feat: limit i/o related events

kunai-common/src/co_re/c/shim.c

@@ -115,13 +115,24 @@ _SHIM_GETTER_BPF_CORE_READ(gid_t, shim_cred_gid(struct cred *pcred), pcred, gid.
 
 struct qstr
 {
-	__u64 hash_len;
+	union
+	{
+		__u64 hash_len;
+		struct
+		{
+			u32 hash;
+			u32 len;
+		};
+	};
+
 	const unsigned char *name;
 }
 __attribute__((preserve_access_index));
 
 SHIM(qstr, name);
 SHIM(qstr, hash_len);
+SHIM(qstr, hash);
+SHIM(qstr, len);
 
 struct vfsmount
 {

kunai-common/src/co_re/core_fs.rs

@@ -93,17 +93,8 @@ pub type qstr = CoRe<gen::qstr>;
 impl qstr {
     rust_shim_kernel_impl!(pub, qstr, name, *const u8);
     rust_shim_kernel_impl!(pub, qstr, hash_len, u64);
-
-    #[inline(always)]
-    pub unsafe fn hash(&self) -> Option<u32> {
-        Some(self.hash_len()? as u32)
-    }
-
-    #[inline(always)]
-    pub unsafe fn len(&self) -> Option<u32> {
-        //(shim_qstr_hash_len(self.as_ptr_mut()) >> 32) as u32
-        Some((self.hash_len()? >> 32) as u32)
-    }
+    rust_shim_kernel_impl!(pub, qstr, hash, u32);
+    rust_shim_kernel_impl!(pub, qstr, len, u32);
 }
 
 #[allow(non_camel_case_types)]

kunai-common/src/co_re/gen.rs

@@ -1,6 +1,7 @@
 pub type __u64 = ::core::ffi::c_ulonglong;
 pub type u64_ = __u64;
 pub type __u32 = ::core::ffi::c_uint;
+pub type u32_ = __u32;
 pub type __u16 = ::core::ffi::c_ushort;
 pub type u16_ = __u16;
 pub type __u8 = ::core::ffi::c_uchar;
@@ -42,11 +43,23 @@ extern "C" {
     pub fn shim_cred_gid(pcred: *mut cred) -> gid_t;
 }
 #[repr(C)]
-#[derive(Debug, Copy, Clone)]
+#[derive(Copy, Clone)]
 pub struct qstr {
-    pub hash_len: __u64,
+    pub __bindgen_anon_1: qstr__bindgen_ty_1,
     pub name: *const ::core::ffi::c_uchar,
 }
+#[repr(C)]
+#[derive(Copy, Clone)]
+pub union qstr__bindgen_ty_1 {
+    pub hash_len: __u64,
+    pub __bindgen_anon_1: qstr__bindgen_ty_1__bindgen_ty_1,
+}
+#[repr(C)]
+#[derive(Debug, Copy, Clone)]
+pub struct qstr__bindgen_ty_1__bindgen_ty_1 {
+    pub hash: u32_,
+    pub len: u32_,
+}
 extern "C" {
     pub fn shim_qstr_name(qstr: *mut qstr) -> *const ::core::ffi::c_uchar;
 }
@@ -65,6 +78,24 @@ extern "C" {
 extern "C" {
     pub fn shim_qstr_hash_len_exists(qstr: *mut qstr) -> bool;
 }
+extern "C" {
+    pub fn shim_qstr_hash(qstr: *mut qstr) -> ::core::ffi::c_uint;
+}
+extern "C" {
+    pub fn shim_qstr_hash_user(qstr: *mut qstr) -> ::core::ffi::c_uint;
+}
+extern "C" {
+    pub fn shim_qstr_hash_exists(qstr: *mut qstr) -> bool;
+}
+extern "C" {
+    pub fn shim_qstr_len(qstr: *mut qstr) -> ::core::ffi::c_uint;
+}
+extern "C" {
+    pub fn shim_qstr_len_user(qstr: *mut qstr) -> ::core::ffi::c_uint;
+}
+extern "C" {
+    pub fn shim_qstr_len_exists(qstr: *mut qstr) -> bool;
+}
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
 pub struct vfsmount {
@@ -141,7 +172,7 @@ extern "C" {
     pub fn shim_super_block_s_root_exists(super_block: *mut super_block) -> bool;
 }
 #[repr(C)]
-#[derive(Debug, Copy, Clone)]
+#[derive(Copy, Clone)]
 pub struct dentry {
     pub d_flags: ::core::ffi::c_uint,
     pub d_parent: *mut dentry,

