Example #1
0
static void
test_patterndb_loads_a_syntactically_complete_xml_properly(void)
{
  _load_pattern_db_from_string(pdb_complete_syntax);
  /* check we did indeed load the patterns */
  assert_msg_matches_and_has_tag("simple-message", ".classifier.system", TRUE);
  _destroy_pattern_db();
}
Example #2
0
void
test_patterndb_tags_outside_of_rule()
{
  patterndb = pattern_db_new();
  messages = NULL;

  g_file_open_tmp("patterndbXXXXXX.xml", &filename, NULL);
  g_file_set_contents(filename, tag_outside_of_rule_skeleton,
                      strlen(tag_outside_of_rule_skeleton), NULL);

  assert_false(pattern_db_reload_ruleset(patterndb, configuration, filename), "successfully loaded an invalid patterndb file");
  _destroy_pattern_db();
}
Example #3
0
void
test_patterndb_message_property_inheritance_disabled()
{
  _load_pattern_db_from_string(pdb_inheritance_disabled_skeleton);

  assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "MESSAGE", NULL);
  assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag1", FALSE);
  assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag2", FALSE);
  assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "actiontag", TRUE);
  assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "actionkey", "actionvalue");

  _destroy_pattern_db();
}
Example #4
0
void
test_patterndb_message_property_inheritance_context(void)
{
  _load_pattern_db_from_string(pdb_inheritance_context_skeleton);

  _feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged1", "merged1");
  _feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged2", "merged2");
  _advance_time(60);

  assert_output_message_nvpair_equals(2, "MESSAGE", "action message");
  assert_output_message_nvpair_equals(2, "merged1", "merged1");
  assert_output_message_nvpair_equals(2, "merged2", "merged2");
  assert_output_message_has_tag(2, "actiontag", TRUE);

  _destroy_pattern_db();
}
Example #5
0
void
test_parser(gchar **test)
{
  GString *str;
  gint index = 1;

  str = g_string_new(pdb_parser_skeleton_prefix);
  g_string_append(str, test[0]);
  g_string_append(str, pdb_parser_skeleton_postfix);

  _load_pattern_db_from_string(str->str);
  g_string_free(str, TRUE);
  while(test[index] != NULL)
    test_pattern(test[index++], test[0], TRUE);
  index++;
  while(test[index] != NULL)
    test_pattern(test[index++], test[0], FALSE);

  _destroy_pattern_db();
}
Example #6
0
static void
test_patterndb_rule(void)
{
  _load_pattern_db_from_string(pdb_ruletest_skeleton);

  test_simple_rule_without_context_or_actions();
  test_correllation_rule_without_actions();
  test_correllation_rule_with_action_on_match();
  test_correllation_rule_with_action_on_timeout();
  test_correllation_rule_with_action_condition();
  test_correllation_rule_with_rate_limited_action();

  test_simple_rule_with_action_on_match();
  test_simple_rule_with_action_condition();
  test_simple_rule_with_rate_limited_action();

  test_correllation_rule_with_create_context();

  assert_msg_doesnot_match("non-matching-pattern");
  _destroy_pattern_db();
}