Function TestFTPDecoder

collector/file_extraction_test.go:317–408

TestFTPDecoder tests FTP decoder functionality

(t *testing.T)

// TestFTPDecoder tests FTP decoder functionality
func TestFTPDecoder(t *testing.T) {
	if !fileExists(ftpPCAP) {
		t.Skip("FTP test PCAP not found:", ftpPCAP)
	}

	tmpDir := t.TempDir()

	// Configure file extraction
	cfg := file.GetDefaultConfig()
	cfg.FileExtraction.Enabled = true
	cfg.FileExtraction.Protocols.FTP = true
	file.SetGlobalConfig(cfg)

	// Create collector
	c := createTestCollector(tmpDir, false)
	c.InputFile = ftpPCAP

	// Run capture
	err := c.CollectPcap(ftpPCAP)
	if err != nil {
		t.Fatalf("Capture failed: %v", err)
	}

	// Check for FTP audit records
	ftpAuditPath := filepath.Join(tmpDir, "FTP.ncap.gz")
	if !fileExists(ftpAuditPath) {
		t.Log("No FTP audit records created")
		return
	}

	// Read FTP records
	reader, err := netio.Open(ftpAuditPath, defaults.BufferSize)
	if err != nil {
		t.Fatalf("Failed to open FTP audit records: %v", err)
	}
	defer reader.Close()

	// Read file header first
	header, err := reader.ReadHeader()
	if err != nil {
		t.Fatalf("Failed to read FTP audit header: %v", err)
	}
	if header.Type != types.Type_NC_FTP {
		t.Fatalf("Expected FTP type, got: %v", header.Type)
	}

	var ftpRecord types.FTP
	commandCount := 0
	var foundRETR, foundSTOR, foundPORT, foundPASV bool

	for {
		err := reader.Next(&ftpRecord)
		if err != nil {
			if err != io.EOF {
				t.Errorf("Error reading FTP record: %v", err)
			}
			break
		}