1
1
package ebpfeng
2
2
3
3
import (
4
+ "os"
5
+ "path"
6
+ "sniffer/pkg/config"
7
+ v1 "sniffer/pkg/config/v1"
8
+ "sniffer/pkg/utils"
9
+ "strings"
4
10
"testing"
5
11
)
6
12
@@ -29,6 +35,48 @@ func TestConvertStringTimeToTimeOBJ(t *testing.T) {
29
35
t .Fatalf ("timestamp convert nanosecond is wrong" )
30
36
}
31
37
38
+ timestamp = "2w023-02-14T14:30:06.863996608+0000"
39
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
40
+ if err == nil {
41
+ t .Fatalf ("timestamp convert should fail" )
42
+ }
43
+
44
+ timestamp = "2023-0w2-14T14:30:06.863996608+0000"
45
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
46
+ if err == nil {
47
+ t .Fatalf ("timestamp convert should fail" )
48
+ }
49
+
50
+ timestamp = "2023-02-1w4T14:30:06.863996608+0000"
51
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
52
+ if err == nil {
53
+ t .Fatalf ("timestamp convert should fail" )
54
+ }
55
+
56
+ timestamp = "2023-02-14T1w4:30:06.863996608+0000"
57
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
58
+ if err == nil {
59
+ t .Fatalf ("timestamp convert should fail" )
60
+ }
61
+
62
+ timestamp = "2023-02-14T14:3w0:06.863996608+0000"
63
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
64
+ if err == nil {
65
+ t .Fatalf ("timestamp convert should fail" )
66
+ }
67
+
68
+ timestamp = "2023-02-14T14:30:0w6.863996608+0000"
69
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
70
+ if err == nil {
71
+ t .Fatalf ("timestamp convert should fail" )
72
+ }
73
+
74
+ timestamp = "2023-02-14T14:30:06.86w3996608+0000"
75
+ _ , err = convertStringTimeToTimeOBJ (timestamp )
76
+ if err == nil {
77
+ t .Fatalf ("timestamp convert should fail" )
78
+ }
79
+
32
80
}
33
81
34
82
func TestParseFalcoEvent (t * testing.T ) {
@@ -46,4 +94,132 @@ func TestParseFalcoEvent(t *testing.T) {
46
94
if ev .GetEventSyscallArgs () != "TYPE=openat(fd: <f>/var/lib/kubelet/pods, dirfd: AT_FDCWD, name: /var/lib/kubelet/pods, flags: O_RDONLY|O_CLOEXEC, mode: 0, dev: 802, ino: 6456368)" {
47
95
t .Fatalf ("ev.GetEventContainerID() failed" )
48
96
}
97
+
98
+ line = "drop event occured"
99
+ ev , err = parseLine (line )
100
+ if err != nil {
101
+ t .Fatalf ("drop event: parseLine failed with err %v" , err )
102
+ }
103
+
104
+ if ! strings .Contains (ev .GetEventCMD (), "drop event occurred" ) {
105
+ t .Fatalf ("drop event should contain line: %s in cmd" , line )
106
+ }
107
+
108
+ line = "2023-02-14T14:30:06.863996608+0000]::[0002f88945ec]::"
109
+ _ , err = parseLine (line )
110
+ if err == nil {
111
+ t .Fatalf ("parse line should fail" )
112
+ }
113
+
114
+ line = "2023-02-14T14:]::[0002f88945ec]::[CAT=FILE]::[PPID=3006]::[PID=4525]::[TYPE=openat(fd: <f>/var/lib/kubelet/pods, dirfd: AT_FDCWD, name: /var/lib/kubelet/pods, flags: O_RDONLY|O_CLOEXEC, mode: 0, dev: 802, ino: 6456368)]::[EXE=/var/lib/minikube/binaries/v1.24.3/kubelet]::[CMD="
115
+ _ , err = parseLine (line )
116
+ if err == nil {
117
+ t .Fatalf ("parse line should fail" )
118
+ }
119
+
120
+ }
121
+
122
+ func TestCreateSyscallFilterString (t * testing.T ) {
123
+ expectedFilterString := "evt.type=execve or evt.type=open"
124
+ filterString := createSyscallFilterString ([]string {"execve" , "open" })
125
+
126
+ if filterString != expectedFilterString {
127
+ t .Fatalf ("filterString:%s should be equal to expectedFilterString:%s" , filterString , expectedFilterString )
128
+ }
129
+
130
+ }
131
+
132
+ func TestCreateFalcoEbpfEngine (t * testing.T ) {
133
+ configPath := path .Join (utils .CurrentDir (), ".." , ".." , "configuration" , "ConfigurationFile.json" )
134
+ err := os .Setenv (config .ConfigEnvVar , configPath )
135
+ if err != nil {
136
+ t .Fatalf ("failed to set env %s with err %v" , config .ConfigEnvVar , err )
137
+ }
138
+
139
+ config := config .GetConfigurationConfigContext ()
140
+ configData , err := config .GetConfigurationReader ()
