static void
test_patterndb_loads_a_syntactically_complete_xml_properly(void)
{
_load_pattern_db_from_string(pdb_complete_syntax);
/* check we did indeed load the patterns */
assert_msg_matches_and_has_tag("simple-message", ".classifier.system", TRUE);
_destroy_pattern_db();
}
void
test_patterndb_tags_outside_of_rule()
{
patterndb = pattern_db_new();
messages = NULL;
g_file_open_tmp("patterndbXXXXXX.xml", &filename, NULL);
g_file_set_contents(filename, tag_outside_of_rule_skeleton,
strlen(tag_outside_of_rule_skeleton), NULL);
assert_false(pattern_db_reload_ruleset(patterndb, configuration, filename), "successfully loaded an invalid patterndb file");
_destroy_pattern_db();
}
void
test_patterndb_message_property_inheritance_disabled()
{
_load_pattern_db_from_string(pdb_inheritance_disabled_skeleton);
assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "MESSAGE", NULL);
assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag1", FALSE);
assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag2", FALSE);
assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "actiontag", TRUE);
assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "actionkey", "actionvalue");
_destroy_pattern_db();
}
void
test_patterndb_message_property_inheritance_context(void)
{
_load_pattern_db_from_string(pdb_inheritance_context_skeleton);
_feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged1", "merged1");
_feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged2", "merged2");
_advance_time(60);
assert_output_message_nvpair_equals(2, "MESSAGE", "action message");
assert_output_message_nvpair_equals(2, "merged1", "merged1");
assert_output_message_nvpair_equals(2, "merged2", "merged2");
assert_output_message_has_tag(2, "actiontag", TRUE);
_destroy_pattern_db();
}
void
test_parser(gchar **test)
{
GString *str;
gint index = 1;
str = g_string_new(pdb_parser_skeleton_prefix);
g_string_append(str, test[0]);
g_string_append(str, pdb_parser_skeleton_postfix);
_load_pattern_db_from_string(str->str);
g_string_free(str, TRUE);
while(test[index] != NULL)
test_pattern(test[index++], test[0], TRUE);
index++;
while(test[index] != NULL)
test_pattern(test[index++], test[0], FALSE);
_destroy_pattern_db();
}
static void
test_patterndb_rule(void)
{
_load_pattern_db_from_string(pdb_ruletest_skeleton);
test_simple_rule_without_context_or_actions();
test_correllation_rule_without_actions();
test_correllation_rule_with_action_on_match();
test_correllation_rule_with_action_on_timeout();
test_correllation_rule_with_action_condition();
test_correllation_rule_with_rate_limited_action();
test_simple_rule_with_action_on_match();
test_simple_rule_with_action_condition();
test_simple_rule_with_rate_limited_action();
test_correllation_rule_with_create_context();
assert_msg_doesnot_match("non-matching-pattern");
_destroy_pattern_db();
}