diff --git a/test/falco_test.py b/test/falco_test.py index 689a7685..5c084d10 100644 --- a/test/falco_test.py +++ b/test/falco_test.py @@ -269,7 +269,7 @@ class FalcoTest(Test): triggered_rules = match.group(1) for rule, count in self.detect_counts.iteritems(): - expected = '\s{}: (\d+)'.format(rule) + expected = '\s{}: (\d+)'.format(re.sub(r'([$\.*+?()[\]{}|^])', r'\\\1', rule)) match = re.search(expected, triggered_rules) if match is None: diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index aecc1a9a..7f4ce784 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -86,6 +86,15 @@ trace_files: !mux - rules/rule_names_with_spaces.yaml trace_file: trace_files/cat_write.scap + rule_names_with_regex_chars: + detect: True + detect_level: WARNING + rules_file: + - rules/rule_names_with_regex_chars.yaml + detect_counts: + - 'Open From Cat ($\.*+?()[]{}|^)': 8 + trace_file: trace_files/cat_write.scap + multiple_rules_first_empty: detect: True detect_level: WARNING @@ -447,13 +456,13 @@ trace_files: !mux - open_from_cat trace_file: trace_files/cat_write.scap - disabled_rules_using_regex: + disabled_rules_using_substring: detect: False rules_file: - rules/empty_rules.yaml - rules/single_rule.yaml disabled_rules: - - "open.*" + - "open_from" trace_file: trace_files/cat_write.scap disabled_rules_using_enabled_flag: diff --git a/test/rules/rule_names_with_regex_chars.yaml b/test/rules/rule_names_with_regex_chars.yaml new file mode 100644 index 00000000..063fed5f --- /dev/null +++ b/test/rules/rule_names_with_regex_chars.yaml @@ -0,0 +1,25 @@ +# +# Copyright (C) 2016-2018 Draios Inc dba Sysdig. +# +# This file is part of falco. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +- macro: is_cat + condition: proc.name=cat + +- rule: Open From Cat ($\.*+?()[]{}|^) + desc: A process named cat does an open + condition: evt.type=open and is_cat + output: "An open was seen (command=%proc.cmdline)" + priority: WARNING \ No newline at end of file