fix tests

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Dec 18, 2024 · a1c3d16 · a1c3d16
1 parent e2cf0df
commit a1c3d16
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 6 deletions.
diff --git a/test/e2e/tests/test_network/test_network.py b/test/e2e/tests/test_network/test_network.py
@@ -40,7 +40,7 @@ def expected_events(origin: dict, destination: dict) -> list:
             "proc.exe": "curl",
         }, {
             "container.id": origin['id'],
-            "evt.args": "fd=3(<4>)",
+            "evt.args": "fd=3(<4>) domain=2(AF_INET) type=1 proto=0",
             "evt.category": "net",
             "evt.type": "socket",
             "fd.name": "",

diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -2591,10 +2591,12 @@ inline void sinsp_parser::add_socket(sinsp_evt *evt,
 #endif
 		   domain != 17)  // AF_PACKET, used for packet capture
 		{
-			//
-			// IPv6 will go here
-			//
-			ASSERT(false);
+			// A possible case in which we enter here is when we reproduce an old scap-file like
+			// `scap_2013` in our tests. In this case, we have only the exit event of the socket
+			// `evt_num=5` because we have just started the capture so we lost the enter event. The
+			// result produced by our scap-file converter is a socket with (domain=0, type=0,
+			// protocol=0).
+			fdi->m_type == SCAP_FD_UNKNOWN
 		}
 	}
 

diff --git a/userspace/libsinsp/test/parsers/parse_connect.cpp b/userspace/libsinsp/test/parsers/parse_connect.cpp
@@ -27,7 +27,7 @@ TEST_F(sinsp_with_test_input, CONNECT_parse_unix_socket) {
 	add_default_init_thread();
 	open_inspector();
 
-	generate_socket_x_event(sinsp_test_input::socket_params(PPM_AF_UNIX, SOCK_STREAM));
+	auto evt = generate_socket_x_event(sinsp_test_input::socket_params(PPM_AF_UNIX, SOCK_STREAM));
 
 	auto fdinfo = evt->get_fd_info();
 	ASSERT_TRUE(fdinfo);