Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle hex #611

Closed
wants to merge 160 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
160 commits
Select commit Hold shift + click to select a range
161662d
initial relational db sink
rpiazza Mar 14, 2024
281c81b
added create_insert_statement to DatabaseConnection
rpiazza Mar 14, 2024
6e26928
Merge branch 'upgrade-python' into relational-data-sink
rpiazza Mar 16, 2024
89c2153
create the tables
rpiazza Mar 17, 2024
37658df
Merge branch 'master' into relational-data-sink
rpiazza Mar 18, 2024
4a12d7d
fix dictionary table generation, remove SERIES
rpiazza Mar 18, 2024
73805d3
flakey
rpiazza Mar 18, 2024
bb6ae81
changes for Dictionary
rpiazza Mar 19, 2024
169c4bb
changes for DictionaryProperty
rpiazza Mar 19, 2024
6c510a3
Merge branch 'dictionary-property' into relational-data-sink
rpiazza Mar 19, 2024
41f1b7a
fix existing DictionaryProperty test
rpiazza Mar 19, 2024
f46d523
fix existing DictionaryProperty test - take 2
rpiazza Mar 19, 2024
dca0070
add object_kind to custom_extensions
rpiazza Mar 20, 2024
3e11107
Dictionary Prop Adjustments
ryantxu1 Mar 20, 2024
0ad3ce7
add args to CustomExtension, implements db class
rpiazza Mar 20, 2024
57f7ec4
fix fk for some extension classes, use kwargs
rpiazza Mar 21, 2024
b896339
remove database connection, start on insert statements
rpiazza Mar 25, 2024
80c8734
flaky
rpiazza Mar 26, 2024
5c707b5
More Dict Prop edits
ryantxu1 Mar 26, 2024
ee49963
handle schemas, process levels, fixed REs
rpiazza Mar 26, 2024
9a1663f
fix schema name for subtables, composite primary keys, RelationalRBSt…
rpiazza Mar 27, 2024
5f23033
added MetaObject
rpiazza Mar 27, 2024
337f095
3/28 edits
ryantxu1 Mar 28, 2024
6c56457
Test update
ryantxu1 Mar 28, 2024
cb2aacb
lots of tweaks for tabe creation, input_creation intial success
rpiazza Mar 29, 2024
79af971
flaky
rpiazza Mar 29, 2024
c93ddce
3/29 checkpoint
ryantxu1 Mar 29, 2024
1d9346a
merging
rpiazza Mar 29, 2024
9a59735
edits to observables
ryantxu1 Mar 29, 2024
704b6ae
fix sco fk
rpiazza Mar 30, 2024
bf840b1
handled sequences
rpiazza Mar 31, 2024
85a4321
catch-all implemented
ryantxu1 Apr 1, 2024
16302a0
linter changes
ryantxu1 Apr 1, 2024
9dc7544
typo
ryantxu1 Apr 1, 2024
dcc83e6
no need to initialize sequence every time
rpiazza Apr 1, 2024
cdd9707
small chages
ryantxu1 Apr 1, 2024
86861f1
minor changes for hashes
rpiazza Apr 1, 2024
9311c66
Adding ListProperty leniency
ryantxu1 Apr 1, 2024
ef399fe
hash table working
rpiazza Apr 1, 2024
d5b7a14
Experimental work on a relational db data source
chisholm Mar 31, 2024
32ccec0
Change relational DB store to create table schemas and pass into
chisholm Apr 1, 2024
ac72888
Merge pull request #590 from chisholm/relational-data-sink-chisholm
rpiazza Apr 2, 2024
b6c2276
flaky, put include all extensions
rpiazza Apr 2, 2024
6251c28
fix external_references, sequence, extension fix, again
rpiazza Apr 2, 2024
e78a837
flaky
rpiazza Apr 2, 2024
8a5685d
handle list of enums
rpiazza Apr 2, 2024
8020efd
Merge pull request #589 from ryantxu1/dictionary-property
rpiazza Apr 2, 2024
4b69095
flaky
rpiazza Apr 2, 2024
2b1c48d
Merge branch 'dictionary-property' into relational-data-sink
rpiazza Apr 2, 2024
9321e06
adding prelimiary test file for url obj
ghackford-mitre Apr 2, 2024
c0e83b8
Dictionary Tables use valid_types
rpiazza Apr 2, 2024
377a148
Merge branch 'oasis-open:relational-data-sink' into relational-data-sink
ghackford-mitre Apr 2, 2024
be63e1f
moving test_url to v21 dir and adding better compare
ghackford-mitre Apr 3, 2024
def9f19
handle kill-chains, support binary properties, special case hash tabl…
rpiazza Apr 4, 2024
eb4b2f1
ignore new extensions, use the correct table name for property extens…
rpiazza Apr 4, 2024
