static void
test_simple_rule_with_rate_limited_action(void)
{
/* tag assigned based on "class" */
assert_msg_matches_and_has_tag("simple-message-with-rate-limited-action", ".classifier.violation", TRUE);
/* messages in the output:
* [0] trigger
* [1] GENERATED (as rate limit was met)
* [2] trigger
* [3] trigger
* [4] trigger
* [5] GENERATED (as rate limit was met again due to advance time */
assert_msg_matches_and_output_message_nvpair_equals("simple-message-with-rate-limited-action", 1, "MESSAGE",
"generated-message-rate-limit");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_no_such_output_message("simple-message-with-rate-limited-action", 3);
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_no_such_output_message("simple-message-with-rate-limited-action", 4);
_dont_reset_patterndb_state_for_the_next_call();
_advance_time(120);
assert_msg_matches_and_output_message_nvpair_equals("simple-message-with-rate-limited-action", 5, "MESSAGE",
"generated-message-rate-limit");
}
static void
test_correllation_rule_without_actions(void)
{
/* tag assigned based on "class" */
assert_msg_matches_and_has_tag("correllated-message-based-on-pid", ".classifier.system", TRUE);
assert_msg_matches_and_nvpair_equals("correllated-message-based-on-pid", "correllated-msg-context-id", MYPID);
assert_msg_matches_and_nvpair_equals("correllated-message-based-on-pid", "correllated-msg-context-length", "1");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-based-on-pid", "correllated-msg-context-length", "2");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-based-on-pid", "correllated-msg-context-length", "3");
}
static void
test_correllation_rule_with_create_context(void)
{
assert_msg_matches_and_nvpair_equals("simple-message-with-action-to-create-context", ".classifier.rule_id", "12");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-that-uses-context-created-by-rule-id#12", "triggering-message", "context message assd");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-that-uses-context-created-by-rule-id#12", "PROGRAM", "prog1");
assert_msg_matches_and_nvpair_equals("correllated-message-with-action-to-create-context", ".classifier.rule_id", "14");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-that-uses-context-created-by-rule-id#14", "triggering-message", "context message 1001 assd");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-that-uses-context-created-by-rule-id#14", "PROGRAM", "prog1");
_dont_reset_patterndb_state_for_the_next_call();
assert_msg_matches_and_nvpair_equals("correllated-message-that-uses-context-created-by-rule-id#14", "triggering-message-context-id", "1001");
}
static void
_feed_message_to_correllation_state(const gchar *program, const gchar *message, const gchar *name, const gchar *value)
{
LogMessage *msg;
gboolean result;
msg = _construct_message_with_nvpair(program, message, name, value);
result = _process(msg);
log_msg_unref(msg);
assert_true(result, "patterndb expected to match but it didn't");
_dont_reset_patterndb_state_for_the_next_call();
}
