From 80adb6fab39e4f60b9bf9b83bfbbdf1f225d9253 Mon Sep 17 00:00:00 2001 From: Leonardo Di Giovanna Date: Thu, 2 Jan 2025 18:34:58 +0100 Subject: [PATCH] test(sinsp/scap_files): add accept events conversion tests Signed-off-by: Leonardo Di Giovanna --- .../engine/savefile/converter/table.cpp | 1 + .../test/scap_files/converter_tests.cpp | 59 +++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/userspace/libscap/engine/savefile/converter/table.cpp b/userspace/libscap/engine/savefile/converter/table.cpp index 50477f593a..9880da536a 100644 --- a/userspace/libscap/engine/savefile/converter/table.cpp +++ b/userspace/libscap/engine/savefile/converter/table.cpp @@ -54,6 +54,7 @@ const std::unordered_map g_conversion_table = { conversion_info() .action(C_ACTION_ADD_PARAMS) .instrs({{C_INSTR_FROM_ENTER, 0}, {C_INSTR_FROM_ENTER, 1}})}, + /*====================== ACCEPT ======================*/ {conversion_key{PPME_SOCKET_ACCEPT_E, 0}, conversion_info().action(C_ACTION_SKIP)}, {conversion_key{PPME_SOCKET_ACCEPT_X, 3}, conversion_info() diff --git a/userspace/libsinsp/test/scap_files/converter_tests.cpp b/userspace/libsinsp/test/scap_files/converter_tests.cpp index 3895c82ac1..ea21b5b20e 100644 --- a/userspace/libsinsp/test/scap_files/converter_tests.cpp +++ b/userspace/libsinsp/test/scap_files/converter_tests.cpp @@ -17,6 +17,7 @@ limitations under the License. */ +#include #include // Use `sudo sysdig -r -S -q` to check the number of events in the scap file. @@ -200,6 +201,64 @@ TEST_F(scap_file_test, listen_x_check_final_converted_event) { create_safe_scap_event(ts, tid, PPME_SOCKET_LISTEN_X, 3, res, fd, backlog)); } +//////////////////////////// +// ACCEPT +//////////////////////////// + +TEST_F(scap_file_test, accept_e_same_number_of_events) { + open_filename("scap_2013.scap"); + assert_num_event_type(PPME_SOCKET_ACCEPT_E, 3817); +} + +TEST_F(scap_file_test, accept_x_same_number_of_events) { + open_filename("scap_2013.scap"); + assert_num_event_type(PPME_SOCKET_ACCEPT_5_X, 3816); +} + +// Compile out this test if test_utils helpers are not defined. +#if !defined(_WIN32) && !defined(__EMSCRIPTEN__) && !defined(__APPLE__) +TEST_F(scap_file_test, accept_x_check_final_converted_event) { + open_filename("scap_2013.scap"); + + // Inside the scap-file the event `519217` is the following: + // - type=PPME_SOCKET_ACCEPT_X, + // - ts=1380933088302022447 + // - tid=43625 + // - args=fd=13(<4t>127.0.0.1:38873->127.0.0.1:80) tuple=127.0.0.1:38873->127.0.0.1:80 + // queuepct=37 queuepct=37 + // + // And its corresponding enter event `519211` is the following: + // - type=PPME_SOCKET_ACCEPT_E + // - ts=1380933088302013474 + // - tid=43625 + // - args= + // + // Let's see the new PPME_SOCKET_ACCEPT_5_X event! + + uint64_t ts = 1380933088302022447; + int64_t tid = 43625; + int64_t fd = 13; + sockaddr_in client_sockaddr = test_utils::fill_sockaddr_in(38873, "127.0.0.1"); + sockaddr_in server_sockaddr = test_utils::fill_sockaddr_in(80, "127.0.0.1"); + const std::vector tuple = + test_utils::pack_socktuple(reinterpret_cast(&client_sockaddr), + reinterpret_cast(&server_sockaddr)); + int32_t queuepct = 37; + int32_t queuelen = 0; + int32_t queuemax = 0; + assert_event_presence( + create_safe_scap_event(ts, + tid, + PPME_SOCKET_ACCEPT_5_X, + 5, + fd, + scap_const_sized_buffer{tuple.data(), tuple.size()}, + queuepct, + queuelen, + queuemax)); +} +#endif + //////////////////////////// // SEND ////////////////////////////