Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

argument parsers improvements #4279

Merged
merged 14 commits into from
Jan 16, 2025
Merged

argument parsers improvements #4279

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
2d5e43a
chore: deprecate internal interface
geyslan Sep 17, 2024
2baff04
chore: add comment about raw values
geyslan Dec 17, 2024
9a328a9
perf: improve ParseCloneFlags
geyslan Sep 17, 2024
86b68aa
perf: fix: improve ParseOpenFlagArgument
geyslan Sep 17, 2024
c99ebed
perf: fix: improve ParseAccessMode
geyslan Sep 17, 2024
9b8fe58
feat: perf: fix: AT flags parsing
geyslan Sep 17, 2024
88f4f92
perf: chore: add missing flags to ParseCapability
geyslan Sep 17, 2024
6c2ca98
perf: chore: add missing flags to ParsePrctlOption
geyslan Sep 17, 2024
083cfd4
perf: chore: add missing flags to ParseBPFCmd
geyslan Sep 17, 2024
35613a5
perf: chore: add flags ParsePtraceRequestArgument
geyslan Sep 17, 2024
4fc5f7c
perf: chore: improve ParseSocketcallCall
geyslan Sep 17, 2024
af50e8b
perf: chore: add flag to ParseSocketDomainArgument
geyslan Sep 17, 2024
9676369
feat: parse dirfd for special case AT_FDCWD
geyslan Sep 17, 2024
cb55f8f
fix(parsers): fix openFlagsValues O_LARGEFILE
geyslan Jan 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/bufferdecoder/eventsreader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,9 +255,9 @@ func readSockaddrFromBuff(ebpfMsgDecoder *EbpfDecoder) (map[string]string, error
}
socketDomainArg, err := parsers.ParseSocketDomainArgument(uint64(family))
if err != nil {
socketDomainArg = parsers.AF_UNSPEC
socketDomainArg = parsers.AF_UNSPEC.String()
}
res["sa_family"] = socketDomainArg.String()
res["sa_family"] = socketDomainArg
switch family {
case 1: // AF_UNIX
/*
Expand Down
35 changes: 30 additions & 5 deletions pkg/events/parse_args.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ func ParseArgs(event *trace.Event) error {
}
}

switch ID(event.EventID) {
evtID := ID(event.EventID)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After all refactoring (optimisation) is complete, I plan to make ParseArgs() smaller (cache wise), fetching parsers from a slice or map based on its eventId. It will certainly help to deduplicate code and expand the parsing to other events.

switch evtID {
case MemProtAlert:
if alertArg := GetArg(event, "alert"); alertArg != nil {
if alert, isUint32 := alertArg.Value.(uint32); isUint32 {
Expand Down Expand Up @@ -83,8 +84,8 @@ func ParseArgs(event *trace.Event) error {
}
case Prctl:
if optArg := GetArg(event, "option"); optArg != nil {
if opt, isInt32 := optArg.Value.(int32); isInt32 {
parsePrctlOption(optArg, uint64(opt))
if option, isInt32 := optArg.Value.(int32); isInt32 {
parsePrctlOption(optArg, uint64(option))
}
}
case Socketcall:
Expand Down Expand Up @@ -115,16 +116,27 @@ func ParseArgs(event *trace.Event) error {
parseSocketType(typeArg, uint64(typ))
}
}
case Access, Faccessat:
case Access:
if modeArg := GetArg(event, "mode"); modeArg != nil {
if mode, isInt32 := modeArg.Value.(int32); isInt32 {
parseAccessMode(modeArg, uint64(mode))
}
}
case Faccessat:
if modeArg := GetArg(event, "mode"); modeArg != nil {
if mode, isInt32 := modeArg.Value.(int32); isInt32 {
parseAccessMode(modeArg, uint64(mode))
}
}
if flagsArg := GetArg(event, "flags"); flagsArg != nil {
if flags, isInt32 := flagsArg.Value.(int32); isInt32 {
parseFaccessatFlag(flagsArg, uint64(flags))
}
}
case Execveat:
if flagsArg := GetArg(event, "flags"); flagsArg != nil {
if flags, isInt32 := flagsArg.Value.(int32); isInt32 {
parseExecFlag(flagsArg, uint64(flags))
parseExecveatFlag(flagsArg, uint64(flags))
}
}
case Open, Openat, SecurityFileOpen:
Expand All @@ -139,6 +151,13 @@ func ParseArgs(event *trace.Event) error {
parseInodeMode(modeArg, uint64(mode))
}
}
if evtID == Fchmodat {
if flagsArg := GetArg(event, "flags"); flagsArg != nil {
if flags, isInt32 := flagsArg.Value.(int32); isInt32 {
parseFchmodatFlag(flagsArg, uint64(flags))
}
}
}
geyslan marked this conversation as resolved.
Show resolved Hide resolved
case Clone:
if flagsArg := GetArg(event, "flags"); flagsArg != nil {
if flags, isUint64 := flagsArg.Value.(uint64); isUint64 {
Expand Down Expand Up @@ -257,6 +276,12 @@ func ParseArgsFDs(event *trace.Event, origTimestamp uint64, fdArgPathMap *bpf.BP
}
}

