(t *testing.T)
| 98 | } |
| 99 | |
| 100 | func TestLoadGroupsFromURLs(t *testing.T) { |
| 101 | mux := http.NewServeMux() |
| 102 | mux.HandleFunc("/default.yml", func(w http.ResponseWriter, r *http.Request) { |
| 103 | b, err := os.ReadFile("_fixtures/filters/default.yml") |
| 104 | if err != nil { |
| 105 | w.WriteHeader(http.StatusInternalServerError) |
| 106 | return |
| 107 | } |
| 108 | _, _ = w.Write(b) |
| 109 | }) |
| 110 | |
| 111 | l, err := net.Listen("tcp", "127.0.0.1:3231") |
| 112 | if err != nil { |
| 113 | t.Fatal(err) |
| 114 | } |
| 115 | srv := httptest.NewUnstartedServer(mux) |
| 116 | srv.Listener = l |
| 117 | srv.Start() |
| 118 | defer srv.Close() |
| 119 | |
| 120 | filters := Filters{ |
| 121 | Rules{ |
| 122 | FromURLs: []string{ |
| 123 | "http://localhost:3231/default.yml", |
| 124 | }, |
| 125 | }, |
| 126 | Macros{FromPaths: nil}, |
| 127 | false, |
| 128 | map[string]*Macro{}, |
| 129 | []*FilterConfig{}, |
| 130 | } |
| 131 | err = filters.LoadFilters() |
| 132 | require.NoError(t, err) |
| 133 | require.Len(t, filters.filters, 1) |
| 134 | |
| 135 | f1 := filters.filters[0] |
| 136 | assert.Equal(t, "only network category", f1.Name) |
| 137 | assert.True(t, *f1.Enabled) |
| 138 | assert.Contains(t, f1.Tags, "TE") |
| 139 | assert.Equal(t, "evt.category = 'net'", f1.Condition) |
| 140 | assert.Equal(t, "this rule matches all network signals", f1.Description) |
| 141 | assert.Equal(t, "low", f1.Severity) |
| 142 | assert.Equal(t, "`%ps.exe` attempted to reach out to `%net.sip` IP address\n", f1.Output) |
| 143 | assert.NotNil(t, f1.Action) |
| 144 | |
| 145 | acts, err := f1.DecodeActions() |
| 146 | require.NoError(t, err) |
| 147 | require.IsType(t, KillAction{}, acts[0]) |
| 148 | |
| 149 | assert.Equal(t, "2.0.0", f1.MinEngineVersion) |
| 150 | } |
nothing calls this directly
no test coverage detected