threathunters-io / laurel

Transform Linux Audit logs for SIEM usage
GNU General Public License v3.0
707 stars 56 forks source link

test failure on big endian. #206

Closed plugwash closed 8 months ago

plugwash commented 8 months ago

Recently we started running the tests for rust-laurel in Debian. When doing so we ran into a test failure on s390x.

107s ---- sockaddr::test::parse_syslog stdout ---- 107s Error: UnrecognizedFamily(256)

Reading the code, it seems to take a series of bytes and interpret those bytes as a sockaddr. However this makes the test data endian sensitive.

In Debian I simply added a patch to skip the tests on big-endian systems. It would alternatively be possible to make the test use different test data depending on the system's endian.

The patch I uploaded to Debian is available at.

https://salsa.debian.org/rust-team/debcargo-conf/-/blob/552e0ea5947350af3eb0bbd7564276a5d466822b/src/laurel/debian/patches/fix-time-overflow.patch