Addl test for validation across files

Add new tests that ensure that validation across files and involving multiple macro/rule objects display the right context. When appending, both objects are displayed. When overwriting, the overwritten object is displayed. Signed-off-by: Mark Stemm <[email protected]>
falcosecurity · Jul 31, 2019 · 9b7c7ff · 9b7c7ff
1 parent 1f0065e
commit 9b7c7ff
Show file tree

Hide file tree

Showing 7 changed files with 100 additions and 0 deletions.
diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml
@@ -402,6 +402,81 @@ trace_files: !mux
       - rules/rule_append_failure.yaml
     trace_file: trace_files/cat_write.scap
 
+  invalid_overwrite_macro:
+    exit_status: 1
+    stdout_contains: |+
+      .*invalid_base_macro.yaml: Ok
+      .*invalid_overwrite_macro.yaml: Compilation error when compiling "foo": Undefined macro 'foo' used in filter.
+      ---
+      - macro: some macro
+        condition: foo
+        append: false
+      ---
+    validate_rules_file:
+      - rules/invalid_base_macro.yaml
+      - rules/invalid_overwrite_macro.yaml
+    trace_file: trace_files/cat_write.scap
+
+  invalid_append_macro:
+    exit_status: 1
+    stdout_contains: |+
+      .*invalid_base_macro.yaml: Ok
+      .*invalid_append_macro.yaml: Compilation error when compiling "evt.type=execve foo": 17: syntax error, unexpected 'foo', expecting 'or', 'and'
+      ---
+      - macro: some macro
+        condition: evt.type=execve
+
+      - macro: some macro
+        condition: foo
+        append: true
+      ---
+    validate_rules_file:
+      - rules/invalid_base_macro.yaml
+      - rules/invalid_append_macro.yaml
+    trace_file: trace_files/cat_write.scap
+
+  invalid_overwrite_rule:
+    exit_status: 1
+    stdout_contains: |+
+      .*invalid_base_rule.yaml: Ok
+      .*invalid_overwrite_rule.yaml: Undefined macro 'bar' used in filter.
+      ---
+      - rule: some rule
+        desc: some desc
+        condition: bar
+        output: some output
+        priority: INFO
+        append: false
+      ---
+    validate_rules_file:
+      - rules/invalid_base_rule.yaml
+      - rules/invalid_overwrite_rule.yaml
+    trace_file: trace_files/cat_write.scap
+
+  invalid_append_rule:
+    exit_status: 1
+    stdout_contains: |+
+      .*invalid_base_rule.yaml: Ok
+      .*invalid_append_rule.yaml: Compilation error when compiling "evt.type=open bar": 15: syntax error, unexpected 'bar', expecting 'or', 'and'
+      ---
+      - rule: some rule
+        desc: some desc
+        condition: evt.type=open
+        output: some output
+        priority: INFO
+
+      - rule: some rule
+        desc: some desc
+        condition: bar
+        output: some output
+        priority: INFO
+        append: true
+      ---
+    validate_rules_file:
+      - rules/invalid_base_rule.yaml
+      - rules/invalid_append_rule.yaml
+    trace_file: trace_files/cat_write.scap
+
   invalid_missing_rule_name:
     exit_status: 1
     stdout_is: |+

diff --git a/test/rules/invalid_append_macro.yaml b/test/rules/invalid_append_macro.yaml
@@ -0,0 +1,3 @@
+- macro: some macro
+  condition: foo
+  append: true
diff --git a/test/rules/invalid_append_rule.yaml b/test/rules/invalid_append_rule.yaml
@@ -0,0 +1,6 @@
+- rule: some rule
+  desc: some desc
+  condition: bar
+  output: some output
+  priority: INFO
+  append: true
diff --git a/test/rules/invalid_base_macro.yaml b/test/rules/invalid_base_macro.yaml
@@ -0,0 +1,2 @@
+- macro: some macro
+  condition: evt.type=execve
diff --git a/test/rules/invalid_base_rule.yaml b/test/rules/invalid_base_rule.yaml
@@ -0,0 +1,5 @@
+- rule: some rule
+  desc: some desc
+  condition: evt.type=open
+  output: some output
+  priority: INFO
diff --git a/test/rules/invalid_overwrite_macro.yaml b/test/rules/invalid_overwrite_macro.yaml
@@ -0,0 +1,3 @@
+- macro: some macro
+  condition: foo
+  append: false
diff --git a/test/rules/invalid_overwrite_rule.yaml b/test/rules/invalid_overwrite_rule.yaml
@@ -0,0 +1,6 @@
+- rule: some rule
+  desc: some desc
+  condition: bar
+  output: some output
+  priority: INFO
+  append: false
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		- macro: some macro
		condition: evt.type=execve