#
# Copyright (C) 2016-2020 The Falco Authors..
#
# This file is part of falco.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

trace_files: !mux

  rule_exception_no_fields:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item ex1: must have fields property with a list of fields
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_no_fields.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_no_name:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item must have name property
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - fields: [proc.name, fd.filename]
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_no_name.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_no_name:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item must have name property
      ---
      - rule: My Rule
        exceptions:
          - values:
              - [nginx, /tmp/foo]
        append: true
      ---
    validate_rules_file:
      - rules/exceptions/append_item_no_name.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_unknown_fields:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item ex1: field name not.exist is not a supported filter field
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
            fields: [not.exist]
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_unknown_fields.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_comps_fields_len_mismatch:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item ex1: fields and comps lists must have equal length
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
            fields: [proc.name, fd.filename]
            comps: [=]
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_comps_fields_len_mismatch.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_unknown_comp:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception item ex1: comparison operator no-comp is not a supported comparison operator
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
            fields: [proc.name, fd.filename]
            comps: [=, no-comp]
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_unknown_comp.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_fields_values_len_mismatch:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Exception item ex1: fields and values lists must have equal length
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
            fields: [proc.name, fd.filename]
            values:
              - [nginx]
        priority: error
      ---
    validate_rules_file:
      - rules/exceptions/item_fields_values_len_mismatch.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_fields_values_len_mismatch:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Exception item ex1: fields and values lists must have equal length
      ---
      - rule: My Rule
        desc: Some desc
        condition: evt.type=open and proc.name=cat
        output: Some output
        exceptions:
          - name: ex1
            fields: [proc.name, fd.filename]
        priority: error

      - rule: My Rule
        exceptions:
          - name: ex1
            values:
              - [nginx]
        append: true
      ---
    validate_rules_file:
      - rules/exceptions/append_item_fields_values_len_mismatch.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_item_not_in_rule:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception new item ex2: must have fields property with a list of fields
      ---
      - rule: My Rule
        exceptions:
          - name: ex2
            values:
              - [apache, /tmp]
        append: true
      ---
    validate_rules_file:
      - rules/exceptions/append_item_not_in_rule.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_no_values:
    detect: True
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_no_values.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_one_value:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_one_value.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_one_value:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_one_value.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_second_value:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_second_value.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_second_value:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_second_value.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_second_item:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_second_item.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_second_item:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_second_item.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_third_item:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_third_item.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_third_item:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_third_item.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_quoted:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_quoted.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_multiple_values:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_multiple.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_comp:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_comp.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_append_comp:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_append_comp.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_values_listref:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_values_listref.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_values_listref_noparens:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_values_listref_noparens.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_values_list:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_values_list.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_single_field:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_single_field.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_single_field_append:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_single_field_append.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_new_single_field_append:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_new_single_field_append.yaml
    trace_file: trace_files/cat_write.scap
  
  rule_exception_new_second_field_append:
    detect: False
    detect_level: WARNING
    rules_file:
      - rules/exceptions/rule_exception_new_second_field_append.yaml
    trace_file: trace_files/cat_write.scap

  rule_exception_new_append_no_field:
    exit_status: 1
    stdout_is: |+
      1 errors:
      Rule exception new item proc_cmdline: must have fields property with a list of fields
      ---
      - rule: Open From Cat
        exceptions:
          - name: proc_cmdline
            comps: in
            values:
              - "cat /dev/null"
        append: true
      ---
    validate_rules_file:
      - rules/exceptions/rule_exception_new_no_field_append.yaml
    trace_file: trace_files/cat_write.scap