mirror of
https://github.com/falcosecurity/falco.git
synced 2025-06-26 14:52:20 +00:00
test: add regression tests for ref loops in lists and macros
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
This commit is contained in:
parent
0a6db28783
commit
cb58ea9c57
@ -358,6 +358,16 @@ trace_files: !mux
|
||||
validate_rules_file:
|
||||
- rules/invalid_macro_without_condition.yaml
|
||||
trace_file: trace_files/cat_write.scap
|
||||
|
||||
invalid_macro_loop:
|
||||
exit_status: 1
|
||||
validate_errors:
|
||||
- item_type: macro
|
||||
item_name: macro_a
|
||||
code: LOAD_ERR_VALIDATE
|
||||
message_contains: "reference loop in macro"
|
||||
validate_rules_file:
|
||||
- rules/invalid_macro_loop.yaml
|
||||
|
||||
invalid_rule_without_output:
|
||||
exit_status: 1
|
||||
@ -403,6 +413,16 @@ trace_files: !mux
|
||||
- rules/list_append_failure.yaml
|
||||
trace_file: trace_files/cat_write.scap
|
||||
|
||||
invalid_list_loop:
|
||||
exit_status: 1
|
||||
validate_errors:
|
||||
- item_type: rule
|
||||
item_name: sample rule
|
||||
code: LOAD_ERR_COMPILE_CONDITION
|
||||
message: "unknown event type list_a"
|
||||
validate_rules_file:
|
||||
- rules/invalid_list_loop.yaml
|
||||
|
||||
invalid_rule_append_dangling:
|
||||
exit_status: 1
|
||||
validate_errors:
|
||||
|
17
test/rules/invalid_list_loop.yaml
Normal file
17
test/rules/invalid_list_loop.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
- list: list_a
|
||||
items: [open]
|
||||
|
||||
- list: list_b
|
||||
items: [list_a]
|
||||
|
||||
- list: list_a
|
||||
items: [list_b]
|
||||
|
||||
- macro: macro_a
|
||||
condition: evt.type in (list_a)
|
||||
|
||||
- rule: sample rule
|
||||
priority: WARNING
|
||||
output: test
|
||||
desc: testdesc
|
||||
condition: macro_a
|
8
test/rules/invalid_macro_loop.yaml
Normal file
8
test/rules/invalid_macro_loop.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
- macro: macro_a
|
||||
condition: evt.type=open
|
||||
|
||||
- macro: macro_b
|
||||
condition: macro_a
|
||||
|
||||
- macro: macro_a
|
||||
condition: macro_b
|
Loading…
Reference in New Issue
Block a user