static void test_patterndb_loads_a_syntactically_complete_xml_properly(void) { _load_pattern_db_from_string(pdb_complete_syntax); /* check we did indeed load the patterns */ assert_msg_matches_and_has_tag("simple-message", ".classifier.system", TRUE); _destroy_pattern_db(); }
void test_patterndb_tags_outside_of_rule() { patterndb = pattern_db_new(); messages = NULL; g_file_open_tmp("patterndbXXXXXX.xml", &filename, NULL); g_file_set_contents(filename, tag_outside_of_rule_skeleton, strlen(tag_outside_of_rule_skeleton), NULL); assert_false(pattern_db_reload_ruleset(patterndb, configuration, filename), "successfully loaded an invalid patterndb file"); _destroy_pattern_db(); }
void test_patterndb_message_property_inheritance_disabled() { _load_pattern_db_from_string(pdb_inheritance_disabled_skeleton); assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "MESSAGE", NULL); assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag1", FALSE); assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "basetag2", FALSE); assert_msg_matches_and_output_message_has_tag("pattern-with-inheritance-disabled", 1, "actiontag", TRUE); assert_msg_matches_and_output_message_nvpair_equals("pattern-with-inheritance-disabled", 1, "actionkey", "actionvalue"); _destroy_pattern_db(); }
void test_patterndb_message_property_inheritance_context(void) { _load_pattern_db_from_string(pdb_inheritance_context_skeleton); _feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged1", "merged1"); _feed_message_to_correllation_state("prog2", "pattern-with-inheritance-context", "merged2", "merged2"); _advance_time(60); assert_output_message_nvpair_equals(2, "MESSAGE", "action message"); assert_output_message_nvpair_equals(2, "merged1", "merged1"); assert_output_message_nvpair_equals(2, "merged2", "merged2"); assert_output_message_has_tag(2, "actiontag", TRUE); _destroy_pattern_db(); }
void test_parser(gchar **test) { GString *str; gint index = 1; str = g_string_new(pdb_parser_skeleton_prefix); g_string_append(str, test[0]); g_string_append(str, pdb_parser_skeleton_postfix); _load_pattern_db_from_string(str->str); g_string_free(str, TRUE); while(test[index] != NULL) test_pattern(test[index++], test[0], TRUE); index++; while(test[index] != NULL) test_pattern(test[index++], test[0], FALSE); _destroy_pattern_db(); }
static void test_patterndb_rule(void) { _load_pattern_db_from_string(pdb_ruletest_skeleton); test_simple_rule_without_context_or_actions(); test_correllation_rule_without_actions(); test_correllation_rule_with_action_on_match(); test_correllation_rule_with_action_on_timeout(); test_correllation_rule_with_action_condition(); test_correllation_rule_with_rate_limited_action(); test_simple_rule_with_action_on_match(); test_simple_rule_with_action_condition(); test_simple_rule_with_rate_limited_action(); test_correllation_rule_with_create_context(); assert_msg_doesnot_match("non-matching-pattern"); _destroy_pattern_db(); }