// SPDX-License-Identifier: GPL-3.0-or-later package ebpfsource import ( "bytes" "encoding/binary" "testing" ) func TestDecodeExecSample(t *testing.T) { raw := execEventRaw{PID: 42, PPID: 7, UID: 1000} copyCString(raw.ParentComm[:], "nginx") copyCString(raw.Filename[:], "/bin/bash") copyCString(raw.Arg1[:], "-c") copyCString(raw.Arg2[:], "id") var sample bytes.Buffer if err := binary.Write(&sample, binary.NativeEndian, raw); err != nil { t.Fatal(err) } event, err := decodeExecSample(sample.Bytes()) if err != nil { t.Fatal(err) } if event.PID != 42 || event.PPID != 7 || event.UID != 1000 || event.ParentComm != "nginx" || event.Filename != "/bin/bash" || len(event.Argv) != 2 || event.Argv[0] != "-c" || event.Argv[1] != "id" { t.Fatalf("unexpected event: %#v", event) } } func TestDecodeExecSampleRejectsWrongSize(t *testing.T) { if _, err := decodeExecSample([]byte{1, 2, 3}); err == nil { t.Fatal("expected size error") } } func TestCStringStopsAtNUL(t *testing.T) { if got := cString([]int8{'a', 'b', 0, 'c'}); got != "ab" { t.Fatalf("got %q", got) } } func copyCString(destination []int8, value string) { for index, char := range []byte(value) { if index >= len(destination)-1 { break } destination[index] = int8(char) } }