5c38b11
Adding enumproperty to simple type and edit openvocabproperty
ryantxu1 Apr 4, 2024
3042ddc
handle when the extension needs the id from the object
rpiazza Apr 4, 2024
06b3d5a
fix fk on windows-pebinary
rpiazza Apr 7, 2024
f604a76
flaky
rpiazza Apr 7, 2024
7abe944
Merge branch 'oasis-open:relational-data-sink' into relational-data-sink
ghackford-mitre Apr 8, 2024
cada268
adding postgres authentication and fixing store.get bug
ghackford-mitre Apr 8, 2024
b80b77f
adding test file for artifacts
ghackford-mitre Apr 9, 2024
dce689a
fix multiple schema names
rpiazza Apr 9, 2024
c967c21
Merge branch 'oasis-open:relational-data-sink' into relational-data-sink
ghackford-mitre Apr 9, 2024
8529c50
skipping over hashes check, removing main function
ghackford-mitre Apr 9, 2024
eb989cd
adding autonomous system test
ghackford-mitre Apr 9, 2024
2ab4699
adding domain name test file
ghackford-mitre Apr 9, 2024
3e91526
Added database existence checks and clear_tables function
robthew Apr 9, 2024
8e83c31
adding directory test file
ghackford-mitre Apr 9, 2024
917a4cc
passing strict to superclass of enum and openvocab
ryantxu1 Apr 10, 2024
f402280
added parameters for database creation
robthew Apr 10, 2024
9ef379c
Fixed db URL
robthew Apr 10, 2024
4ef8360
updating directory test with ctime and mtime check
ghackford-mitre Apr 12, 2024
baa7781
adding email address test file
ghackford-mitre Apr 12, 2024
605c181
adding test file for email messages
ghackford-mitre Apr 12, 2024
9646a59
removing print statements in email message test
ghackford-mitre Apr 12, 2024
8015c2c
adding tests for ipv4 and ipv6
ghackford-mitre Apr 12, 2024
50412ee
adding mutext test file
ghackford-mitre Apr 12, 2024
a2646ff
adding tests for file and network_traffic objects
ghackford-mitre Apr 15, 2024
d74253e
Adjusted database creation options
robthew Apr 15, 2024
8cf2440
adding tests for process
ghackford-mitre Apr 15, 2024
f3d54f2
adding test for software, removing incorrect comment in process
ghackford-mitre Apr 15, 2024
bdf0ba7
adding user_account test file
ghackford-mitre Apr 15, 2024
0faa69e
add test file for windows registry
ghackford-mitre Apr 15, 2024
b7bd5ee
adding test file for x.509 certificates
ghackford-mitre Apr 15, 2024
21d35e4
adding sqlalchemy to setup.py
ghackford-mitre Apr 15, 2024
ae3190f
adding inflection to setup.py requirements
ghackford-mitre Apr 15, 2024
fa652d0
adding psycopg2 to setup.py requirements
ghackford-mitre Apr 15, 2024
0caa109
Merge pull request #594 from ghackford-mitre/relational-data-sink
rpiazza Apr 15, 2024
316edb3
Merge pull request #593 from robthew/master
rpiazza Apr 16, 2024
d2ecc73
added unique constraint
rpiazza Apr 16, 2024
a94fd81
Merge branch 'relational-data-sink' of github.com:oasis-open/cti-pyth…
rpiazza Apr 16, 2024
2955024
flaky
rpiazza Apr 16, 2024
3c92d7c
flaky 2
rpiazza Apr 16, 2024
242deb8
Merge branch 'oasis-open:master' into master
robthew Apr 16, 2024
b8782e3
flaky 3
rpiazza Apr 16, 2024
d779241
Merge remote-tracking branch 'upstream/relational-data-sink'
robthew Apr 16, 2024
3c9b432
Merge branch 'oasis-open:relational-data-sink' into relational-data-sink
ryantxu1 Apr 16, 2024
7b877ff
Merge pull request #591 from ryantxu1/relational-data-sink
rpiazza Apr 16, 2024
a964b6c
Merge datastore relation test
ryantxu1 Apr 16, 2024
8285a2f
removing multiple store var
ryantxu1 Apr 16, 2024
502604f
Merge pull request #596 from ryantxu1/relational-data-sink-merge-test
rpiazza Apr 16, 2024
b613add
Fix styling
ryantxu1 Apr 16, 2024
1b34137
Merge pull request #597 from ryantxu1/relational-data-sink-merge-test
rpiazza Apr 16, 2024
0513ca0
remove extra store
rpiazza Apr 16, 2024
eb21abf
add postgres to pipeline
rpiazza Apr 16, 2024
cccf04c
add postgres to pipeline, and use it
