Skip to content

Commit 1529dbe

Browse files
NDStrahilevitzNDStrahilevitz
committed
filters: move enabling logic to methods
1 parent cb56c15 commit 1529dbe

File tree

12 files changed

+155
-50
lines changed

12 files changed

+155
-50
lines changed

‎cmd/tracee-ebpf/flags/filter.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -158,14 +158,14 @@ func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
158158

159159
if strings.HasPrefix("container", filterName) {
160160
if operatorAndValues == "=new" {
161-
filter.NewContFilter.Enabled = true
161+
filter.NewContFilter.Enable()
162162
filter.NewContFilter.Value = true
163163
continue
164164
}
165165
if operatorAndValues == "!=new" {
166-
filter.ContFilter.Enabled = true
166+
filter.ContFilter.Enable()
167167
filter.ContFilter.Value = true
168-
filter.NewContFilter.Enabled = true
168+
filter.NewContFilter.Enable()
169169
filter.NewContFilter.Value = false
170170
continue
171171
}
@@ -218,12 +218,12 @@ func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
218218

219219
if strings.HasPrefix("pid", filterName) {
220220
if operatorAndValues == "=new" {
221-
filter.NewPidFilter.Enabled = true
221+
filter.NewPidFilter.Enable()
222222
filter.NewPidFilter.Value = true
223223
continue
224224
}
225225
if operatorAndValues == "!=new" {
226-
filter.NewPidFilter.Enabled = true
226+
filter.NewPidFilter.Enable()
227227
filter.NewPidFilter.Value = false
228228
continue
229229
}
@@ -275,7 +275,7 @@ func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
275275
}
276276

277277
func prepareEventsToTrace(eventFilter *filters.StringFilter, setFilter *filters.StringFilter, eventsNameToID map[string]events.ID) ([]events.ID, error) {
278-
eventFilter.Enabled = true
278+
eventFilter.Enable()
279279
eventsToTrace := eventFilter.Equal
280280
excludeEvents := eventFilter.NotEqual
281281
setsToTrace := setFilter.Equal

‎cmd/tracee-ebpf/main.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,9 @@ func main() {
135135
}
136136
cfg.Filter = &filter
137137

138-
containerMode := (cfg.Filter.ContFilter.Enabled && cfg.Filter.ContFilter.Value) ||
139-
(cfg.Filter.NewContFilter.Enabled && cfg.Filter.NewContFilter.Value) ||
140-
cfg.Filter.ContIDFilter.Enabled
138+
containerMode := (cfg.Filter.ContFilter.Enabled() && cfg.Filter.ContFilter.Value) ||
139+
(cfg.Filter.NewContFilter.Enabled() && cfg.Filter.NewContFilter.Value) ||
140+
cfg.Filter.ContIDFilter.Enabled()
141141

142142
outputSlice := c.StringSlice("output")
143143
if checkCommandIsHelp(outputSlice) {

‎pkg/ebpf/events_pipeline.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ func (t *Tracee) processEvents(ctx context.Context, in <-chan *trace.Event) (<-c
249249
continue
250250
}
251251

252-
if (t.config.Filter.ContFilter.Value || t.config.Filter.NewContFilter.Enabled) && event.ContainerID == "" {
252+
if (t.config.Filter.ContFilter.Value || t.config.Filter.NewContFilter.Enabled()) && event.ContainerID == "" {
253253
// Don't trace false container positives -
254254
// a container filter is set by the user, but this event wasn't originated in a container.
255255
// Although kernel filters shouldn't submit such events, we do this check to be on the safe side.

‎pkg/ebpf/tracee.go‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -654,67 +654,67 @@ func (t *Tracee) getOptionsConfig() uint32 {
654654

