1313
1414import org .apache .lucene .util .BytesRef ;
1515import org .elasticsearch .common .network .NetworkDirectionUtils ;
16- import org .elasticsearch .test .ESTestCase ;
1716import org .elasticsearch .xpack .esql .core .expression .Expression ;
1817import org .elasticsearch .xpack .esql .core .tree .Source ;
1918import org .elasticsearch .xpack .esql .core .type .DataType ;
@@ -33,7 +32,9 @@ public NetworkDirectionTests(@Name("TestCase") Supplier<TestCaseSupplier.TestCas
3332
3433 @ ParametersFactory
3534 public static Iterable <Object []> parameters () {
35+ // These tests copy the data from the NetworkDirectionUtils tests
3636 var suppliers = List .of (
37+ // CIDR tests
3738 new TestCaseSupplier (
3839 List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
3940 () -> new TestCaseSupplier .TestCase (
@@ -46,6 +47,152 @@ public static Iterable<Object[]> parameters() {
4647 DataType .KEYWORD ,
4748 equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INBOUND ))
4849 )
50+ ),
51+ new TestCaseSupplier (
52+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
53+ () -> new TestCaseSupplier .TestCase (
54+ List .of (
55+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.2" ), DataType .IP , "source_ip" ),
56+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("10.0.1.1" ), DataType .IP , "destination_ip" ),
57+ new TestCaseSupplier .TypedData (List .of ("10.0.0.0/8" ), DataType .KEYWORD , "internal_networks" )
58+ ),
59+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
60+ DataType .KEYWORD ,
61+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_OUTBOUND ))
62+ )
63+ ),
64+ // Unspecified tests
65+ new TestCaseSupplier (
66+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
67+ () -> new TestCaseSupplier .TestCase (
68+ List .of (
69+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("0.0.0.0" ), DataType .IP , "source_ip" ),
70+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("0.0.0.0" ), DataType .IP , "destination_ip" ),
71+ new TestCaseSupplier .TypedData (List .of ("unspecified" ), DataType .KEYWORD , "internal_networks" )
72+ ),
73+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
74+ DataType .KEYWORD ,
75+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
76+ )
77+ ),
78+ new TestCaseSupplier (
79+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
80+ () -> new TestCaseSupplier .TestCase (
81+ List .of (
82+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("::" ), DataType .IP , "source_ip" ),
83+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("::" ), DataType .IP , "destination_ip" ),
84+ new TestCaseSupplier .TypedData (List .of ("unspecified" ), DataType .KEYWORD , "internal_networks" )
85+ ),
86+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
87+ DataType .KEYWORD ,
88+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
89+ )
90+ ),
91+ // Private network tests
92+ new TestCaseSupplier (
93+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
94+ () -> new TestCaseSupplier .TestCase (
95+ List .of (
96+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
97+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.2" ), DataType .IP , "destination_ip" ),
98+ new TestCaseSupplier .TypedData (List .of ("private" ), DataType .KEYWORD , "internal_networks" )
99+ ),
100+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
101+ DataType .KEYWORD ,
102+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
103+ )
104+ ),
105+ new TestCaseSupplier (
106+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
107+ () -> new TestCaseSupplier .TestCase (
108+ List .of (
109+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("10.0.1.1" ), DataType .IP , "source_ip" ),
110+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.2" ), DataType .IP , "destination_ip" ),
111+ new TestCaseSupplier .TypedData (List .of ("private" ), DataType .KEYWORD , "internal_networks" )
112+ ),
113+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
114+ DataType .KEYWORD ,
115+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
116+ )
117+ ),
118+ new TestCaseSupplier (
119+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
120+ () -> new TestCaseSupplier .TestCase (
121+ List .of (
122+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
123+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("172.16.0.1" ), DataType .IP , "destination_ip" ),
124+ new TestCaseSupplier .TypedData (List .of ("private" ), DataType .KEYWORD , "internal_networks" )
125+ ),
126+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
127+ DataType .KEYWORD ,
128+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
129+ )
130+ ),
131+ new TestCaseSupplier (
132+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
133+ () -> new TestCaseSupplier .TestCase (
134+ List .of (
135+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
136+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("fd12:3456:789a:1::1" ), DataType .IP , "destination_ip" ),
137+ new TestCaseSupplier .TypedData (List .of ("private" ), DataType .KEYWORD , "internal_networks" )
138+ ),
139+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
140+ DataType .KEYWORD ,
141+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_INTERNAL ))
142+ )
143+ ),
144+ // Public tests
145+ new TestCaseSupplier (
146+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
147+ () -> new TestCaseSupplier .TestCase (
148+ List .of (
149+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
150+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.2" ), DataType .IP , "destination_ip" ),
151+ new TestCaseSupplier .TypedData (List .of ("public" ), DataType .KEYWORD , "internal_networks" )
152+ ),
153+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
154+ DataType .KEYWORD ,
155+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_EXTERNAL ))
156+ )
157+ ),
158+ new TestCaseSupplier (
159+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
160+ () -> new TestCaseSupplier .TestCase (
161+ List .of (
162+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("10.0.1.1" ), DataType .IP , "source_ip" ),
163+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.2" ), DataType .IP , "destination_ip" ),
164+ new TestCaseSupplier .TypedData (List .of ("public" ), DataType .KEYWORD , "internal_networks" )
165+ ),
166+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
167+ DataType .KEYWORD ,
168+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_EXTERNAL ))
169+ )
170+ ),
171+ new TestCaseSupplier (
172+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
173+ () -> new TestCaseSupplier .TestCase (
174+ List .of (
175+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
176+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("172.16.0.1" ), DataType .IP , "destination_ip" ),
177+ new TestCaseSupplier .TypedData (List .of ("public" ), DataType .KEYWORD , "internal_networks" )
178+ ),
179+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
180+ DataType .KEYWORD ,
181+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_EXTERNAL ))
182+ )
183+ ),
184+ new TestCaseSupplier (
185+ List .of (DataType .IP , DataType .IP , DataType .KEYWORD ),
186+ () -> new TestCaseSupplier .TestCase (
187+ List .of (
188+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("192.168.1.1" ), DataType .IP , "source_ip" ),
189+ new TestCaseSupplier .TypedData (EsqlDataTypeConverter .stringToIP ("fd12:3456:789a:1::1" ), DataType .IP , "destination_ip" ),
190+ new TestCaseSupplier .TypedData (List .of ("public" ), DataType .KEYWORD , "internal_networks" )
191+ ),
192+ "NetworkDirectionEvaluator[sourceIp=Attribute[channel=0], destinationIp=Attribute[channel=1], networks=Attribute[channel=2]]" ,
193+ DataType .KEYWORD ,
194+ equalTo (new BytesRef (NetworkDirectionUtils .DIRECTION_EXTERNAL ))
195+ )
49196 )
50197 );
51198
0 commit comments