Commit Graph

166 Commits

Author SHA1 Message Date
Federico Di Pierro
45754fda9f new(userspace,unit_tests): deny main config to include itself.
Moreover, added a couple more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
8112f6210b chore(userspace,unit_tests): enable override of main config from secondary config files.
Moreover, do not trigger an exception when an included file is not present; just print a warning.
Finally, add more tests.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
6e1f128851 chore(unit_tests): more tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Federico Di Pierro
b3ebf9f57e new(userspace,unit_tests): introduce the possibility to split main config file into multiple config files.
The PR introduces a `includes` keyword in the config file,
that points to a list of strings (paths to other config files).

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2024-04-10 14:44:20 +02:00
Gianmatteo Palmieri
368463e295 new(tests): add unique exceptions names test
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-04-03 18:23:53 +02:00
Luca Guerra
f895f8fc78 fix(tests): fix uninitialized variable in test
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-29 14:08:24 +01:00
Gianmatteo Palmieri
a8018a2894 new(tests): test override/append exception with no values
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-27 09:15:13 +01:00
Luca Guerra
8421e4b122 fix(cmake): fix USE_BUNDLED_DEPS=ON and BUILD_FALCO_UNIT_TESTS=ON
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-03-25 16:47:06 +01:00
Gianmatteo Palmieri
3d4be156cc new(tests): add unit test for invalid macro/list name
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-03-08 00:02:01 +01:00
Gianmatteo Palmieri
928cb8bb8e new(tests): add unit test for exceptions condition
Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
2024-02-28 08:28:26 +01:00
Federico Aponte
b4e55ee6a1 cleanup: falco_engine test fixture
Upgrade GTest to 1.14.0

Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-21 00:31:59 +01:00
Federico Aponte
745d18ba38 refactor: test AtomicSignalHandler.handle_once_wait_consistency
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-20 15:19:56 +01:00
Samuel Gaist
e07f056fc5 fix(tests): remove unused variables in rule loader tests
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-19 18:01:48 +01:00
Andrea Terzolo
76ab28ff59 tests: remove deprecated assertions
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-02-16 18:30:38 +01:00
Samuel Gaist
5e497a4119 fix(c++): improve const correctness
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-15 22:16:33 +01:00
Luca Guerra
fe5c58e20e cleanup(tests): use test_falco_engine in test_enable_rule
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Luca Guerra
baf9e77810 cleanup(tests): update configure_interesting_sets to use test_falco_engine
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Luca Guerra
1afacb45fb cleanup(tests): extract engine fixture
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Luca Guerra
12f57514ad cleanup(tests): pass a valid inspector to factory/ast/filter tests
Signed-off-by: Luca Guerra <luca@guerra.sh>
2024-02-15 11:03:30 +01:00
Federico Aponte
539dac0590 fix: Some compiler warnings
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2024-02-15 10:07:30 +01:00
Samuel Gaist
08f62200b1 fix(c++): add missing explicit to single argument constructors
Reported by cppcheck

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2024-02-12 16:59:17 +01:00
Jason Dellaluce
58f8f14a1b fix(tests): solve last few compilation issues
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Jason Dellaluce
4cffcedba1 refactor: remove refs to gen_event class family
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-02-06 10:25:53 +01:00
Mark Stemm
e1fb55e046 Add unit test for alternate rules loader
Add a unit test for providing an alternate rules loader that also
demonstrates how users can define sub-classes that may want to extend
the falco rules syntax.

This test creates a test rules reader/collector/compiler that supports
top-level objects "test_object". The reader reads them and saves them
in the collector. The compiler iterates over all test_objects and puts
the property values into a single set<string>.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-30 20:24:33 +01:00
Jason Dellaluce
acba90d97a test(engine): assess proper list escaping in engine collector
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2024-01-23 11:58:09 +01:00
Andrea Terzolo
64bbffe5ef fix codespell
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
5ee05abc08 cleanup: adopt a new helper method in tests
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
c308f5c7e2 cleanup: rename some error messages
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
ee78c862ad tests: add some new tests on override replace
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
8ebdbe3e6f cleanup: use macros for default error messages
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
91d1511285 tests: add test on the order for macro and rules
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
3f9ede86bb tests: add some new tests about list order
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
56de6e6786 update(rule_loader): remove the warning on the required_engine_version
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
5ac005bd4d update(rule_loader): deprecate all non-SemVer compatible values
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
2367d36867 cleanup(tests): use new check_error_message helper
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
95e4c58e7f update(rule_loader): deprecate enabled usage
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
4aebee684a update(rule_loader): deprecate append key and add a warning
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Andrea Terzolo
7cac2833b2 cleanup(rule_loader): add a common log message
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2024-01-11 15:37:38 +01:00
Mark Stemm
66df3dc417 Add unit tests for add_source() + related lookup methods
Add unit tests for add_source() and its related find_*_for_source()
methods. The test just verifies that the values provided to
add_source() are the same as the values returned by the find methods.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2024-01-08 12:00:27 +01:00
Luca Guerra
728c8d7d0e fix(engine): clarify error message for invalid append
Signed-off-by: Luca Guerra <luca@guerra.sh>
2023-12-22 21:49:21 +01:00
Luca Guerra
04dd06b2c6 new(tests): add error testing for rule overrides
Signed-off-by: Luca Guerra <luca@guerra.sh>
2023-12-22 21:49:21 +01:00
Luca Guerra
bc072502cc new(engine): add selective overrides
Signed-off-by: Luca Guerra <luca@guerra.sh>
2023-12-22 21:49:21 +01:00
Mark Stemm
ab0133d1dd Add unit tests for enabling/disabling rules
Add unit tests for enabling/disabling rules, covering:

