From c58f1bba20f0163564b714c35bf2716749899e36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Geyslan=20Greg=C3=B3rio?= Date: Mon, 30 Oct 2023 09:56:42 -0300 Subject: [PATCH] chore(tests): integration changes - add coolDown to sleep before to run the next test. - change runCmd to receive the number of expected events. - ExpectAnyOfEvts (ExpectAnyOfEach before) now call runCmd passing 1 as expected events. - eventBuffer.clear() now sets a new empty slice for it, instead of relying on the old underlying array. - replaced copyActualEvents() with eventBuffer.getCopy(). - refactored test functions and improved comments. --- tests/integration/event_filters_test.go | 262 +++++++++++++++--------- tests/integration/tracee.go | 19 +- 2 files changed, 180 insertions(+), 101 deletions(-) diff --git a/tests/integration/event_filters_test.go b/tests/integration/event_filters_test.go index e1984dc46a55..e3c451e8b449 100644 --- a/tests/integration/event_filters_test.go +++ b/tests/integration/event_filters_test.go @@ -75,7 +75,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "mntns/pidns: trace events only from mount/pid namespace 0", @@ -104,7 +105,8 @@ func Test_EventFilters(t *testing.T) { newCmdEvents("who", 1*time.Second, []trace.Event{}, []string{}), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "mntns: trace events from all mount namespaces but current", @@ -131,7 +133,8 @@ func Test_EventFilters(t *testing.T) { newCmdEvents("who", 1*time.Second, []trace.Event{}, []string{}), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "pidns: trace events from all pid namespaces but current", @@ -158,7 +161,8 @@ func Test_EventFilters(t *testing.T) { newCmdEvents("who", 1*time.Second, []trace.Event{}, []string{}), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: mntns: pidns: event: trace events set in a single policy from current pid/mount namespaces", @@ -202,7 +206,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: trace events set in a single policy from ping command", @@ -244,7 +249,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: trace events set in a single policy from ping command", @@ -282,7 +288,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "event: args: trace event set in a specific policy with args pathname finishing with 'ls'", @@ -322,7 +329,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "event: args: trace event set in a specific policy with args pathname starting with * wildcard", @@ -357,7 +365,8 @@ func Test_EventFilters(t *testing.T) { newCmdEvents("who", 1*time.Second, []trace.Event{}, []string{}), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: args: trace event set in a specific policy with args from ls command", @@ -396,7 +405,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: trace events set in two specific policies from ls and uname commands", @@ -459,7 +469,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "exec: event: trace events in separate policies from who and uname executable", @@ -522,7 +533,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, // TODO: Add pid>0 pid<1000 // TODO: Add u>0 u!=1000 @@ -564,7 +576,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAnyOfEach, + coolDown: 1 * time.Second, + test: ExpectAnyOfEvts, }, { name: "pid: trace events from pid 1", @@ -597,7 +610,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAnyOfEach, + coolDown: 1 * time.Second, + test: ExpectAnyOfEvts, }, { name: "uid: comm: trace uid 0 from ls command", @@ -630,7 +644,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "uid: comm: trace only uid>0 from ls command (should be empty)", @@ -661,7 +676,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: trace filesystem events from ls command", @@ -698,7 +714,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "exec: event: trace only setns events from \"/usr/bin/dockerd\" executable", @@ -736,7 +753,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "trace new pids (should be empty)", @@ -767,7 +785,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: trace events set in a specific policy from ls command", @@ -799,7 +818,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "comm: trace events set in a specific policy from ls