File events

bpf_queue.c

@@ -67,6 +67,9 @@ libbpf_print_fn(enum libbpf_print_level level, const char *fmt, va_list ap)
 	return (0);
 }
 
+/*
+ * This structure exists to work around the bad layout of ebpf events
+ */
 struct ebpf_ctx {
 	struct ebpf_pid_info		*pids;
 	struct ebpf_cred_info		*creds;
@@ -304,6 +307,97 @@ ebpf_events_to_raw(struct ebpf_event_header *ev)
 		}
 		break;
 	}
+	case EBPF_EVENT_FILE_CREATE: /* FALLTHROUGH */
+	case EBPF_EVENT_FILE_DELETE: /* FALLTHROUGH */
+	case EBPF_EVENT_FILE_MODIFY: /* FALLTHROUGH */
+	case EBPF_EVENT_FILE_RENAME: {
+		struct ebpf_file_create_event	*create = NULL;
+		struct ebpf_file_delete_event	*delete = NULL;
+		struct ebpf_file_modify_event	*modify = NULL;
+		struct ebpf_file_rename_event	*rename = NULL;
+		struct ebpf_file_info		*info	= NULL;
+		const char			*path	= NULL;
+		struct ebpf_varlen_fields_start *vl	= NULL;
+		struct quark_file		*file;
+		size_t				 pathlen;
+		u32 dummy;
+
+		if ((raw = raw_event_alloc(RAW_FILE)) == NULL)
+			goto bad;
+
+		raw->time = ev->ts;
+
+		/* Cope with the weird ebpf layout structures */
+		switch (ev->type) {
+		case EBPF_EVENT_FILE_CREATE:
+			create = (struct ebpf_file_create_event *)ev;
+			info = &create->finfo;
+			vl = &create->vl_fields;
+			raw->pid = create->pids.tgid;
+			break;
+		case EBPF_EVENT_FILE_DELETE:
+			delete = (struct ebpf_file_delete_event *)ev;
+			info = &delete->finfo;
+			vl = &delete->vl_fields;
+			raw->pid = delete->pids.tgid;
+			break;
+		case EBPF_EVENT_FILE_MODIFY:
+			modify = (struct ebpf_file_modify_event *)ev;
+			info = &modify->finfo;
+			vl = &modify->vl_fields;
+			raw->pid = modify->pids.tgid;
+			break;
+		case EBPF_EVENT_FILE_RENAME:
+			rename = (struct ebpf_file_rename_event *)ev;
+			info = &rename->finfo;
+			vl = &rename->vl_fields;
+			raw->pid = rename->pids.tgid;
+			break;
+		default:
+			qwarnx("unhandled file event type %lu", ev->type);
+			goto bad;
+		}
+
+		if (info == NULL) {
+			qwarnx("no info");
+			goto bad;
+		}
+		FOR_EACH_VARLEN_FIELD_PTR(vl, field, dummy) {
+			switch (field->type) {
+			case EBPF_VL_FIELD_PATH:
+				path = field->data;
+				break;
+			case EBPF_VL_FIELD_SYMLINK_TARGET_PATH: /* FALLTHROUGH */
+			case EBPF_VL_FIELD_PIDS_SS_CGROUP_PATH: /* FALLTHROUGH */
+			case EBPF_VL_FIELD_OLD_PATH:		/* FALLTHROUGH */
+			case EBPF_VL_FIELD_NEW_PATH:
+				continue;
+			default:
+				qwarnx("unhandled field type %d", field->type);
+				goto bad;
+			}
+		}
+
+		if (path == NULL) {
+			qwarnx("no path");
+			goto bad;
+		}
+		if ((pathlen = strlen(path)) == 0) {
+			qwarnx("empty path");
+			goto bad;
+		}
+		raw->file.quark_file = calloc(1,
+		    sizeof(*raw->file.quark_file) + pathlen + 1); /* for NUL */
+		if (raw->file.quark_file == NULL)
+			goto bad;
+		file = raw->file.quark_file;
+		memcpy(file->path, path, pathlen);
+		file->path[pathlen] = 0; /* paranoia */
+
+		//fprintf(stderr, "%d: (%ld) %s\n", raw->pid, ev->type, file->path);
+
+		break;
+	}
 	default:
 		qwarnx("unhandled type %lu", ev->type);
 		goto bad;

elastic-ebpf/GPL/Events/EbpfEventProto.h

@@ -83,6 +83,12 @@ enum ebpf_varlen_field_type {
                                                sizeof(struct ebpf_varlen_field)),            \
                   __i++)
 
