Skip to content

Commit 98666e1

Browse files
NDStrahilevitzNDStrahilevitz
committed
filters: add filter constructors
1 parent 5dbc539 commit 98666e1

File tree

11 files changed

+118
-77
lines changed

11 files changed

+118
-77
lines changed

‎cmd/tracee-ebpf/flags/filter.go‎

Lines changed: 16 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@ import (
99
"github.com/aquasecurity/tracee/pkg/filters"
1010
)
1111

12-
// MaxBpfStrFilterSize value should match MAX_STR_FILTER_SIZE defined in BPF code
13-
const MaxBpfStrFilterSize = 16
14-
1512
func FilterHelp() string {
1613
return `Select which events to trace by defining trace expressions that operate on events or process metadata.
1714
Only events that match all trace expressions will be traced (trace flags are ANDed).
@@ -85,66 +82,27 @@ To 'escape' those operators, please use single quotes, e.g.: 'uid>0'
8582

8683
func PrepareFilter(filtersArr []string) (tracee.Filter, error) {
8784
filter := tracee.Filter{
88-
UIDFilter: &filters.UIntFilter{
89-
Equal: []uint64{},
90-
NotEqual: []uint64{},
91-
Less: filters.LessNotSetUint,
92-
Greater: filters.GreaterNotSetUint,
93-
Is32Bit: true,
94-
},
95-
PIDFilter: &filters.UIntFilter{
96-
Equal: []uint64{},
97-
NotEqual: []uint64{},
98-
Less: filters.LessNotSetUint,
99-
Greater: filters.GreaterNotSetUint,
100-
Is32Bit: true,
101-
},
102-
NewPidFilter: &filters.BoolFilter{},
103-
MntNSFilter: &filters.UIntFilter{
104-
Equal: []uint64{},
105-
NotEqual: []uint64{},
106-
Less: filters.LessNotSetUint,
107-
Greater: filters.GreaterNotSetUint,
108-
},
109-
PidNSFilter: &filters.UIntFilter{
110-
Equal: []uint64{},
111-
NotEqual: []uint64{},
112-
Less: filters.LessNotSetUint,
113-
Greater: filters.GreaterNotSetUint,
114-
},
115-
UTSFilter: &filters.StringFilter{
116-
Equal: []string{},
117-
NotEqual: []string{},
118-
Size: MaxBpfStrFilterSize,
119-
},
120-
CommFilter: &filters.StringFilter{
121-
Equal: []string{},
122-
NotEqual: []string{},
123-
Size: MaxBpfStrFilterSize,
124-
},
125-
ContFilter: &filters.BoolFilter{},
126-
NewContFilter: &filters.BoolFilter{},
127-
ContIDFilter: &filters.ContIDFilter{
128-
Equal: []string{},
129-
NotEqual: []string{},
130-
},
131-
RetFilter: &filters.RetFilter{
132-
Filters: make(map[events.ID]filters.IntFilter),
133-
},
134-
ArgFilter: &filters.ArgFilter{
135-
Filters: make(map[events.ID]map[string]filters.StringFilter),
136-
},
137-
ProcessTreeFilter: &filters.ProcessTreeFilter{
138-
PIDs: make(map[uint32]bool),
139-
},
140-
EventsToTrace: []events.ID{},
85+
UIDFilter: filters.NewUInt32Filter(),
86+
PIDFilter: filters.NewUInt32Filter(),
87+
NewPidFilter: filters.NewBoolFilter(),
88+
MntNSFilter: filters.NewUIntFilter(),
89+
PidNSFilter: filters.NewUIntFilter(),
90+
UTSFilter: filters.NewStringFilter(),
91+
CommFilter: filters.NewStringFilter(),
92+
ContFilter: filters.NewBoolFilter(),
93+
NewContFilter: filters.NewBoolFilter(),
94+
ContIDFilter: filters.NewContainerFilter("cgroup_id_filter"),
95+
RetFilter: filters.NewRetFilter(),
96+
ArgFilter: filters.NewArgFilter(),
97+
ProcessTreeFilter: filters.NewProcessTreeFilter(),
98+
EventsToTrace: []events.ID{},
14199
NetFilter: &tracee.NetIfaces{
142100
Ifaces: []string{},
143101
},
144102
}
145103

146-
eventFilter := &filters.StringFilter{Equal: []string{}, NotEqual: []string{}}
147-
setFilter := &filters.StringFilter{Equal: []string{}, NotEqual: []string{}}
104+
eventFilter := filters.NewStringFilter()
105+
setFilter := filters.NewStringFilter()
148106

149107
eventsNameToID := events.Definitions.NamesToIDs()
150108
// remove internal events since they shouldn't be accesible by users

‎pkg/ebpf/filters.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ type Filter struct {
2020
CommFilter *filters.StringFilter
2121
ContFilter *filters.BoolFilter
2222
NewContFilter *filters.BoolFilter
23-
ContIDFilter *filters.ContIDFilter
23+
ContIDFilter *filters.ContainerFilter
2424
RetFilter *filters.RetFilter
2525
ArgFilter *filters.ArgFilter
2626
ProcessTreeFilter *filters.ProcessTreeFilter