command", @@ -847,7 +867,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "comm: trace events set in a specific policy from ls and who commands", @@ -902,7 +923,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "event: args: context: only security_file_open from \"execve\" syscall", @@ -943,7 +965,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "comm: event: do a file write", @@ -980,7 +1003,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, // // TODO: add tests using signature events @@ -1052,7 +1076,8 @@ func Test_EventFilters(t *testing.T) { // ), // }, // useSyscaller: false, - // test: ExpectAtLeastOneOfEach, + // coolDown: 0, + // test: ExpectAtLeastOneOfEach, // }, // events matched in multiple policies - intertwined workloads @@ -1112,7 +1137,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: trace events from ping command in multiple policies", @@ -1176,7 +1202,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: trace events from ping command in multiple policies", @@ -1282,7 +1309,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: trace only events from from ls and who commands in multiple policies", @@ -1338,7 +1366,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAllEqualTo, + coolDown: 0, + test: ExpectAllEvtsEqualToOne, }, { name: "comm: trace at least one event in multiple policies from ls and who commands", @@ -1393,7 +1422,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: false, - test: ExpectAtLeastOneOfEach, + coolDown: 0, + test: ExpectAtLeastOneForEach, }, // This uses the syscaller tool which emits the desired events from a desired comm, @@ -1441,7 +1471,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: true, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "event: trace execve event set in a specific policy from fakeprog1 command", @@ -1476,7 +1507,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: true, - test: ExpectAtLeastOneOfEach, + coolDown: 0, + test: ExpectAtLeastOneForEach, }, { name: "comm: event: args: trace event set in a specific policy with args from fakeprog1 and fakeprog2 commands", @@ -1555,7 +1587,8 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: true, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, { name: "comm: event: retval: trace event set in a specific policy with retval from fakeprog1 and fakeprog2 commands", @@ -1627,13 +1660,17 @@ func Test_EventFilters(t *testing.T) { ), }, useSyscaller: true, - test: ExpectAllInOrder, + coolDown: 0, + test: ExpectAllInOrderSequentially, }, } // run tests cases for _, tc := range tt { t.Run(tc.name, func(t *testing.T) { + // wait for the previous test to cool down + coolDown(t, tc.coolDown) + // prepare tracee config config := config.Config{ Policies: newPolicies(tc.policyFiles), @@ -1652,8 +1689,8 @@ func Test_EventFilters(t *testing.T) { defer trc.Unsubscribe(stream) // start a goroutine to read events from the channel into the buffer - buf := &eventBuffer{} - go func(ctx context.Context) { + buf := newEventBuffer() + go func(ctx context.Context, buf *eventBuffer) { for { select { case <-ctx.Done(): @@ -1662,7 +1699,7 @@ func Test_EventFilters(t *testing.T) { buf.addEvent(evt) } } - }(ctx) + }(ctx, buf) // run a test case and validate the results against the expected events tc.test(t, tc.cmdEvents, buf, tc.useSyscaller) @@ -1695,6 +1732,7 @@ type testCase struct { policyFiles []policyFileWithID cmdEvents []cmdEvents useSyscaller bool + coolDown time.Duration // cool down before running the test case test func(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) } @@ -1792,6 +1830,13 @@ func expectEvent( } } +func coolDown(t *testing.T, duration time.Duration) { + if duration > 0 { + t.Logf("Cooling down for %v", duration) + time.Sleep(duration) + } +} + // proc represents a process, with its pid and the number of events it should generate type proc struct { pid int @@ -1799,7 +1844,7 @@ type proc struct { } // runCmd runs a command and returns a process -func runCmd(t *testing.T, cmd cmdEvents, actual *eventBuffer, useSyscaller, failOnTimeout bool) proc { +func runCmd(t *testing.T, cmd cmdEvents, expectedEvts int, actual *eventBuffer, useSyscaller, failOnTimeout bool) proc { var ( pid int err error @@ -1811,11 +1856,11 @@ func runCmd(t *testing.T, cmd cmdEvents, actual *eventBuffer, useSyscaller, fail pid, err = testutils.ExecPinnedCmdWithTimeout(cmd.runCmd, cmd.timeout) require.NoError(t, err) - waitForTraceeOutputEvents(t, actual, time.Now(), len(cmd.evts), failOnTimeout) + waitForTraceeOutputEvents(t, actual, time.Now(), expectedEvts, failOnTimeout) return proc{ pid: pid, - expectedEvts: len(cmd.evts), + expectedEvts: expectedEvts, } } @@ -1916,18 +1961,6 @@ func pidToCheck(cmd string, actEvt trace.Event) int { return actEvt.ProcessID } -// copyActualEvents returns a copy of the actual events -// This is to avoid holding the lock while comparing the events (in nested loops) -func copyActualEvents(actual *eventBuffer) []trace.Event { - var evts []trace.Event - - actual.mu.Lock() - evts = append(evts, actual.events...) - actual.mu.Unlock() - - return evts -} - // assert that the given string slices are equal, ignoring order func assertUnorderedStringSlicesEqual(t *testing.T, expNames []string, actNames []string) { assert.Equal(t, len(expNames), len(actNames)) @@ -1944,26 +1977,36 @@ func assertUnorderedStringSlicesEqual(t *testing.T, expNames []string, actNames } } -// ExpectAtLeastOneOfEach validates that at least one event from each command was captured -func ExpectAtLeastOneOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { - for _, exp := range cmdEvents { +// ExpectAtLeastOneForEach validates that at least one event from each command +// in 'cmdEvents' was captured in the actual events. It does not impose a minimum +// expected event count and checks that at least one event from each command +// (regardless of the number of expected events) is present in the actual events. +// It continues searching for all expected events for each command and raises a +// test failure only if none of the expected events for a command are found in +// the actual events. +// +// This function is suitable when you want to ensure that each command has at +// least one event in the actual events, regardless of the number of expected +// events for each command. +func ExpectAtLeastOneForEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { + for _, cmd := range cmdEvents { syscallsInSets := []string{} - checkSets := len(exp.sets) > 0 + checkSets := len(cmd.sets) > 0 if checkSets { - syscallsInSets = getAllSyscallsInSets(exp.sets) + syscallsInSets = getAllSyscallsInSets(cmd.sets) } actual.clear() // first stage: run commands - proc := runCmd(t, exp, actual, useSyscaller, true) - if len(exp.evts) == 0 && proc.expectedEvts > 0 { - t.Fatalf("expected no events for command %s, but got %d", exp.runCmd, proc.expectedEvts) + proc := runCmd(t, cmd, len(cmd.evts), actual, useSyscaller, true) + if len(cmd.evts) == 0 && proc.expectedEvts > 0 { + t.Fatalf("expected no events for command %s, but got %d", cmd.runCmd, proc.expectedEvts) } - actEvtsCopy := copyActualEvents(actual) + actEvtsCopy := actual.getCopy() // second stage: validate events - for _, expEvt := range exp.evts { + for _, expEvt := range cmd.evts { found := false checkHost := expEvt.HostName != anyHost checkComm := expEvt.ProcessName != anyComm @@ -1974,8 +2017,8 @@ func ExpectAtLeastOneOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBu checkPolicy := expEvt.MatchedPoliciesUser != anyPolicy checkPolicyName := len(expEvt.MatchedPolicies) > 0 && expEvt.MatchedPolicies[0] != anyPolicyName - if len(exp.evts) > 0 && proc.expectedEvts == 0 { - t.Fatalf("expected events for command %s, but got none", exp.runCmd) + if len(cmd.evts) > 0 && proc.expectedEvts == 0 { + t.Fatalf("expected events for command %s, but got none", cmd.runCmd) } for _, actEvt := range actEvtsCopy { @@ -1992,7 +2035,7 @@ func ExpectAtLeastOneOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBu if checkProcessorID && actEvt.ProcessorID != expEvt.ProcessorID { continue } - if checkPID && pidToCheck(exp.runCmd, actEvt) != expEvt.ProcessID { + if checkPID && pidToCheck(cmd.runCmd, actEvt) != expEvt.ProcessID { continue } if checkPID && actEvt.ProcessID != expEvt.ProcessID { @@ -2060,27 +2103,38 @@ func ExpectAtLeastOneOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBu } } -// ExpectAnyOfEach validates that at any event from each