if dirfdArg := GetArg(event, "dirfd"); dirfdArg != nil {
if dirfd, isInt32 := dirfdArg.Value.(int32); isInt32 {
parseDirfdAt(dirfdArg, uint64(dirfd))
}
}

return nil
}

Expand Down
60 changes: 45 additions & 15 deletions pkg/events/parse_args_helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,21 @@ package events
import (
"strconv"

"golang.org/x/sys/unix"

"github.com/aquasecurity/tracee/pkg/events/parsers"
"github.com/aquasecurity/tracee/pkg/logger"
"github.com/aquasecurity/tracee/types/trace"
)

func parseDirfdAt(arg *trace.Argument, dirfd uint64) {
if int32(dirfd) == unix.AT_FDCWD {
arg.Type = "string"
arg.Value = "AT_FDCWD"
return
}
}

func parseMMapProt(arg *trace.Argument, prot uint64) {
mmapProtArgument := parsers.ParseMmapProt(prot)
arg.Type = "string"
Expand All @@ -21,7 +31,7 @@ func parseSocketDomainArgument(arg *trace.Argument, domain uint64) {
arg.Value = strconv.FormatUint(domain, 10)
return
}
arg.Value = socketDomainArgument.String()
arg.Value = socketDomainArgument
}

func parseSocketType(arg *trace.Argument, typ uint64) {
Expand Down Expand Up @@ -61,7 +71,7 @@ func parseCapability(arg *trace.Argument, capability uint64) {
arg.Value = strconv.FormatUint(capability, 10)
return
}
arg.Value = capabilityFlagArgument.String()
arg.Value = capabilityFlagArgument
}

func parseMemProtAlert(arg *trace.Argument, alert uint32) {
Expand Down Expand Up @@ -93,17 +103,17 @@ func parsePtraceRequestArgument(arg *trace.Argument, req uint64) {
arg.Value = strconv.FormatUint(req, 10)
return
}
arg.Value = ptraceRequestArgument.String()
arg.Value = ptraceRequestArgument
}

func parsePrctlOption(arg *trace.Argument, opt uint64) {
func parsePrctlOption(arg *trace.Argument, option uint64) {
arg.Type = "string"
prctlOptionArgument, err := parsers.ParsePrctlOption(opt)
prctlOptionArgument, err := parsers.ParsePrctlOption(option)
if err != nil {
arg.Value = strconv.FormatUint(opt, 10)
arg.Value = strconv.FormatUint(option, 10)
return
}
arg.Value = prctlOptionArgument.String()
arg.Value = prctlOptionArgument
}

func parseSocketcallCall(arg *trace.Argument, call uint64) {
Expand All @@ -113,7 +123,7 @@ func parseSocketcallCall(arg *trace.Argument, call uint64) {
arg.Value = strconv.FormatUint(call, 10)
return
}
arg.Value = socketCallArgument.String()
arg.Value = socketCallArgument
}