655655
func (t *Tracee) getFiltersConfig() uint32 {
656656
var cFilterVal uint32
657-
if t.config.Filter.UIDFilter.Enabled {
657+
if t.config.Filter.UIDFilter.Enabled() {
658658
cFilterVal = cFilterVal | filterUIDEnabled
659659
if t.config.Filter.UIDFilter.FilterOut() {
660660
cFilterVal = cFilterVal | filterUIDOut
661661
}
662662
}
663-
if t.config.Filter.PIDFilter.Enabled {
663+
if t.config.Filter.PIDFilter.Enabled() {
664664
cFilterVal = cFilterVal | filterPidEnabled
665665
if t.config.Filter.PIDFilter.FilterOut() {
666666
cFilterVal = cFilterVal | filterPidOut
667667
}
668668
}
669-
if t.config.Filter.NewPidFilter.Enabled {
669+
if t.config.Filter.NewPidFilter.Enabled() {
670670
cFilterVal = cFilterVal | filterNewPidEnabled
671671
if t.config.Filter.NewPidFilter.FilterOut() {
672672
cFilterVal = cFilterVal | filterNewPidOut
673673
}
674674
}
675-
if t.config.Filter.MntNSFilter.Enabled {
675+
if t.config.Filter.MntNSFilter.Enabled() {
676676
cFilterVal = cFilterVal | filterMntNsEnabled
677677
if t.config.Filter.MntNSFilter.FilterOut() {
678678
cFilterVal = cFilterVal | filterMntNsOut
679679
}
680680
}
681-
if t.config.Filter.PidNSFilter.Enabled {
681+
if t.config.Filter.PidNSFilter.Enabled() {
682682
cFilterVal = cFilterVal | filterPidNsEnabled
683683
if t.config.Filter.PidNSFilter.FilterOut() {
684684
cFilterVal = cFilterVal | filterPidNsOut
685685
}
686686
}
687-
if t.config.Filter.UTSFilter.Enabled {
687+
if t.config.Filter.UTSFilter.Enabled() {
688688
cFilterVal = cFilterVal | filterUTSNsEnabled
689689
if t.config.Filter.UTSFilter.FilterOut() {
690690
cFilterVal = cFilterVal | filterUTSNsOut
691691
}
692692
}
693-
if t.config.Filter.CommFilter.Enabled {
693+
if t.config.Filter.CommFilter.Enabled() {
694694
cFilterVal = cFilterVal | filterCommEnabled
695695
if t.config.Filter.CommFilter.FilterOut() {
696696
cFilterVal = cFilterVal | filterCommOut
697697
}
698698
}
699-
if t.config.Filter.ContFilter.Enabled {
699+
if t.config.Filter.ContFilter.Enabled() {
700700
cFilterVal = cFilterVal | filterContEnabled
701701
if t.config.Filter.ContFilter.FilterOut() {
702702
cFilterVal = cFilterVal | filterContOut
703703
}
704704
}
705-
if t.config.Filter.NewContFilter.Enabled {
705+
if t.config.Filter.NewContFilter.Enabled() {
706706
cFilterVal = cFilterVal | filterNewContEnabled
707707
if t.config.Filter.NewContFilter.FilterOut() {
708708
cFilterVal = cFilterVal | filterNewContOut
709709
}
710710
}
711-
if t.config.Filter.ContIDFilter.Enabled {
711+
if t.config.Filter.ContIDFilter.Enabled() {
712712
cFilterVal = cFilterVal | filterCgroupIdEnabled
713713
if t.config.Filter.ContIDFilter.FilterOut() {
714714
cFilterVal = cFilterVal | filterCgroupIdOut
715715
}
716716
}
717-
if t.config.Filter.ProcessTreeFilter.Enabled {
717+
if t.config.Filter.ProcessTreeFilter.Enabled() {
718718
cFilterVal = cFilterVal | filterProcTreeEnabled
719719
if t.config.Filter.ProcessTreeFilter.FilterOut() {
720720
cFilterVal = cFilterVal | filterProcTreeOut
@@ -1083,7 +1083,7 @@ func (t *Tracee) initBPF() error {
10831083
return err
10841084
}
10851085

1086-
err = t.config.Filter.ProcessTreeFilter.Set(t.bpfModule)
1086+
err = t.config.Filter.ProcessTreeFilter.InitBPF(t.bpfModule)
10871087
if err != nil {
10881088
return fmt.Errorf("error building process tree: %v", err)
10891089
}

‎pkg/filters/args.go‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,13 @@ import (
1010

1111
type ArgFilter struct {
1212
Filters map[events.ID]map[string]*StringFilter // key to the first map is event id, and to the second map the argument name
13-
Enabled bool
13+
enabled bool
1414
}
1515

1616
func NewArgFilter() *ArgFilter {
1717
return &ArgFilter{
1818
Filters: map[events.ID]map[string]*StringFilter{},
19-
Enabled: false,
19+
enabled: false,
2020
}
2121
}
2222

@@ -41,7 +41,7 @@ func matchFilter(filters []string, argValStr string) bool {
4141
}
4242

4343
func (filter *ArgFilter) Filter(eventID events.ID, args []trace.Argument) bool {
44-
if filter.Enabled {
44+
if filter.Enabled() {
4545
for argName, filter := range filter.Filters[events.ID(eventID)] {
4646
var argVal interface{}
4747
ok := false
@@ -70,7 +70,6 @@ func (filter *ArgFilter) Filter(eventID events.ID, args []trace.Argument) bool {
7070
}
7171

7272
func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, eventsNameToID map[string]events.ID) error {
73-
filter.Enabled = true
7473
// Event argument filter has the following format: "event.argname=argval"
7574
// filterName have the format event.argname, and operatorAndValues have the format "=argval"
7675
splitFilter := strings.Split(filterName, ".")
@@ -130,5 +129,29 @@ func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, even
130129

131130
filter.Filters[id][argName] = val
132131

132+
filter.Enable()
133+
133134
return nil
134135
}
136+
137+
func (filter *ArgFilter) Enable() {
138+
filter.enabled = true
139+
for _, filterMap := range filter.Filters {
140+
for _, f := range filterMap {
141+
f.Enable()
142+
}
143+
}
144+
}
145+
146+
func (filter *ArgFilter) Disable() {
147+
filter.enabled = false
148+
for _, filterMap := range filter.Filters {
149+
for _, f := range filterMap {
150+
f.Disable()
151+
}
152+
}
153+
}
154+
155+
func (filter *ArgFilter) Enabled() bool {
156+
return filter.enabled
157+
}

