75 lines
2.7 KiB
Go
75 lines
2.7 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package ebpfsource
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/cilium/ebpf"
|
|
"github.com/cilium/ebpf/btf"
|
|
)
|
|
|
|
func TestEmbeddedExecCollectionShape(t *testing.T) {
|
|
specification, err := loadExec()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
program := specification.Programs["trace_execve"]
|
|
eventsMap := specification.Maps["events"]
|
|
if program == nil || program.Type != ebpf.TracePoint || program.SectionName != "tracepoint/syscalls/sys_enter_execve" {
|
|
t.Fatalf("unexpected exec program: %#v", program)
|
|
}
|
|
if eventsMap == nil || eventsMap.Type != ebpf.PerfEventArray {
|
|
t.Fatalf("unexpected exec events map: %#v", eventsMap)
|
|
}
|
|
if countCORERelocations(program) < 2 {
|
|
t.Fatal("exec program must retain parent task CO-RE relocations")
|
|
}
|
|
}
|
|
|
|
func TestEmbeddedSyscallCollectionShape(t *testing.T) {
|
|
specification, err := loadSyscall()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
program := specification.Programs["trace_sys_enter"]
|
|
exitProgram := specification.Programs["trace_sys_exit"]
|
|
filterMap := specification.Maps["monitored_syscalls"]
|
|
writeCommsMap := specification.Maps["monitored_host_comms"]
|
|
pendingWritesMap := specification.Maps["pending_returns"]
|
|
eventsMap := specification.Maps["syscall_events"]
|
|
if program == nil || program.Type != ebpf.TracePoint || program.SectionName != "tracepoint/raw_syscalls/sys_enter" {
|
|
t.Fatalf("unexpected syscall program: %#v", program)
|
|
}
|
|
if exitProgram == nil || exitProgram.Type != ebpf.TracePoint || exitProgram.SectionName != "tracepoint/raw_syscalls/sys_exit" {
|
|
t.Fatalf("unexpected syscall exit program: %#v", exitProgram)
|
|
}
|
|
if filterMap == nil || filterMap.Type != ebpf.Hash || filterMap.MaxEntries != 64 ||
|
|
filterMap.KeySize != 8 || filterMap.ValueSize != 4 {
|
|
t.Fatalf("unexpected syscall filter map: %#v", filterMap)
|
|
}
|
|
if writeCommsMap == nil || writeCommsMap.Type != ebpf.Hash || writeCommsMap.MaxEntries != 64 ||
|
|
writeCommsMap.KeySize != 16 || writeCommsMap.ValueSize != 4 {
|
|
t.Fatalf("unexpected write comm map: %#v", writeCommsMap)
|
|
}
|
|
if pendingWritesMap == nil || pendingWritesMap.Type != ebpf.Hash || pendingWritesMap.MaxEntries != 4096 ||
|
|
pendingWritesMap.KeySize != 8 {
|
|
t.Fatalf("unexpected pending writes map: %#v", pendingWritesMap)
|
|
}
|
|
if eventsMap == nil || eventsMap.Type != ebpf.PerfEventArray {
|
|
t.Fatalf("unexpected syscall events map: %#v", eventsMap)
|
|
}
|
|
if countCORERelocations(program) < 2 {
|
|
t.Fatal("syscall program must retain parent task CO-RE relocations")
|
|
}
|
|
}
|
|
|
|
func countCORERelocations(program *ebpf.ProgramSpec) int {
|
|
count := 0
|
|
for index := range program.Instructions {
|
|
if btf.CORERelocationMetadata(&program.Instructions[index]) != nil {
|
|
count++
|
|
}
|
|
}
|
|
return count
|
|
}
|