Skip to content

Commit 6316a77

Browse files
nad2040nad2040
committed
fix err with pipe2 not being processed
dup3 flags are tracked now reincrease HS_MAX_PATH back to 4096 as artificial limit for paths. dyn lens work, so it doesn't impact performance now. reimplement the syscall_of_nr integration with crate for printing out the event logs fix issue with nul bytes showing. and handle the case where path1 and path2 are missing from the structure
1 parent d6359be commit 6316a77

4 files changed

Lines changed: 77 additions & 30 deletions

File tree

‎src/bpf/hs_trace.bpf.c‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,8 @@ BPF_PROG(hs_trace_create_pipe_exit)
346346
exit.pid_tgid = pid_tgid;
347347
exit.ret = ((struct sys_exit_pipe2_args *)ctx)->ret;
348348

349+
bpf_dynptr_write(&ptr, 0, &exit, sizeof(struct sys_exit_info_t), 0);
350+
349351
bpf_ringbuf_submit_dynptr(&ptr, 0);
350352

351353
return 0;
@@ -571,17 +573,18 @@ BPF_PROG(hs_trace_sys_enter, struct pt_regs *regs, long syscall_id)
571573
event_type = ENTER_PATH1;
572574
break;
573575
#endif
576+
#ifdef __NR_dup3
577+
case __NR_dup3:
578+
flags = (unsigned int)PT_REGS_PARM3_CORE(regs);
579+
// FALLTHROUGH
580+
#endif
574581
#ifdef __NR_dup2
575582
case __NR_dup2:
576-
// FALLTHROUGH
577583
#endif
578-
#ifdef __NR_dup3
579-
case __NR_dup3:
580584
fd = (int)PT_REGS_PARM1_CORE(regs);
581585
fd2 = (int)PT_REGS_PARM2_CORE(regs);
582586
event_type = ENTER_PATH2;
583587
break;
584-
#endif
585588
#ifdef __NR_dup
586589
case __NR_dup:
587590
fd = (int)PT_REGS_PARM1_CORE(regs);
@@ -746,7 +749,15 @@ BPF_PROG(hs_trace_sys_enter, struct pt_regs *regs, long syscall_id)
746749
bpf_printk("failed to read user str path1, %d, "
747750
"pathptr1 = %p\n",
748751
len1, pathptr1);
749-
return 0;
752+
len1 = bpf_probe_read_kernel_str(path1, HS_MAX_PATH,
753+
pathptr1);
754+
if (len1 < 0) {
755+
bpf_printk(
756+
"failed to read kernel str path1, %d, "
757+
"pathptr1 = %p\n",
758+
len1, pathptr1);
759+
return 0;
760+
}
750761
}
751762
}
752763
len1 &= (HS_MAX_PATH - 1);
@@ -760,7 +771,15 @@ BPF_PROG(hs_trace_sys_enter, struct pt_regs *regs, long syscall_id)
760771
len2 = bpf_probe_read_user_str(path2, HS_MAX_PATH, pathptr2);
761772
if (len2 < 0) {
762773
bpf_printk("failed to read user str path2, %d\n", len2);
763-
return 0;
774+
len2 = bpf_probe_read_kernel_str(path2, HS_MAX_PATH,
775+
pathptr2);
776+
if (len2 < 0) {
777+
bpf_printk(
778+
"failed to read kernel str path2, %d, "
779+
"pathptr2 = %p\n",
780+
len2, pathptr2);
781+
return 0;
782+
}
764783
}
765784
}
766785
len2 &= (HS_MAX_PATH - 1);

‎src/bpf/hs_trace.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
#define _HS_TRACE_H_
33

44
#ifndef HS_MAX_PATH
5-
#define HS_MAX_PATH 1024
5+
#define HS_MAX_PATH 4096
66
#endif
77

88
#ifndef BUFF_SIZE

‎src/dep_tracer.rs‎

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,15 @@ impl Display for SyscallEvent {
196196
write!(
197197
f,
198198
"{}(fd={},path={},fd2={},path2={},flags={})",
199-
syscall_nr, fd, path1, fd2, path2, flags
199+
match syscall_of_nr(*syscall_nr as u64) {
200+
Some(syscall) => syscall,
201+
None => "syscall_nr not found",
202+
},
203+
fd,
204+
path1,
205+
fd2,
206+
path2,
207+
flags
200208
)
201209
}
202210
SyscallEvent::Exit { pid_tgid: _, ret } => {
@@ -372,7 +380,9 @@ impl Context {
372380
.fd_tables
373381
.get(&parent_pid)
374382
.expect(format!("missing fd table for {parent_pid}").as_str());
383+
// println!("clone: parent {fd_table:#?}");
375384
let mut child_fd_table = fd_table.clone();
385+
// println!("clone: child {child_fd_table:#?}");
376386
for (_fd_, file_desc) in child_fd_table.iter_mut() {
377387
self.open_files.increment_ref_count(file_desc.open_file);
378388
}
@@ -408,6 +418,7 @@ impl Context {
408418
.fd_tables
409419
.get_mut(&pid)
410420
.expect(format!("expected fd table for pid {pid}").as_str());
421+
// println!("ctxt.dup_file: {fd_table:#?}");
411422
let old_file_desc = fd_table
412423
.get(&old_fd)
413424
.expect(format!("expected old fd {old_fd} to be present for pid {pid}").as_str());
@@ -423,6 +434,7 @@ impl Context {
423434
}
424435

