diff options
| author | Paul Buetow <paul@buetow.org> | 2024-02-22 20:33:32 +0200 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2024-02-22 20:33:32 +0200 |
| commit | f649f89201cf1b8a8a8aab98dba91bbbd96ecd09 (patch) | |
| tree | ae679a032479c92ff5d18169b73d7b3921706bde | |
| parent | e800879cd818f51f83c3bfa86a42aa331a58af0c (diff) | |
finally make use of the NQC's generated code
| -rw-r--r-- | internal/c/tracepoints/open.c | 2 | ||||
| -rw-r--r-- | internal/c/types.h | 2 | ||||
| -rw-r--r-- | internal/eventloop.go | 37 | ||||
| -rw-r--r-- | internal/generated/nqc.raku | 4 | ||||
| -rw-r--r-- | internal/generated/types/types.go | 24 | ||||
| -rw-r--r-- | internal/syncpool/syncpool.go | 19 | ||||
| -rw-r--r-- | internal/types/types.go | 89 |
7 files changed, 34 insertions, 143 deletions
diff --git a/internal/c/tracepoints/open.c b/internal/c/tracepoints/open.c index 7e15f85..f3b3a21 100644 --- a/internal/c/tracepoints/open.c +++ b/internal/c/tracepoints/open.c @@ -4,7 +4,7 @@ static __always_inline int _handle_enter_open(struct trace_event_raw_sys_enter * if (filter()) return 0; - struct openat_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct openat_enter_event), 0); + struct open_enter_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_enter_event), 0); if (!ev) return 0; diff --git a/internal/c/types.h b/internal/c/types.h index 0692c93..e1d5e29 100644 --- a/internal/c/types.h +++ b/internal/c/types.h @@ -29,7 +29,7 @@ struct fd_event { __s32 fd; }; -struct openat_enter_event { +struct open_enter_event { __u32 op_id; __u32 pid_tgid; __u64 time; diff --git a/internal/eventloop.go b/internal/eventloop.go index 287198a..c482ceb 100644 --- a/internal/eventloop.go +++ b/internal/eventloop.go @@ -7,14 +7,13 @@ import ( "encoding/binary" "fmt" - "ioriotng/internal/syncpool" - . "ioriotng/internal/types" + . "ioriotng/internal/generated/types" bpf "github.com/aquasecurity/libbpfgo" ) func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) { - enterOpen := make(map[uint32]*OpenatEnterEvent) + enterOpen := make(map[uint32]*OpenEnterEvent) enterFd := make(map[uint32]*FdEvent) // To do this, extract the PID from the TID (pid_tid >> 32) // openFiles := make(map[ @@ -24,52 +23,52 @@ func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) { case OPENAT_ENTER_OP_ID: fallthrough case OPEN_ENTER_OP_ID: - ev := readRaw(raw, syncpool.OpenEnterEvent.Get().(*OpenatEnterEvent)) - enterOpen[ev.PidTGid] = ev + ev := readRaw(raw, NewOpenEnterEvent()) + enterOpen[ev.PidTgid] = ev case OPENAT_EXIT_OP_ID: fallthrough case OPEN_EXIT_OP_ID: - ev := readRaw(raw, syncpool.FdEvent.Get().(*FdEvent)) - enterEv, ok := enterOpen[ev.PidTGid] + ev := readRaw(raw, NewFdEvent()) + enterEv, ok := enterOpen[ev.PidTgid] if !ok { fmt.Println("Dropping", ev) - syncpool.FdEvent.Put(ev) + RecycleFdEvent(ev) continue } duration := float64(ev.Time-enterEv.Time) / float64(1_000_000) fmt.Println(duration, "ms", enterEv, ev) - delete(enterOpen, ev.PidTGid) - syncpool.FdEvent.Put(ev) - syncpool.OpenEnterEvent.Put(enterEv) + delete(enterOpen, ev.PidTgid) + RecycleFdEvent(ev) + RecycleOpenEnterEvent(enterEv) case CLOSE_ENTER_OP_ID: fallthrough case WRITE_ENTER_OP_ID: fallthrough case WRITEV_ENTER_OP_ID: - ev := readRaw(raw, syncpool.FdEvent.Get().(*FdEvent)) - enterFd[ev.PidTGid] = ev + ev := readRaw(raw, NewFdEvent()) + enterFd[ev.PidTgid] = ev case CLOSE_EXIT_OP_ID: fallthrough case WRITE_EXIT_OP_ID: fallthrough case WRITEV_EXIT_OP_ID: - ev := readRaw(raw, syncpool.NullEvent.Get().(*NullEvent)) - enterEv, ok := enterFd[ev.PidTGid] + ev := readRaw(raw, NewNullEvent()) + enterEv, ok := enterFd[ev.PidTgid] if !ok { fmt.Println("Dropping", ev) - syncpool.NullEvent.Put(ev) + RecycleNullEvent(ev) continue } duration := float64(ev.Time-enterEv.Time) / float64(1_000_000) fmt.Println(duration, "ms", enterEv, ev) - delete(enterFd, ev.PidTGid) - syncpool.NullEvent.Put(ev) - syncpool.FdEvent.Put(enterEv) + delete(enterFd, ev.PidTgid) + RecycleNullEvent(ev) + RecycleFdEvent(enterEv) default: panic(fmt.Sprintf("UNKNOWN Ringbuf data received len:%d raw:%v", len(raw), raw)) diff --git a/internal/generated/nqc.raku b/internal/generated/nqc.raku index 578a263..ced6b3c 100644 --- a/internal/generated/nqc.raku +++ b/internal/generated/nqc.raku @@ -103,11 +103,11 @@ class NQCToGoActions { New: func() interface\{\} \{ return &$identifier\{\} \}, \} - func {$identifier}New() *$identifier \{ + func New{$identifier}() *$identifier \{ return poolOf{$identifier}s.Get().(*$identifier); \} - func {$identifier}Recycle(elem *$identifier) \{ + func Recycle{$identifier}(elem *$identifier) \{ poolOf{$identifier}s.Put(elem) \} END diff --git a/internal/generated/types/types.go b/internal/generated/types/types.go index db86f28..8211277 100644 --- a/internal/generated/types/types.go +++ b/internal/generated/types/types.go @@ -62,11 +62,11 @@ var poolOfNullEvents = sync.Pool{ New: func() interface{} { return &NullEvent{} }, } -func NullEventNew() *NullEvent { +func NewNullEvent() *NullEvent { return poolOfNullEvents.Get().(*NullEvent) } -func NullEventRecycle(elem *NullEvent) { +func RecycleNullEvent(elem *NullEvent) { poolOfNullEvents.Put(elem) } @@ -85,15 +85,15 @@ var poolOfFdEvents = sync.Pool{ New: func() interface{} { return &FdEvent{} }, } -func FdEventNew() *FdEvent { +func NewFdEvent() *FdEvent { return poolOfFdEvents.Get().(*FdEvent) } -func FdEventRecycle(elem *FdEvent) { +func RecycleFdEvent(elem *FdEvent) { poolOfFdEvents.Put(elem) } -type OpenatEnterEvent struct { +type OpenEnterEvent struct { OpId OpId PidTgid uint32 Time uint64 @@ -101,20 +101,20 @@ type OpenatEnterEvent struct { Comm [MAX_PROGNAME_LENGTH]byte } -func (o OpenatEnterEvent) String() string { +func (o OpenEnterEvent) String() string { return fmt.Sprintf("OpId:%v PidTgid:%v Time:%v Filename:%v Comm:%v", o.OpId, o.PidTgid, o.Time, string(o.Filename[:]), string(o.Comm[:])) } -var poolOfOpenatEnterEvents = sync.Pool{ - New: func() interface{} { return &OpenatEnterEvent{} }, +var poolOfOpenEnterEvents = sync.Pool{ + New: func() interface{} { return &OpenEnterEvent{} }, } -func OpenatEnterEventNew() *OpenatEnterEvent { - return poolOfOpenatEnterEvents.Get().