77 lines
2.4 KiB
Go
77 lines
2.4 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package system
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestCaptureUsesInjectableProcRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
proc := filepath.Join(root, "42")
|
|
if err := os.Mkdir(proc, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(proc, "comm"), []byte("bash\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(proc, "cmdline"), []byte("bash\x00-i\x00"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(proc, "environ"), []byte("LD_PRELOAD=/tmp/x.so\x00A=B\x00"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Symlink("/tmp/x (deleted)", filepath.Join(proc, "exe")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
fdDir := filepath.Join(proc, "fd")
|
|
if err := os.Mkdir(fdDir, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.Symlink("/dev/input/event3", filepath.Join(fdDir, "7")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
preload := filepath.Join(root, "ld.so.preload")
|
|
if err := os.WriteFile(preload, []byte("/tmp/global.so\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
state, err := CaptureWithPaths(Paths{
|
|
ProcRoot: root, LDPreloadPath: preload,
|
|
SocketSource: func() []model.Socket { return []model.Socket{} },
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(state.Processes) != 1 {
|
|
t.Fatalf("unexpected processes: %#v", state.Processes)
|
|
}
|
|
got := state.Processes[0]
|
|
if got.PID != 42 || got.Comm != "bash" || got.Cmdline != "bash -i" || got.Exe != "/tmp/x (deleted)" {
|
|
t.Fatalf("unexpected process: %#v", got)
|
|
}
|
|
if got.Environ["LD_PRELOAD"] != "/tmp/x.so" || got.FDTargets["7"] != "/dev/input/event3" {
|
|
t.Fatalf("missing environment or fd state: %#v", got)
|
|
}
|
|
if state.LDPreload != "/tmp/global.so" {
|
|
t.Fatalf("unexpected global preload: %q", state.LDPreload)
|
|
}
|
|
}
|
|
|
|
func TestParseSSMatchesPythonShapes(t *testing.T) {
|
|
text := "tcp ESTAB 0 0 10.0.0.2:5555 8.8.8.8:443 users:((\"bash\",pid=42,fd=3)) ino:999\n"
|
|
sockets := parseSS(text, "tcp")
|
|
if len(sockets) != 1 {
|
|
t.Fatalf("unexpected sockets: %#v", sockets)
|
|
}
|
|
got := sockets[0]
|
|
if got.State != "ESTAB" || got.Local != "10.0.0.2:5555" || got.Peer != "8.8.8.8:443" {
|
|
t.Fatalf("unexpected endpoints: %#v", got)
|
|
}
|
|
if got.Inode == nil || *got.Inode != 999 || got.PID == nil || *got.PID != 42 || got.Comm != "bash" {
|
|
t.Fatalf("unexpected ownership: %#v", got)
|
|
}
|
|
}
|