diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index 59ab44b423..87e33d375a 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -3672,9 +3672,9 @@ void sinsp_parser::parse_rw_exit(sinsp_evt *evt) { } if((etype == PPME_SOCKET_SEND_X || etype == PPME_SOCKET_SENDTO_X) && - evt->get_fd_info() == nullptr && evt->get_tinfo() != nullptr) { + evt->get_fd_info() == nullptr && evt->get_tinfo() != nullptr) { infer_sendto_fdinfo(evt); - } + } if(evt->get_fd_info() == NULL) { return; diff --git a/userspace/libsinsp/test/scap_files/converter_tests.cpp b/userspace/libsinsp/test/scap_files/converter_tests.cpp index 858c4ca35f..ab651df6eb 100644 --- a/userspace/libsinsp/test/scap_files/converter_tests.cpp +++ b/userspace/libsinsp/test/scap_files/converter_tests.cpp @@ -17,6 +17,7 @@ limitations under the License. */ +#include #include // Use `sudo sysdig -r -S -q` to check the number of events in the scap file. @@ -200,6 +201,64 @@ TEST_F(scap_file_test, listen_x_check_final_converted_event) { create_safe_scap_event(ts, tid, PPME_SOCKET_LISTEN_X, 3, res, fd, backlog)); } +//////////////////////////// +// ACCEPT +//////////////////////////// + +TEST_F(scap_file_test, accept_e_same_number_of_events) { + open_filename("scap_2013.scap"); + assert_num_event_type(PPME_SOCKET_ACCEPT_E, 3817); +} + +TEST_F(scap_file_test, accept_x_same_number_of_events) { + open_filename("scap_2013.scap"); + assert_num_event_type(PPME_SOCKET_ACCEPT_5_X, 3816); +} + +// Compile out this test if test_utils helpers are not defined. +#if !defined(_WIN32) && !defined(__EMSCRIPTEN__) && !defined(__APPLE__) +TEST_F(scap_file_test, accept_x_check_final_converted_event) { + open_filename("scap_2013.scap"); + + // Inside the scap-file the event `519217` is the following: + // - type=PPME_SOCKET_ACCEPT_X, + // - ts=1380933088302022447 + // - tid=43625 + // - args=fd=13(<4t>127.0.0.1:38873->127.0.0.1:80) tuple=127.0.0.1:38873->127.0.0.1:80 + // queuepct=37 queuepct=37 + // + // And its corresponding enter event `519211` is the following: + // - type=PPME_SOCKET_ACCEPT_E + // - ts=1380933088302013474 + // - tid=43625 + // - args= + // + // Let's see the new PPME_SOCKET_ACCEPT_5_X event! + + uint64_t ts = 1380933088302022447; + int64_t tid = 43625; + int64_t fd = 13; + sockaddr_in client_sockaddr = test_utils::fill_sockaddr_in(38873, "127.0.0.1"); + sockaddr_in server_sockaddr = test_utils::fill_sockaddr_in(80, "127.0.0.1"); + const std::vector tuple = + test_utils::pack_socktuple(reinterpret_cast(&client_sockaddr), + reinterpret_cast(&server_sockaddr)); + int32_t queuepct = 37; + int32_t queuelen = 0; + int32_t queuemax = 0; + assert_event_presence( + create_safe_scap_event(ts, + tid, + PPME_SOCKET_ACCEPT_5_X, + 5, + fd, + scap_const_sized_buffer{tuple.data(), tuple.size()}, + queuepct, + queuelen, + queuemax)); +} +#endif + //////////////////////////// // WRITE ////////////////////////////