@@ -19,44 +19,36 @@ limitations under the License.
19
19
#include < libsinsp/sinsp.h>
20
20
#include < gtest/gtest.h>
21
21
22
- #include " filter_compiler.h "
22
+ #include < sinsp_with_test_input.h >
23
23
24
- TEST (sinsp_filter_check , bcontains_bstartswith)
24
+ TEST_F (sinsp_with_test_input , bcontains_bstartswith)
25
25
{
26
- // craft a fake read exit event containing the "hello" string
27
- char scap_evt_err[2048 ];
26
+ add_default_init_thread ();
27
+
28
+ open_inspector ();
29
+
28
30
uint8_t read_buf[] = {' h' , ' e' , ' l' , ' l' , ' o' };
29
- uint8_t scap_evt_buf[2048 ];
30
- size_t evt_size;
31
- scap_sized_buffer scap_evt;
32
- scap_evt.buf = (void *) &scap_evt_buf[0 ];
33
- scap_evt.size = (size_t ) sizeof (scap_evt_buf);
34
- if (scap_event_encode_params (
35
- scap_evt, &evt_size, scap_evt_err, PPME_SYSCALL_READ_X, 3 , (int64_t ) 0 ,
36
- scap_const_sized_buffer{&read_buf[0 ],sizeof (read_buf)}) != SCAP_SUCCESS)
37
- {
38
- FAIL () << " could not create scap event" ;
39
- }
40
- sinsp_evt evt;
41
- evt.init ((uint8_t *) scap_evt.buf , 0 ); // 68656c6c6f
31
+ sinsp_evt * evt = add_event_advance_ts (increasing_ts (), 1 , PPME_SYSCALL_READ_X, 2 , (int64_t ) 0 , scap_const_sized_buffer{read_buf, sizeof (read_buf)});
42
32
43
33
// test filters with bcontains
44
- filter_compile (NULL , " evt.buffer bcontains" );
45
- filter_compile (NULL , " evt.buffer bcontains 2" );
46
- filter_compile (NULL , " evt.buffer bcontains 2g" );
47
- filter_run (&evt, true , " evt.buffer bcontains 68656c6c6f" );
48
- filter_run (&evt, true , " evt.buffer bcontains 656c6C" );
49
- filter_run (&evt, false , " evt.buffer bcontains 20" );
50
- filter_run (&evt, false , " evt.buffer bcontains 656c6cAA" );
34
+ EXPECT_FALSE (filter_compiles (" evt.buffer bcontains" ));
35
+ EXPECT_FALSE (filter_compiles (" evt.buffer bcontains 2" ));
36
+ EXPECT_FALSE (filter_compiles (" evt.buffer bcontains 2g" ));
37
+
38
+ EXPECT_TRUE (eval_filter (evt, " evt.buffer bcontains 68656c6c6f" ));
39
+ EXPECT_TRUE (eval_filter (evt, " evt.buffer bcontains 656c6C" ));
40
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bcontains 20" ));
41
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bcontains 656c6cAA" ));
51
42
52
43
// test filters with bstartswith
53
- filter_compile (NULL , " evt.buffer bstartswith" );
54
- filter_compile (NULL , " evt.buffer bstartswith 2" );
55
- filter_compile (NULL , " evt.buffer bstartswith 2g" );
56
- filter_run (&evt, true , " evt.buffer bstartswith 68" );
57
- filter_run (&evt, true , " evt.buffer bstartswith 68656c6c6f" );
58
- filter_run (&evt, false , " evt.buffer bstartswith 65" );
59
- filter_run (&evt, false , " evt.buffer bstartswith 656c6C" );
60
- filter_run (&evt, false , " evt.buffer bstartswith 20" );
61
- filter_run (&evt, false , " evt.buffer bstartswith 656c6cAA" );
44
+ EXPECT_FALSE (filter_compiles (" evt.buffer bstartswith" ));
45
+ EXPECT_FALSE (filter_compiles (" evt.buffer bstartswith 2" ));
46
+ EXPECT_FALSE (filter_compiles (" evt.buffer bstartswith 2g" ));
47
+
48
+ EXPECT_TRUE (eval_filter (evt, " evt.buffer bstartswith 68" ));
49
+ EXPECT_TRUE (eval_filter (evt, " evt.buffer bstartswith 68656c6c6f" ));
50
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bstartswith 65" ));
51
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bstartswith 656c6C" ));
52
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bstartswith 20" ));
53
+ EXPECT_FALSE (eval_filter (evt, " evt.buffer bstartswith 656c6cAA" ));
62
54
}
0 commit comments