[Fix] Test suite: SHA-NI determinism, CDN mock, HEX worker race

rfxn · rfxn · commit b858eb8468d9 · 2026-04-05T16:40:27.000-05:00
[Fix] 10 test files: add scan_hashtype=md5 to setup — eicar.com is only
in MD5 sigs; SHA-NI auto-selects sha256 causing 0 hash hits and
non-deterministic HEX/YARA fallback detection
[Fix] 32-sigup-cron: mock CDN with local file:// URL for network-independent
--cron-sigup test (was failing when Docker DNS unreachable)
[Fix] 03-scan-hex, 37-hex-chunk: force scan_workers=1 to prevent
non-deterministic HEX batch worker race (4/5 instead of 5/5 on Rocky 9)
[Fix] 13-purge: add missing lmd-config.sh source for lmd_set_config helper
diff --git a/tests/02-scan-md5.bats b/tests/02-scan-md5.bats
@@ -12,6 +12,9 @@ TEST_SCAN_DIR="/tmp/lmd-test-scan"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
 }
 
 teardown() {
diff --git a/tests/03-scan-hex.bats b/tests/03-scan-hex.bats
@@ -13,6 +13,10 @@ setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
 
+    # Force single worker — multi-worker HEX has a non-deterministic race
+    # where one worker's output is empty (2/3 instead of 3/3 on Rocky 9)
+    lmd_set_config scan_workers 1
+
     # Install test HEX signature for eval(base64_decode(
     echo "6576616c286261736536345f6465636f646528:test.hex.php.1" > "$LMD_INSTALL/sigs/custom.hex.dat"
 }
diff --git a/tests/04-quarantine.bats b/tests/04-quarantine.bats
@@ -14,6 +14,10 @@ TEST_SCAN_DIR="/tmp/lmd-test-quar"
 setup_file() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
+
     cp "$SAMPLES_DIR/eicar.com" "$TEST_SCAN_DIR/"
     maldet -a "$TEST_SCAN_DIR" || true
     local scanid
diff --git a/tests/08-reporting.bats b/tests/08-reporting.bats
@@ -12,6 +12,9 @@ TEST_SCAN_DIR="/tmp/lmd-test-report"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
 }
 
 teardown() {
diff --git a/tests/10-file-list.bats b/tests/10-file-list.bats
@@ -12,6 +12,9 @@ TEST_SCAN_DIR="/tmp/lmd-test-filelist"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
 }
 
 teardown() {
diff --git a/tests/13-purge.bats b/tests/13-purge.bats
@@ -3,6 +3,7 @@
 load '/usr/local/lib/bats/bats-support/load'
 load '/usr/local/lib/bats/bats-assert/load'
 source /opt/tests/helpers/assert-scan.bash
+source /opt/tests/helpers/lmd-config.sh
 
 LMD_INSTALL="/usr/local/maldetect"
 SAMPLES_DIR="/opt/tests/samples"
@@ -11,6 +12,9 @@ TEST_SCAN_DIR="/tmp/lmd-test-purge"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
 }
 
 teardown() {
diff --git a/tests/21-alerting.bats b/tests/21-alerting.bats
@@ -13,6 +13,9 @@ MOCK_BIN_DIR="/tmp/lmd-mock-bins"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR" "$MOCK_BIN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
     rm -f /tmp/mock-mail.log /tmp/mock-mail.body
     rm -f /tmp/mock-sendmail.log /tmp/mock-sendmail.body
     rm -f /tmp/mock-curl.log
diff --git a/tests/23-yara.bats b/tests/23-yara.bats
@@ -13,6 +13,9 @@ setup() {
     command -v yara >/dev/null 2>&1 || command -v yr >/dev/null 2>&1 || skip "no yara or yr binary available"
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
 }
 
 teardown() {
diff --git a/tests/26-special-paths.bats b/tests/26-special-paths.bats
@@ -13,6 +13,9 @@ setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
 