command was captured -func ExpectAnyOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { - for _, exp := range cmdEvents { +// ExpectAnyOfEvts validates that at least one event from each command in +// 'cmdEvents' was captured in the actual events. It requires a minimum of two +// expected events for each command and stops searching as soon as it finds a +// matching event. If any command does not have at least one matching event in +// the actual events, it raises a test failure. +// +// This function is suitable when you expect any of a set of events to occur +// and want to confirm that at least one of them happened. +func ExpectAnyOfEvts(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { + for _, cmd := range cmdEvents { + if len(cmd.evts) <= 1 { + t.Fatalf("ExpectAnyOfEvts test requires at least 2 expected events for command %s", cmd.runCmd) + } + syscallsInSets := []string{} - checkSets := len(exp.sets) > 0 + checkSets := len(cmd.sets) > 0 if checkSets { - syscallsInSets = getAllSyscallsInSets(exp.sets) + syscallsInSets = getAllSyscallsInSets(cmd.sets) } actual.clear() // first stage: run commands - proc := runCmd(t, exp, actual, useSyscaller, true) - if len(exp.evts) == 0 && proc.expectedEvts > 0 { - t.Fatalf("expected no events for command %s, but got %d", exp.runCmd, proc.expectedEvts) + proc := runCmd(t, cmd, 1, actual, useSyscaller, true) + if len(cmd.evts) == 0 && proc.expectedEvts > 0 { + t.Fatalf("expected no events for command %s, but got %d", cmd.runCmd, proc.expectedEvts) } - actEvtsCopy := copyActualEvents(actual) + actEvtsCopy := actual.getCopy() // second stage: validate events found := false - for _, expEvt := range exp.evts { + for _, expEvt := range cmd.evts { checkHost := expEvt.HostName != anyHost checkComm := expEvt.ProcessName != anyComm checkProcessorID := expEvt.ProcessorID != anyProcessorID @@ -2090,8 +2144,8 @@ func ExpectAnyOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, u checkPolicy := expEvt.MatchedPoliciesUser != anyPolicy checkPolicyName := len(expEvt.MatchedPolicies) > 0 && expEvt.MatchedPolicies[0] != anyPolicyName - if len(exp.evts) > 0 && proc.expectedEvts == 0 { - t.Fatalf("expected events for command %s, but got none", exp.runCmd) + if len(cmd.evts) > 0 && proc.expectedEvts == 0 { + t.Fatalf("expected events for command %s, but got none", cmd.runCmd) } for _, actEvt := range actEvtsCopy { @@ -2108,7 +2162,7 @@ func ExpectAnyOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, u if checkProcessorID && actEvt.ProcessorID != expEvt.ProcessorID { continue } - if checkPID && pidToCheck(exp.runCmd, actEvt) != expEvt.ProcessID { + if checkPID && pidToCheck(cmd.runCmd, actEvt) != expEvt.ProcessID { continue } if checkPID && actEvt.ProcessID != expEvt.ProcessID { @@ -2177,33 +2231,39 @@ func ExpectAnyOfEach(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, u } // evaluate found - require.True(t, found, "None of the expected events\n%+v\nare in the actual output\n%+v\n", exp.evts, actEvtsCopy) + require.True(t, found, "None of the expected events\n%+v\nare in the actual output\n%+v\n", cmd.evts, actEvtsCopy) } } -// ExpectAllEqualTo expects all events to be equal to the expected events -func ExpectAllEqualTo(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { - for _, exp := range cmdEvents { - if len(exp.evts) != 1 { - t.Fatalf("ExpectAllEqualTo test requires exactly one event per command") +// ExpectAllEvtsEqualToOne validates that all events within a command match the +// single expected event for each command. It enforces that each command's events +// are exactly equal to the single expected event. +// +// This function is suitable for cases where each command should produce one +// specific event, and all commands should match their respective events. +func ExpectAllEvtsEqualToOne(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { + for _, cmd := range cmdEvents { + if len(cmd.evts) != 1 { + t.Fatalf("ExpectAllEvtsEqualToOne test requires exactly one event per command, but got %d events for command %s", len(cmd.evts), cmd.runCmd) } actual.clear() // first stage: run commands - proc := runCmd(t, exp, actual, useSyscaller, true) - actEvtsCopy := copyActualEvents(actual) + proc := runCmd(t, cmd, len(cmd.evts), actual, useSyscaller, true) + + actEvtsCopy := actual.getCopy() if proc.expectedEvts == 0 { - t.Fatalf("expected one event for command %s, but got none", exp.runCmd) + t.Fatalf("expected one event for command %s, but got none", cmd.runCmd) } syscallsInSets := []string{} - checkSets := len(exp.sets) > 0 + checkSets := len(cmd.sets) > 0 if checkSets { - syscallsInSets = getAllSyscallsInSets(exp.sets) + syscallsInSets = getAllSyscallsInSets(cmd.sets) } // second stage: validate events - for _, expEvt := range exp.evts { + for _, expEvt := range cmd.evts { checkHost := expEvt.HostName != anyHost checkComm := expEvt.ProcessName != anyComm checkProcessorID := expEvt.ProcessorID != anyProcessorID @@ -2228,7 +2288,7 @@ func ExpectAllEqualTo(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, assert.Equal(t, expEvt.ProcessorID, actEvt.ProcessorID, "processor id") } if checkPID { - assert.Equal(t, expEvt.ProcessID, pidToCheck(exp.runCmd, actEvt), "pid") + assert.Equal(t, expEvt.ProcessID, pidToCheck(cmd.runCmd, actEvt), "pid") } if checkUID { assert.Equal(t, expEvt.UserID, actEvt.UserID, "user id") @@ -2265,27 +2325,29 @@ func ExpectAllEqualTo(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, } } -// ExpectAllInOrder expects all events to be equal to the expected events in the same order -func ExpectAllInOrder(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { +// ExpectAllInOrderSequentially validates that the actual events match the +// expected events for each command, with events appearing in the same order. +func ExpectAllInOrderSequentially(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, useSyscaller bool) { // first stage: run commands actual.clear() procs, _ := runCmds(t, cmdEvents, actual, useSyscaller, true) if len(procs) > len(cmdEvents) { t.Fatalf("expected %d commands, but got %d", len(cmdEvents), len(procs)) } - actEvtsCopy := copyActualEvents(actual) + + actEvtsCopy := actual.getCopy() // second stage: check events - for cmdIdx, exp := range cmdEvents { + for cmdIdx, cmd := range cmdEvents { syscallsInSets := []string{} - checkSets := len(exp.sets) > 0 + checkSets := len(cmd.sets) > 0 if checkSets { - syscallsInSets = getAllSyscallsInSets(exp.sets) + syscallsInSets = getAllSyscallsInSets(cmd.sets) } // compare the expected events with the actual events in the same order - for evtIdx, expEvt := range exp.evts { - actEvt := actEvtsCopy[cmdIdx*len(exp.evts)+evtIdx] + for evtIdx, expEvt := range cmd.evts { + actEvt := actEvtsCopy[cmdIdx*len(cmd.evts)+evtIdx] if checkSets { assert.Contains(t, syscallsInSets, actEvt.EventName, "event name in set") @@ -2309,7 +2371,7 @@ func ExpectAllInOrder(t *testing.T, cmdEvents []cmdEvents, actual *eventBuffer, assert.Equal(t, expEvt.ProcessorID, actEvt.ProcessorID, "processor id") } if checkPID { - assert.Equal(t, expEvt.ProcessID, pidToCheck(exp.runCmd, actEvt), "pid") + assert.Equal(t, expEvt.ProcessID, pidToCheck(cmd.runCmd, actEvt), "pid") } if checkUID { assert.Equal(t, expEvt.UserID, actEvt.UserID, "user id") diff --git a/tests/integration/tracee.go b/tests/integration/tracee.go index 2ad4fabf9f20..3743bddff473 100644 --- a/tests/integration/tracee.go +++ b/tests/integration/tracee.go @@ -27,6 +27,12 @@ type eventBuffer struct { events []trace.Event } +func newEventBuffer() *eventBuffer { + return &eventBuffer{ + events: make([]trace.Event, 0), + } +} + // addEvent adds an event to the eventBuffer func (b *eventBuffer) addEvent(evt trace.Event) { b.mu.Lock() @@ -40,7 +46,7 @@ func (b *eventBuffer) clear() { b.mu.Lock() defer b.mu.Unlock() - b.events = b.events[:0] + b.events = make([]trace.Event, 0) } // len returns the number of events in the eventBuffer @@ -51,6 +57,17 @@ func (b *eventBuffer) len() int { return len(b.events) } +// getCopy returns a copy of the eventBuffer events +func (b *eventBuffer) getCopy() []trace.Event { + b.mu.RLock() + defer b.mu.RUnlock() + + evts := make([]trace.Event, len(b.events)) + copy(evts, b.events) + + return evts +} + // load tracee into memory with args func startTracee(ctx context.Context, t *testing.T, cfg config.Config, output *config.OutputConfig, capture *config.CaptureConfig) *tracee.Tracee { initialize.SetLibbpfgoCallbacks()