From df072dace79ae1df0c863763d0579f2ef3244c59 Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Fri, 6 Sep 2024 16:41:58 +0000 Subject: [PATCH] update(libsinsp/tests): add CLI options test for append output Signed-off-by: Luca Guerra --- .../test_configuration_output_options.cpp | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/unit_tests/falco/test_configuration_output_options.cpp b/unit_tests/falco/test_configuration_output_options.cpp index 6f956f71cbf..1d10decc173 100644 --- a/unit_tests/falco/test_configuration_output_options.cpp +++ b/unit_tests/falco/test_configuration_output_options.cpp @@ -66,3 +66,38 @@ TEST(ConfigurationRuleOutputOptions, parse_yaml) EXPECT_EQ(falco_config.m_append_output[2].m_raw_fields.size(), 1); EXPECT_EQ(falco_config.m_append_output[2].m_raw_fields.count("ka.verb"), 1); } + +TEST(ConfigurationRuleOutputOptions, cli_options) +{ + falco_configuration falco_config; + + ASSERT_NO_THROW(falco_config.init_from_content("", + std::vector{ + R"(append_output[]={"source": "syscall", "tag": "persistence", "rule": "some rule name", "format": "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"})", + R"(append_output[]={"tag": "persistence", "fields": [{"proc.aname[2]": "%proc.aname[2]"}, {"proc.aname[3]": "%proc.aname[3]"}, {"proc.aname[4]": "%proc.aname[4]"}], "format": "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"})", + R"(append_output[]={"source": "k8s_audit", "fields": ["ka.verb", {"static_field": "static content"}]})"})); + + EXPECT_EQ(falco_config.m_append_output.size(), 3); + + EXPECT_EQ(falco_config.m_append_output[0].m_source, "syscall"); + EXPECT_EQ(falco_config.m_append_output[0].m_tag, "persistence"); + EXPECT_EQ(falco_config.m_append_output[0].m_rule, "some rule name"); + EXPECT_EQ(falco_config.m_append_output[0].m_formatted_fields.size(), 0); + EXPECT_EQ(falco_config.m_append_output[0].m_format, "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"); + + EXPECT_EQ(falco_config.m_append_output[1].m_tag, "persistence"); + EXPECT_EQ(falco_config.m_append_output[1].m_format, "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"); + + EXPECT_EQ(falco_config.m_append_output[1].m_formatted_fields.size(), 3); + EXPECT_EQ(falco_config.m_append_output[1].m_formatted_fields["proc.aname[2]"], "%proc.aname[2]"); + EXPECT_EQ(falco_config.m_append_output[1].m_formatted_fields["proc.aname[3]"], "%proc.aname[3]"); + EXPECT_EQ(falco_config.m_append_output[1].m_formatted_fields["proc.aname[4]"], "%proc.aname[4]"); + + EXPECT_EQ(falco_config.m_append_output[2].m_source, "k8s_audit"); + + EXPECT_EQ(falco_config.m_append_output[2].m_formatted_fields.size(), 1); + EXPECT_EQ(falco_config.m_append_output[2].m_formatted_fields["static_field"], "static content"); + + EXPECT_EQ(falco_config.m_append_output[2].m_raw_fields.size(), 1); + EXPECT_EQ(falco_config.m_append_output[2].m_raw_fields.count("ka.verb"), 1); +}