diff options
| -rw-r--r-- | internal/eventfilter.go | 34 | ||||
| -rw-r--r-- | internal/eventloop.go | 8 | ||||
| -rw-r--r-- | internal/flags/flags.go | 2 |
3 files changed, 41 insertions, 3 deletions
diff --git a/internal/eventfilter.go b/internal/eventfilter.go index 1edda5a..cedd88d 100644 --- a/internal/eventfilter.go +++ b/internal/eventfilter.go @@ -2,6 +2,7 @@ package internal import ( "bytes" + "fmt" "ior/internal/flags" "ior/internal/generated/types" ) @@ -9,22 +10,53 @@ import ( type eventFilter struct { commFilterEnable bool commFilter [types.MAX_PROGNAME_LENGTH]byte + pathFilterEnable bool + pathFilter [types.MAX_FILENAME_LENGTH]byte } func newEventFilter(flags flags.Flags) *eventFilter { var ef eventFilter if flags.CommFilter != "" { + if len(flags.CommFilter) > types.MAX_FILENAME_LENGTH { + panic(fmt.Sprintf("Comm filter's max size is %d", types.MAX_PROGNAME_LENGTH)) + } ef.commFilterEnable = true copy(ef.commFilter[:], []byte(flags.CommFilter)) } + if flags.PathFilter != "" { + if len(flags.PathFilter) > types.MAX_FILENAME_LENGTH { + panic(fmt.Sprintf("Path filter's max size is %d", types.MAX_FILENAME_LENGTH)) + } + ef.pathFilterEnable = true + copy(ef.pathFilter[:], []byte(flags.PathFilter)) + } return &ef } func (ef *eventFilter) openEvent(ev *types.OpenEvent) (*types.OpenEvent, bool) { + commFilterPass := true if ef.commFilterEnable { - return ev, bytes.Contains(ev.Comm[:], ef.commFilter[:]) + commFilterPass = bytes.Contains(ev.Comm[:], ef.commFilter[:]) + } + pathFilterPass := true + if ef.pathFilterEnable { + pathFilterPass = bytes.Contains(ev.Filename[:], ef.pathFilter[:]) + } + return ev, commFilterPass && pathFilterPass +} + +func (ef *eventFilter) pathEvent(ev *types.PathEvent) (*types.PathEvent, bool) { + if ef.pathFilterEnable { + return ev, bytes.Contains(ev.Pathname[:], ef.pathFilter[:]) + } + return ev, true +} + +func (ef *eventFilter) nameEvent(ev *types.NameEvent) (*types.NameEvent, bool) { + if ef.pathFilterEnable { + return ev, bytes.Contains(ev.Oldname[:], ef.pathFilter[:]) || bytes.Contains(ev.Newname[:], ef.pathFilter[:]) } return ev, true } diff --git a/internal/eventloop.go b/internal/eventloop.go index 4961f80..8569004 100644 --- a/internal/eventloop.go +++ b/internal/eventloop.go @@ -71,9 +71,13 @@ func (e *eventLoop) events(rawCh <-chan []byte) <-chan *eventPair { case EXIT_RET_EVENT: e.syscallExit(NewRetEvent(raw), ch) case ENTER_NAME_EVENT: - e.syscallEnter(NewNameEvent(raw)) + if ev, ok := e.filter.nameEvent(NewNameEvent(raw)); ok { + e.syscallEnter(ev) + } case ENTER_PATH_EVENT: - e.syscallEnter(NewPathEvent(raw)) + if ev, ok := e.filter.pathEvent(NewPathEvent(raw)); ok { + e.syscallEnter(ev) + } default: panic(fmt.Sprintf("unhandled event type %v: %v", EventType(raw[0]), raw)) } diff --git a/internal/flags/flags.go b/internal/flags/flags.go index c22bb75..51bca07 100644 --- a/internal/flags/flags.go +++ b/internal/flags/flags.go @@ -12,6 +12,7 @@ type Flags struct { TidFilter int EventMapSize int CommFilter string + PathFilter string PprofEnable bool } @@ -20,6 +21,7 @@ func New() (flags Flags) { flag.IntVar(&flags.TidFilter, "tid", -1, "Filter for thread ID") flag.IntVar(&flags.EventMapSize, "mapSize", 4096*16, "BPF FD event ring buffer map size") flag.StringVar(&flags.CommFilter, "comm", "", "Command to filter for") + flag.StringVar(&flags.PathFilter, "path", "", "Path to filter for") flag.BoolVar(&flags.PprofEnable, "pprof", false, "Enable profiling") flag.Parse() |