141
+ if err != nil {
142
+ t .Errorf ("GetConfigurationReader failed with err %v" , err )
143
+ }
144
+ err = config .ParseConfiguration (v1 .CreateConfigData (), configData )
145
+ if err != nil {
146
+ t .Fatalf ("ParseConfiguration failed with err %v" , err )
147
+ }
148
+
149
+ engine := CreateFalcoEbpfEngine ([]string {"123" , "456" }, false , false , "" )
150
+ if engine .containerID != "" || engine .includeHost != false || engine .sniffMainThreadOnly != false {
151
+ t .Fatalf ("CreateFalcoEbpfEngine fail to create as expected" )
152
+ }
153
+ }
154
+
155
+ func TestEbpfEngineCMDWithParams (t * testing.T ) {
156
+ configPath := path .Join (utils .CurrentDir (), ".." , ".." , "configuration" , "ConfigurationFile.json" )
157
+ err := os .Setenv (config .ConfigEnvVar , configPath )
158
+ if err != nil {
159
+ t .Fatalf ("failed to set env %s with err %v" , config .ConfigEnvVar , err )
160
+ }
161
+
162
+ config := config .GetConfigurationConfigContext ()
163
+ configData , err := config .GetConfigurationReader ()
164
+ if err != nil {
165
+ t .Errorf ("GetConfigurationReader failed with err %v" , err )
166
+ }
167
+ err = config .ParseConfiguration (v1 .CreateConfigData (), configData )
168
+ if err != nil {
169
+ t .Fatalf ("ParseConfiguration failed with err %v" , err )
170
+ }
171
+
172
+ engine := CreateFalcoEbpfEngine ([]string {"123" , "456" }, false , false , "" )
173
+ if engine .containerID != "" || engine .includeHost != false || engine .sniffMainThreadOnly != false {
174
+ t .Fatalf ("CreateFalcoEbpfEngine fail to create as expected" )
175
+ }
176
+
177
+ cmd := engine .ebpfEngineCMDWithParams ()
178
+ if cmd [0 ] != "-f" || cmd [1 ] != "evt.type=123 or evt.type=456" || cmd [2 ] != "-e" {
179
+ t .Fatalf ("ebpfEngineCMDWithParams is note with the right values %v" , cmd )
180
+ }
181
+
182
+ engine2 := CreateFalcoEbpfEngine ([]string {"123" , "456" }, true , true , "123" )
183
+ if engine2 .containerID != "123" || engine2 .includeHost != true || engine2 .sniffMainThreadOnly != true {
184
+ t .Fatalf ("CreateFalcoEbpfEngine fail to create as expected" )
185
+ }
186
+
187
+ cmd2 := engine2 .ebpfEngineCMDWithParams ()
188
+ if cmd2 [0 ] != "-f" || cmd2 [1 ] != "evt.type=123 or evt.type=456" || cmd2 [2 ] != "-o" || cmd2 [3 ] != "-m" || cmd2 [4 ] != "-c" || cmd2 [5 ] != "123" || cmd2 [6 ] != "-e" {
189
+ t .Fatalf ("ebpfEngineCMDWithParams is note with the right values %v" , cmd )
190
+ }
191
+
192
+ }
193
+
194
+ func TestStartEbpfEngine (t * testing.T ) {
195
+ configPath := path .Join (utils .CurrentDir (), ".." , ".." , "configuration" , "ConfigurationFile.json" )
196
+ err := os .Setenv (config .ConfigEnvVar , configPath )
197
+ if err != nil {
198
+ t .Fatalf ("failed to set env ConfigEnvVar with err %v" , err )
199
+ }
200
+
201
+ cfg := config .GetConfigurationConfigContext ()
202
+ configData , err := cfg .GetConfigurationReader ()
203
+ if err != nil {
204
+ t .Fatalf ("GetConfigurationReader failed with err %v" , err )
205
+ }
206
+ err = cfg .ParseConfiguration (v1 .CreateFalcoMockConfigData (), configData )
207
+ if err != nil {
208
+ t .Fatalf ("ParseConfiguration failed with err %v" , err )
209
+ }
210
+
211
+ engine := CreateFalcoEbpfEngine ([]string {"123" , "456" }, false , false , "" )
212
+ if engine .containerID != "" || engine .includeHost != false || engine .sniffMainThreadOnly != false {
213
+ t .Fatalf ("CreateFalcoEbpfEngine fail to create as expected" )
214
+ }
215
+
216
+ cmd := engine .ebpfEngineCMDWithParams ()
217
+ if cmd [0 ] != "-f" || cmd [1 ] != "evt.type=123 or evt.type=456" || cmd [2 ] != "-e" {
218
+ t .Fatalf ("ebpfEngineCMDWithParams is note with the right values %v" , cmd )
219
+ }
220
+
221
+ err = engine .StartEbpfEngine ()
222
+ if err != nil {
223
+ t .Fatalf ("StartEbpfEngine failed with err %v" , err )
224
+ }
49
225
}
0 commit comments