rpiazza Apr 16, 2024
a259389
add another step for postgres
rpiazza Apr 16, 2024
4286ef5
don't use the job name
rpiazza Apr 16, 2024
3c504ee
only one job
rpiazza Apr 16, 2024
38f60a2
added docker:
rpiazza Apr 16, 2024
4abcf3d
added //
rpiazza Apr 16, 2024
2fe4cdc
Merge remote-tracking branch 'upstream/relational-data-sink'
robthew Apr 16, 2024
68497bb
Updated to add_method to check class names
robthew Apr 16, 2024
0efa195
Merge pull request #598 from robthew/master
rpiazza Apr 16, 2024
dbe31d4
slightly different
rpiazza Apr 16, 2024
1583e4d
change postgres url
rpiazza Apr 16, 2024
2d578e3
different url, and no create_tables or metadata in store
rpiazza Apr 16, 2024
b54166a
create the metadata after all
rpiazza Apr 16, 2024
203fc26
use 0.0.0.0
rpiazza Apr 16, 2024
585e6df
use env vars in postgres url
rpiazza Apr 16, 2024
11cef1b
add env vars to tox run
rpiazza Apr 16, 2024
8ca924a
add env vars at top of workflow
rpiazza Apr 16, 2024
d52bf2d
default values for the env vars
rpiazza Apr 16, 2024
dc69b75
instantiate the db
rpiazza Apr 16, 2024
d15be96
create the tables in sqlalchemy
rpiazza Apr 16, 2024
42ed197
Merge branch 'master' into relational-data-sink
rpiazza Aug 20, 2024
baac7b5
Merge branch 'master' into relational-data-sink
rpiazza Aug 21, 2024
4067ba7
fixed kill_chains, granular_markings, extension-definitions
rpiazza Aug 21, 2024
7d7cf7a
try to fix test_datastore_relational_db
rpiazza Aug 21, 2024
675746b
fix core properties for SMOs and remove hardcoded name for kill chain…
rpiazza Sep 10, 2024
aa8c9a1
handle object-markings-refs in SMOs
rpiazza Sep 10, 2024
27fbfa3
drop db when testing
rpiazza Sep 10, 2024
9814e6c
removed extension-definition object_ref table, added fk to SMOs
rpiazza Sep 13, 2024
f4f1828
fixed binary list, dictionary insert
rpiazza Sep 13, 2024
8811fa9
Expand relational data store query capability; expand relational
chisholm Sep 13, 2024
c33d879
Remove a stray comma
chisholm Sep 13, 2024
dcd2a50
Merge pull request #600 from chisholm/relational-data-source
rpiazza Sep 13, 2024
16aaf9c
add id binding for dictionaries
rpiazza Sep 13, 2024
f0f6d8f
Fix DictionaryProperty so that EnumProperty and ReferenceProperty both
chisholm Sep 15, 2024
92231d9
Merge pull request #602 from chisholm/relational-data-sink-fix-dictio…
rpiazza Sep 16, 2024
f294727
handle dictionaries better
rpiazza Sep 16, 2024
c847a5c
Minor fix to certain relational data sink unit tests related to
chisholm Sep 16, 2024
3f17c0f
Merge pull request #603 from chisholm/relational-data-sink-update-dic…
rpiazza Sep 17, 2024
e508f99
fix insert of dictionary values
rpiazza Sep 17, 2024
f1af0dd
initial db backend
rpiazza Nov 5, 2024
8fd7226
handle ARRAY
rpiazza Nov 7, 2024
507914e
more ARRAY
rpiazza Nov 7, 2024
a84867c
flaky
rpiazza Nov 8, 2024
7df7b9e
more on ARRAY
rpiazza Nov 11, 2024
cf9c0c9
consistently make tables with schema argument, add sql-type pass methods
rpiazza Nov 13, 2024
4a019aa
more ARRAY
rpiazza Nov 15, 2024
35ce57a
next_id method, stix_type_name vs. schema_name
rpiazza Nov 17, 2024
3276661
handle hex_property in list
rpiazza Nov 17, 2024
1af893e
Add a missing "return" to determine_sql_type_from_stix()
chisholm Nov 19, 2024
04f1c55
Merge pull request #609 from chisholm/missing-return
rpiazza Nov 19, 2024
9b9ca63
Add support for db backends and dbs which don't support array
chisholm Nov 19, 2024
88f5fa8
Merge pull request #610 from chisholm/query-db-backend
rpiazza Nov 20, 2024
6465249
fix for list of timestamps
rpiazza Nov 20, 2024
0e3bf33
handle-hex-better
rpiazza Nov 21, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions .github/workflows/python-ci-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,31 @@
name: cti-python-stix2 test harness
on: [push, pull_request]