‎pkg/ebpf/tracee.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -825,7 +825,7 @@ func (t *Tracee) populateBPFMaps() error {
825825
errmap["pid_ns_filter"] = t.config.Filter.PidNSFilter.InitBPF(t.bpfModule, "pid_ns_filter")
826826
errmap["uts_ns_filter"] = t.config.Filter.UTSFilter.InitBPF(t.bpfModule, "uts_ns_filter")
827827
errmap["comm_filter"] = t.config.Filter.CommFilter.InitBPF(t.bpfModule, "comm_filter")
828-
errmap["cont_id_filter"] = t.config.Filter.ContIDFilter.InitBPF(t.bpfModule, t.containers, "cgroup_id_filter")
828+
errmap["cont_id_filter"] = t.config.Filter.ContIDFilter.InitBPF(t.bpfModule, t.containers)
829829

830830
for k, v := range errmap {
831831
if v != nil {

‎pkg/filters/args.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,17 @@ import (
88
)
99

1010
type ArgFilter struct {
11-
Filters map[events.ID]map[string]StringFilter // key to the first map is event id, and to the second map the argument name
11+
Filters map[events.ID]map[string]*StringFilter // key to the first map is event id, and to the second map the argument name
1212
Enabled bool
1313
}
1414

15+
func NewArgFilter() *ArgFilter {
16+
return &ArgFilter{
17+
Filters: map[events.ID]map[string]*StringFilter{},
18+
Enabled: false,
19+
}
20+
}
21+
1522
func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, eventsNameToID map[string]events.ID) error {
1623
filter.Enabled = true
1724
// Event argument filter has the following format: "event.argname=argval"
@@ -59,11 +66,11 @@ func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, even
5966
}
6067

6168
if _, ok := filter.Filters[id]; !ok {
62-
filter.Filters[id] = make(map[string]StringFilter)
69+
filter.Filters[id] = map[string]*StringFilter{}
6370
}
6471

6572
if _, ok := filter.Filters[id][argName]; !ok {
66-
filter.Filters[id][argName] = StringFilter{}
73+
filter.Filters[id][argName] = &StringFilter{}
6774
}
6875

6976
val := filter.Filters[id][argName]

‎pkg/filters/bool.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ type BoolFilter struct {
55
Enabled bool
66
}
77

8+
func NewBoolFilter() *BoolFilter {
9+
return &BoolFilter{}
10+
}
11+
812
func (filter *BoolFilter) Parse(value string) error {
913
filter.Enabled = true
1014
filter.Value = false

‎pkg/filters/containers.go‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,23 @@ import (
88
"github.com/aquasecurity/tracee/pkg/containers"
99
)
1010

11-
type ContIDFilter struct {
12-
Equal []string
13-
NotEqual []string
14-
Enabled bool
11+
type ContainerFilter struct {
12+
Equal []string
13+
NotEqual []string
14+
Enabled bool
15+
bpfMapName string
1516
}
1617

17-
func (filter *ContIDFilter) Parse(operatorAndValues string) error {
18+
func NewContainerFilter(mapName string) *ContainerFilter {
19+
return &ContainerFilter{
20+
Equal: []string{},
21+
NotEqual: []string{},
22+
Enabled: false,
23+
bpfMapName: mapName,
24+
}
25+
}
26+
27+
func (filter *ContainerFilter) Parse(operatorAndValues string) error {
1828
filter.Enabled = true
1929

2030
strFilter := &StringFilter{
@@ -34,15 +44,15 @@ func (filter *ContIDFilter) Parse(operatorAndValues string) error {
3444
return nil
3545
}
3646

37-
func (filter *ContIDFilter) InitBPF(bpfModule *bpf.Module, conts *containers.Containers, filterMapName string) error {
47+
func (filter *ContainerFilter) InitBPF(bpfModule *bpf.Module, conts *containers.Containers) error {
3848
if !filter.Enabled {
3949
return nil
4050
}
4151

4252
filterEqualU32 := uint32(filterEqual) // const need local var for bpfMap.Update()
4353
filterNotEqualU32 := uint32(filterNotEqual)
4454

45-
filterMap, err := bpfModule.GetMap(filterMapName)
55+
filterMap, err := bpfModule.GetMap(filter.bpfMapName)
4656
if err != nil {
4757
return err
4858
}
@@ -75,7 +85,7 @@ func (filter *ContIDFilter) InitBPF(bpfModule *bpf.Module, conts *containers.Con
7585
return nil
7686
}
7787

78-
func (filter *ContIDFilter) FilterOut() bool {
88+
func (filter *ContainerFilter) FilterOut() bool {
7989
if len(filter.Equal) > 0 && len(filter.NotEqual) == 0 {
8090
return false
8191
} else {

