github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-27 15:17:50 +00:00
Code Issues Projects Releases Wiki Activity

update(test): fixed tests.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2022-05-13 13:05:36 +02:00 committed by poiana
parent 39f55f4b5c
commit d9d8dedc32
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
test/falco_tests_plugins.yaml
View File

@ -24,7 +24,7 @@ trace_files: !mux
- rules/plugins/cloudtrail_create_instances.yaml - rules/plugins/cloudtrail_create_instances.yaml
conf_file: BUILD_DIR/test/confs/plugins/cloudtrail_json_create_instances.yaml conf_file: BUILD_DIR/test/confs/plugins/cloudtrail_json_create_instances.yaml
addl_cmdline_opts: --list-plugins addl_cmdline_opts: --list-plugins
stdout_contains: "2 Plugins Loaded.*Name: cloudtrail.*ID:.*Name: json" stdout_contains: "2 Plugins Loaded.*Name: cloudtrail.*Name: json.*"
list_plugin_fields: list_plugin_fields:
check_detection_counts: False check_detection_counts: False
@ -54,21 +54,21 @@ trace_files: !mux
multiple_source_plugins: multiple_source_plugins:
exit_status: 1 exit_status: 1
stderr_contains: "Can not load multiple source plugins. cloudtrail already loaded." stderr_contains: "Can not load multiple plugins with event sourcing capability: 'cloudtrail' already loaded."
conf_file: BUILD_DIR/test/confs/plugins/multiple_source_plugins.yaml conf_file: BUILD_DIR/test/confs/plugins/multiple_source_plugins.yaml
rules_file: rules_file:
- rules/plugins/cloudtrail_create_instances.yaml - rules/plugins/cloudtrail_create_instances.yaml
incompatible_extract_sources: incompatible_extract_sources:
exit_status: 1 exit_status: 1
stderr_contains: "Extractor plugin not compatible with event source aws_cloudtrail." stderr_contains: "Plugin '.*' has field extraction capability but is not compatible with any enabled event source"
conf_file: BUILD_DIR/test/confs/plugins/incompatible_extract_sources.yaml conf_file: BUILD_DIR/test/confs/plugins/incompatible_extract_sources.yaml
rules_file: rules_file:
- rules/plugins/cloudtrail_create_instances.yaml - rules/plugins/cloudtrail_create_instances.yaml
overlap_extract_sources: overlap_extract_sources:
exit_status: 1 exit_status: 1
stderr_contains: "Extractor plugins have overlapping compatible event source test_source." stderr_contains: "Plugin '.*' supports extraction of field 'test.field' that is overlapping for source 'test_source'"
conf_file: BUILD_DIR/test/confs/plugins/overlap_extract_sources.yaml conf_file: BUILD_DIR/test/confs/plugins/overlap_extract_sources.yaml
rules_file: rules_file:
- rules/plugins/cloudtrail_create_instances.yaml - rules/plugins/cloudtrail_create_instances.yaml

4
test/plugins/test_extract.cpp
View File

@ -26,7 +26,7 @@ static const char *pl_desc = "Test Plugin For Regression Tests";
static const char *pl_contact = "github.com/falcosecurity/falco"; static const char *pl_contact = "github.com/falcosecurity/falco";
static const char *pl_version = "0.1.0"; static const char *pl_version = "0.1.0";
static const char *pl_extract_sources = "[\"test_source\"]"; static const char *pl_extract_sources = "[\"test_source\"]";
static const char *pl_fields = "[]"; static const char *pl_fields = "[{\"type\": \"uint64\", \"name\": \"test.field\", \"desc\": \"Describing test field\"}]";
// This struct represents the state of a plugin. Just has a placeholder string value. // This struct represents the state of a plugin. Just has a placeholder string value.
typedef struct plugin_state typedef struct plugin_state
@ -44,7 +44,7 @@ const char* plugin_get_name()
{ {
// Add a random-ish suffix to the end, as some tests load // Add a random-ish suffix to the end, as some tests load
// multiple copies of this plugin // multiple copies of this plugin
snprintf(pl_name, sizeof(pl_name)-1, "%s%ld\n", pl_name_base, random()); snprintf(pl_name, sizeof(pl_name)-1, "%s%ld", pl_name_base, random());
return pl_name; return pl_name;
} }