github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-01 06:37:22 +00:00
Code Issues Projects Releases Wiki Activity

new(test): test case about illogical drop actions

Browse Source 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2021-03-19 12:57:29 +00:00
committed by poiana
parent e3f7cdab20
commit 5380fe5308
3 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
test/README.md
View File

@@ -26,7 +26,7 @@ make test-trace-files
It prepares the fixtures (`json` and `scap` files) needed by the integration tests. It prepares the fixtures (`json` and `scap` files) needed by the integration tests.
Using `virtualenv` the steps to locally run a specific test suite are the following ones (from this directory): Using `virtualenv` the steps to locally run a specific test suite are the following ones (**from this directory**):
```console ```console
virtualenv venv virtualenv venv

12
test/confs/drops_ignore_log.yaml Normal file
View File

@@ -0,0 +1,12 @@
syscall_event_drops:
actions:
- ignore
- log
rate: .03333
max_burst: 10
simulate_drops: true
stdout_output:
enabled: true
log_stderr: true

9
test/falco_tests.yaml
View File

@@ -1227,6 +1227,15 @@ trace_files: !mux
stdout_not_contains: stdout_not_contains:
- "Falco internal: syscall event drop" - "Falco internal: syscall event drop"
monitor_syscall_drops_ignore_and_log:
exit_status: 1
rules_file:
- rules/single_rule.yaml
conf_file: confs/drops_ignore_log.yaml
trace_file: trace_files/ping_sendto.scap
stderr_contains:
- "syscall event drop action \"log\" does not make sense with the \"ignore\" action"
monitor_syscall_drops_log: monitor_syscall_drops_log:
exit_status: 0 exit_status: 0
rules_file: rules_file: