-
Notifications
You must be signed in to change notification settings - Fork 42
/
utils.go
317 lines (276 loc) · 9.75 KB
/
utils.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
package manager
import (
"bufio"
"debug/elf"
"errors"
"fmt"
"os"
"regexp"
"runtime"
"sort"
"strconv"
"strings"
"sync"
)
type state uint
const (
reset state = iota
initialized
paused
running
// maxEventNameLen - maximum length for a kprobe (or uprobe) event name
// MAX_EVENT_NAME_LEN (linux/kernel/trace/trace.h)
maxEventNameLen = 64
minFunctionNameLen = 10
// maxBPFClassifierNameLen - maximum length for a TC
// CLS_BPF_NAME_LEN (linux/net/sched/cls_bpf.c)
maxBPFClassifierNameLen = 256
)
// ConcatErrors - Concatenate 2 errors into one error.
func ConcatErrors(err1, err2 error) error {
if err1 == nil {
return err2
}
if err2 != nil {
return fmt.Errorf("error:%v, error2:%v", err1, err2.Error())
}
return err1
}
// availableFilterFunctions - cache of the list of available kernel functions.
var availableFilterFunctions []string
func FindFilterFunction(funcName string) (string, error) {
// Prepare matching pattern
searchedName, err := regexp.Compile(funcName)
if err != nil {
return "", err
}
// Cache available filter functions if necessary
if len(availableFilterFunctions) == 0 {
funcs, err := os.ReadFile("/sys/kernel/debug/tracing/available_filter_functions")
if err != nil {
return "", err
}
availableFilterFunctions = strings.Split(string(funcs), "\n")
for i, name := range availableFilterFunctions {
splittedName := strings.Split(name, " ")
name = splittedName[0]
splittedName = strings.Split(name, "\t")
name = splittedName[0]
availableFilterFunctions[i] = name
}
sort.Strings(availableFilterFunctions)
}
// Match function name
var potentialMatches []string
for _, f := range availableFilterFunctions {
if searchedName.MatchString(f) {
potentialMatches = append(potentialMatches, f)
}
if f == funcName {
return f, nil
}
}
if len(potentialMatches) > 0 {
return potentialMatches[0], nil
}
return "", nil
}
// cache of the syscall prefix depending on kernel version
var syscallPrefix string
// GetSyscallFnName - Returns the kernel function of the provided syscall, after reading /proc/kallsyms to retrieve
// the list of symbols of the current kernel.
func GetSyscallFnName(name string) (string, error) {
return GetSyscallFnNameWithSymFile(name, defaultSymFile)
}
// cache of the symfile
var kallsymsCache = make(map[string]bool)
var kallSymsLocker = sync.Mutex{}
// GetSyscallFnNameWithSymFile - Returns the kernel function of the provided syscall, after reading symFile to retrieve
// the list of symbols of the current kernel.
func GetSyscallFnNameWithSymFile(name string, symFile string) (string, error) {
if symFile == "" {
symFile = defaultSymFile
}
// Get name from kallsyms cache
if len(kallsymsCache) == 0 {
file, err := os.Open(symFile)
if err != nil {
return "", err
}
defer file.Close()
// cache up the kallsyms for speed up
scanner := bufio.NewScanner(file)
for scanner.Scan() {
line := strings.Split(scanner.Text(), " ")
if len(line) < 3 {
continue
}
// only save symbol in text (code) section and weak symbol
// Reference: https://github.com/iovisor/bcc/pull/1540/files
if strings.ToLower(line[1]) == "t" || strings.ToLower(line[1]) == "w" {
kallSymsLocker.Lock()
kallsymsCache[line[2]] = true
kallSymsLocker.Unlock()
}
}
}
kallSymsLocker.Lock()
_, exist := kallsymsCache[name]
kallSymsLocker.Unlock()
if exist {
return name, nil
}
if syscallPrefix == "" {
syscallName, err := getSyscallName("open", symFile)
if err != nil {
return "", err
}
syscallPrefix = strings.TrimSuffix(syscallName, "open")
}
return syscallPrefix + name, nil
}
const defaultSymFile = "/proc/kallsyms"
// Returns the qualified syscall named by going through '/proc/kallsyms' on the
// system on which its executed. It allows BPF programs that may have been compiled
// for older syscall functions to run on newer kernels
func getSyscallName(name string, symFile string) (string, error) {
// Get kernel symbols
syms, err := os.ReadFile(symFile)
if err != nil {
return "", err
}
return getSyscallFnNameWithKallsyms(name, string(syms))
}
func getSyscallFnNameWithKallsyms(name string, kallsymsContent string) (string, error) {
var arch string
switch runtime.GOARCH {
case "386":
arch = "ia32"
case "arm64":
arch = "arm64"
default:
arch = "x64"
}
var b strings.Builder
// We should search for new syscall function like "__x64__sys_open"
// Note the start of word boundary. Should return exactly one string
regexStr := `(\b__` + arch + `_[Ss]y[sS]_` + name + `\b)`
fnRegex := regexp.MustCompile(regexStr)
match := fnRegex.FindString(kallsymsContent)
if len(match) > 0 {
b.WriteString(match)
return b.String(), nil
}
// If nothing found, search for old syscall function to be sure
regexStr = `(\b[Ss]y[sS]_` + name + `\b)`
fnRegex = regexp.MustCompile(regexStr)