jobs:
build:
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: postgres

jobs:
test-job:
runs-on: ubuntu-latest

services:
postgres:
image: postgres:11
# Provide the password for postgres
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: postgres
ports: [ '5432:5432' ]
# Set health checks to wait until postgres has started
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5

strategy:
matrix:
python-version: [3.8, 3.9, '3.10', '3.11', '3.12']
Expand Down
8 changes: 4 additions & 4 deletions .pre-commit-config.yaml
Original file line number Diff line number Diff line change
@@ -1,22 +1,22 @@
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v3.4.0
rev: v4.5.0
hooks:
- id: trailing-whitespace
- id: check-merge-conflict
- repo: https://github.com/asottile/add-trailing-comma
rev: v2.0.2
rev: v3.1.0
hooks:
- id: add-trailing-comma
- repo: https://github.com/PyCQA/flake8
rev: 3.8.4
rev: 7.0.0
hooks:
- id: flake8
name: Check project styling
args:
- --max-line-length=160
- repo: https://github.com/PyCQA/isort
rev: 5.12.0
rev: 5.13.2
hooks:
- id: isort
name: Sort python imports (shows diff)
Expand Down
6 changes: 6 additions & 0 deletions setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ def get_long_description():
'requests',
'simplejson',
'stix2-patterns>=1.2.0',
'inflection',
],
project_urls={
'Documentation': 'https://stix2.readthedocs.io/',
Expand All @@ -61,5 +62,10 @@ def get_long_description():
extras_require={
'taxii': ['taxii2-client>=2.3.0'],
'semantic': ['haversine', 'rapidfuzz'],
'relationaldb': [
'sqlalchemy',
'sqlalchemy_utils',
'psycopg2',
],
},
)
4 changes: 4 additions & 0 deletions stix2/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -470,6 +470,10 @@ def _check_object_constraints(self):
self._check_at_least_one_property()