‎pkg/filters/int.go‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,25 @@ type IntFilter struct {
1616
Enabled bool
1717
}
1818

19+
func NewIntFilter() *IntFilter {
20+
return newIntFilter(false)
21+
}
22+
23+
func NewInt32Filter() *IntFilter {
24+
return newIntFilter(true)
25+
}
26+
27+
func newIntFilter(is32Bit bool) *IntFilter {
28+
return &IntFilter{
29+
Equal: []int64{},
30+
NotEqual: []int64{},
31+
Greater: GreaterNotSetInt,
32+
Less: LessNotSetInt,
33+
Is32Bit: is32Bit,
34+
Enabled: false,
35+
}
36+
}
37+
1938
func (filter *IntFilter) Parse(operatorAndValues string) error {
2039
filter.Enabled = true
2140
if len(operatorAndValues) < 2 {

‎pkg/filters/processtree.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,13 @@ type ProcessTreeFilter struct {
1717
Enabled bool
1818
}
1919

20+
func NewProcessTreeFilter() *ProcessTreeFilter {
21+
return &ProcessTreeFilter{
22+
PIDs: map[uint32]bool{},
23+
Enabled: false,
24+
}
25+
}
26+
2027
func (filter *ProcessTreeFilter) Parse(operatorAndValues string) error {
2128
filter.Enabled = true
2229

‎pkg/filters/retval.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,17 @@ import (
88
)
99

1010
type RetFilter struct {
11-
Filters map[events.ID]IntFilter
11+
Filters map[events.ID]*IntFilter
1212
Enabled bool
1313
}
1414

15+
func NewRetFilter() *RetFilter {
16+
return &RetFilter{
17+
Filters: map[events.ID]*IntFilter{},
18+
Enabled: false,
19+
}
20+
}
21+
1522
func (filter *RetFilter) Parse(filterName string, operatorAndValues string, eventsNameToID map[string]events.ID) error {
1623
filter.Enabled = true
1724
// Ret filter has the following format: "event.ret=val"
@@ -28,7 +35,7 @@ func (filter *RetFilter) Parse(filterName string, operatorAndValues string, even
2835
}
2936

3037
if _, ok := filter.Filters[id]; !ok {
31-
filter.Filters[id] = IntFilter{
38+
filter.Filters[id] = &IntFilter{
3239
Equal: []int64{},
3340
NotEqual: []int64{},
3441
Less: LessNotSetInt,
@@ -39,7 +46,7 @@ func (filter *RetFilter) Parse(filterName string, operatorAndValues string, even
3946
intFilter := filter.Filters[id]
4047

4148
// Treat operatorAndValues as an int filter to avoid code duplication
42-
err := (&intFilter).Parse(operatorAndValues)
49+
err := intFilter.Parse(operatorAndValues)
4350
if err != nil {
4451
return err
4552
}

‎pkg/filters/string.go‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,17 @@ import (
1111
type StringFilter struct {
1212
Equal []string
1313
NotEqual []string
14-
Size uint
1514
Enabled bool
1615
}
1716

17+
func NewStringFilter() *StringFilter {
18+
return &StringFilter{
19+
Equal: []string{},
20+
NotEqual: []string{},
21+
Enabled: false,
22+
}
23+
}
24+
1825
func (filter *StringFilter) Parse(operatorAndValues string) error {
1926
filter.Enabled = true
2027
if len(operatorAndValues) < 2 {
@@ -48,6 +55,9 @@ func (filter *StringFilter) Parse(operatorAndValues string) error {
4855
}
4956

5057
func (filter *StringFilter) InitBPF(bpfModule *bpf.Module, filterMapName string) error {
58+
// MaxBpfStrFilterSize value should match MAX_STR_FILTER_SIZE defined in BPF code
59+
const maxBpfStrFilterSize = 16
60+
5161
if !filter.Enabled {
5262
return nil
5363
}
@@ -62,14 +72,14 @@ func (filter *StringFilter) InitBPF(bpfModule *bpf.Module, filterMapName string)
6272
return err
6373
}
6474
for i := 0; i < len(filter.Equal); i++ {
65-
filterEqualBytes := make([]byte, filter.Size)
75+
filterEqualBytes := make([]byte, maxBpfStrFilterSize)
6676
copy(filterEqualBytes, filter.Equal[i])
6777
if err = filterMap.Update(unsafe.Pointer(&filterEqualBytes[0]), unsafe.Pointer(&filterEqualU32)); err != nil {
6878
return err
6979
}
7080
}
7181
for i := 0; i < len(filter.NotEqual); i++ {
72-
filterNotEqualBytes := make([]byte, filter.Size)
82+
filterNotEqualBytes := make([]byte, maxBpfStrFilterSize)
7383
copy(filterNotEqualBytes, filter.NotEqual[i])
7484
if err = filterMap.Update(unsafe.Pointer(&filterNotEqualBytes[0]), unsafe.Pointer(&filterNotEqualU32)); err != nil {
7585
return err

0 commit comments

Comments
 (0)