Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

new: make ACCEPT_{E,X} and ACCEPT_5_{E,X} converter-managed #2210

Closed
wants to merge 1 commit into from
Closed

new: make ACCEPT_{E,X} and ACCEPT_5_{E,X} converter-managed #2210

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions driver/event_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,11 +203,13 @@ const struct ppm_event_info g_event_info[] = {
{"backlog", PT_INT32, PF_DEC}}},
[PPME_SOCKET_ACCEPT_E] = {"accept",
EC_NET | EC_SYSCALL,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION |
EF_TMP_CONVERTER_MANAGED,
0},
[PPME_SOCKET_ACCEPT_X] = {"accept",
EC_NET | EC_SYSCALL,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION |
EF_TMP_CONVERTER_MANAGED,
3,
{{"fd", PT_FD, PF_DEC},
{"tuple", PT_SOCKTUPLE, PF_NA},
Expand Down Expand Up @@ -1408,11 +1410,11 @@ const struct ppm_event_info g_event_info[] = {
[PPME_CPU_HOTPLUG_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SOCKET_ACCEPT_5_E] = {"accept",
EC_NET | EC_SYSCALL,
EF_CREATES_FD | EF_MODIFIES_STATE,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
0},
[PPME_SOCKET_ACCEPT_5_X] = {"accept",
EC_NET | EC_SYSCALL,
EF_CREATES_FD | EF_MODIFIES_STATE,
EF_CREATES_FD | EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
5,
{{"fd", PT_FD, PF_DEC},
{"tuple", PT_SOCKTUPLE, PF_NA},
Expand Down
54 changes: 54 additions & 0 deletions test/libscap/test_suites/engines/savefile/converter.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ See the License for the specific language governing permissions and
limitations under the License.
*/
#include "convert_event_test.h"

#include <libsinsp/test/test_utils.h>
#include <sys/socket.h>
#include <netinet/in.h>

Expand Down Expand Up @@ -361,3 +363,55 @@ TEST_F(convert_event_test, PPME_SOCKET_LISTEN_X_to_3_params_with_enter) {
create_safe_scap_event(ts, tid, PPME_SOCKET_LISTEN_X, 1, res),
create_safe_scap_event(ts, tid, PPME_SOCKET_LISTEN_X, 3, res, fd, backlog));
}

////////////////////////////
// ACCEPT
////////////////////////////

TEST_F(convert_event_test, PPME_SOCKET_ACCEPT_E_skip) {
uint64_t ts = 12;
int64_t tid = 25;

auto evt = create_safe_scap_event(ts, tid, PPME_SOCKET_ACCEPT_E, 0);
assert_single_conversion_skip(evt);
}

TEST_F(convert_event_test, PPME_SOCKET_ACCEPT_X_to_PPME_SOCKET_ACCEPT_5_X) {
uint64_t ts = 12;
int64_t tid = 25;

int64_t fd = 25;
char tuple[] = {'h', 'e', 'l', 'l', 'o'};
uint8_t queuepct = 3;

// Defaulted to 0
uint32_t queuelen = 0;
uint32_t queuemax = 0;

assert_single_conversion_success(
conversion_result::CONVERSION_COMPLETED,
create_safe_scap_event(ts,
tid,
PPME_SOCKET_ACCEPT_X,
3,
fd,
scap_const_sized_buffer{tuple, sizeof(tuple)},
queuepct),
create_safe_scap_event(ts,
tid,
PPME_SOCKET_ACCEPT_5_X,
5,
fd,
scap_const_sized_buffer{tuple, sizeof(tuple)},
queuepct,
queuelen,
queuemax));
}

TEST_F(convert_event_test, PPME_SOCKET_ACCEPT_5_E_skip) {
uint64_t ts = 12;
int64_t tid = 25;

auto evt = create_safe_scap_event(ts, tid, PPME_SOCKET_ACCEPT_5_E, 0);
assert_single_conversion_skip(evt);
}
15 changes: 14 additions & 1 deletion userspace/libscap/engine/savefile/converter/table.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,4 +53,17 @@ const std::unordered_map<conversion_key, conversion_info> g_conversion_table = {
{conversion_key{PPME_SOCKET_LISTEN_X, 1},
conversion_info()
.action(C_ACTION_ADD_PARAMS)
.instrs({{C_INSTR_FROM_ENTER, 0}, {C_INSTR_FROM_ENTER, 1}})}};
.instrs({{C_INSTR_FROM_ENTER, 0}, {C_INSTR_FROM_ENTER, 1}})},
{conversion_key{PPME_SOCKET_ACCEPT_E, 0}, conversion_info().action(C_ACTION_SKIP)},
{conversion_key{PPME_SOCKET_ACCEPT_X, 3},
conversion_info()
.desired_type(PPME_SOCKET_ACCEPT_5_X)
.action(C_ACTION_CHANGE_TYPE)
.instrs({
{C_INSTR_FROM_OLD, 0},
{C_INSTR_FROM_OLD, 1},
{C_INSTR_FROM_OLD, 2},
{C_INSTR_FROM_DEFAULT, 0},
{C_INSTR_FROM_DEFAULT, 0},
})},
{conversion_key{PPME_SOCKET_ACCEPT_5_E, 0}, conversion_info().action(C_ACTION_SKIP)}};
7 changes: 4 additions & 3 deletions userspace/libscap/scap_event.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -520,7 +520,7 @@ int get_enter_event_fd_location(ppm_event_code etype) {
return location;
}

// In the exit events we don't have a precise convension on the fd parameter position.
// In the exit events we don't have a precise convention on the fd parameter position.
int get_exit_event_fd_location(ppm_event_code etype) {
ASSERT(etype < PPM_EVENT_MAX);
ASSERT(PPME_IS_EXIT(etype));
Expand All @@ -529,13 +529,14 @@ int get_exit_event_fd_location(ppm_event_code etype) {
// we want to return -1 as location if we forgot to handle something
int location = -1;
switch(etype) {
case PPME_SOCKET_LISTEN_X:
location = 1;
break;
case PPME_SYSCALL_READ_X:
case PPME_SYSCALL_PREAD_X:
case PPME_SOCKET_BIND_X:
location = 2;
break;
case PPME_SOCKET_LISTEN_X:
location = 1;
default:
break;
}
Expand Down
Loading