func parseAccessMode(arg *trace.Argument, mode uint64) {
Expand All @@ -123,17 +133,37 @@ func parseAccessMode(arg *trace.Argument, mode uint64) {
arg.Value = strconv.FormatUint(mode, 10)
return
}
arg.Value = accessModeArgument.String()
arg.Value = accessModeArgument
}

func parseFaccessatFlag(arg *trace.Argument, flags uint64) {
arg.Type = "string"
faccessatFlagArgument, err := parsers.ParseFaccessatFlag(flags)
if err != nil {
arg.Value = strconv.FormatUint(flags, 10)
return
}
arg.Value = faccessatFlagArgument
}

func parseFchmodatFlag(arg *trace.Argument, flags uint64) {
arg.Type = "string"
fchmodatFlagArgument, err := parsers.ParseFchmodatFlag(flags)
if err != nil {
arg.Value = strconv.FormatUint(flags, 10)
return
}
arg.Value = fchmodatFlagArgument
}

func parseExecFlag(arg *trace.Argument, flags uint64) {
func parseExecveatFlag(arg *trace.Argument, flags uint64) {
arg.Type = "string"
execFlagArgument, err := parsers.ParseExecFlag(flags)
execFlagArgument, err := parsers.ParseExecveatFlag(flags)
if err != nil {
arg.Value = strconv.FormatUint(flags, 10)
return
}
arg.Value = execFlagArgument.String()
arg.Value = execFlagArgument
}

func parseOpenFlagArgument(arg *trace.Argument, flags uint64) {
Expand All @@ -143,7 +173,7 @@ func parseOpenFlagArgument(arg *trace.Argument, flags uint64) {
arg.Value = strconv.FormatUint(flags, 10)
return
}
arg.Value = openFlagArgument.String()
arg.Value = openFlagArgument
}

func parseCloneFlags(arg *trace.Argument, flags uint64) {
Expand All @@ -153,7 +183,7 @@ func parseCloneFlags(arg *trace.Argument, flags uint64) {
arg.Value = strconv.FormatUint(flags, 10)
return
}
arg.Value = cloneFlagArgument.String()
arg.Value = cloneFlagArgument
}

func parseBPFCmd(arg *trace.Argument, cmd uint64) {
Expand All @@ -163,7 +193,7 @@ func parseBPFCmd(arg *trace.Argument, cmd uint64) {
arg.Value = strconv.FormatUint(cmd, 10)
return
}
arg.Value = bpfCommandArgument.String()
arg.Value = bpfCommandArgument
}

func parseSocketLevel(arg *trace.Argument, level uint64) {
Expand Down
8 changes: 4 additions & 4 deletions pkg/events/parse_args_helpers_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ func TestParseArgsHelpers(t *testing.T) {
TestParsePrctlOption(t)
TestParseSocketcallCall(t)
TestParseAccessMode(t)
TestParseExecFlag(t)
TestParseExecveatFlag(t)
TestParseOpenFlagArgument(t)
TestParseCloneFlags(t)
TestParseBPFCmd(t)
Expand Down Expand Up @@ -755,7 +755,7 @@ func TestParseAccessMode(t *testing.T) {
Name: "mode",
Type: "string",
},
Value: "R_OK|W_OK|X_OK",
Value: "X_OK|W_OK|R_OK",
},
},
},
Expand All @@ -776,7 +776,7 @@ func TestParseAccessMode(t *testing.T) {
})
}
}
func TestParseExecFlag(t *testing.T) {
func TestParseExecveatFlag(t *testing.T) {
testCases := []struct {
name string
args []trace.Argument
Expand Down Expand Up @@ -833,7 +833,7 @@ func TestParseExecFlag(t *testing.T) {
event := &trace.Event{
Args: testCase.args,
}
parseExecFlag(GetArg(event, "flags"), testCase.args[0].Value.(uint64))
parseExecveatFlag(GetArg(event, "flags"), testCase.args[0].Value.(uint64))
for _, expArg := range testCase.expectedArgs {
arg := GetArg(event, expArg.Name)
assert.Equal(t, expArg, *arg)
Expand Down
Loading
Loading