match = fnRegex.FindString(kallsymsContent)
// If we get something like 'sys_open' or 'SyS_open', return
// either (they have same addr) else, just return original string
if len(match) > 0 {
b.WriteString(match)
return b.String(), nil
}
// check for '__' prefixed functions, like '__sys_open'
regexStr = `(\b__[Ss]y[sS]_` + name + `\b)`
fnRegex = regexp.MustCompile(regexStr)
match = fnRegex.FindString(kallsymsContent)
// If we get something like '__sys_open' or '__SyS_open', return
// either (they have same addr) else, just return original string
if len(match) > 0 {
b.WriteString(match)
return b.String(), nil
}
return "", errors.New("could not find a valid syscall name")
}
var safeEventRegexp = regexp.MustCompile("[^a-zA-Z0-9]")
func GenerateEventName(probeType, funcName, UID string, attachPID int) (string, error) {
// truncate the function name and UID name to reduce the length of the event
attachPIDstr := strconv.Itoa(attachPID)
maxFuncNameLen := (maxEventNameLen - 3 /* _ */ - len(probeType) - len(UID) - len(attachPIDstr))
if maxFuncNameLen < minFunctionNameLen { /* let's garantee that we have a function name minimum of 10 chars (minFunctionNameLen) of trow an error */
dbgFullEventString := safeEventRegexp.ReplaceAllString(fmt.Sprintf("%s_%s_%s_%s", probeType, funcName, UID, attachPIDstr), "_")
return "", fmt.Errorf("event name is too long (kernel limit is %d (MAX_EVENT_NAME_LEN)): minFunctionNameLen %d, len 3, probeType %d, funcName %d, UID %d, attachPIDstr %d ; full event string : '%s'", maxEventNameLen, minFunctionNameLen, len(probeType), len(funcName), len(UID), len(attachPIDstr), dbgFullEventString)
}
eventName := safeEventRegexp.ReplaceAllString(fmt.Sprintf("%s_%.*s_%s_%s", probeType, maxFuncNameLen, funcName, UID, attachPIDstr), "_")
if len(eventName) > maxEventNameLen {
return "", fmt.Errorf("event name too long (kernel limit MAX_EVENT_NAME_LEN is %d): '%s'", maxEventNameLen, eventName)
}
return eventName, nil
}
// OpenAndListSymbols - Opens an elf file and extracts all its symbols
func OpenAndListSymbols(path string) (*elf.File, []elf.Symbol, error) {
// open elf file
f, err := elf.Open(path)
if err != nil {
return nil, nil, errors.New(fmt.Sprintf("error:%v , couldn't open elf file %s", err, path))
}
defer f.Close()
// Loop through all symbols
syms, errSyms := f.Symbols()
dynSyms, errDynSyms := f.DynamicSymbols()
syms = append(syms, dynSyms...)
if len(syms) == 0 {
var err error
if errSyms != nil {
err = errors.New(fmt.Sprintf("error:%v , failed to list symbols", err))
}
if errDynSyms != nil {
err = errors.New(fmt.Sprintf("error:%v , failed to list dynamic symbols", err))
}
if err != nil {
return nil, nil, err
} else {
return nil, nil, errors.New("no symbols found")
}
}
return f, syms, nil
}
// SanitizeUprobeAddresses - sanitizes the addresses of the provided symbols
func SanitizeUprobeAddresses(f *elf.File, syms []elf.Symbol) {
// If the binary is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to
// the file load address. For executable (ET_EXEC) binaries and shared objects (ET_DYN), translate the virtual
// address to physical address in the binary file.
if f.Type == elf.ET_EXEC || f.Type == elf.ET_DYN {
for i, sym := range syms {
for _, prog := range f.Progs {
if prog.Type == elf.PT_LOAD {
if sym.Value >= prog.Vaddr && sym.Value < (prog.Vaddr+prog.Memsz) {
syms[i].Value = sym.Value - prog.Vaddr + prog.Off
}
}
}
}
}
}
// FindSymbolOffsets - Parses the provided file and returns the offsets of the symbols that match the provided pattern
func FindSymbolOffsets(path string, pattern *regexp.Regexp) ([]elf.Symbol, error) {
f, syms, err := OpenAndListSymbols(path)
if err != nil {
return nil, err
}
var matches []elf.Symbol
for _, sym := range syms {
if elf.ST_TYPE(sym.Info) == elf.STT_FUNC && pattern.MatchString(sym.Name) {
matches = append(matches, sym)
}
}
if len(matches) == 0 {
return nil, ErrSymbolNotFound
}
SanitizeUprobeAddresses(f, matches)
return matches, nil
}
func generateTCFilterName(UID, sectionName string, attachPID int) (string, error) {
attachPIDstr := strconv.Itoa(attachPID)
maxSectionNameLen := maxBPFClassifierNameLen - 3 /* _ */ - len(UID) - len(attachPIDstr)
if maxSectionNameLen < 0 {
dbgFullFilterString := safeEventRegexp.ReplaceAllString(fmt.Sprintf("%s_%s_%s", sectionName, UID, attachPIDstr), "_")
return "", fmt.Errorf("filter name is too long (kernel limit is %d (CLS_BPF_NAME_LEN)): sectionName %d, UID %d, attachPIDstr %d ; full event string : '%s'", maxEventNameLen, len(sectionName), len(UID), len(attachPIDstr), dbgFullFilterString)
}
filterName := safeEventRegexp.ReplaceAllString(fmt.Sprintf("%.*s_%s_%s", maxSectionNameLen, sectionName, UID, attachPIDstr), "_")
if len(filterName) > maxBPFClassifierNameLen {
return "", fmt.Errorf("filter name too long (kernel limit CLS_BPF_NAME_LEN is %d): '%s'", maxBPFClassifierNameLen, filterName)
}
return filterName, nil
}