test: add bpf cmd tests

Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
cilium · Sep 30, 2024 · 9915897 · 9915897
1 parent e024d73
commit 9915897
Showing 1 changed file with 64 additions and 0 deletions.
diff --git a/pkg/sensors/tracing/kprobe_test.go b/pkg/sensors/tracing/kprobe_test.go
@@ -6970,3 +6970,67 @@ tetragon_missed_prog_probes_total{attach="wake_up_new_task",policy="__base__"} 0
 		prometheus.BuildFQName(consts.MetricsNamespace, "", "missed_prog_probes_total")))
 
 }
+
+func TestKprobeBpfCmd(t *testing.T) {
+	var doneWG, readyWG sync.WaitGroup
+	defer doneWG.Wait()
+
+	ctx, cancel := context.WithTimeout(context.Background(), tus.Conf().CmdWaitTime)
+	defer cancel()
+
+	hook := `apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+ name: "bpf-cmd"
+spec:
+ kprobes:
+ - call: "security_bpf"
+   syscall: false
+   args:
+   - index: 0
+     type: "bpf_cmd"
+`
+	createCrdFile(t, hook)
+
+	obs, err := observertesthelper.GetDefaultObserverWithFile(t, ctx, testConfigFile, tus.Conf().TetragonLib, observertesthelper.WithMyPid())
+	if err != nil {
+		t.Fatalf("GetDefaultObserverWithFile error: %s", err)
+	}
+	observertesthelper.LoopEvents(ctx, t, &doneWG, &readyWG, obs)
+	readyWG.Wait()
+
+	time.Sleep(1 * time.Second)
+	err = loadTestCrd()
+	if err != nil {
+		t.Fatalf("Loading test CRD failed: %s", err)
+	}
+
+	mapCreate := ec.NewProcessKprobeChecker("").
+		WithFunctionName(sm.Full("security_bpf")).
+		WithArgs(ec.NewKprobeArgumentListMatcher().
+			WithValues(
+				ec.NewKprobeArgumentChecker().WithBpfCmdArg(tetragon.BpfCmd_BPF_MAP_CREATE),
+			),
+		)
+
+	progLoad := ec.NewProcessKprobeChecker("").
+		WithFunctionName(sm.Full("security_bpf")).
+		WithArgs(ec.NewKprobeArgumentListMatcher().
+			WithValues(
+				ec.NewKprobeArgumentChecker().WithBpfCmdArg(tetragon.BpfCmd_BPF_PROG_LOAD),
+			),
+		)
+
+	btfLoad := ec.NewProcessKprobeChecker("").
+		WithFunctionName(sm.Full("security_bpf")).
+		WithArgs(ec.NewKprobeArgumentListMatcher().
+			WithValues(
+				ec.NewKprobeArgumentChecker().WithBpfCmdArg(tetragon.BpfCmd_BPF_BTF_LOAD),
+			),
+		)
+
+	checker := ec.NewUnorderedEventChecker(mapCreate, progLoad, btfLoad)
+
+	err = jsonchecker.JsonTestCheck(t, checker)
+	assert.NoError(t, err)
+}