tests: add test for go caller function and package

.github/workflows/test.yml

@@ -26,4 +26,4 @@ jobs:
         run: (cd testpkgs/basiccgo && make all)
 
       - name: Run tests
-        run: (cd track_syscalls && sudo go test)
+        run: (cd track_syscalls && sudo go test ./...)

track_syscalls/main.go

@@ -53,7 +53,7 @@ func main() {
 func runBuildMode(args Args) {
 	syscalls := make(map[string]map[int]bool)
 	setupAndRun(args.BinaryPath, args.ModManifest, func(event ebpfEvent, stackTrace []uint64, objs *ebpfObjects) {
-		callerPackage, _, err := stackanalyzer.GetCallerPackageAndFunction(stackTrace)
+		callerPackage, _, err := stackanalyzer.ResolveCallerAndPackageNameFromStackTrace(stackTrace)
 		if err != nil {
 			log.Printf("Error getting caller package: %v", err)
 			return
@@ -97,7 +97,7 @@ func runEnforceMode(args Args) {
 	defer f.Close()
 
 	setupAndRun(args.BinaryPath, args.ModManifest, func(event ebpfEvent, stackTrace []uint64, objs *ebpfObjects) {
-		callerPackage, _, err := stackanalyzer.GetCallerPackageAndFunction(stackTrace)
+		callerPackage, _, err := stackanalyzer.ResolveCallerAndPackageNameFromStackTrace(stackTrace)
 		if err != nil {
 			log.Printf("Error getting caller package: %v", err)
 			return

track_syscalls/main_test.go

@@ -53,7 +53,7 @@ func TestBuild(t *testing.T) {
 	StopTracer(tracer)
 
 	var expectedCallerFunction = "Go caller function: example.com/filereader.ExecuteMaliciousCGO"
-	var expectedCallerPackage = "Go caller package: example.com"
+	var expectedCallerPackage = "Go caller package: example.com/filereader"
 	var actualOutput = outputBuffer.String()
 
 	if !strings.Contains(actualOutput, expectedCallerFunction) {

track_syscalls/stackanalyzer/stackanalyzer.go

@@ -18,6 +18,7 @@ type ImportedPackages struct {
 	packages []string
 }
 
+// ToDo: do not use global variables
 var ImportedPackagesCache *ImportedPackages
 
 func LoadModuleCache(modManifest string) error {
@@ -69,7 +70,7 @@ func ResolveSymbols(stackTrace []uint64) string {
 	return strings.Join(resolved, "\n")
 }
 
-func GetCallerPackageAndFunction(stackTrace []uint64) (string, string, error) {
+func ResolveCallerAndPackageNameFromStackTrace(stackTrace []uint64) (string, string, error) {
 
 	if ImportedPackagesCache == nil {
 		return "", "", fmt.Errorf("ImportedPackagesCache is not initialized")
@@ -83,11 +84,22 @@ func GetCallerPackageAndFunction(stackTrace []uint64) (string, string, error) {
 		symbol := binanalyzer.Resolve(addr)
 
 		// Check if the symbol contains an imported Go package
-		for _, pkgName := range ImportedPackagesCache.packages {
-			if strings.Contains(symbol, pkgName) {
-				funcName := strings.TrimPrefix(symbol, pkgName+".")
-				return pkgName, funcName, nil
-			}
+		pkgName, funcName, err := GetCallerPackageAndFunction(symbol)
+		if err != nil {
+			return "", "", err
+		}
+		if pkgName != "" && funcName != "" {
+			return pkgName, funcName, nil
+		}
+	}
+	return "", "", nil
+}
+
+func GetCallerPackageAndFunction(resolvedSymbol string) (string, string, error) {
+	for _, pkgName := range ImportedPackagesCache.packages {
+		if strings.Contains(resolvedSymbol, pkgName) {
+			funcName := strings.TrimPrefix(resolvedSymbol, pkgName+".")
+			return pkgName, funcName, nil
 		}
 	}
 	return "", "", nil

track_syscalls/stackanalyzer/stackanalyzer_test.go

@@ -0,0 +1,50 @@
+package stackanalyzer
+
+import (
+	"testing"
+)
+
+func TestLoadModuleCache_CanParseRequireInGoMod(t *testing.T) {
+	// arrange
+	var modManifest string = "../../testdata/go.mod"
+
+	// act
+	err := LoadModuleCache(modManifest)
+	if err != nil {
+		t.Errorf("Error initalising module cache: %v", err)
+	}
+
+	// assert
+	if len(ImportedPackagesCache.packages) != 1 {
+		t.Errorf("Expected 1 module, got %d", len(ImportedPackagesCache.packages))
+	}
+	if ImportedPackagesCache.packages[0] != "example.com" {
+		t.Errorf("Expected module to be example.com, got %s", ImportedPackagesCache.packages[0])
+	}
+}
+
+func TestGetCallerPackageAndFunction_GetCallerAndPackageInformationFromBasiccgo(t *testing.T) {
+	// arrange
+	var stackFrame = "example.com/filereader.ExecuteMaliciousCGO"
+	var modManifest string = "../../testdata/go.mod"
+
+	// act
+	// this is to load the module cache
+	err := LoadModuleCache(modManifest)
+	if err != nil {
+		t.Errorf("Error initalising module cache: %v", err)
+	}
+	callerPackage, callerFunction, err := GetCallerPackageAndFunction(stackFrame)
+
+	// assert
+	if err != nil {
+		t.Errorf("Error getting caller package and function: %v", err)
+	}
+
+	if callerPackage != "example.com/filereader" {
+		t.Errorf("Expected caller package to be example.com/filereader, got %s", callerPackage)
+	}
+	if callerFunction != "example.com/filereader.ExecuteMaliciousCGO" {
+		t.Errorf("Expected caller function to be ExecuteMaliciousCGO, got %s", callerFunction)
+	}
+}

track_syscalls/utils.go

@@ -5,6 +5,7 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
+	"golang.org/x/sys/unix"
 	"log"
 	"os"
 	"os/signal"
@@ -15,14 +16,12 @@ import (
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/ringbuf"
 	"github.com/cilium/ebpf/rlimit"
-	"golang.org/x/sys/unix"
 )
 
 func logEvent(event ebpfEvent, stackTrace []uint64) {
 	resolvedStackTrace := stackanalyzer.ResolveSymbols(stackTrace)
-	callerPackage, callerFunction, err := stackanalyzer.GetCallerPackageAndFunction(stackTrace)
+	callerPackage, callerFunction, err := stackanalyzer.ResolveCallerAndPackageNameFromStackTrace(stackTrace)
 	if err != nil {
-		log.Printf("Error getting caller package: %v", err)
 		return
 	}