diff --git a/test/falco_tests_plugins.yaml b/test/falco_tests_plugins.yaml index f80b4860..6aaf15db 100644 --- a/test/falco_tests_plugins.yaml +++ b/test/falco_tests_plugins.yaml @@ -24,7 +24,7 @@ trace_files: !mux - rules/plugins/cloudtrail_create_instances.yaml conf_file: BUILD_DIR/test/confs/plugins/cloudtrail_json_create_instances.yaml addl_cmdline_opts: --list-plugins - stdout_contains: "2 Plugins Loaded.*Name: cloudtrail.*ID:.*Name: json" + stdout_contains: "2 Plugins Loaded.*Name: cloudtrail.*Name: json.*" list_plugin_fields: check_detection_counts: False @@ -54,21 +54,21 @@ trace_files: !mux multiple_source_plugins: exit_status: 1 - stderr_contains: "Can not load multiple source plugins. cloudtrail already loaded." + stderr_contains: "Can not load multiple plugins with event sourcing capability: 'cloudtrail' already loaded." conf_file: BUILD_DIR/test/confs/plugins/multiple_source_plugins.yaml rules_file: - rules/plugins/cloudtrail_create_instances.yaml incompatible_extract_sources: exit_status: 1 - stderr_contains: "Extractor plugin not compatible with event source aws_cloudtrail." + stderr_contains: "Plugin '.*' has field extraction capability but is not compatible with any enabled event source" conf_file: BUILD_DIR/test/confs/plugins/incompatible_extract_sources.yaml rules_file: - rules/plugins/cloudtrail_create_instances.yaml overlap_extract_sources: exit_status: 1 - stderr_contains: "Extractor plugins have overlapping compatible event source test_source." + stderr_contains: "Plugin '.*' supports extraction of field 'test.field' that is overlapping for source 'test_source'" conf_file: BUILD_DIR/test/confs/plugins/overlap_extract_sources.yaml rules_file: - rules/plugins/cloudtrail_create_instances.yaml diff --git a/test/plugins/test_extract.cpp b/test/plugins/test_extract.cpp index a4a5863a..0e7a4947 100644 --- a/test/plugins/test_extract.cpp +++ b/test/plugins/test_extract.cpp @@ -26,7 +26,7 @@ static const char *pl_desc = "Test Plugin For Regression Tests"; static const char *pl_contact = "github.com/falcosecurity/falco"; static const char *pl_version = "0.1.0"; static const char *pl_extract_sources = "[\"test_source\"]"; -static const char *pl_fields = "[]"; +static const char *pl_fields = "[{\"type\": \"uint64\", \"name\": \"test.field\", \"desc\": \"Describing test field\"}]"; // This struct represents the state of a plugin. Just has a placeholder string value. typedef struct plugin_state @@ -44,7 +44,7 @@ const char* plugin_get_name() { // Add a random-ish suffix to the end, as some tests load // multiple copies of this plugin - snprintf(pl_name, sizeof(pl_name)-1, "%s%ld\n", pl_name_base, random()); + snprintf(pl_name, sizeof(pl_name)-1, "%s%ld", pl_name_base, random()); return pl_name; }