tracee
tracee copied to clipboard
aquasecurity
[FEAT] add output tests
Prerequisites
Select one OR another:
- [ ] I'll create a PR to implement this feature (assign to yourself).
- [x] Someone else should implement this (describe it well).
Feature description
This feature is about adding tests regarding different output methods we have (table, json, gob) The test should be able to catch, for example, errors that results from not registering gob type, exceeding from table column width or breaking the json output.
The feature is needed because bugs happens for different output types.
Additional Information (feature drawings, files, logs, etc)
Hello, can I be assigned to this issue ? And I couldn't find documentation about tests, are there indications about how they should be written ?
The feature is needed because bugs happens for different output types.
Also, is it possible to have more details about those bugs ?
@cdelzotti example for gob issues:
https://github.com/aquasecurity/tracee/issues/1617
The overall idea is that all output printers types should be tested for all existing possible types, from all events, that are marshaled/unmarshalled. This way we would get errors that happen runtime only whenever an event needs unmarshalling for a type we haven't considered.
We don't have documentation for tests I'm afraid, only code.
So, if I understand correctly, the "pipe" between tracee-ebpf and tracee-rules must be tested for all supported format (which are currently gob and json if I'm not mistaken) for all possible events to ensure that everything can be printed and read correctly ?
I'm currently thinking about a test file importing cmd/tracee-ebpf/internal/printer and tracee-rules/input.go to check if everything that is marshaled by the printer can be unmarshalled by tracee-rules input. Does this deserves its own section within the tests/ directory ?
Hmm, how can I actually perform these tests knowing that printer.go is located in an internal package and input.go functions are not exported ?
I don't know if there is a way to import these or if I'm supposed to change de visibility of some functions :thinking: