From 746a94ae6ae0154cd84613f7146a4005dd50cc15 Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Fri, 14 Jun 2024 16:54:57 +0000 Subject: [PATCH 1/2] new(tests): add tests for event result Signed-off-by: Luca Guerra --- userspace/libsinsp/test/events_evt.ut.cpp | 42 +++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/userspace/libsinsp/test/events_evt.ut.cpp b/userspace/libsinsp/test/events_evt.ut.cpp index 09346d5d3b..ac5ac4b648 100644 --- a/userspace/libsinsp/test/events_evt.ut.cpp +++ b/userspace/libsinsp/test/events_evt.ut.cpp @@ -19,6 +19,7 @@ limitations under the License. #include #include +#include #include "test_utils.h" TEST_F(sinsp_with_test_input, event_category) @@ -57,6 +58,47 @@ TEST_F(sinsp_with_test_input, event_category) ASSERT_EQ(get_field_as_string(evt, "evt.num"), "4"); } +TEST_F(sinsp_with_test_input, event_res) +{ + add_default_init_thread(); + + open_inspector(); + + sinsp_evt * evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_EPOLL_CREATE_E, 1, (uint32_t)-1); + EXPECT_FALSE(field_has_value(evt, "evt.res")); + + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_EPOLL_CREATE_X, 1, (int64_t)-SE_EINVAL); + + EXPECT_EQ(get_field_as_string(evt, "evt.res"), "EINVAL"); + EXPECT_EQ(get_field_as_string(evt, "evt.rawres"), "-22"); + EXPECT_TRUE(eval_filter(evt, "evt.rawres < 0")); + EXPECT_EQ(get_field_as_string(evt, "evt.failed"), "true"); + EXPECT_EQ(get_field_as_string(evt, "evt.count.error"), "1"); + + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_EPOLL_CREATE_E, 1, (uint32_t) 100); + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_EPOLL_CREATE_X, 1, (uint64_t) 0); + + EXPECT_EQ(get_field_as_string(evt, "evt.res"), "SUCCESS"); + EXPECT_EQ(get_field_as_string(evt, "evt.rawres"), "0"); + EXPECT_EQ(get_field_as_string(evt, "evt.failed"), "false"); + + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_E, 3, "/tmp/the_file.txt", 0, 0); + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_X, 6, (int64_t)123, "/tmp/the_file.txt", 0, 0, 0, (uint64_t) 0); + + EXPECT_EQ(get_field_as_string(evt, "evt.res"), "SUCCESS"); + EXPECT_EQ(get_field_as_string(evt, "evt.rawres"), "123"); + EXPECT_EQ(get_field_as_string(evt, "evt.failed"), "false"); + + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_E, 3, "/tmp/the_file.txt", 0, 0); + evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_X, 6, (int64_t)-SE_EACCES, "/tmp/the_file.txt", 0, 0, 0, (uint64_t) 0); + + EXPECT_EQ(get_field_as_string(evt, "evt.res"), "EACCES"); + EXPECT_EQ(get_field_as_string(evt, "evt.rawres"), std::to_string(-SE_EACCES).c_str()); + EXPECT_EQ(get_field_as_string(evt, "evt.failed"), "true"); + EXPECT_EQ(get_field_as_string(evt, "evt.count.error"), "1"); + EXPECT_EQ(get_field_as_string(evt, "evt.count.error.file"), "1"); +} + TEST_F(sinsp_with_test_input, event_hostname) { #ifdef __linux__ From d687601ab22816707f769de5a37b8f63e3f64cad Mon Sep 17 00:00:00 2001 From: Luca Guerra Date: Mon, 17 Jun 2024 09:44:17 +0000 Subject: [PATCH 2/2] cleanup(libsinsp): remove misaligned access from sinsp_filtercheck.cpp Signed-off-by: Luca Guerra --- userspace/libsinsp/sinsp_filtercheck.cpp | 38 +++++++++++-------- .../libsinsp/sinsp_filtercheck_event.cpp | 6 +-- 2 files changed, 25 insertions(+), 19 deletions(-) diff --git a/userspace/libsinsp/sinsp_filtercheck.cpp b/userspace/libsinsp/sinsp_filtercheck.cpp index b260f295fb..28f1dc37bb 100644 --- a/userspace/libsinsp/sinsp_filtercheck.cpp +++ b/userspace/libsinsp/sinsp_filtercheck.cpp @@ -72,6 +72,14 @@ void sinsp_filter_check::set_inspector(sinsp* inspector) m_inspector = inspector; } +template +static inline T rawval_cast(uint8_t *rawval) +{ + T val; + memcpy(&val, rawval, sizeof(T)); + return val; +} + Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, ppm_param_type ptype, ppm_print_format print_format, @@ -102,7 +110,7 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, if(print_format == PF_DEC || print_format == PF_ID) { - return *(int16_t *)rawval; + return rawval_cast(rawval); } else if(print_format == PF_OCT || print_format == PF_HEX) @@ -119,7 +127,7 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, if(print_format == PF_DEC || print_format == PF_ID) { - return *(int32_t *)rawval; + return rawval_cast(rawval); } else if(print_format == PF_OCT || print_format == PF_HEX) @@ -134,11 +142,11 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, case PT_DOUBLE: if(print_format == PF_DEC) { - return (Json::Value::Int64)(int64_t)*(double*)rawval; + return (Json::Value::Int64)(int64_t)rawval_cast(rawval); } else { - return (Json::Value)*(double*)rawval; + return (Json::Value)rawval_cast(rawval); } case PT_INT64: case PT_PID: @@ -146,7 +154,7 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, if(print_format == PF_DEC || print_format == PF_ID) { - return (Json::Value::Int64)*(int64_t *)rawval; + return (Json::Value::Int64)rawval_cast(rawval); } else { @@ -212,7 +220,7 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, if(print_format == PF_DEC || print_format == PF_ID) { - return (Json::Value::UInt64)*(uint64_t *)rawval; + return (Json::Value::UInt64)rawval_cast(rawval); } else if( print_format == PF_10_PADDED_DEC || @@ -233,7 +241,7 @@ Json::Value sinsp_filter_check::rawval_to_json(uint8_t* rawval, return Json::nullValue; case PT_BOOL: - return Json::Value((bool)(*(uint32_t*)rawval != 0)); + return Json::Value((bool)(rawval_cast(rawval) != 0)); case PT_CHARBUF: case PT_FSPATH: @@ -309,7 +317,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(int16_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_INT32: if(print_format == PF_OCT) @@ -334,7 +342,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(int32_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_INT64: case PT_PID: @@ -365,7 +373,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(int64_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_L4PROTO: // This can be resolved in the future case PT_UINT8: @@ -417,7 +425,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(uint16_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_UINT32: if(print_format == PF_OCT) @@ -442,7 +450,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(uint32_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_UINT64: case PT_RELTIME: @@ -473,7 +481,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - prfmt, *(uint64_t *)rawval); + prfmt, rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_CHARBUF: case PT_FSPATH: @@ -494,7 +502,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, ASSERT(false); return NULL; case PT_BOOL: - if(*(uint32_t*)rawval != 0) + if(rawval_cast(rawval) != 0) { return (char*)"true"; } @@ -544,7 +552,7 @@ char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); snprintf(m_getpropertystr_storage.data(), STRPROPERTY_STORAGE_SIZE, - "%.1lf", *(double*)rawval); + "%.1lf", rawval_cast(rawval)); return m_getpropertystr_storage.data(); case PT_IPNET: m_getpropertystr_storage.resize(STRPROPERTY_STORAGE_SIZE); diff --git a/userspace/libsinsp/sinsp_filtercheck_event.cpp b/userspace/libsinsp/sinsp_filtercheck_event.cpp index f7096f48f1..596fc6f20b 100644 --- a/userspace/libsinsp/sinsp_filtercheck_event.cpp +++ b/userspace/libsinsp/sinsp_filtercheck_event.cpp @@ -1247,8 +1247,7 @@ uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt *evt, uint32_t* len, if(pi != NULL) { - ASSERT(pi->m_len == sizeof(int64_t)); - if(*(int64_t*)pi->m_val < 0) + if(pi->as() < 0) { m_val.u32 = 1; } @@ -1259,8 +1258,7 @@ uint8_t* sinsp_filter_check_event::extract_single(sinsp_evt *evt, uint32_t* len, if(pi != NULL) { - ASSERT(pi->m_len == sizeof(int64_t)); - if(*(int64_t*)pi->m_val < 0) + if(pi->as() < 0) { m_val.u32 = 1; }