(*OpenatEnterEvent) +func NewOpenEnterEvent() *OpenEnterEvent { + return poolOfOpenEnterEvents.Get().(*OpenEnterEvent) } -func OpenatEnterEventRecycle(elem *OpenatEnterEvent) { - poolOfOpenatEnterEvents.Put(elem) +func RecycleOpenEnterEvent(elem *OpenEnterEvent) { + poolOfOpenEnterEvents.Put(elem) } type Flags struct { diff --git a/internal/syncpool/syncpool.go b/internal/syncpool/syncpool.go deleted file mode 100644 index c41034f..0000000 --- a/internal/syncpool/syncpool.go +++ /dev/null @@ -1,19 +0,0 @@ -package syncpool - -import ( - "ioriotng/internal/types" - "sync" -) - -func syncPool[T any]() sync.Pool { - return sync.Pool{ - New: func() interface{} { - var value T - return &value - }, - } -} - -var OpenEnterEvent = syncPool[types.OpenatEnterEvent]() -var FdEvent = syncPool[types.FdEvent]() -var NullEvent = syncPool[types.NullEvent]() diff --git a/internal/types/types.go b/internal/types/types.go deleted file mode 100644 index 5cd1d55..0000000 --- a/internal/types/types.go +++ /dev/null @@ -1,89 +0,0 @@ -// These types mirror the C types from internal/c/types.h -// TODO: Move to internal/generated, and auto-generate this file! -package types - -import ( - "fmt" -) - -type OpId uint32 - -const ( - MAX_FILENAME_LENGTH = 256 - MAX_PROGNAME_LENGTH = 16 -) - -const ( - OPENAT_ENTER_OP_ID OpId = iota + 1 - OPENAT_EXIT_OP_ID - OPEN_ENTER_OP_ID - OPEN_EXIT_OP_ID - CLOSE_ENTER_OP_ID - CLOSE_EXIT_OP_ID - WRITE_ENTER_OP_ID - WRITE_EXIT_OP_ID - WRITEV_ENTER_OP_ID - WRITEV_EXIT_OP_ID -) - -func (id OpId) String() string { - switch id { - case OPENAT_ENTER_OP_ID: - return "openat:enter" - case OPENAT_EXIT_OP_ID: - return "openat:exit" - case OPEN_ENTER_OP_ID: - return "open:enter" - case OPEN_EXIT_OP_ID: - return "open:exit" - case CLOSE_ENTER_OP_ID: - return "close:enter" - case CLOSE_EXIT_OP_ID: - return "close:exit" - case WRITE_ENTER_OP_ID: - return "write:enter" - case WRITE_EXIT_OP_ID: - return "write:exit" - case WRITEV_ENTER_OP_ID: - return "write:enter" - case WRITEV_EXIT_OP_ID: - return "write:exit" - default: - panic(fmt.Sprintf("Unknown OpId %d", uint32(id))) - } -} - -type NullEvent struct { - OpId OpId - PidTGid uint32 - Time uint64 -} - -func (ev NullEvent) String() string { - return fmt.Sprintf("%s PidTGid:%v Time:%v", ev.OpId, ev.PidTGid, ev.Time) -} - -type FdEvent struct { - NullEvent - Fd int32 -} - -func (ev FdEvent) String() string { - return fmt.Sprintf("%s Fd:%v", ev.NullEvent.String(), ev.Fd) -} - -type OpenatEnterEvent struct { - NullEvent - Filename [MAX_FILENAME_LENGTH]byte - Comm [MAX_PROGNAME_LENGTH]byte -} - -func (ev OpenatEnterEvent) String() string { - comm := string(ev.Comm[:]) - - return fmt.Sprintf("%s Filename:%s Comm:%s", ev.NullEvent.String(), string(ev.Filename[:]), comm) -} - -type FlagValues struct { - UidFilter uint32 -} |
