test(sinsp/scap_files): add accept events conversion tests

Signed-off-by: Leonardo Di Giovanna <[email protected]>
falcosecurity · Jan 3, 2025 · beabd39 · beabd39
1 parent d11578f
commit beabd39
Show file tree

Hide file tree

Showing 2 changed files with 57 additions and 0 deletions.
diff --git a/userspace/libscap/engine/savefile/converter/table.cpp b/userspace/libscap/engine/savefile/converter/table.cpp
@@ -54,6 +54,7 @@ const std::unordered_map<conversion_key, conversion_info> g_conversion_table = {
          conversion_info()
                  .action(C_ACTION_ADD_PARAMS)
                  .instrs({{C_INSTR_FROM_ENTER, 0}, {C_INSTR_FROM_ENTER, 1}})},
+        /*====================== ACCEPT ======================*/
         {conversion_key{PPME_SOCKET_ACCEPT_E, 0}, conversion_info().action(C_ACTION_SKIP)},
         {conversion_key{PPME_SOCKET_ACCEPT_X, 3},
          conversion_info()

diff --git a/userspace/libsinsp/test/scap_files/converter_tests.cpp b/userspace/libsinsp/test/scap_files/converter_tests.cpp
@@ -17,6 +17,7 @@ limitations under the License.
 
 */
 
+#include <test_utils.h>
 #include <scap_files/scap_file_test.h>
 
 // Use `sudo sysdig -r <scap-file> -S -q` to check the number of events in the scap file.
@@ -200,6 +201,61 @@ TEST_F(scap_file_test, listen_x_check_final_converted_event) {
 	        create_safe_scap_event(ts, tid, PPME_SOCKET_LISTEN_X, 3, res, fd, backlog));
 }
 
+////////////////////////////
+// ACCEPT
+////////////////////////////
+
+TEST_F(scap_file_test, accept_e_same_number_of_events) {
+	open_filename("scap_2013.scap");
+	assert_num_event_type(PPME_SOCKET_ACCEPT_E, 3817);
+}
+
+TEST_F(scap_file_test, accept_x_same_number_of_events) {
+	open_filename("scap_2013.scap");
+	assert_num_event_type(PPME_SOCKET_ACCEPT_5_X, 3816);
+}
+
+TEST_F(scap_file_test, accept_x_check_final_converted_event) {
+	open_filename("scap_2013.scap");
+
+	// Inside the scap-file the event `519217` is the following:
+	// - type=PPME_SOCKET_ACCEPT_X,
+	// - ts=1380933088302022447
+	// - tid=43625
+	// - args=fd=13(<4t>127.0.0.1:38873->127.0.0.1:80) tuple=127.0.0.1:38873->127.0.0.1:80
+	// queuepct=37 queuepct=37
+	//
+	// And its corresponding enter event `519211` is the following:
+	// - type=PPME_SOCKET_ACCEPT_E
+	// - ts=1380933088302013474
+	// - tid=43625
+	// - args=
+	//
+	// Let's see the new PPME_SOCKET_ACCEPT_5_X event!
+
+	uint64_t ts = 1380933088302022447;
+	int64_t tid = 43625;
+	int64_t fd = 13;
+	sockaddr_in client_sockaddr = test_utils::fill_sockaddr_in(38873, "127.0.0.1");
+	sockaddr_in server_sockaddr = test_utils::fill_sockaddr_in(80, "127.0.0.1");
+	const std::vector<uint8_t> tuple =
+	        test_utils::pack_socktuple(reinterpret_cast<struct sockaddr *>(&client_sockaddr),
+	                                   reinterpret_cast<struct sockaddr *>(&server_sockaddr));
+	int32_t queuepct = 37;
+	int32_t queuelen = 0;
+	int32_t queuemax = 0;
+	assert_event_presence(
+	        create_safe_scap_event(ts,
+	                               tid,
+	                               PPME_SOCKET_ACCEPT_5_X,
+	                               5,
+	                               fd,
+	                               scap_const_sized_buffer{tuple.data(), tuple.size()},
+	                               queuepct,
+	                               queuelen,
+	                               queuemax));
+}
+
 ////////////////////////////
 // SEND
 ////////////////////////////