+#define FOR_EACH_VARLEN_FIELD_PTR(_vl, _c, _i)				\
+	for (_i = 0, (_c) = (struct ebpf_varlen_field *)(_vl)->data;	\
+	     _i < (_vl)->nfields;					\
+	     (_c) = (struct ebpf_varlen_field *)((char *)(_c) + (_c)->size + sizeof(struct ebpf_varlen_field)), \
+		 _i++)
+
 struct ebpf_varlen_fields_start {
     uint32_t nfields;
     size_t size;

quark-mon.c

@@ -10,6 +10,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
+#include <time.h>
 #include <unistd.h>
 
 #include <sys/wait.h>
@@ -115,7 +116,7 @@ static void
 usage(void)
 {
 	fprintf(stderr, "usage: %s -h\n", program_invocation_short_name);
-	fprintf(stderr, "usage: %s [-BbDefkNSstv] "
+	fprintf(stderr, "usage: %s [-BbDeFkMNSstv] "
 	    "[-C filename ] [-l maxlength] [-m maxnodes] [-P ppid]\n",
 	    program_invocation_short_name);
 	fprintf(stderr, "usage: %s -V\n", program_invocation_short_name);
@@ -127,13 +128,14 @@ int
 main(int argc, char *argv[])
 {
 	int				 ch, maxnodes;
-	int				 do_priv_drop, do_snap, lflag;
+	int				 do_priv_drop, do_snap, benchmark, lflag;
 	u32				 filter_ppid;
 	struct quark_queue		*qq;
 	struct quark_queue_attr		 qa;
 	const struct quark_event	*qev;
 	struct sigaction		 sigact;
 	FILE				*graph_by_time, *graph_by_pidtime, *graph_cache;
+	struct timespec			 bench_stamp, now;
 
 	quark_queue_default_attr(&qa);
 	qa.flags &= ~QQ_ALL_BACKENDS;
@@ -143,8 +145,9 @@ main(int argc, char *argv[])
 	do_snap = 1;
 	graph_by_time = graph_by_pidtime = graph_cache = NULL;
 	lflag = 0;
+	benchmark = 0;
 
-	while ((ch = getopt(argc, argv, "BbC:Deghkl:m:NP:tSsvV")) != -1) {
+	while ((ch = getopt(argc, argv, "BbC:DeFghkl:Mm:NP:tSsvV")) != -1) {
 		const char *errstr;
 
 		switch (ch) {
@@ -165,6 +168,9 @@ main(int argc, char *argv[])
 		case 'e':
 			qa.flags |= QQ_ENTRY_LEADER;
 			break;
+		case 'F':
+			qa.flags |= QQ_FILE;
+			break;
 		case 'g':
 			qa.flags |= QQ_MIN_AGG;
 			break;
@@ -200,6 +206,9 @@ main(int argc, char *argv[])
 			if (graph_by_pidtime == NULL)
 				err(1, "fopen");
 			break;
+		case 'M':
+			benchmark = 1;
+			break;
 		case 'N':
 			qa.flags |= QQ_DNS;
 			break;
@@ -230,6 +239,12 @@ main(int argc, char *argv[])
 		}
 	}
 
+	if (benchmark) {
+		if (clock_gettime(CLOCK_MONOTONIC, &bench_stamp) == -1)
+			err(1, "clock_gettime");
+		do_snap = 0;
+	}
+
 	if (qa.flags & QQ_BYPASS) {
 		if (qa.flags &
 		    (QQ_KPROBE|QQ_ENTRY_LEADER|QQ_MIN_AGG|QQ_THREAD_EVENTS) ||
@@ -300,7 +315,21 @@ main(int argc, char *argv[])
 		}
 
 		/*
-		 * Filter out processes by parent pid if set.
+		 * Benchmark mode, don't dump to stdout, just print stats every second
+		 */
+		if (benchmark) {
+			if (clock_gettime(CLOCK_MONOTONIC, &now) == -1)
+				err(1, "clock_gettime");
+
+			if ((now.tv_sec - bench_stamp.tv_sec) >= 1) {
+				dump_stats(qq);
+				bench_stamp = now;
+			}
+			continue;
+		}
+
+		/*
+		 * Filter out processes by parent pid if set
 		 */
 		if (filter_ppid &&
 		    qev->process != NULL &&

quark.c

@@ -85,6 +85,7 @@ raw_event_alloc(int type)
 	case RAW_COMM:		/* nada */
 	case RAW_SOCK_CONN:	/* nada */
 	case RAW_PACKET:	/* caller allocates */
+	case RAW_FILE:		/* caller allocates */
 		break;
 	default:
 		qwarnx("unhandled raw_type %d", raw->type);
@@ -122,6 +123,9 @@ raw_event_free(struct raw_event *raw)
 	case RAW_PACKET:
 		free(raw->packet.quark_packet);
 		break;
+	case RAW_FILE:
+		free(raw->file.quark_file);
+		break;
 	default:
 		qwarnx("unhandled raw_type %d", raw->type);
 		break;
@@ -297,6 +301,8 @@ event_storage_clear(struct quark_queue *qq)
 	qq->event_storage.socket = NULL;
 	free(qq->event_storage.packet);
 	qq->event_storage.packet = NULL;
+	free(qq->event_storage.file);
+	qq->event_storage.file = NULL;
 }
 
 static void
@@ -575,7 +581,7 @@ event_flag_str(u64 flag)
 	case QUARK_F_COMM:
 		return "COMM";
 	case QUARK_F_FILENAME:
-		return "FILENAME";
+		return "FNAME";
 	case QUARK_F_CMDLINE:
 		return "CMDLINE";
 	case QUARK_F_CWD:
@@ -605,6 +611,8 @@ event_type_str(u64 event)
 		return "PACKET";
 	case QUARK_EV_BYPASS:
 		return "BYPASS";
+	case QUARK_EV_FILE:
+		return "FILE";
 	default:
 		return "?";
 	}
@@ -907,6 +915,7 @@ quark_event_dump(const struct quark_event *qev, FILE *f)
 	const struct quark_process	*qp;
 	const struct quark_socket	*qsk;
 	const struct quark_packet	*packet;
+	const struct quark_file		*file;
 	int				 pid;
 
 	if (qev->events == QUARK_EV_BYPASS) {
@@ -919,6 +928,7 @@ quark_event_dump(const struct quark_event *qev, FILE *f)
 	qp = qev->process;
 	qsk = qev->socket;
 	packet = qev->packet;
+	file = qev->file;
 
 	pid = qp != NULL ? qp->pid : 0;
 	events_type_str(qev->events, events, sizeof(events));
@@ -959,6 +969,15 @@ quark_event_dump(const struct quark_event *qev, FILE *f)
 		sshbuf_dump_data(packet->data, packet->cap_len, f);
 	}
 
+	if (qev->events & QUARK_EV_FILE) {
+		flagname = "FILE";
+
+		if (file == NULL)
+			return (-1);
+
+		P("  %.4s\tpath=%s\n", flagname, file->path);
+	}
+
 	if (qp == NULL)
 		return (-1);
 
@@ -2310,10 +2329,9 @@ quark_queue_open(struct quark_queue *qq, struct quark_queue_attr *qa)
 		qa->max_length = 1;
 	}
 	/*
-	 * QQ_{FILE,MEMFD} needs QQ_BYPASS for now
+	 * QQ_MEMFD needs QQ_BYPASS for now
 	 */
-	if ((qa->flags & (QQ_FILE|QQ_MEMFD))
-	    && !(qa->flags & QQ_BYPASS))
+	if ((qa->flags & QQ_MEMFD) && !(qa->flags & QQ_BYPASS))
 		return (errno = EINVAL, -1);
 
 	if ((qa->flags & QQ_ALL_BACKENDS) == 0 ||
@@ -2604,6 +2622,29 @@ raw_event_packet(struct quark_queue *qq, struct raw_event *raw)
 	return (qev);
 }
 
+static const struct quark_event *
+raw_event_file(struct quark_queue *qq, struct raw_event *raw)
+{
+	struct quark_event	*qev;
+
+	if (raw->file.quark_file == NULL) {
+		qwarnx("quark_file is null");
+
+		return (NULL);
+	}
+
+	qev = &qq->event_storage;
+
+	qev->events = QUARK_EV_FILE;
+	qev->process = quark_process_lookup(qq, raw->pid);
+
+	/* Steal the file */
+	qev->file = raw->file.quark_file;
+	raw->file.quark_file = NULL;
+
+	return (qev);
+}
+
 static const struct quark_event *
 get_bypass_event(struct quark_queue *qq)
 {
@@ -2652,6 +2693,9 @@ quark_queue_get_event(struct quark_queue *qq)
 		case RAW_PACKET:
 			qev = raw_event_packet(qq, raw);
 			break;
+		case RAW_FILE:
+			qev = raw_event_file(qq, raw);
+			break;
 		default:
 			qwarnx("unhandled raw->type: %d", raw->type);
 			break;