52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package ebpfsource
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/binary"
|
|
"testing"
|
|
)
|
|
|
|
func TestDecodeExecSample(t *testing.T) {
|
|
raw := execEventRaw{PID: 42, PPID: 7, UID: 1000}
|
|
copyCString(raw.ParentComm[:], "nginx")
|
|
copyCString(raw.Filename[:], "/bin/bash")
|
|
copyCString(raw.Arg1[:], "-c")
|
|
copyCString(raw.Arg2[:], "id")
|
|
var sample bytes.Buffer
|
|
if err := binary.Write(&sample, binary.NativeEndian, raw); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
event, err := decodeExecSample(sample.Bytes())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if event.PID != 42 || event.PPID != 7 || event.UID != 1000 ||
|
|
event.ParentComm != "nginx" || event.Filename != "/bin/bash" ||
|
|
len(event.Argv) != 2 || event.Argv[0] != "-c" || event.Argv[1] != "id" {
|
|
t.Fatalf("unexpected event: %#v", event)
|
|
}
|
|
}
|
|
|
|
func TestDecodeExecSampleRejectsWrongSize(t *testing.T) {
|
|
if _, err := decodeExecSample([]byte{1, 2, 3}); err == nil {
|
|
t.Fatal("expected size error")
|
|
}
|
|
}
|
|
|
|
func TestCStringStopsAtNUL(t *testing.T) {
|
|
if got := cString([]int8{'a', 'b', 0, 'c'}); got != "ab" {
|
|
t.Fatalf("got %q", got)
|
|
}
|
|
}
|
|
|
|
func copyCString(destination []int8, value string) {
|
|
for index, char := range []byte(value) {
|
|
if index >= len(destination)-1 {
|
|
break
|
|
}
|
|
destination[index] = int8(char)
|
|
}
|
|
}
|