github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2026-01-22 21:25:04 +00:00
Code Issues Projects Releases Wiki Activity
3,484 Commits 122 Branches 181 Tags
eaeec7c0793c4fdf6caec37d256746c75e6f43df
Commit Graph

217 Commits

Author SHA1 Message Date
Andrea Terzolo
059a28184d tests: fix rule paths 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2023-01-25 17:37:37 +01:00
Jason Dellaluce
4aeb3672e5 fix(test): update rules file reference 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2023-01-21 17:58:08 +01:00
Andrea Terzolo
e1ff4db67a update(ci): support modern bpf with musl build 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-12-21 11:26:02 +01:00
Jason Dellaluce
cb58ea9c57 test: add regression tests for ref loops in lists and macros 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-12-13 15:06:10 +01:00
dependabot[bot]
ec04b758e6 chore(deps): Bump certifi from 2020.4.5.1 to 2022.12.7 in /test 
Bumps [certifi](https://github.com/certifi/python-certifi) from 2020.4.5.1 to 2022.12.7.
- [Release notes](https://github.com/certifi/python-certifi/releases)
- [Commits](https://github.com/certifi/python-certifi/compare/2020.04.05.1...2022.12.07)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2022-12-12 11:01:44 +01:00
Jason Dellaluce
7d28637f44 fix(test): fix regresstion test 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-10-12 14:03:20 +02:00
Andrea Terzolo
fbac2a9570 tests: fix broken tests 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-10-05 19:38:21 +02:00
Federico Di Pierro
e68151eb07 chore(test,userspace/falco): fixed tests after libs bump. 
Moreover, try to create grpc socket folder path only if grpc is actually enabled.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-10-05 19:38:21 +02:00
Andrea Terzolo
aa0abb4288 tests: fix traces-positive/run-shell-untrusted.scap test 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Andrea Terzolo
a325086363 test(falco): fix broken tests 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-09-20 11:35:28 +02:00
Andrea Terzolo
1930ec56c7 test(plugin): bump plugin API in test 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-20 11:35:28 +02:00
Leonardo Grasso
c732e5d800 update: gRPC server sock defaults to /run/falco/falco.sock 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-09-14 10:27:24 +02:00
Jason Dellaluce
ce769b1fbe fix(test): adapt plugin tests to new error msgs and features 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-09-12 16:14:15 +02:00
Mark Stemm
103d7e08b8 Update tests for rules loading (item names) 
Update a few tests related to rules loading to use new names for
items (e.g. "rules content" for top level errors instead of "file")

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-09-07 10:13:02 +02:00
Jason Dellaluce
9646308651 update(test): use event source selection in plugins tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:47:18 +02:00
Jason Dellaluce
e15d9f6f51 update(test): use event source selection in k8s audit tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:47:18 +02:00
Jason Dellaluce
ce0dd918fb refactor(test): enable selecting event sources in regression test suite 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-26 12:47:18 +02:00
Leonardo Grasso
8e8491f280 update(test/output_files): add "hostname" to fixture 
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-08-25 16:59:15 +02:00
Andrea Terzolo
ff247f922d chore(test/utils): remove unused script 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-08-05 17:56:28 +02:00
Mark Stemm
a37e2252b2 Update tests to use result struct + json-based validation 
Update tests that validated rules files (typically looking for
errors/warnings) to use the new result struct + json based validation:

- When validating rules files, always use json output.

- In test cases, instead of parsing stderr/stdout, use new test
  properties "validate_ok", "validate_errors",
  "validate_warnings". These parse the json output and look for
  specific tuples of (error code, error message, item type, item name)
  in the output.

- There were a few tests that were actually validation tests but using
  the -r argument to load rules. Convert them to validation tests. In
  one case, split the test into two separate tests--one for
  validation, one ensuring that the rule doesn't match anything.

- There were a couple of tests that were duplicates of existing
  validation tests, just checking for the error in a different
  way. Remove them.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-08-04 14:49:23 +02:00
Jason Dellaluce
a531e8b3ed fix(test): use old event versions in trace tests 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
07fde46e7c fix(test): sync plugin tests to new plugin loader errors 
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-08-03 15:58:21 +02:00
Jason Dellaluce
effabf533d test(plugins): drop macro source warning test 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-06-28 11:33:08 +02:00
Jason Dellaluce
555bf9971c fix(test): update expected test result for docker-compose scap file 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Luca Guerra <luca@guerra.sh>
 2022-06-23 18:12:24 +02:00
Leonardo Grasso
c309107949 fix(test): correct "incompat_plugin_api" expectation 
See https://github.com/falcosecurity/libs/pull/389

