Unit test for fd.net + in operator fixes (#343)

Tests fix for https://github.com/draios/falco/issues/339. Depends on
https://github.com/draios/sysdig/pull/1091.

test/falco_tests.yaml

@@ -663,4 +663,11 @@ trace_files: !mux
     rules_file:
       - rules/rule_append.yaml
     trace_file: trace_files/cat_write.scap
-    stdout_contains: "^(?!.*Warning An open of /dev/null was seen.*)"
+    stdout_contains: "^(?!.*Warning An open of /dev/null was seen.*)"
+
+  in_operator_netmasks:
+    detect: True
+    detect_level: INFO
+    rules_file:
+      - rules/detect_connect_using_in.yaml
+    trace_file: trace_files/connect_localhost.scap

test/rules/detect_connect_using_in.yaml

@@ -0,0 +1,6 @@
+- rule: Localhost connect
+  desc: Detect any connect to the localhost network, using fd.net and the in operator
+  condition: evt.type=connect and fd.net in ("127.0.0.1/24")
+  output: Program connected to localhost network
+    (user=%user.name command=%proc.cmdline connection=%fd.name)
+  priority: INFO