From 136b528849d602e2e58900ff580dc03b638c99db Mon Sep 17 00:00:00 2001 From: Jason Dellaluce Date: Wed, 3 Aug 2022 12:55:42 +0000 Subject: [PATCH] fix(tests): index old version of events in rulesets Co-authored-by: Andrea Terzolo Signed-off-by: Jason Dellaluce --- tests/engine/test_filter_evttype_resolver.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/engine/test_filter_evttype_resolver.cpp b/tests/engine/test_filter_evttype_resolver.cpp index e4041027..a810b551 100644 --- a/tests/engine/test_filter_evttype_resolver.cpp +++ b/tests/engine/test_filter_evttype_resolver.cpp @@ -57,12 +57,14 @@ ast::expr* compile(const string &fltstr) TEST_CASE("Should find event types from filter", "[rule_loader]") { set openat_only{ + PPME_SYSCALL_OPENAT_E, PPME_SYSCALL_OPENAT_X, PPME_SYSCALL_OPENAT_2_E, PPME_SYSCALL_OPENAT_2_X }; set close_only{ PPME_SYSCALL_CLOSE_E, PPME_SYSCALL_CLOSE_X }; set openat_close{ + PPME_SYSCALL_OPENAT_E, PPME_SYSCALL_OPENAT_X, PPME_SYSCALL_OPENAT_2_E, PPME_SYSCALL_OPENAT_2_X, PPME_SYSCALL_CLOSE_E, PPME_SYSCALL_CLOSE_X }; @@ -75,7 +77,7 @@ TEST_CASE("Should find event types from filter", "[rule_loader]") { // Skip "old" event versions that have been replaced // by newer event versions, or events that are unused. - if(g_infotables.m_event_info[i].flags & (EF_OLD_VERSION | EF_UNUSED)) + if(g_infotables.m_event_info[i].flags & EF_UNUSED) { continue; }