Linux: update tests for sockscan to be more generic

test/test_volatility.py

@@ -372,17 +372,26 @@ def test_linux_sockscan(image, volatility, python):
     # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6
     rc, out, err = runvol_plugin("linux.sockscan.Sockscan", image, volatility, python)
 
-    assert re.search(
-        rb"AF_UNIX\s+STREAM\s+-\s+/tmp/pulse-JldaJj8OxQLa/native\s+14054\s+-\s+14053\s+ESTABLISHED\s+-",
-        out,
+    # ensure that multiple unix paths for sockets have been found
+    assert (
+        len(
+            re.findall(
+                rb"(/[ -~]+?){1,8}",
+                out,
+            )
+        )
+        >= 10
     )
-    assert re.search(
-        rb"AF_INET\s+STREAM\s+TCP\s+192.168.201.161\s+22\s+192.168.201.1\s+59982\s+ESTABLISHED\s+-",
-        out,
-    )
-    assert re.search(
-        rb"AF_INET\s+STREAM\s+TCP\s+0.0.0.0\s+901\s+0.0.0.0\s+0\s+LISTEN\s+-",
-        out,
+
+    # ensure that multiple IPv4 addresses have been found
+    assert (
+        len(
+            re.findall(
+                rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}",
+                out,
+            )
+        )
+        >= 10
     )
 
     assert out.count(b"\n") >= 50