github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-10-21 11:29:26 +00:00
Code Issues Projects Releases Wiki Activity
2,751 Commits 123 Branches 176 Tags
55ec8c0e1b3af424f49341474b44842554416173
Commit Graph

179 Commits

Author SHA1 Message Date
Mark Stemm
b4eb5b87b6 Automated tests for exceptions 
Handle various positive and negative cases. Should handle every error
and warning path when reading exceptions objects or rule exception
fields, and various positive cases of using exceptions to prevent
alerts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-19 10:37:55 +01:00
Mark Stemm
3fb1d207e2 Update tests expected outputs 
The format of error responses has changed to include a summary of errors
and/or warnings. This changed many test cases that were looking for
specific outputs.

Update to add counts and other minor formatting changes.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2021-01-19 10:37:55 +01:00
Lorenzo Fontana
f5c1e7c165 build: fix build directory for xunit tests 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-11-05 11:49:40 -05:00
Lorenzo Fontana
aaf6816821 build: make our integration tests report clear steps for circleCI UI 
inspection via collect test data [0]

[0] https://circleci.com/docs/2.0/collect-test-data/

Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-11-05 11:49:40 -05:00
Leonardo Grasso
d07f18ad05 update(test): use to iso time 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
4af705c15d fix(test): correct parent dir creation for strict tests 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-13 05:12:00 -04:00
Leonardo Grasso
f567f2f7f7 chore(test): update copyright year 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
ab615c36ad update(test): check all fields for gRPC output 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
60c322a73d new(test): strict json output 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
f12210325f chore(test): correct file name 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
682e53f5b5 update(test): strict output tests 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
6e8352e847 chore(test): cleanup tmp file 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
c512784503 new(test): stdout output strict 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Leonardo Grasso
b0942f8774 new(test): add "output_strictly_contains" option 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-10-12 06:00:54 -04:00
Lorenzo Fontana
7e9ca5c540 build: run_regression_tests.sh skip packages tests if asked 
Co-Authored-By: Leonardo Grasso <me@leonardograsso.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-09-10 15:01:07 +02:00
Mark Stemm
f32bb84851 Start versioning trace files 
Start versioning trace files with a unique date. Any time we need to
create new trace files, change TRACE_FILES_VERSION in this script and
copy to traces-{positive,negative,info}-<VERSION>.zip.

The zip file should unzip to traces-{positive,negative,info}, without
any version.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-09-03 18:56:51 +02:00
Chuck Schweizer
d678be5579 Adding user.loginuid to the default falco rules in any place user.name exists 
This update will provide information as to which process uid intitiated the event.  This is really important for processes that are started
by a different user name.

Signed-off-by: Chuck Schweizer <chuck.schweizer.lvk2@statefarm.com>
 2020-08-28 10:02:19 +02:00
Leonardo Grasso
e0b66ecae9 revert: "build: temporary remove falco_traces.yaml from integration test suite" 
This reverts commit 7a2708de09.

Co-Authored-By: Lorenzo Fontana <fontanalorenz@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-08-24 20:32:24 +02:00
Lorenzo Fontana
7a2708de09 build: temporary remove falco_traces.yaml from integration test suite 
This happens because the file descriptors paths have been fixed
in this commit [0].
However, the scap files fixtures we have for the tests still contain
the old paths causing this problem.

We are commenting out those tests and opening an issue to get this fixed
later.

[0] 37aab8debf

Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>
 2020-08-20 19:26:56 +02:00
Leo Di Donato
23224355a5 docs(test): integration tests intended to be run against a release build of Falco 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>

Co-authored-by: Leonardo Grasso <me@leonardograsso.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
3814b2e81b docs(test): run all the test suites at once 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
a83b91fc53 new(test): run_regression_tests.sh -h 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
d8faa95702 fix(test): run_regression_tests.sh must generate falco_traces test suite in a non-interactive way 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
ef5e71598a docs(test): instruction to run falco_tests_package integration test suite locally 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
bb1282c7be update(test): make run_regression_tests.sh script accept different 
options

The following options have been added:
* -v (verbose)
* -p (prepare falco_traces test suite)
* -b (specify custom branch for downloading trace files)
* -d (specify the build directory)

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
8f07189ede docs(test): instructions for executing falco_traces integration test suite 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
dec2ff7d72 docs(test): prepare the local environment for running integration test suites 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
f3022e0abf build(test): target test-traces files 
This make target calls the `trace-files-psp`, `trace-files-k8s-audit`,
`trace-files-base-scap` targets to place all the integration test
fixtures in the proper position.

Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
9b42b20e1c build(test/trace_files): target trace-files-base-scap 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
850a49989f build(test/trace_files/psp): target trace-files-psp 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Leonardo Di Donato
0dc2a6abd3 build(test/traces_file/k8s_audit): target trace-files-k8s-audit 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-07-20 22:48:00 +02:00
Lorenzo Fontana
324a3b88e7 build: remove libyaml-0-2 as dependency in packages and dockerfiles 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-16 19:34:39 +02:00
Lorenzo Fontana
352307431a fix: update k8s audit endpoint to /k8s-audit everywhere 
Co-Authored-By: Leonardo Di Donato <leodidonato@gmail.com>
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-07-01 13:29:51 +02:00
Leonardo Grasso
6cfb0ec2b8 update(test): setup bidi gRPC integration test 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-30 13:04:03 +02:00
Leonardo Grasso
4af769f84c new(test): add gRPC unix socket support 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
b4d005eb51 new(test): read grpc config fields 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
061c5f5ac9 new(test): setup gRPC output test case 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-06-30 13:04:03 +02:00
Leonardo Di Donato
3bfd94fefd docs(test): run locally handling python deps with venv 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-26 15:01:48 +02:00
Leonardo Di Donato
6eb9b1add1 build(test): requirements.txt 
Co-authored-by: Lorenzo Fontana <lo@linux.com>
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-05-26 15:01:48 +02:00
Leonardo Grasso
46483339a3 fix(test): correct kernel module name 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-18 14:08:25 +02:00
Leonardo Grasso
622a6c1e44 fix(test/driver-loader): source script to get env vars populated 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:19:31 +02:00
Leonardo Grasso
95e7242d13 test: add driver-loader integration tests 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-15 11:19:31 +02:00
Leonardo Grasso
05c684d68c test: add bin package (tar.gz) to integration test 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2020-05-12 19:22:49 +02:00
Mark Stemm
357da40fc4 Only use metadata in k8s audit event for secrets 
Instead of using the request object to identify service account tokens,
exclude any secrets activity by system users (e.g. users starting with
"system:"). This allows the rules to work on k8s audit events at
Metadata level instead of RequestResponse level.

Also change the example objects for automated tests to ones collected at
Metadata level.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-04-22 21:00:38 +02:00
Mark Stemm
9af7c7fd59 Tests for creating/deleting secrets rules 
Add test to verify new rules for creating/deleting secrets. New trace
files for creating a secret/deleting a secret, and test cases that
verify that the rules trigger. Two additional test cases/traces file
tracks creating a service account token secret/kube-system secret and
ensures that the rules do *not* trigger.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2020-04-22 21:00:38 +02:00
Leonardo Di Donato
09b87b9a3d fix(test): use .falco dir 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Lorenzo Fontana
a9658d446f fix(test): urrlib from python 2 to 3 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-23 18:50:06 +01:00
Leonardo Di Donato
c1d840d471 update(test): account only for falco version in tests, not driver version 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
 2020-03-23 18:50:06 +01:00
Lorenzo Fontana
9db36822e7 update(docker/tester): python 3 support for regression tests 
Signed-off-by: Lorenzo Fontana <lo@linux.com>
 2020-03-17 21:24:31 +01:00
Hiroki Suezawa
3067af566e rule(Change thread namespace): fix regression test 
Signed-off-by: Hiroki Suezawa <suezawa@gmail.com>
 2020-03-12 16:35:46 +01:00