mirror of
https://github.com/falcosecurity/falco.git
synced 2026-04-05 11:32:17 +00:00
With the changes in https://github.com/falcosecurity/libs/pull/74, there isn't any need to warn about the order of operators and the evt.type field--the set of event types for a filter should be exact now regardless of the order of operators. So update tests that were logging those warnings to note that the warnings won't occur any more. Also, some tests more accurately *do* note that they have an overly permissive evttype (e.g. ones related to syscalls, which are uncommon and are evaluated for all event types) to reflect the new behavior. Finally, in unit tests create an actual sinsp filter instead of a gen_event_filter, which is the base class and shouldn't be created directly. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Falco unit tests
This folder contains the unit-tests suite for Falco. The framework we use for unit-tests is Catch2, while the one we use for mocking is FakeIt.
How to write tests
When you want to test a new file or test a non tested file, remember four steps:
- The folder structure here is the same as the one in the
userspacefolder, souserspace/enginebecomestests/engine. - We call test files with this format
test_<original-file-name>.cpp - Update the
CMakeLists.txtfile to include your file inFALCO_TESTS_SOURCESand change theFALCO_TESTED_LIBRARIESaccordingly. You might also need to add dependencies, in that case, look attarget_link_librariesandtarget_include_directories - If you are unsure on how to write tests, refer to our existing tests in this folder and to the Catch2 documentation.
How to execute tests
The suite can be configured with cmake and run with make.
In the root folder of Falco, after creating the build directory:
cd falco
mkdir build
cd build
You can prepare the tests with:
cmake ..
Optionally, you can customize the test suite by passing custom arguments like the examples below:
filter all tests containing the word ctor
cmake -DFALCO_TESTS_ARGUMENTS:STRING="-R ctor" ..
verbose execution
cmake -DFALCO_TESTS_ARGUMENTS:STRING="-V" ..
To see a list of all the custom arguments you may pass, execute ctest --help in your terminal.
Once you are ready, you can run your configuration with:
make tests