Address feedback from PR

- Instead of having a possibly null string pointer as the argument to
   enable_* and process_event, have wrapper versions that assume a
   default falco ruleset. The default ruleset name is a static member of
   the falco_engine class, and the default ruleset id is created/found
   in the constructor.
 - This makes the whole mechanism simple enough that it doesn't require
   seprarate testing, so remove the capability within falco to read a
   ruleset from the environment and remove automated tests that specify
   a ruleset.
 - Make pattern/tags/ruleset arguments to enable_* functions const.

(I'll squash this down before I commit)
This commit is contained in:
Mark Stemm
2017-02-10 11:53:39 -08:00
parent 0a69fc0c85
commit 185729d5d6
5 changed files with 57 additions and 138 deletions

View File

@@ -23,8 +23,6 @@ class FalcoTest(Test):
self.should_detect = self.params.get('detect', '*', default=False)
self.trace_file = self.params.get('trace_file', '*')
self.env = {}
if not os.path.isabs(self.trace_file):
self.trace_file = os.path.join(self.basedir, self.trace_file)
@@ -125,10 +123,6 @@ class FalcoTest(Test):
if self.run_tags == '':
self.run_tags=[]
self.ruleset = self.params.get('ruleset', '*', default='')
if self.ruleset != '':
self.env["FALCO_RULESET"] = self.ruleset
def check_rules_warnings(self, res):
found_warning = sets.Set()
@@ -250,7 +244,7 @@ class FalcoTest(Test):
for tag in self.run_tags:
cmd += ' -t {}'.format(tag)
self.falco_proc = process.SubProcess(cmd, env=self.env)
self.falco_proc = process.SubProcess(cmd)
res = self.falco_proc.run(timeout=180, sig=9)

View File

@@ -483,75 +483,3 @@ trace_files: !mux
- open_11: 1
- open_12: 0
- open_13: 0
# Trying one of the combinations with a ruleset specified. Should get same output and no errors.
run_tags_c_ruleset:
detect: True
detect_level: WARNING
rules_file:
- rules/tagged_rules.yaml
trace_file: trace_files/open-multiple-files.scap
run_tags: [c]
ruleset: my-ruleset
detect_counts:
- open_1: 0
- open_2: 0
- open_3: 1
- open_4: 0
- open_5: 1
- open_6: 1
- open_7: 1
- open_8: 0
- open_9: 1
- open_10: 1
- open_11: 0
- open_12: 0
- open_13: 0
# Disabling one rule with a ruleset specified. Should get that one rule missing and no errors.
disabled_with_ruleset:
detect: True
detect_level: WARNING
rules_file:
- rules/tagged_rules.yaml
trace_file: trace_files/open-multiple-files.scap
disabled_rules:
- "open_4"
ruleset: my-ruleset
detect_counts:
- open_1: 1
- open_2: 1
- open_3: 1
- open_4: 0
- open_5: 1
- open_6: 1
- open_7: 1
- open_8: 1
- open_9: 1
- open_10: 1
- open_11: 1
- open_12: 1
- open_13: 1
# Enabling all rules with a ruleset specified. Should get all rules matching.
default_with_ruleset:
detect: True
detect_level: WARNING
rules_file:
- rules/tagged_rules.yaml
trace_file: trace_files/open-multiple-files.scap
ruleset: my-ruleset
detect_counts:
- open_1: 1
- open_2: 1
- open_3: 1
- open_4: 1
- open_5: 1
- open_6: 1
- open_7: 1
- open_8: 1
- open_9: 1
- open_10: 1
- open_11: 1
- open_12: 1
- open_13: 1