425436
pub fn create_pipe(&mut self, pid_tgid: u64, fd1: i32, fd2: i32, flags: u32, path: PathBuf) {
437+
// println!("fds passed to create_pipe are {fd1} and {fd2}");
426438
let pid = upid_of(pid_tgid);
427439
let read_end = self.open_files.open_file(0, path.clone());
428440
let write_end = self.open_files.open_file(0, path);
@@ -449,6 +461,7 @@ impl Context {
449461
open_file: write_end,
450462
},
451463
);
464+
// println!("{fd_table:#?}");
452465
}
453466

454467
// pub fn close_file(&mut self, pid_tgid: u64, fd: i32) {
@@ -914,19 +927,19 @@ fn parse_openat(
914927
}
915928
}
916929

917-
// fn parse_close(
918-
// ctxt: &mut Context,
919-
// sets: &mut RWSet,
920-
// pid_tgid: u64,
921-
// ret: i64,
922-
// flags: u32,
923-
// fd: i32,
924-
// path: &str,
925-
// ) {
926-
// // if ret >= 0 {
927-
// // ctxt.close_file(pid_tgid, fd);
928-
// // }
929-
// }
930+
fn parse_close(
931+
ctxt: &mut Context,
932+
sets: &mut RWSet,
933+
pid_tgid: u64,
934+
ret: i64,
935+
flags: u32,
936+
fd: i32,
937+
path: &str,
938+
) {
939+
if ret >= 0 {
940+
// ctxt.close_file(pid_tgid, fd);
941+
}
942+
}
930943

931944
fn parse_open(
932945
ctxt: &mut Context,
@@ -1105,10 +1118,12 @@ pub fn event_stream_handler(rx: mpsc::Receiver<Option<SyscallEvent>>) -> Result<
11051118
loop {
11061119
match rx.recv() {
11071120
Ok(Some(enter @ SyscallEvent::Enter { pid_tgid, .. })) => {
1121+
// print!("{enter}");
11081122
let mut logs = LOGS.lock().unwrap();
11091123
logs.update_log(pid_tgid, enter)
11101124
}
11111125
Ok(Some(exit @ SyscallEvent::Exit { pid_tgid, ret })) => {
1126+
// print!("{exit}");
11121127
let mut logs = LOGS.lock().unwrap();
11131128
logs.update_log(pid_tgid, exit);
11141129
let event_queue = logs.log.get(&pid_tgid).unwrap();

‎src/main.rs‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -209,15 +209,27 @@ fn main() -> Result<()> {
209209
let path1_len = header.path1_len as usize;
210210
let path2_len = header.path2_len as usize;
211211

212-
let path1_data = &data[header_len..header_len + path1_len];
213-
let path2_data = &data[header_len + path1_len..header_len + path1_len + path2_len];
214-
215-
let path1 = std::str::from_utf8(path1_data)
216-
.expect("invalid utf8 string")
217-
.to_string();
218-
let path2 = std::str::from_utf8(path2_data)
219-
.expect("invalid utf8 string")
220-
.to_string();
212+
let path1_data = &data[header_len..(header_len + path1_len)];
213+
let path2_data = &data[(header_len + path1_len)..(header_len + path1_len + path2_len)];
214+
215+
let path1 = if path1_len > 0 {
216+
CStr::from_bytes_with_nul(path1_data)
217+
.expect("invalid C string")
218+
.to_str()
219+
.expect("should be valid str")
220+
.to_string()
221+
} else {
222+
String::new()
223+
};
224+
let path2 = if path2_len > 0 {
225+
CStr::from_bytes_with_nul(path2_data)
226+
.expect("invalid C string")
227+
.to_str()
228+
.expect("should be valid str")
229+
.to_string()
230+
} else {
231+
String::new()
232+
};
221233

222234
SyscallEvent::Enter {
223235
pid_tgid: header.pid_tgid,
@@ -316,5 +328,6 @@ fn main() -> Result<()> {
316328
}
317329
}
318330
}
331+
println!("{program_total} missed events during the duration of the program");
319332
Ok(())
320333
}

0 commit comments

Comments
 (0)