feat(go): advance validation sidecar toward production

go-agent/internal/ebpfsource/spec_test.go

@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package ebpfsource
+
+import (
+	"testing"
+
+	"github.com/cilium/ebpf"
+	"github.com/cilium/ebpf/btf"
+)
+
+func TestEmbeddedExecCollectionShape(t *testing.T) {
+	specification, err := loadExec()
+	if err != nil {
+		t.Fatal(err)
+	}
+	program := specification.Programs["trace_execve"]
+	eventsMap := specification.Maps["events"]
+	if program == nil || program.Type != ebpf.TracePoint || program.SectionName != "tracepoint/syscalls/sys_enter_execve" {
+		t.Fatalf("unexpected exec program: %#v", program)
+	}
+	if eventsMap == nil || eventsMap.Type != ebpf.PerfEventArray {
+		t.Fatalf("unexpected exec events map: %#v", eventsMap)
+	}
+	if countCORERelocations(program) < 2 {
+		t.Fatal("exec program must retain parent task CO-RE relocations")
+	}
+}
+
+func TestEmbeddedSyscallCollectionShape(t *testing.T) {
+	specification, err := loadSyscall()
+	if err != nil {
+		t.Fatal(err)
+	}
+	program := specification.Programs["trace_sys_enter"]
+	exitProgram := specification.Programs["trace_sys_exit"]
+	filterMap := specification.Maps["monitored_syscalls"]
+	writeCommsMap := specification.Maps["monitored_host_comms"]
+	pendingWritesMap := specification.Maps["pending_returns"]
+	eventsMap := specification.Maps["syscall_events"]
+	if program == nil || program.Type != ebpf.TracePoint || program.SectionName != "tracepoint/raw_syscalls/sys_enter" {
+		t.Fatalf("unexpected syscall program: %#v", program)
+	}
+	if exitProgram == nil || exitProgram.Type != ebpf.TracePoint || exitProgram.SectionName != "tracepoint/raw_syscalls/sys_exit" {
+		t.Fatalf("unexpected syscall exit program: %#v", exitProgram)
+	}
+	if filterMap == nil || filterMap.Type != ebpf.Hash || filterMap.MaxEntries != 64 ||
+		filterMap.KeySize != 8 || filterMap.ValueSize != 4 {
+		t.Fatalf("unexpected syscall filter map: %#v", filterMap)
+	}
+	if writeCommsMap == nil || writeCommsMap.Type != ebpf.Hash || writeCommsMap.MaxEntries != 64 ||
+		writeCommsMap.KeySize != 16 || writeCommsMap.ValueSize != 4 {
+		t.Fatalf("unexpected write comm map: %#v", writeCommsMap)
+	}
+	if pendingWritesMap == nil || pendingWritesMap.Type != ebpf.Hash || pendingWritesMap.MaxEntries != 4096 ||
+		pendingWritesMap.KeySize != 8 {
+		t.Fatalf("unexpected pending writes map: %#v", pendingWritesMap)
+	}
+	if eventsMap == nil || eventsMap.Type != ebpf.PerfEventArray {
+		t.Fatalf("unexpected syscall events map: %#v", eventsMap)
+	}
+	if countCORERelocations(program) < 2 {
+		t.Fatal("syscall program must retain parent task CO-RE relocations")
+	}
+}
+
+func countCORERelocations(program *ebpf.ProgramSpec) int {
+	count := 0
+	for index := range program.Instructions {
+		if btf.CORERelocationMetadata(&program.Instructions[index]) != nil {
+			count++
+		}
+	}
+	return count
+}