class _MetaObject(_STIXBase):
pass


def _choose_one_hash(hash_dict):
if "MD5" in hash_dict:
return {"MD5": hash_dict["MD5"]}
Expand Down
4 changes: 3 additions & 1 deletion stix2/custom.py
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ def __init__(self, **kwargs):
return _CustomObservable


def _custom_extension_builder(cls, type, properties, version, base_class):
def _custom_extension_builder(cls, applies_to, type, properties, version, base_class):

properties = _get_properties_dict(properties)
toplevel_properties = None
Expand All @@ -98,6 +98,7 @@ def _custom_extension_builder(cls, type, properties, version, base_class):
# it exists. How to treat the other properties which were given depends on
# the extension type.
extension_type = getattr(cls, "extension_type", None)
applies_to = applies_to
if extension_type:
# I suppose I could also go with a plain string property, since the
# value is fixed... but an enum property seems more true to the
Expand Down Expand Up @@ -128,6 +129,7 @@ class _CustomExtension(cls, base_class):

_type = type
_properties = nested_properties
_applies_to = applies_to
if extension_type == "toplevel-property-extension":
_toplevel_properties = toplevel_properties

Expand Down
28 changes: 28 additions & 0 deletions stix2/datastore/relational_db/add_method.py
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
import re

from stix2.datastore.relational_db.utils import get_all_subclasses
from stix2.properties import Property
from stix2.v21.base import _STIXBase21

_ALLOWABLE_CLASSES = get_all_subclasses(_STIXBase21)
_ALLOWABLE_CLASSES.extend(get_all_subclasses(Property))
_ALLOWABLE_CLASSES.extend([Property])


def create_real_method_name(name, klass_name):
classnames = map(lambda x: x.__name__, _ALLOWABLE_CLASSES)
if klass_name not in classnames:
raise NameError

split_up_klass_name = re.findall('[A-Z][^A-Z]*', klass_name)
return name + "_" + "_".join([x.lower() for x in split_up_klass_name])


def add_method(cls):

def decorator(fn):
method_name = fn.__name__
fn.__name__ = create_real_method_name(fn.__name__, cls.__name__)
setattr(cls, method_name, fn)
return fn
return decorator
Original file line number Diff line number Diff line change
@@ -0,0 +1,114 @@
from typing import Any

from sqlalchemy import Boolean, Float, Integer, Text, create_engine
from sqlalchemy_utils import create_database, database_exists, drop_database

from stix2.base import (
_DomainObject, _MetaObject, _Observable, _RelationshipObject,
)


class DatabaseBackend:
def __init__(self, database_connection_url, force_recreate=False, **kwargs: Any):
self.database_connection_url = database_connection_url
self.database_exists = database_exists(database_connection_url)

if force_recreate:
if self.database_exists:
drop_database(database_connection_url)
create_database(database_connection_url)
self.database_exists = database_exists(database_connection_url)

self.database_connection = create_engine(database_connection_url)

def _create_schemas(self):
pass

@staticmethod
def determine_schema_name(stix_object):
return ""

@staticmethod
def determine_stix_type(stix_object):
if isinstance(stix_object, _DomainObject):
return "sdo"
elif isinstance(stix_object, _Observable):
return "sco"
elif isinstance(stix_object, _RelationshipObject):
return "sro"
elif isinstance(stix_object, _MetaObject):
return "common"

def _create_database(self):
if self.database_exists:
drop_database(self.database_connection.url)
create_database(self.database_connection.url)
self.database_exists = database_exists(self.database_connection.url)

def schema_for(stix_class):
return ""

@staticmethod
def schema_for_core():
return ""

# you must implement the next 4 methods in the subclass

@staticmethod
def determine_sql_type_for_property(): # noqa: F811
pass

@staticmethod
def determine_sql_type_for_binary_property(): # noqa: F811
pass

@staticmethod
def determine_sql_type_for_hex_property(): # noqa: F811
pass

@staticmethod
def determine_sql_type_for_timestamp_property(): # noqa: F811
pass

@staticmethod
def determine_sql_type_for_kill_chain_phase(): # noqa: F811
return None

@staticmethod
def determine_sql_type_for_boolean_property(): # noqa: F811
return Boolean

@staticmethod
def determine_sql_type_for_float_property(): # noqa: F811
return Float

@staticmethod
def determine_sql_type_for_integer_property(): # noqa: F811
return Integer

@staticmethod
def determine_sql_type_for_reference_property(): # noqa: F811
return Text

@staticmethod
def determine_sql_type_for_string_property(): # noqa: F811
return Text

@staticmethod
def determine_sql_type_for_key_as_int(): # noqa: F811
return Integer

@staticmethod
def determine_sql_type_for_key_as_id(): # noqa: F811
return Text

@staticmethod
def array_allowed():
return False

def generate_value(self, stix_type, value):
sql_type = stix_type.determine_sql_type(self)
if sql_type == self.determine_sql_type_for_string_property():
return value
elif sql_type == self.determine_sql_type_for_hex_property():
return bytes.fromhex(value)
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
import os
from typing import Any

from sqlalchemy import TIMESTAMP, LargeBinary, Text
from sqlalchemy.schema import CreateSchema

from stix2.base import (
_DomainObject, _MetaObject, _Observable, _RelationshipObject,
)
from stix2.datastore.relational_db.utils import schema_for

from .database_backend_base import DatabaseBackend


class PostgresBackend(DatabaseBackend):
default_database_connection_url = \
f"postgresql://{os.getenv('POSTGRES_USER', 'postgres')}:" + \
f"{os.getenv('POSTGRES_PASSWORD', 'postgres')}@" + \
f"{os.getenv('POSTGRES_IP_ADDRESS', '0.0.0.0')}:" + \
f"{os.getenv('POSTGRES_PORT', '5432')}/postgres"

def __init__(self, database_connection_url=default_database_connection_url, force_recreate=False, **kwargs: Any):
super().__init__(database_connection_url, force_recreate=force_recreate, **kwargs)

def _create_schemas(self):
with self.database_connection.begin() as trans:
trans.execute(CreateSchema("common", if_not_exists=True))
trans.execute(CreateSchema("sdo", if_not_exists=True))
trans.execute(CreateSchema("sco", if_not_exists=True))
trans.execute(CreateSchema("sro", if_not_exists=True))

@staticmethod
def determine_schema_name(stix_object):
if isinstance(stix_object, _DomainObject):
return "sdo"
elif isinstance(stix_object, _Observable):
return "sco"
elif isinstance(stix_object, _RelationshipObject):
return "sro"
elif isinstance(stix_object, _MetaObject):
return "common"

@staticmethod
def schema_for(stix_class):
return schema_for(stix_class)

@staticmethod
def schema_for_core():
return "common"

@staticmethod
def determine_sql_type_for_binary_property(): # noqa: F811
return PostgresBackend.determine_sql_type_for_string_property()

@staticmethod
def determine_sql_type_for_hex_property(): # noqa: F811
# return LargeBinary
return PostgresBackend.determine_sql_type_for_string_property()

@staticmethod
def determine_sql_type_for_timestamp_property(): # noqa: F811
return TIMESTAMP(timezone=True)

@staticmethod
def array_allowed():
return True
Loading
Loading