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-06-23 18:12:24 +02:00
Luca Guerra
5dce4d2025 fix(tests): make tests run locally (take 2) 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-06-23 12:22:03 +02:00
Luca Guerra
9d7153e119 fix(tests): make run_regression_tests.sh work locally 
Signed-off-by: Luca Guerra <luca@guerra.sh>
 2022-06-13 09:38:44 +02:00
Andrea Terzolo
7068e9958f tests(k8s_audit_plugin): fix a k8s_audit_plugin test 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-06-07 16:07:53 +02:00
Federico Di Pierro
75712caa9a fix(test): dropped file:// from k8s audit log tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-26 12:37:26 +02:00
Andrea Terzolo
46159b8de9 update(userspace/engine): introduce new check_plugin_requirements API 
Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it>
 2022-05-24 15:55:17 +02:00
Federico Di Pierro
d9d8dedc32 update(test): fixed tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-05-21 16:33:38 +02:00
Jason Dellaluce
96e2864c16 test(falco_k8s_audit): fix k8s audit tests to used plugin ruleset 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-05-12 18:28:34 +02:00
Jason Dellaluce
69db6adf9d refactor(test): use SKIP_PLUGINS_TESTS to skip k8s audit regression tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Jason Dellaluce
67d2fe45a5 refactor: add k8saudit plugin and adapt config, tests, and rulesets 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-29 20:47:19 +02:00
Federico Di Pierro
7aed3b6d01 fix(test): fixed wrong test expected output. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-04-29 10:16:50 +02:00
Federico Di Pierro
9ec05c7048 fix(test): dropped get_type() api from test_source/extract tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-04-29 10:16:50 +02:00
Mark Stemm
531bc3eb5a Falco test changes (small output matches) for actions 
With the split of falco_init into application:: methods, including a
notion of a success/error/proceed result, there is a
more concrete line between runtime errors (e.g. things that throw
exceptions) and errors returned by methods that run the application.

Some of the plugins tests were expecting errors to be returned by
exceptions (e.g. with a leading "Runtime error: and a trailing "
Exiting.").

Now, the errors are just returned directly in application::run(), so
drop the leading and trailing bits in expected test outputs.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-04-22 13:27:52 +02:00
Jason Dellaluce
391ab028fc refactor!: deprecate PSP regression tests 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-21 18:50:58 +02:00
Jason Dellaluce
c0f8171d89 test: adapt integration tests to new rule loader error messages 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-04-11 12:22:18 +02:00
Jason Dellaluce
c801c09e7d update(test): adapt integration test error messages to comply to new parser errors 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-23 18:31:43 +01:00
Jason Dellaluce
9607cbc2c7 update(build): temporarely bump cloudtrail and json plugin version to dev builds 
This is required due to the plugin API version being bumped to 1.0.0 in the framework after
the recent breaking changes. cloudtrail and json will be switched back to a stable build
once they get released to require the plugin API version with the newest major.

Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2022-03-18 23:20:01 +01:00
Mark Stemm
df219b5e1d New tests for rule + exception, macro with unknown source 
Add new test cases for a rule with an unknown source *and* an
exception, and a macro with an unknown source.

The first results in a rule warning (and no error), and the second
prints an error and skips.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-03-18 13:54:47 +01:00
Josh Soref
19a6cf74f8 spelling: successfully 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
35d0f0603f spelling: multitrailing 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Josh Soref
19ab9e5f35 spelling: expand 
Signed-off-by: Josh Soref <jsoref@users.noreply.github.com>
 2022-03-01 16:30:24 +01:00
Mark Stemm
83c527dd91 Use cmake function to copy files, as a single target 
Replace nearly-identical blocks of code that defined individual custom
targets/custom commands to copy files from source to build dir with
the copy_files_to_build_dir function.

This reduces the number of build targets and speeds up/cleans up the
make output.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
 2022-02-18 16:47:43 +01:00
Federico Di Pierro
ff21544186 update(build)!: replaced various PROBE with DRIVER where necessary. 
Follow-up of https://github.com/falcosecurity/libs/pull/197.
Updated libs too to master version, as needed.

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-02-08 09:50:39 +01:00
Leonardo Grasso
9ae8d281f5 fix(test): falco_hostnetwork_images list is now in k8s_audit_rules.yaml 
Co-Authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
 2022-01-24 15:03:12 +01:00
Federico Di Pierro
0c290d98f8 fix(tests): avoid hardcoding plugin version 0.1.0 in plugin tests. 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
 2022-01-17 17:20:33 +01:00
Jason Dellaluce
b5667cab99 chore(test): remove unused files in test directory 
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
 2021-12-09 10:36:45 +01:00