‎pkg/filters/bool.go‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ package filters
22

33
type BoolFilter struct {
44
Value bool
5-
Enabled bool
5+
enabled bool
66
}
77

88
func NewBoolFilter() *BoolFilter {
99
return &BoolFilter{}
1010
}
1111

1212
func (filter *BoolFilter) Parse(value string) error {
13-
filter.Enabled = true
13+
filter.Enable()
1414
filter.Value = false
1515
if value[0] != '!' {
1616
filter.Value = true
@@ -19,6 +19,18 @@ func (filter *BoolFilter) Parse(value string) error {
1919
return nil
2020
}
2121

22+
func (f *BoolFilter) Enable() {
23+
f.enabled = true
24+
}
25+
26+
func (f *BoolFilter) Disable() {
27+
f.enabled = false
28+
}
29+
30+
func (f *BoolFilter) Enabled() bool {
31+
return f.enabled
32+
}
33+
2234
func (filter *BoolFilter) FilterOut() bool {
2335
if filter.Value {
2436
return false

‎pkg/filters/containers.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func NewContainerFilter(mapName string) *ContainerFilter {
1919
}
2020

2121
func (filter *ContainerFilter) InitBPF(bpfModule *bpf.Module, conts *containers.Containers) error {
22-
if !filter.Enabled {
22+
if !filter.Enabled() {
2323
return nil
2424
}
2525

‎pkg/filters/int.go‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ type IntFilter struct {
1818
Greater int64
1919
Less int64
2020
Is32Bit bool
21-
Enabled bool
21+
enabled bool
2222
}
2323

2424
func NewIntFilter() *IntFilter {
@@ -36,12 +36,23 @@ func newIntFilter(is32Bit bool) *IntFilter {
3636
Greater: maxIntVal,
3737
Less: minIntVal,
3838
Is32Bit: is32Bit,
39-
Enabled: false,
39+
enabled: false,
4040
}
4141
}
4242

43+
func (f *IntFilter) Enable() {
44+
f.enabled = true
45+
}
46+
47+
func (f *IntFilter) Disable() {
48+
f.enabled = false
49+
}
50+
51+
func (f *IntFilter) Enabled() bool {
52+
return f.enabled
53+
}
54+
4355
func (filter *IntFilter) Parse(operatorAndValues string) error {
44-
filter.Enabled = true
4556
if len(operatorAndValues) < 2 {
4657
return fmt.Errorf("invalid operator and/or values given to filter: %s", operatorAndValues)
4758
}
@@ -84,5 +95,7 @@ func (filter *IntFilter) Parse(operatorAndValues string) error {
8495
}
8596
}
8697

98+
filter.Enable()
99+
87100
return nil
88101
}

‎pkg/filters/processtree.go‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,31 @@ import (
1414

1515
type ProcessTreeFilter struct {
1616
PIDs map[uint32]bool // PIDs is a map where k=pid and v represents whether it and its descendents should be traced or not
17-
Enabled bool
17+
enabled bool
1818
mapName string
1919
}
2020

2121
func NewProcessTreeFilter(mapName string) *ProcessTreeFilter {
2222
return &ProcessTreeFilter{
2323
PIDs: map[uint32]bool{},
24-
Enabled: false,
24+
enabled: false,
2525
mapName: mapName,
2626
}
2727
}
2828

29-
func (filter *ProcessTreeFilter) Parse(operatorAndValues string) error {
30-
filter.Enabled = true
29+
func (f *ProcessTreeFilter) Enable() {
30+
f.enabled = true
31+
}
32+
33+
func (f *ProcessTreeFilter) Disable() {
34+
f.enabled = false
35+
}
3136

37+
func (f *ProcessTreeFilter) Enabled() bool {
38+
return f.enabled
39+
}
40+
41+
func (filter *ProcessTreeFilter) Parse(operatorAndValues string) error {
3242
if len(operatorAndValues) < 2 {
3343
return fmt.Errorf("invalid operator and/or values given to filter: %s", operatorAndValues)
3444
}
@@ -60,11 +70,13 @@ func (filter *ProcessTreeFilter) Parse(operatorAndValues string) error {
6070
filter.PIDs[uint32(pid)] = equalityOperator
6171
}
6272

73+
filter.Enable()
74+
6375
return nil
6476
}
6577

66-
func (filter *ProcessTreeFilter) Set(bpfModule *bpf.Module) error {
67-
if !filter.Enabled {
78+
func (filter *ProcessTreeFilter) InitBPF(bpfModule *bpf.Module) error {
79+
if !filter.Enabled() {
6880
return nil
6981
}
7082

0 commit comments

Comments
 (0)