2 Commits

Author	SHA1	Message	Date
Mark Stemm	df219b5e1d	New tests for rule + exception, macro with unknown source ... Add new test cases for a rule with an unknown source *and* an exception, and a macro with an unknown source. The first results in a rule warning (and no error), and the second prints an error and skips. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2022-03-18 13:54:47 +01:00
Mark Stemm	2a4e4d555d	Add automated tests for plugins ... Test infrastructure and sample confs/rules/traces for plugins automated tests: New test cases are in falco_tests_plugins.yaml and cover: - Listing plugins and fields when plugins are loaded. - Basic cloudtrail + json plugin on a fake cloudtrail json file and a sample rule that uses both plugins. - Conflicts between source/extractor plugins - Incompatible plugin api - Wrong plugin path - Checking for warnings when reading rules with unnown sources (e.g. when plugins are not loaded) Some test-only plugins written in C are in test/plugins and built on the fly. (They aren't included in packages of course). The test framework needed some small changes to handle these tests: - Add a mode to not check detection counts at all (for --list/--list-plugins) - addl_cmdline_opts to allow specifying --list/--list-plugins - Using DOTALL when matching stderr/stdout (allows multi-line matches more easily) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>	2021-11-12 18:27:59 +01:00