Function TestBuildAuditNetlinkMessage

ssh/tailssh/auditd_linux_test.go:31–114

(t *testing.T)

}

func TestBuildAuditNetlinkMessage(t *testing.T) {
	testCases := []struct {
		name     string
		msgType  uint16
		message  string
		wantType uint16
	}{
		{
			name:     "simple-message",
			msgType:  auditUserLogin,
			message:  "op=login acct=test",
			wantType: auditUserLogin,
		},
		{
			name:     "message-with-quoted-fields",
			msgType:  auditUserLogin,
			message:  `op=login hostname="test-host" exe="/usr/bin/tailscaled" ts_user="user@example.com" ts_node="node.tail-scale.ts.net"`,
			wantType: auditUserLogin,
		},
		{
			name:     "message-with-special-chars",
			msgType:  auditUserLogin,
			message:  `op=login hostname="host with spaces" ts_user="user name@example.com" ts_display_name="User \"Quote\" Name"`,
			wantType: auditUserLogin,
		},
		{
			name:     "long-message-truncated",
			msgType:  auditUserLogin,
			message:  string(make([]byte, 2000)),
			wantType: auditUserLogin,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			msg, err := buildAuditNetlinkMessage(tc.msgType, tc.message)
			if err != nil {
				t.Fatalf("buildAuditNetlinkMessage failed: %v", err)
			}

			if len(msg) < syscall.NLMSG_HDRLEN {
				t.Fatalf("message too short: got %d bytes, want at least %d", len(msg), syscall.NLMSG_HDRLEN)
			}

			var nlh syscall.NlMsghdr
			buf := bytes.NewReader(msg[:syscall.NLMSG_HDRLEN])
			if err := binary.Read(buf, binary.NativeEndian, &nlh); err != nil {
				t.Fatalf("failed to parse netlink header: %v", err)
			}

			if nlh.Type != tc.wantType {
				t.Errorf("message type: got %d, want %d", nlh.Type, tc.wantType)
			}

			if nlh.Flags != nlmFRequest {
				t.Errorf("flags: got 0x%x, want 0x%x", nlh.Flags, nlmFRequest)
			}