diff --git a/userspace/libsinsp/test/CMakeLists.txt b/userspace/libsinsp/test/CMakeLists.txt index 8dd0138fdc..3ea523ffa8 100644 --- a/userspace/libsinsp/test/CMakeLists.txt +++ b/userspace/libsinsp/test/CMakeLists.txt @@ -106,6 +106,7 @@ set(LIBSINSP_UNIT_TESTS_SOURCES filter_escaping.ut.cpp filter_parser.ut.cpp filter_op_bcontains.ut.cpp + filter_op_contains.ut.cpp filter_op_pmatch.ut.cpp filter_op_numeric_compare.ut.cpp filter_compiler.ut.cpp diff --git a/userspace/libsinsp/test/filter_op_contains.ut.cpp b/userspace/libsinsp/test/filter_op_contains.ut.cpp new file mode 100644 index 0000000000..393db2fb35 --- /dev/null +++ b/userspace/libsinsp/test/filter_op_contains.ut.cpp @@ -0,0 +1,39 @@ +// SPDX-License-Identifier: Apache-2.0 +/* +Copyright (C) 2024 The Falco Authors. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +*/ + +#include +#include + +#include + +TEST_F(sinsp_with_test_input, contains_icontains) +{ + add_default_init_thread(); + + open_inspector(); + + int64_t fd = 1; + sinsp_evt * evt = add_event_advance_ts(increasing_ts(), 3, PPME_SYSCALL_OPEN_X, 6, fd, "/opt/dir/SUBDIR/file.txt", PPM_O_RDWR | PPM_O_CREAT, 0, 0, (uint64_t) 0); + + EXPECT_TRUE(eval_filter(evt, "evt.arg.flags contains O_CREAT")); + EXPECT_FALSE(eval_filter(evt, "evt.arg.flags contains O_TMPFILE")); + EXPECT_TRUE(eval_filter(evt, "evt.arg.flags icontains O_CREAT")); + EXPECT_TRUE(eval_filter(evt, "fd.name contains /dir")); + EXPECT_TRUE(eval_filter(evt, "fd.name icontains /subdir")); + EXPECT_FALSE(eval_filter(evt, "fd.name icontains notthis")); +}