kunai-common/src/config.rs

@@ -67,5 +67,7 @@ impl Filter {
 pub struct BpfConfig {
     pub loader: Loader,
     pub filter: Filter,
+    pub glob_max_eps_io: Option<u64>,
+    pub task_max_eps_io: Option<u64>,
     pub send_data_min_len: u64,
 }

kunai-common/src/path.rs

@@ -33,8 +33,6 @@ pub const MAX_NAME: usize = u8::MAX as usize;
 #[repr(C)]
 #[derive(BpfError, Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Error {
-    #[error("should not happen")]
-    ShouldNotHappen,
     #[error("filename is too long")]
     FileNameTooLong,
     #[error("filepath is too long")]
@@ -81,6 +79,8 @@ pub enum Error {
     DNameNameMissing,
     #[error("d_name.len field missing")]
     DNameLenMissing,
+    #[error("d_name.hash_len field missing")]
+    DNameHashLenMissing,
     #[error("failed to get path ino")]
     PathInoFailure,
     #[error("failed to get path sb ino")]
@@ -125,6 +125,34 @@ pub struct Metadata {
     pub ctime: Time,
 }
 
+#[allow(dead_code)]
+#[repr(C)]
+#[derive(Default, Debug, Clone, Copy, Hash, PartialEq, Eq)]
+pub struct MapKey {
+    hash: u64,
+    // depth is a u32 to force structure alignment
+    // without this kernel 5.4 fails at using this
+    // struct
+    depth: u32,
+    len: u32,
+    ino: u64,
+    sb_ino: u64,
+}
+
+impl From<&Path> for MapKey {
+    #[inline(always)]
+    fn from(p: &Path) -> Self {
+        let meta = p.metadata.unwrap_or_default();
+        MapKey {
+            hash: p.hash,
+            depth: p.depth as u32,
+            len: p.len,
+            ino: meta.ino,
+            sb_ino: meta.sb_ino,
+        }
+    }
+}
+
 #[repr(C)]
 #[derive(Debug, Clone, Copy, Eq)]
 pub struct Path {
@@ -133,38 +161,31 @@ pub struct Path {
     len: u32,
     depth: u16,
     real: bool, // flag if path is a realpath
+    pub hash: u64,
     pub metadata: Option<Metadata>,
     pub mode: Mode,
     pub error: Option<Error>,
 }
 
 impl PartialEq for Path {
     fn eq(&self, other: &Self) -> bool {
-        let meta_eq = {
-            if self.metadata.is_none() && other.metadata.is_none() {
-                return true;
-            }
-
-            if let Some(sm) = self.metadata {
-                if let Some(om) = other.metadata {
-                    // we don't consider atime (access time)
-                    // as being relevant for path Eq checking
-                    return sm.ino == om.ino
-                        && sm.sb_ino == om.sb_ino
-                        && sm.size == om.size
-                        && sm.mtime == om.mtime
-                        && sm.ctime == om.ctime;
-                }
+        let meta_eq = match (self.metadata, other.metadata) {
+            (Some(sm), Some(om)) => {
+                sm.ino == om.ino
+                    && sm.sb_ino == om.sb_ino
+                    && sm.size == om.size
+                    && sm.mtime == om.mtime
+                    && sm.ctime == om.ctime
             }
-
-            false
+            (None, None) => true,
+            _ => false,
         };
 
-        self.buffer == other.buffer
+        meta_eq
             && self.len == other.len
             && self.depth == other.depth
             && self.real == other.real
-            && meta_eq
+            && self.buffer == other.buffer
     }
 }
 
@@ -175,6 +196,7 @@ impl Default for Path {
             null: 0,
             len: 0,
             depth: 0,
+            hash: 0,
             real: false,
             metadata: None,
             mode: Mode::Append,
@@ -185,6 +207,11 @@ impl Default for Path {
 
 // common implementation
 impl Path {
+    #[inline(always)]
+    pub fn map_key(&self) -> MapKey {
+        MapKey::from(self)
+    }
+
     pub fn copy_from_str<T: AsRef<str>>(
         &mut self,
         s: T,