Merge pull request #156 from kunai-project/chore-upgrades

chore: updates and upgrades

kunai-common/src/bpf_events/events/correlation.rs

@@ -12,7 +12,6 @@ use super::MAX_ARGV_SIZE;
 /// EventProcessor. As a consequence it should hold any
 /// information the EventProcessor would need to maintain
 /// a fresh cache.
-
 pub type CorrelationEvent = Event<CorrelationData>;
 
 #[repr(C)]

kunai-common/src/bpf_events/events/dns_query.rs

@@ -38,7 +38,7 @@ impl DnsQueryData {
             // there are two bytes at front encoding the size of the packet
             return &self.data.as_slice()[2..];
         }
-        return self.data.as_slice();
+        self.data.as_slice()
     }
 }
 

kunai-common/src/path.rs

@@ -132,7 +132,7 @@ pub struct MapKey {
     hash: u64,
     // depth is a u32 to force structure alignment
     // without this kernel 5.4 fails at using this
-    // struct
+    // struct on the eBPF stack
     depth: u32,
     len: u32,
     ino: u64,

kunai/Cargo.toml

@@ -36,7 +36,7 @@ gene_derive = { version = "0.4.0" }
 anyhow = "1.0.68"
 env_logger = "0.10"
 log = "0.4"
-tokio = { version = "1.39", features = [
+tokio = { version = "1.42", features = [
     "macros",
     "rt",
     "rt-multi-thread",
@@ -55,7 +55,7 @@ uuid = { version = "1.6.1", features = ["serde", "v4", "v5"] }
 object = { version = "0.34.0", features = ["elf"] }
 huby = { version = "0.2", features = ["serde"] }
 firo = { version = "0.2" }
-yara-x = { version = "0.9.0" }
+yara-x = { version = "0.11" }
 fs-walk = { version = "0.1.0" }
 communityid = { version = "0.1", features = ["serde"] }
 serde_yaml = "0.9"

kunai/src/bin/main.rs

@@ -265,7 +265,7 @@ struct EventConsumer<'s> {
     scan_events_enabled: bool,
 }
 
-impl<'s> EventConsumer<'s> {
+impl EventConsumer<'_> {
     fn prepare_output(config: &Config) -> anyhow::Result<Output> {
         let output = match &config.output.path.as_str() {
             &"stdout" => String::from("/dev/stdout"),
@@ -2479,7 +2479,7 @@ impl EventProducer {
                         // info_unchecked can be used here as we are sure info is valid
                         let etype = unsafe { dec.info_unchecked() }.etype;
 
-                        // filtering out unwanted events but let Excve/Clone go as those are used
+                        // filtering out unwanted events but let Execve/Clone go as those are used
                         // for correlation on consumer side.
                         if ep.filter.is_disabled(etype)
                             && !matches!(

kunai/src/containers.rs

@@ -35,7 +35,7 @@ impl<'de> Deserialize<'de> for Container {
         struct ContainerVisitor;
         const VARIANTS: &[&str] = &Container::variants_str();
 
-        impl<'de> serde::de::Visitor<'de> for ContainerVisitor {
+        impl serde::de::Visitor<'_> for ContainerVisitor {
             type Value = Container;
 
             fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {

kunai/src/events.rs

@@ -154,7 +154,7 @@ impl<'de> Deserialize<'de> for UtcDateTime {
     {
         struct UtcDateTimeVisitor;
 
-        impl<'de> Visitor<'de> for UtcDateTimeVisitor {
+        impl Visitor<'_> for UtcDateTimeVisitor {
             type Value = UtcDateTime;
 
             fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {

kunai/src/tests/kernel.rs

@@ -95,7 +95,7 @@ fn setrlimit(rlimit: &rlimit) -> anyhow::Result<()> {
     Ok(())
 }
 
-fn custom_panic_handler(info: &panic::PanicInfo) {
+fn custom_panic_handler(info: &panic::PanicHookInfo) {
     // Your custom panic handling code goes here
     println!("\x1b[1;31m{info}\x1b[0m");
     // we power-off the system

kunai/src/yara.rs

@@ -10,7 +10,6 @@ use std::{
 /// yara-x uses a lot of lifetimes, which makes it hard to integrate
 /// in existing code. So this module mainly redefines easier types
 /// to work with.
-
 /// Wraps a yara_x::Rules, but preventing it from moving around in memory.
 struct PinnedRules {
     rules: yara_x::Rules,
@@ -46,7 +45,7 @@ impl SourceCode {
     }
 }
 
-impl<'a> Scanner<'a> {
+impl Scanner<'_> {
     pub fn with_rules(rules: yara_x::Rules) -> Self {
         let pinned_rules = Box::pin(PinnedRules {
             rules,
@@ -63,7 +62,7 @@ impl<'a> Scanner<'a> {
     }
 }
 
-unsafe impl<'s> Send for Scanner<'s> {}
+unsafe impl Send for Scanner<'_> {}
 
 impl<'s> Deref for Scanner<'s> {
     type Target = Mutex<yara_x::Scanner<'s>>;
@@ -72,7 +71,7 @@ impl<'s> Deref for Scanner<'s> {
     }
 }
 
-impl<'s> DerefMut for Scanner<'s> {
+impl DerefMut for Scanner<'_> {
     fn deref_mut(&mut self) -> &mut Self::Target {
         &mut self.scanner
     }

rust-toolchain.toml

@@ -1,5 +1,5 @@
 [toolchain]
-channel = "1.80"
+channel = "1.81"
 targets = ["x86_64-unknown-linux-gnu", "aarch64-unknown-linux-gnu"]
 
 # to have the necessary for code analysis