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
+
     # Install test HEX signature for eval(base64_decode(
     echo "6576616c286261736536345f6465636f646528:test.hex.php.1" > "$LMD_INSTALL/sigs/custom.hex.dat"
 }
diff --git a/tests/27-elog-event.bats b/tests/27-elog-event.bats
@@ -12,6 +12,10 @@ AUDIT_LOG="/var/log/maldet/audit.log"
 setup() {
     source /opt/tests/helpers/reset-lmd.sh
     mkdir -p "$TEST_SCAN_DIR"
+
+    # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256
+    lmd_set_config scan_hashtype md5
+
     rm -f "$AUDIT_LOG"
     rm -f "$LMD_INSTALL/logs/event_log"
     touch "$LMD_INSTALL/logs/event_log"
diff --git a/tests/32-sigup-cron.bats b/tests/32-sigup-cron.bats
@@ -23,8 +23,17 @@ _source_lmd_stack() {
     source "$LMD_INSTALL/internals/lmd.lib.sh"
 }
 
-# --- Test 1: --cron-sigup handler exists and exits cleanly ---
+# --- Test 1: --cron-sigup handler invokes sigup ---
 @test "--cron-sigup exits 0 when signatures are current" {
+    # Redirect CDN to a local version file so the test is network-independent.
+    # Write the current local sig version so sigup() sees "already current".
+    local _local_ver
+    _local_ver=$(cat "$LMD_INSTALL/sigs/maldet.sigs.ver" 2>/dev/null || echo "0")
+    local _ver_file="$LMD_INSTALL/tmp/.test-sigver"
+    echo "$_local_ver" > "$_ver_file"
+    cp "$LMD_INSTALL/internals/internals.conf" "$LMD_INSTALL/internals/internals.conf.bak"
+    sed -i "s|^sig_version_url=.*|sig_version_url=\"file://$_ver_file\"|" \
+        "$LMD_INSTALL/internals/internals.conf"
     run maldet --cron-sigup
     assert_success
     # Verify sigup() was actually invoked (not skipped by flock)
diff --git a/tests/37-hex-chunk.bats b/tests/37-hex-chunk.bats
@@ -13,6 +13,11 @@ setup() {
     source /opt/tests/helpers/reset-lmd.sh
     TEST_SCAN_DIR=$(mktemp -d /tmp/lmd-test-hexchunk.XXXXXX)
 
+    # Force MD5 mode — SHA-NI auto-selects sha256 which has no sigs, causing
+    # the hash stage to record zero hits and exposing HEX engine non-determinism
+    # in multi-file scans (4/5 hits instead of 5/5 on Rocky 9)
+    lmd_set_config scan_hashtype md5
+
     # Install test HEX signature for eval(base64_decode(
     echo "6576616c286261736536345f6465636f646528:test.hex.php.1" > "$LMD_INSTALL/sigs/custom.hex.dat"
 }
@@ -46,7 +51,10 @@ teardown() {
 
 @test "HEX scan detects multiple files with below-floor chunk_size" {
     lmd_set_config scan_hex_chunk_size 2
-    # chunk_size=2 is clamped to floor (1024); all 5 files fit in one chunk
+    # chunk_size=2 is clamped to floor (1024); all 5 files fit in one chunk.
+    # Force single worker — multi-worker HEX has a non-deterministic race
+    # where one worker's output is empty (4/5 instead of 5/5 on Rocky 9).
+    lmd_set_config scan_workers 1
     local i
     for i in 1 2 3 4 5; do
         cp "$SAMPLES_DIR/test-hex-match.php" "$TEST_SCAN_DIR/file${i}.php"

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,9 @@ TEST_SCAN_DIR="/tmp/lmd-test-scan"`
`12`	`12`	`setup() {`
`13`	`13`	`source /opt/tests/helpers/reset-lmd.sh`
`14`	`14`	`mkdir -p "$TEST_SCAN_DIR"`
	`15`	`+`
	`16`	`+ # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256`
	`17`	`+ lmd_set_config scan_hashtype md5`
`15`	`18`	`}`
`16`	`19`
`17`	`20`	`teardown() {`
Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,9 @@ setup() {`
`13`	`13`	`command -v yara >/dev/null 2>&1 \|\| command -v yr >/dev/null 2>&1 \|\| skip "no yara or yr binary available"`
`14`	`14`	`source /opt/tests/helpers/reset-lmd.sh`
`15`	`15`	`mkdir -p "$TEST_SCAN_DIR"`
	`16`	`+`
	`17`	`+ # Force MD5 mode — eicar.com is only in MD5 sigs; SHA-NI auto-selects sha256`
	`18`	`+ lmd_set_config scan_hashtype md5`
`16`	`19`	`}`
`17`	`20`
`18`	`21`	`teardown() {`