45 lines
1.2 KiB
Go
45 lines
1.2 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package events
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestRuleSetMatchesCompatibilityJSON(t *testing.T) {
|
|
rules := NewRuleSet(DefaultExecRuleEngine())
|
|
tests := []struct {
|
|
raw string
|
|
sid int
|
|
}{
|
|
{`{"type":"execve","pid":"42","ppid":"1","uid":"1000","parent_comm":"nginx","filename":"/bin/sh","argv":["-c","id"]}`, 100003},
|
|
{`{"type":"sys","pid":"43","comm":"loader","syscall":"mprotect","args":["0x1000","0x1000",0],"arg2":"0x6"}`, 100060},
|
|
{`{"type":"listen","pid":"44","comm":"python3","listen_ip":"0.0.0.0","listen_port":"4444"}`, 100068},
|
|
}
|
|
for _, test := range tests {
|
|
alerts, err := rules.MatchJSON([]byte(test.raw))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
found := false
|
|
for _, alert := range alerts {
|
|
if alert.SID == test.sid {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatalf("sid %d did not match %s: %#v", test.sid, test.raw, alerts)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestScanJSONLReportsLine(t *testing.T) {
|
|
err := ScanJSONL(strings.NewReader("\n{}\n"), func(raw []byte) error {
|
|
_, err := NewRuleSet(DefaultExecRuleEngine()).MatchJSON(raw)
|
|
return err
|
|
})
|
|
if err == nil || !strings.Contains(err.Error(), "line 2") {
|
|
t.Fatalf("missing line context: %v", err)
|
|
}
|
|
}
|