sccm as _ # pylint: disable=unused-import
from plaso.lib import timelib
from plaso.parsers import sccm

from tests import test_lib as shared_test_lib
Expand All @@ -28,27 +27,23 @@ def testParse(self):
events = list(storage_writer.GetEvents())

event = events[0]
expected_timestamp = timelib.Timestamp.CopyFromString(
'2014-11-29 01:03:19.766')
self.assertEqual(event.timestamp, expected_timestamp)

self.CheckTimestamp(event.timestamp, '2014-11-29 01:03:19.766000')

# Test timestamps with seven digits after seconds.
event = events[3]
expected_timestamp = timelib.Timestamp.CopyFromString(
'2015-01-02 10:22:50.873496')
self.assertEqual(event.timestamp, expected_timestamp)

self.CheckTimestamp(event.timestamp, '2015-01-02 10:22:50.873496')

# Test timestamps with '-' in microseconds.
event = events[7]
expected_timestamp = timelib.Timestamp.CopyFromString(
'2014-12-28 18:59:43.373')
self.assertEqual(event.timestamp, expected_timestamp)

self.CheckTimestamp(event.timestamp, '2014-12-28 18:59:43.373000')

# Test timestamps with '+' in microseconds.
event = events[9]
expected_timestamp = timelib.Timestamp.CopyFromString(
'2014-11-23 17:52:13.827')
self.assertEqual(event.timestamp, expected_timestamp)

self.CheckTimestamp(event.timestamp, '2014-11-23 17:52:13.827000')

# Test full and short message formats.
event = events[4]
Expand Down
17 changes: 4 additions & 13 deletions tests/parsers/selinux.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@
import unittest

from plaso.formatters import selinux as _ # pylint: disable=unused-import
from plaso.lib import timelib
from plaso.parsers import selinux

from tests import test_lib as shared_test_lib
Expand All @@ -33,9 +32,7 @@ def testParse(self):
# Test case: normal entry.
event = events[0]

expected_timestamp = timelib.Timestamp.CopyFromString(
'2012-05-24 07:40:01.174')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2012-05-24 07:40:01.174000')

expected_message = (
'[audit_type: LOGIN, pid: 25443] pid=25443 uid=0 old '
Expand All @@ -49,9 +46,7 @@ def testParse(self):
# Test case: short date.
event = events[1]

expected_timestamp = timelib.Timestamp.CopyFromString(
'2012-05-24 07:40:01')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2012-05-24 07:40:01.000000')

expected_string = '[audit_type: SHORTDATE] check rounding'

Expand All @@ -60,9 +55,7 @@ def testParse(self):
# Test case: no msg.
event = events[2]

expected_timestamp = timelib.Timestamp.CopyFromString(
'2012-05-24 07:40:22.174')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2012-05-24 07:40:22.174000')

expected_string = '[audit_type: NOMSG]'

Expand All @@ -71,9 +64,7 @@ def testParse(self):
# Test case: under score.
event = events[3]

expected_timestamp = timelib.Timestamp.CopyFromString(
'2012-05-24 07:47:46.174')
self.assertEqual(event.timestamp, expected_timestamp)
self.CheckTimestamp(event.timestamp, '2012-05-24 07:47:46.174000')

expected_message = (
'[audit_type: UNDER_SCORE, pid: 25444] pid=25444 uid=0 old '
Expand Down

0 comments on commit c1d00d1

Please sign in to comment.