From 84beebbd48f7f4fa93e6c2bbeb51b00594a59487 Mon Sep 17 00:00:00 2001
From: qjerome <qjerome@rawsec.lu>
Date: Mon, 20 Jan 2025 13:55:01 +0100
Subject: [PATCH] =?UTF-8?q?fix:=C2=A0event=20filter?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Event filter was not working as intented, especially for non-configurable events.
Those were filtered out by the current design of the Filter structure.

Thy PR fixes this by considering as enabled any event which is not configurable.
---
 kunai-common/src/config.rs | 30 ++++++++++++++++++++++++++----
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/kunai-common/src/config.rs b/kunai-common/src/config.rs
index 1d731b5..6e18947 100644
--- a/kunai-common/src/config.rs
+++ b/kunai-common/src/config.rs
@@ -20,8 +20,15 @@ pub struct Loader {
     pub tgid: u32,
 }
 
-const FILTER_SIZE: usize = bpf_events::Type::Max as usize;
+// FILTER_SIZE should not go beyond configurable event types
+// otherwise we might prevent some wanted events (not configurable)
+// from being processed
+const FILTER_SIZE: usize = bpf_events::Type::EndConfigurable as usize;
 
+/// A structure carrying on/off information about
+/// Kunai events. Only events which are configurable
+/// (with id below [bpf_events::Type::EndConfigurable])
+/// can be configured.
 #[repr(C)]
 #[derive(Debug, Clone, Copy)]
 pub struct Filter {
@@ -29,33 +36,48 @@ pub struct Filter {
 }
 
 impl Filter {
+    /// Creates a [Filter] with all events enabled
     pub fn all_enabled() -> Self {
         Self {
             enabled: [true; FILTER_SIZE],
         }
     }
 
+    /// Creates a [Filter] with all events disabled
     pub fn all_disabled() -> Self {
         Self {
             enabled: [false; FILTER_SIZE],
         }
     }
 
+    #[inline(always)]
+    fn set_value(&mut self, ty: bpf_events::Type, value: bool) {
+        // we set the value only if it already exists
+        if let Some(en) = self.enabled.get_mut(ty as usize) {
+            *en = value;
+        }
+    }
+
+    /// Disable any events of type [bpf_events::Type]
     #[inline(always)]
     pub fn disable(&mut self, ty: bpf_events::Type) {
-        self.enabled[ty as usize] = false;
+        self.set_value(ty, false);
     }
 
+    /// Enable any events of type [bpf_events::Type]
     #[inline(always)]
     pub fn enable(&mut self, ty: bpf_events::Type) {
-        self.enabled[ty as usize] = true;
+        self.set_value(ty, true);
     }
 
+    /// Returns `true` if event type [bpf_events::Type] is enabled
     #[inline(always)]
     pub fn is_enabled(&self, ty: bpf_events::Type) -> bool {
-        self.enabled[ty as usize]
+        // all the event types not configurable should always be enabled
+        self.enabled.get(ty as usize).cloned().unwrap_or(true)
     }
 
+    /// Returns `true` if event type [bpf_events::Type] is disabled
     #[inline(always)]
     pub fn is_disabled(&self, ty: bpf_events::Type) -> bool {
         !self.is_enabled(ty)