summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaul Buetow <paul@buetow.org>2024-02-22 20:33:32 +0200
committerPaul Buetow <paul@buetow.org>2024-02-22 20:33:32 +0200
commitf649f89201cf1b8a8a8aab98dba91bbbd96ecd09 (patch)
treeae679a032479c92ff5d18169b73d7b3921706bde
parente800879cd818f51f83c3bfa86a42aa331a58af0c (diff)
finally make use of the NQC's generated code
-rw-r--r--internal/c/tracepoints/open.c2
-rw-r--r--internal/c/types.h2
-rw-r--r--internal/eventloop.go37
-rw-r--r--internal/generated/nqc.raku4
-rw-r--r--internal/generated/types/types.go24
-rw-r--r--internal/syncpool/syncpool.go19
-rw-r--r--internal/types/types.go89
7 files changed, 34 insertions, 143 deletions
diff --git a/internal/c/tracepoints/open.c b/internal/c/tracepoints/open.c
index 7e15f85..f3b3a21 100644
--- a/internal/c/tracepoints/open.c
+++ b/internal/c/tracepoints/open.c
@@ -4,7 +4,7 @@ static __always_inline int _handle_enter_open(struct trace_event_raw_sys_enter *
if (filter())
return 0;
- struct openat_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct openat_enter_event), 0);
+ struct open_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_enter_event), 0);
if (!ev)
return 0;
diff --git a/internal/c/types.h b/internal/c/types.h
index 0692c93..e1d5e29 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -29,7 +29,7 @@ struct fd_event {
__s32 fd;
};
-struct openat_enter_event {
+struct open_enter_event {
__u32 op_id;
__u32 pid_tgid;
__u64 time;
diff --git a/internal/eventloop.go b/internal/eventloop.go
index 287198a..c482ceb 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -7,14 +7,13 @@ import (
"encoding/binary"
"fmt"
- "ioriotng/internal/syncpool"
- . "ioriotng/internal/types"
+ . "ioriotng/internal/generated/types"
bpf "github.com/aquasecurity/libbpfgo"
)
func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) {
- enterOpen := make(map[uint32]*OpenatEnterEvent)
+ enterOpen := make(map[uint32]*OpenEnterEvent)
enterFd := make(map[uint32]*FdEvent)
// To do this, extract the PID from the TID (pid_tid >> 32)
// openFiles := make(map[
@@ -24,52 +23,52 @@ func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) {
case OPENAT_ENTER_OP_ID:
fallthrough
case OPEN_ENTER_OP_ID:
- ev := readRaw(raw, syncpool.OpenEnterEvent.Get().(*OpenatEnterEvent))
- enterOpen[ev.PidTGid] = ev
+ ev := readRaw(raw, NewOpenEnterEvent())
+ enterOpen[ev.PidTgid] = ev
case OPENAT_EXIT_OP_ID:
fallthrough
case OPEN_EXIT_OP_ID:
- ev := readRaw(raw, syncpool.FdEvent.Get().(*FdEvent))
- enterEv, ok := enterOpen[ev.PidTGid]
+ ev := readRaw(raw, NewFdEvent())
+ enterEv, ok := enterOpen[ev.PidTgid]
if !ok {
fmt.Println("Dropping", ev)
- syncpool.FdEvent.Put(ev)
+ RecycleFdEvent(ev)
continue
}
duration := float64(ev.Time-enterEv.Time) / float64(1_000_000)
fmt.Println(duration, "ms", enterEv, ev)
- delete(enterOpen, ev.PidTGid)
- syncpool.FdEvent.Put(ev)
- syncpool.OpenEnterEvent.Put(enterEv)
+ delete(enterOpen, ev.PidTgid)
+ RecycleFdEvent(ev)
