-
Notifications
You must be signed in to change notification settings - Fork 876
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #83 from draios/add-correctness-tests
Add correctness tests
- Loading branch information
Showing
10 changed files
with
319 additions
and
87 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,9 @@ | ||
/build* | ||
*~ | ||
test/falco_test.pyc | ||
test/falco_tests.yaml | ||
test/traces-negative | ||
test/traces-positive | ||
|
||
userspace/falco/lua/re.lua | ||
userspace/falco/lua/lpeg.so |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,63 @@ | ||
#!/usr/bin/env python | ||
|
||
import os | ||
import re | ||
|
||
from avocado import Test | ||
from avocado.utils import process | ||
from avocado.utils import linux_modules | ||
|
||
class FalcoTest(Test): | ||
|
||
def setUp(self): | ||
""" | ||
Load the sysdig kernel module if not already loaded. | ||
""" | ||
self.falcodir = self.params.get('falcodir', '/', default=os.path.join(self.basedir, '../build')) | ||
|
||
self.should_detect = self.params.get('detect', '*') | ||
self.trace_file = self.params.get('trace_file', '*') | ||
|
||
# Doing this in 2 steps instead of simply using | ||
# module_is_loaded to avoid logging lsmod output to the log. | ||
lsmod_output = process.system_output("lsmod", verbose=False) | ||
|
||
if linux_modules.parse_lsmod_for_module(lsmod_output, 'sysdig_probe') == {}: | ||
self.log.debug("Loading sysdig kernel module") | ||
process.run('sudo insmod {}/driver/sysdig-probe.ko'.format(self.falcodir)) | ||
|
||
self.str_variant = self.trace_file | ||
|
||
def test(self): | ||
self.log.info("Trace file %s", self.trace_file) | ||
|
||
# Run the provided trace file though falco | ||
cmd = '{}/userspace/falco/falco -r {}/../rules/falco_rules.yaml -c {}/../falco.yaml -e {}'.format( | ||
self.falcodir, self.falcodir, self.falcodir, self.trace_file) | ||
|
||
self.falco_proc = process.SubProcess(cmd) | ||
|
||
res = self.falco_proc.run(timeout=60, sig=9) | ||
|
||
if res.exit_status != 0: | ||
self.error("Falco command \"{}\" exited with non-zero return value {}".format( | ||
cmd, res.exit_status)) | ||
|
||
# Get the number of events detected. | ||
res = re.search('Events detected: (\d+)', res.stdout) | ||
if res is None: | ||
self.fail("Could not find a line 'Events detected: <count>' in falco output") | ||
|
||
events_detected = int(res.group(1)) | ||
|
||
if not self.should_detect and events_detected > 0: | ||
self.fail("Detected {} events when should have detected none".format(events_detected)) | ||
|
||
if self.should_detect and events_detected == 0: | ||
self.fail("Detected {} events when should have detected > 0".format(events_detected)) | ||
|
||
pass | ||
|
||
|
||
if __name__ == "__main__": | ||
main() |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,62 @@ | ||
#!/bin/bash | ||
|
||
SCRIPT=$(readlink -f $0) | ||
SCRIPTDIR=$(dirname $SCRIPT) | ||
MULT_FILE=$SCRIPTDIR/falco_tests.yaml | ||
|
||
function download_trace_files() { | ||
for TRACE in traces-positive traces-negative ; do | ||
curl -so $SCRIPTDIR/$TRACE.zip https://s3.amazonaws.com/download.draios.com/falco-tests/$TRACE.zip && | ||
unzip -d $SCRIPTDIR $SCRIPTDIR/$TRACE.zip && | ||
rm -rf $SCRIPTDIR/$TRACE.zip | ||
done | ||
} | ||
|
||
function prepare_multiplex_file() { | ||
echo "trace_files: !mux" > $MULT_FILE | ||
|
||
for trace in $SCRIPTDIR/traces-positive/*.scap ; do | ||
[ -e "$trace" ] || continue | ||
NAME=`basename $trace .scap` | ||
cat << EOF >> $MULT_FILE | ||
$NAME: | ||
detect: True | ||
trace_file: $trace | ||
EOF | ||
done | ||
|
||
for trace in $SCRIPTDIR/traces-negative/*.scap ; do | ||
[ -e "$trace" ] || continue | ||
NAME=`basename $trace .scap` | ||
cat << EOF >> $MULT_FILE | ||
$NAME: | ||
detect: False | ||
trace_file: $trace | ||
EOF | ||
done | ||
|
||
echo "Contents of $MULT_FILE:" | ||
cat $MULT_FILE | ||
} | ||
|
||
function run_tests() { | ||
CMD="avocado run --multiplex $MULT_FILE --job-results-dir $SCRIPTDIR/job-results -- $SCRIPTDIR/falco_test.py" | ||
echo "Running: $CMD" | ||
$CMD | ||
TEST_RC=$? | ||
} | ||
|
||
|
||
function print_test_failure_details() { | ||
echo "Showing full job logs for any tests that failed:" | ||
jq '.tests[] | select(.status != "PASS") | .logfile' $SCRIPTDIR/job-results/latest/results.json | xargs cat | ||
} | ||
|
||
download_trace_files | ||
prepare_multiplex_file | ||
run_tests | ||
if [ $TEST_RC -ne 0 ]; then | ||
print_test_failure_details | ||
fi | ||
|
||
exit $TEST_RC |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,9 @@ | ||
#!/bin/bash | ||
|
||
# Run sysdig excluding all events that aren't used by falco and also | ||
# excluding other high-volume events that aren't essential. This | ||
# results in smaller trace files. | ||
|
||
# The remaining arguments are taken from the command line. | ||
|
||
exec sudo sysdig not evt.type in '(mprotect,brk,mq_timedreceive,mq_receive,mq_timedsend,mq_send,getrusage,procinfo,rt_sigprocmask,rt_sigaction,ioctl,clock_getres,clock_gettime,clock_nanosleep,clock_settime,close,epoll_create,epoll_create1,epoll_ctl,epoll_pwait,epoll_wait,eventfd,fcntl,fcntl64,fstat,fstat64,fstatat64,fstatfs,fstatfs64,futex,getitimer,gettimeofday,ioprio_get,ioprio_set,llseek,lseek,lstat,lstat64,mmap,mmap2,munmap,nanosleep,poll,ppoll,pread,pread64,preadv,procinfo,pselect6,pwrite,pwrite64,pwritev,read,readv,recv,recvfrom,recvmmsg,recvmsg,sched_yield,select,send,sendfile,sendfile64,sendmmsg,sendmsg,sendto,setitimer,settimeofday,shutdown,splice,stat,stat64,statfs,statfs64,switch,tee,timer_create,timer_delete,timerfd_create,timerfd_gettime,timerfd_settime,timer_getoverrun,timer_gettime,timer_settime,wait4,write,writev) and user.name!=ec2-user' $@ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters