github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-10 10:32:23 +00:00
Code Issues Projects Releases Wiki Activity

fix(unit_tests): adapt to connect4 corner cases

Browse Source 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
Jason Dellaluce 2023-03-06 16:24:09 +00:00 committed by poiana
parent 8fe474088d
commit b32c0b9283
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
unit_tests/falco/app/actions/test_configure_interesting_sets.cpp
View File

@ -107,7 +107,7 @@ TEST(ConfigureInterestingSets, engine_codes_syscalls_set)
auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source);
auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set);
ASSERT_NAMES_EQ(rules_sc_names, strset_t({
"connect", "accept", "open", "ptrace", "mmap", "execve", "read"}));
"connect", "accept", "accept4", "open", "ptrace", "mmap", "execve", "read"}));
}
TEST(ConfigureInterestingSets, preconditions_postconditions)
@ -166,7 +166,7 @@ TEST(ConfigureInterestingSets, engine_codes_nonsyscalls_set)
auto rules_sc_set = engine->sc_codes_for_ruleset(s_sample_source);
auto rules_sc_names = libsinsp::events::sc_set_to_names(rules_sc_set);
ASSERT_NAMES_EQ(rules_sc_names, strset_t({
"connect", "accept", "open", "ptrace", "mmap", "execve", "read",
"connect", "accept", "accept4", "open", "ptrace", "mmap", "execve", "read",
"syncfs", "fanotify_init", // from generic event filters
}));
}
@ -333,6 +333,7 @@ TEST(ConfigureInterestingSets, selection_custom_base_set)
libsinsp::events::sc_set_to_names(default_base_set),
strset_t({ "connect", "open", "ptrace", "mmap", "execve", "read"}));
expected_sc_names.erase("accept");
expected_sc_names.erase("accept4");
ASSERT_NAMES_CONTAIN(selected_sc_names, expected_sc_names);
// non-empty custom base set (positive, without -A)