mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
044a7c153e
Modify rulesets to not keep track of the event types for a given set filter. Instead, using the changes in https://github.com/falcosecurity/libs/pull/74 event types are returned directly by the filter. Within each ruleset, there's a vector that maps from event number to set of filters that are related to that event number. There's also a general set of filters for all event types. run() both indexes into the per-event vector as well as iterate over the all event types set. Also, used shared_ptr instead of direct pointers, which matches the updated interface used by lua_parser. This simplifies the bookkeeping a bit (no more delete when removing rulesets). Given these changes, there's no need for a separate falco_sinsp_ruleset class any longer, so remove it. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Falco unit tests
This folder contains the unit-tests suite for Falco. The framework we use for unit-tests is Catch2, while the one we use for mocking is FakeIt.
How to write tests
When you want to test a new file or test a non tested file, remember four steps:
- The folder structure here is the same as the one in the
userspacefolder, souserspace/enginebecomestests/engine. - We call test files with this format
test_<original-file-name>.cpp - Update the
CMakeLists.txtfile to include your file inFALCO_TESTS_SOURCESand change theFALCO_TESTED_LIBRARIESaccordingly. You might also need to add dependencies, in that case, look attarget_link_librariesandtarget_include_directories - If you are unsure on how to write tests, refer to our existing tests in this folder and to the Catch2 documentation.
How to execute tests
The suite can be configured with cmake and run with make.
In the root folder of Falco, after creating the build directory:
cd falco
mkdir build
cd build
You can prepare the tests with:
cmake ..
Optionally, you can customize the test suite by passing custom arguments like the examples below:
filter all tests containing the word ctor
cmake -DFALCO_TESTS_ARGUMENTS:STRING="-R ctor" ..
verbose execution
cmake -DFALCO_TESTS_ARGUMENTS:STRING="-V" ..
To see a list of all the custom arguments you may pass, execute ctest --help in your terminal.
Once you are ready, you can run your configuration with:
make tests