+ RecycleOpenEnterEvent(enterEv)
case CLOSE_ENTER_OP_ID:
fallthrough
case WRITE_ENTER_OP_ID:
fallthrough
case WRITEV_ENTER_OP_ID:
- ev := readRaw(raw, syncpool.FdEvent.Get().(*FdEvent))
- enterFd[ev.PidTGid] = ev
+ ev := readRaw(raw, NewFdEvent())
+ enterFd[ev.PidTgid] = ev
case CLOSE_EXIT_OP_ID:
fallthrough
case WRITE_EXIT_OP_ID:
fallthrough
case WRITEV_EXIT_OP_ID:
- ev := readRaw(raw, syncpool.NullEvent.Get().(*NullEvent))
- enterEv, ok := enterFd[ev.PidTGid]
+ ev := readRaw(raw, NewNullEvent())
+ enterEv, ok := enterFd[ev.PidTgid]
if !ok {
fmt.Println("Dropping", ev)
- syncpool.NullEvent.Put(ev)
+ RecycleNullEvent(ev)
continue
}
duration := float64(ev.Time-enterEv.Time) / float64(1_000_000)
fmt.Println(duration, "ms", enterEv, ev)
- delete(enterFd, ev.PidTGid)
- syncpool.NullEvent.Put(ev)
- syncpool.FdEvent.Put(enterEv)
+ delete(enterFd, ev.PidTgid)
+ RecycleNullEvent(ev)
+ RecycleFdEvent(enterEv)
default:
panic(fmt.Sprintf("UNKNOWN Ringbuf data received len:%d raw:%v", len(raw), raw))
diff --git a/internal/generated/nqc.raku b/internal/generated/nqc.raku
index 578a263..ced6b3c 100644
--- a/internal/generated/nqc.raku
+++ b/internal/generated/nqc.raku
@@ -103,11 +103,11 @@ class NQCToGoActions {
New: func() interface\{\} \{ return &$identifier\{\} \},
\}
- func {$identifier}New() *$identifier \{
+ func New{$identifier}() *$identifier \{
return poolOf{$identifier}s.Get().(*$identifier);
\}
- func {$identifier}Recycle(elem *$identifier) \{
+ func Recycle{$identifier}(elem *$identifier) \{
poolOf{$identifier}s.Put(elem)
\}
END
diff --git a/internal/generated/types/types.go b/internal/generated/types/types.go
index db86f28..8211277 100644
--- a/internal/generated/types/types.go
+++ b/internal/generated/types/types.go
@@ -62,11 +62,11 @@ var poolOfNullEvents = sync.Pool{
New: func() interface{} { return &NullEvent{} },
}
-func NullEventNew() *NullEvent {
+func NewNullEvent() *NullEvent {
return poolOfNullEvents.Get().(*NullEvent)
}
-func NullEventRecycle(elem *NullEvent) {
+func RecycleNullEvent(elem *NullEvent) {
poolOfNullEvents.Put(elem)
}
@@ -85,15 +85,15 @@ var poolOfFdEvents = sync.Pool{
New: func() interface{} { return &FdEvent{} },
}
-func FdEventNew() *FdEvent {
+func NewFdEvent() *FdEvent {
return poolOfFdEvents.Get().(*FdEvent)
}
-func FdEventRecycle(elem *FdEvent) {
+func RecycleFdEvent(elem *FdEvent) {
poolOfFdEvents.Put(elem)
}
-type OpenatEnterEvent struct {
+type OpenEnterEvent struct {
OpId OpId
PidTgid uint32
Time uint64
@@ -101,20 +101,20 @@ type OpenatEnterEvent struct {
Comm [MAX_PROGNAME_LENGTH]byte
}
-func (o OpenatEnterEvent) String() string {
+func (o OpenEnterEvent) String() string {
return fmt.Sprintf("OpId:%v PidTgid:%v Time:%v Filename:%v Comm:%v", o.OpId, o.PidTgid, o.Time, string(o.Filename[:]), string(o.Comm[:]))
}
-var poolOfOpenatEnterEvents = sync.Pool{
- New: func() interface{} { return &OpenatEnterEvent{} },
+var poolOfOpenEnterEvents = sync.Pool{
