more on filters, needs more testing

3 files changed, 50 insertions, 16 deletions

diff --git a/internal/eventfilter.go b/internal/eventfilter.go
index cedd88d..7edc330 100644
--- a/internal/eventfilter.go
+++ b/internal/eventfilter.go
@@ -5,13 +5,16 @@ import (
 	"fmt"
 	"ior/internal/flags"
 	"ior/internal/generated/types"
+	"strings"
 )
 
 type eventFilter struct {
 	commFilterEnable bool
-	commFilter       [types.MAX_PROGNAME_LENGTH]byte
+	commFilterBytes  [types.MAX_PROGNAME_LENGTH]byte
+	commFilter       string
 	pathFilterEnable bool
-	pathFilter       [types.MAX_FILENAME_LENGTH]byte
+	pathFilterBytes  [types.MAX_FILENAME_LENGTH]byte
+	pathFilter       string
 }
 
 func newEventFilter(flags flags.Flags) *eventFilter {
@@ -22,41 +25,52 @@ func newEventFilter(flags flags.Flags) *eventFilter {
 			panic(fmt.Sprintf("Comm filter's max size is %d", types.MAX_PROGNAME_LENGTH))
 		}
 		ef.commFilterEnable = true
-		copy(ef.commFilter[:], []byte(flags.CommFilter))
+		copy(ef.commFilterBytes[:], []byte(flags.CommFilter))
+		ef.commFilter = flags.CommFilter
 	}
+
 	if flags.PathFilter != "" {
 		if len(flags.PathFilter) > types.MAX_FILENAME_LENGTH {
 			panic(fmt.Sprintf("Path filter's max size is %d", types.MAX_FILENAME_LENGTH))
 		}
 		ef.pathFilterEnable = true
-		copy(ef.pathFilter[:], []byte(flags.PathFilter))
+		copy(ef.pathFilterBytes[:], []byte(flags.PathFilter))
+		ef.pathFilter = flags.PathFilter
 	}
 
 	return &ef
 }
 
+func (ef *eventFilter) eventPair(ev *eventPair) bool {
+	if ef.commFilterEnable && !strings.Contains(ev.comm, ef.commFilter) {
+		return false
+	}
+	if ef.pathFilterEnable && !strings.Contains(ev.file.Name(), ef.pathFilter) {
+		return false
+	}
+	return true
+}
+
 func (ef *eventFilter) openEvent(ev *types.OpenEvent) (*types.OpenEvent, bool) {
-	commFilterPass := true
-	if ef.commFilterEnable {
-		commFilterPass = bytes.Contains(ev.Comm[:], ef.commFilter[:])
+	if ef.commFilterEnable && !bytes.Contains(ev.Comm[:], ef.commFilterBytes[:]) {
+		return ev, false
 	}
-	pathFilterPass := true
-	if ef.pathFilterEnable {
-		pathFilterPass = bytes.Contains(ev.Filename[:], ef.pathFilter[:])
+	if ef.pathFilterEnable && !bytes.Contains(ev.Filename[:], ef.pathFilterBytes[:]) {
+		return ev, false
 	}
-	return ev, commFilterPass && pathFilterPass
+	return ev, true
 }
 
 func (ef *eventFilter) pathEvent(ev *types.PathEvent) (*types.PathEvent, bool) {
 	if ef.pathFilterEnable {
-		return ev, bytes.Contains(ev.Pathname[:], ef.pathFilter[:])
+		return ev, bytes.Contains(ev.Pathname[:], ef.pathFilterBytes[:])
 	}
 	return ev, true
 }
 
 func (ef *eventFilter) nameEvent(ev *types.NameEvent) (*types.NameEvent, bool) {
 	if ef.pathFilterEnable {
-		return ev, bytes.Contains(ev.Oldname[:], ef.pathFilter[:]) || bytes.Contains(ev.Newname[:], ef.pathFilter[:])
+		return ev, bytes.Contains(ev.Oldname[:], ef.pathFilterBytes[:]) || bytes.Contains(ev.Newname[:], ef.pathFilterBytes[:])
 	}
 	return ev, true
 }
diff --git a/internal/eventloop.go b/internal/eventloop.go
index 8569004..4f0f7ca 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -5,6 +5,7 @@ import "C"
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"ior/internal/flags"
 	. "ior/internal/generated/types"
@@ -48,7 +49,6 @@ func (e *eventLoop) run(rawCh <-chan []byte) {
 	fmt.Println("Good bye")
 }
 
-// Deserialise raw byte stream from BPF ringbuffer.
 func (e *eventLoop) events(rawCh <-chan []byte) <-chan *eventPair {
 	ch := make(chan *eventPair)
 
@@ -131,7 +131,6 @@ func (e *eventLoop) syscallExit(exitEv event, ch chan<- *eventPair) {
 			e.files[fd] = file
 		}
 		ev.file = file
-
 		e.comms[openEv.Tid] = string(openEv.Comm[:])
 
 	case *NameEvent:
@@ -158,9 +157,16 @@ func (e *eventLoop) syscallExit(exitEv event, ch chan<- *eventPair) {
 			ev.file = newFdFileWithPid(fd, ev.enterEv.(*FdEvent).Pid)
 		}
 		ev.comm = e.comm(ev.enterEv.GetTid())
-
+		if !e.filter.eventPair(ev) {
+			ev.recycle()
+			return
+		}
 	case *NullEvent:
 		ev.comm = e.comm(ev.enterEv.GetTid())
+		if !e.filter.eventPair(ev) {
+			ev.recycle()
+			return
+		}
 
 	default:
 		panic(fmt.Sprintf("unknown type: %v", v))
@@ -177,6 +183,7 @@ func (e *eventLoop) comm(tid uint32) string {
 		return comm
 	}
 	if linkName, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", tid)); err == nil {
+		linkName = filepath.Base(linkName)
 		e.comms[tid] = linkName
 		return linkName
 	}
diff --git a/internal/file.go b/internal/file.go
index efb570b..fe519ba 100644
--- a/internal/file.go
+++ b/internal/file.go
@@ -9,6 +9,7 @@ import (
 
 type file interface {
 	String() string
+	Name() string
 }
 
 type fdFile struct {
@@ -27,6 +28,10 @@ func newFdFileWithPid(fd int32, pid uint32) fdFile {
 	return fdFile{fd, "?"}
 }
 
+func (f fdFile) Name() string {
+	return f.name
+}
+
 func (f fdFile) String() string {
 	var sb strings.Builder
 
@@ -46,6 +51,10 @@ type oldnameNewnameFile struct {
 	oldname, newname string
 }
 
+func (f oldnameNewnameFile) Name() string {
+	return f.newname
+}
+
 func (f oldnameNewnameFile) String() string {
 	var sb strings.Builder
 
@@ -61,6 +70,10 @@ type pathnameFile struct {
 	pathname string
 }
 
+func (f pathnameFile) Name() string {
+	return f.pathname
+}
+
 func (f pathnameFile) String() string {
 	var sb strings.Builder