 - matching names by substring
 - using "" to match all rules
 - matching names exactly
 - using ruleset ids in addition to ruleset names

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
2023-12-18 15:58:04 +01:00
Federico Di Pierro
9e1e68f64b chore(unit_tests): added more tests for yaml env vars expansion.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-12-14 12:44:47 +01:00
Federico Di Pierro
cbbcb61153 new(unit_tests,userspace): properly support env var expansions in all scalar values of yaml file.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-12-13 17:03:46 +01:00
Federico Di Pierro
3b095a5eda chore(unit_tests): added tests around empty config value resolving to default.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-12-13 17:03:46 +01:00
Federico Di Pierro
7805bf5ad5 fix(userspace,unit_tests): fixed bool parsing.
Moreover, added some more tests around env vars.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-12-13 17:03:46 +01:00
Federico Di Pierro
0c0fb63008 chore(unit_test,userspace): allow env var to get expanded in yaml even when part of a string.
Moreover, support env variable embedding another env variable.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-12-13 17:03:46 +01:00
Federico Aponte
44b7352180 cleanup: fix several warnings from a Clang build
Signed-off-by: Federico Aponte <federico.aponte@sysdig.com>
2023-12-06 16:40:26 +01:00
Luca Guerra
6411eed4a7 cleanup(falco): remove decode_uri as it is no longer used
Signed-off-by: Luca Guerra <luca@guerra.sh>
2023-11-29 17:42:06 +01:00
Andrea Terzolo
00b7c56d54 cleanup: rename modern-ebpf into modern_ebpf
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
4443e9d64f fix: fix some broken tests
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Federico Di Pierro
b92e0d6134 chore(userspace,unit_tests): renamed engine.replay.trace_file to engine.replay.capture_file.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
898ba68b3b test: don't test load config if we are under wasm
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
96f474a29c docs: fix codespell
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
1b14fed380 tests: call the callback action only once
moreover this commit corrects `cpus_for_each_syscall_buffer` into test
configs

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
be16af7fe0 cleanup: rename cpus_for_each_syscall_buffer
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
588a94578a fix: take into consideration that load_yaml is called more than once
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
bc8f61ca68 tests: add a basic test to check config precedence
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
1ee6569a5d fix: use only new config instead of old command line options
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Andrea Terzolo
f3f56db5ca cleanup: some renaming from bpf to ebpf
the idea is to use only the word `ebpf` in Falco

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Federico Di Pierro
4127764129 chore(userspace): renamed driver. config to engine.; renamed engine.replay.scap_file to engine.replay.trace_file.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
2023-11-27 15:01:00 +01:00
Federico Di Pierro
4f1b950e0d chore(userspace,falco.yaml): rename new config key to driver.kind.
Moreover, renamed driver kinds to use better naming, and move driver's related
config keys under `driver.$kind`.

Added DEPRECTATION notices on CLI options, and in falco.yaml.

DEPRECATED options (both CLI and config ones) will have priority over the new ones,
to retain compatibility with existing configs.

DEPRECATED options will be dropped in Falco 0.38.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
2023-11-27 15:01:00 +01:00
Jason Dellaluce
04e2f19915 refactor: solve compilation issues with latest libs changes
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-11-16 09:26:19 +01:00
Luca Guerra
f073a6ee88 update(engine): add tests for decode_url()
Signed-off-by: Luca Guerra <luca@guerra.sh>
2023-11-14 20:36:15 +01:00
Roberto Scolaro
115729a86a fix(unit_test): new macro for env var setting
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2023-11-13 10:59:47 +01:00
Roberto Scolaro
5db29f4692 fix(unit_tests/falco): enable env test on win32
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
2023-11-13 10:59:47 +01:00
Samuel Gaist
d074728994 feat(userspace/falco): add configuration support for IPV6 webserver listen address
The IPV6 capabilities is provided through cpp-httplib.

Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2023-11-03 09:09:08 +01:00
Samuel Gaist
fac48cd145 test(configuration): implement basic webserver listen address test
Signed-off-by: Samuel Gaist <samuel.gaist@idiap.ch>
2023-11-03 09:09:08 +01:00
Leonardo Grasso
fe50ac22ee update: add SPDX license identifier
See https://github.com/falcosecurity/evolution/issues/318

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
2023-09-21 13:21:47 +02:00
Daniel Wright
513f122aff feat: support parsing of system environment variables in yaml
In order to allow the user to supply environment variables in standard
ways performed in other applications the get_scalar function has been
extended to support defining an environment variable in the format
`${FOO}`. Environment variables can be escaped via defining as `$${FOO}`.
As this handles some additional complexity, a unit test has been  added
to cover this new functionality

Signed-off-by: Daniel Wright <danielwright@bitgo.com>
2023-09-06 11:45:00 +02:00
Melissa Kilby
6cdb740786 cleanup(userspace): update parse_prometheus_interval
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-08-25 15:20:45 +02:00
Jason Dellaluce
527c42c030 chore: polish conditional compilation flags for emscripten
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-08-24 10:30:40 +02:00
rohith-raju
e8ee850dee update(ci,cmake): add support for emscripten build
Signed-off-by: rohith-raju <rohithraju488@gmail.com>
2023-08-24 10:30:40 +02:00
rohith-raju
105f2f6ee3 update(unit_tests): use typecast as wasm can't handle 64 bit int
Signed-off-by: rohith-raju <rohithraju488@gmail.com>
2023-08-24 10:30:40 +02:00
Jason Dellaluce
aa6061681d update: adapt code to multi-platform builds
Co-authored-by: Rohith Raju <rohithraju488@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-08-24 10:30:40 +02:00
Andrea Terzolo
1a359f5806 fix: add a check on online CPUs
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
2023-05-25 10:23:10 +02:00
Melissa Kilby
9b341b2c49 new(unit_tests): tests for prometheus compliant time durations
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-05-23 09:58:34 +02:00
Lorenzo Susini
a269866976 test(unit_tests/engine): test filter_details_resolver class
Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
2023-05-19 15:56:05 +02:00
Jason Dellaluce
9bfce8cfae update(userspace): make sure that async event is always matched in rules
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-05-19 12:15:04 +02:00
Jason Dellaluce
1f4919bfe1 update: improve control and UX of ignored events
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-04-27 11:10:14 +02:00
Jason Dellaluce
8926022035 update: adapt Falco to new sinsp event source management
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-04-26 12:59:13 +02:00
Jason Dellaluce
91cca0bd0e update(cmake): bump libs and drivers to 5b4dd9e2ae0cd2efeaf9da37d8c29631241d448c9ce5b0e35d8dd7f81d814034
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-04-04 19:39:53 +02:00
Jason Dellaluce
06d36d6e1b test(userspace/falco): leverage new sc_set_to_event_names API and solve last few todos
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-04-04 19:39:53 +02:00
Melissa Kilby
306d76d06b cleanup(unit_tests): try making test_configure_interesting_sets more robust
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-04-04 17:55:52 +02:00
Melissa Kilby
78daafb56c cleanup(app_actions): finalize base_syscalls.repair option
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-03-30 19:08:33 +02:00
Jason Dellaluce
2b93a79521 refactor: apply review suggestions
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-03-30 19:08:33 +02:00
Melissa Kilby
3e0f0d3692 cleanup(unit_tests): revert some test extensions in interim
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-03-30 19:08:33 +02:00
Melissa Kilby
ea3571564b cleanup(unit_tests): add selection_custom_base_set_repair tests
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-03-30 19:08:33 +02:00
Melissa Kilby
e360175c15 fix(app_actions): enforce PPM_SC_SCHED_PROCESS_EXIT for base_syscalls.custom_set
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-03-30 19:08:33 +02:00
Jason Dellaluce
b32c0b9283 fix(unit_tests): adapt to connect4 corner cases
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-03-09 09:39:12 +01:00
Jason Dellaluce
3ab7c7d753 chore: fix typos
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-03-09 09:39:12 +01:00
Jason Dellaluce
b225549679 test(unit_test): adapt and grow tests on configure_intertesting_sets
The test now take in accoint pre/post-conditions of the actions,
usage of the -A option, and the newly-introduced base_syscall
user configuration. This also makes sure that the event selection
properly handles generic events and options/configs precedence.

Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-03-09 09:39:12 +01:00
Jason Dellaluce
a7f521b4b8 chore(unit_tests): move existing test in right directory
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-03-09 09:39:12 +01:00
Jason Dellaluce
5ed5c63202 refactor: adapt event set configuration changes to new libs definition
Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-02-21 14:31:28 +01:00
Jason Dellaluce
4706cd8b4e cleanup: solve std namespace issues and remove unused imports
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-02-21 14:31:28 +01:00
Jason Dellaluce
34ea7a8245 cleanup(userspace/engine): drop filtr_evttype_resolver
Its logic was ported into libsinsp in:
3d8550e70e

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
2023-02-21 14:31:28 +01:00
Melissa Kilby
3b5633a3e5 cleanup(unit_tests): remove some rebase leftovers
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-02-21 14:31:28 +01:00
Melissa Kilby
72439b2eed cleanup(app_actions): adjust configure_interesting_sets
* address reviewers feedback
* improve clarity around new -A and -i behavior
* additional cleanup (e.g. use generic set operations only)
* extend unit tests

Note: sinsp ppm sc API is undergoing a refactor, therefore current lookups are interim
and will subsequently be refactored as well.

Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-02-21 14:31:28 +01:00
Melissa Kilby
f77f8667a1 cleanup(tests): add unit tests for configure_interesting_sets
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
2023-02-21 14:31:28 +01:00