+ New: func() interface{} { return &OpenEnterEvent{} },
}
-func OpenatEnterEventNew() *OpenatEnterEvent {
- return poolOfOpenatEnterEvents.Get().(*OpenatEnterEvent)
+func NewOpenEnterEvent() *OpenEnterEvent {
+ return poolOfOpenEnterEvents.Get().(*OpenEnterEvent)
}
-func OpenatEnterEventRecycle(elem *OpenatEnterEvent) {
- poolOfOpenatEnterEvents.Put(elem)
+func RecycleOpenEnterEvent(elem *OpenEnterEvent) {
+ poolOfOpenEnterEvents.Put(elem)
}
type Flags struct {
diff --git a/internal/syncpool/syncpool.go b/internal/syncpool/syncpool.go
deleted file mode 100644
index c41034f..0000000
--- a/internal/syncpool/syncpool.go
+++ /dev/null
@@ -1,19 +0,0 @@
-package syncpool
-
-import (
- "ioriotng/internal/types"
- "sync"
-)
-
-func syncPool[T any]() sync.Pool {
- return sync.Pool{
- New: func() interface{} {
- var value T
- return &value
- },
- }
-}
-
-var OpenEnterEvent = syncPool[types.OpenatEnterEvent]()
-var FdEvent = syncPool[types.FdEvent]()
-var NullEvent = syncPool[types.NullEvent]()
diff --git a/internal/types/types.go b/internal/types/types.go
deleted file mode 100644
index 5cd1d55..0000000
--- a/internal/types/types.go
+++ /dev/null
@@ -1,89 +0,0 @@
-// These types mirror the C types from internal/c/types.h
-// TODO: Move to internal/generated, and auto-generate this file!
-package types
-
-import (
- "fmt"
-)
-
-type OpId uint32
-
-const (
- MAX_FILENAME_LENGTH = 256
- MAX_PROGNAME_LENGTH = 16
-)
-
-const (
- OPENAT_ENTER_OP_ID OpId = iota + 1
- OPENAT_EXIT_OP_ID
- OPEN_ENTER_OP_ID
- OPEN_EXIT_OP_ID
- CLOSE_ENTER_OP_ID
- CLOSE_EXIT_OP_ID
- WRITE_ENTER_OP_ID
- WRITE_EXIT_OP_ID
- WRITEV_ENTER_OP_ID
- WRITEV_EXIT_OP_ID
-)
-
-func (id OpId) String() string {
- switch id {
- case OPENAT_ENTER_OP_ID:
- return "openat:enter"
- case OPENAT_EXIT_OP_ID:
- return "openat:exit"
- case OPEN_ENTER_OP_ID:
- return "open:enter"
- case OPEN_EXIT_OP_ID:
- return "open:exit"
- case CLOSE_ENTER_OP_ID:
- return "close:enter"
- case CLOSE_EXIT_OP_ID:
- return "close:exit"
- case WRITE_ENTER_OP_ID:
- return "write:enter"
- case WRITE_EXIT_OP_ID:
- return "write:exit"
- case WRITEV_ENTER_OP_ID:
- return "write:enter"
- case WRITEV_EXIT_OP_ID:
- return "write:exit"
- default:
- panic(fmt.Sprintf("Unknown OpId %d", uint32(id)))
- }
-}
-
-type NullEvent struct {
- OpId OpId
- PidTGid uint32
- Time uint64
-}
-
-func (ev NullEvent) String() string {
- return fmt.Sprintf("%s PidTGid:%v Time:%v", ev.OpId, ev.PidTGid, ev.Time)
-}
-
-type FdEvent struct {
- NullEvent
- Fd int32
-}
-
-func (ev FdEvent) String() string {
- return fmt.Sprintf("%s Fd:%v", ev.NullEvent.String(), ev.Fd)
-}
-
-type OpenatEnterEvent struct {
- NullEvent
- Filename [MAX_FILENAME_LENGTH]byte
- Comm [MAX_PROGNAME_LENGTH]byte
-}
-
-func (ev OpenatEnterEvent) String() string {
- comm := string(ev.Comm[:])
-
- return fmt.Sprintf("%s Filename:%s Comm:%s", ev.NullEvent.String(), string(ev.Filename[:]), comm)
-}
-
-type FlagValues struct {
- UidFilter uint32
-}