Skip to content

Commit 83d9fa3

Browse files
Molter73Molter73
committed
cleanup: refactor submit event functions
A new event_args_t type is added to group together common arguments used by all submit event functions. This reduces the number of arguments that need to be passed into these functions and make it harder to make mistakes in the ordering of the actual arguments.
1 parent f104599 commit 83d9fa3

3 files changed

Lines changed: 111 additions & 113 deletions

File tree

‎fact-ebpf/src/bpf/events.h‎

Lines changed: 57 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -12,120 +12,113 @@
1212
#include <bpf/bpf_helpers.h>
1313
// clang-format on
1414

15-
__always_inline static void __submit_event(struct event_t* event,
16-
struct metrics_by_hook_t* m,
17-
file_activity_type_t event_type,
18-
const char filename[PATH_MAX],
19-
inode_key_t* inode,
20-
inode_key_t* parent_inode,
21-
bool use_bpf_d_path) {
22-
event->type = event_type;
15+
struct event_args_t {
16+
struct event_t* event;
17+
struct metrics_by_hook_t* metrics;
18+
const char* filename;
19+
inode_key_t* inode;
20+
inode_key_t parent_inode;
21+
bool use_bpf_d_path;
22+
};
23+
24+
__always_inline static void __submit_event(struct event_args_t* args) {
25+
struct event_t* event = args->event;
2326
event->timestamp = bpf_ktime_get_boot_ns();
24-
inode_copy_or_reset(&event->inode, inode);
25-
inode_copy_or_reset(&event->parent_inode, parent_inode);
26-
bpf_probe_read_str(event->filename, PATH_MAX, filename);
27+
inode_copy_or_reset(&event->inode, args->inode);
28+
inode_copy_or_reset(&event->parent_inode, &args->parent_inode);
29+
bpf_probe_read_str(event->filename, PATH_MAX, args->filename);
2730

2831
struct helper_t* helper = get_helper();
2932
if (helper == NULL) {
3033
goto error;
3134
}
3235

33-
int64_t err = process_fill(&event->process, use_bpf_d_path);
36+
int64_t err = process_fill(&event->process, args->use_bpf_d_path);
3437
if (err) {
3538
bpf_printk("Failed to fill process information: %d", err);
3639
goto error;
3740
}
3841

39-
m->added++;
42+
args->metrics->added++;
4043
bpf_ringbuf_submit(event, 0);
4144
return;
4245

4346
error:
44-
m->error++;
47+
args->metrics->error++;
4548
bpf_ringbuf_discard(event, 0);
4649
}
4750

48-
__always_inline static void submit_open_event(struct metrics_by_hook_t* m,
49-
file_activity_type_t event_type,
50-
const char filename[PATH_MAX],
51-
inode_key_t* inode,
52-
inode_key_t* parent_inode) {
53-
struct event_t* event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
54-
if (event == NULL) {
55-
m->ringbuffer_full++;
51+
__always_inline static void submit_open_event(struct event_args_t* args,
52+
file_activity_type_t event_type) {
53+
args->event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
54+
if (args->event == NULL) {
55+
args->metrics->ringbuffer_full++;
5656
return;
5757
}
58+
args->event->type = event_type;
5859

59-
__submit_event(event, m, event_type, filename, inode, parent_inode, true);
60+
__submit_event(args);
6061
}
6162

62-
__always_inline static void submit_unlink_event(struct metrics_by_hook_t* m,
63-
const char filename[PATH_MAX],
64-
inode_key_t* inode,
65-
inode_key_t* parent_inode) {
66-
struct event_t* event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
67-
if (event == NULL) {
68-
m->ringbuffer_full++;
63+
__always_inline static void submit_unlink_event(struct event_args_t* args) {
64+
args->event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
65+
if (args->event == NULL) {
66+
args->metrics->ringbuffer_full++;
6967
return;
7068
}
69+
args->event->type = FILE_ACTIVITY_UNLINK;
7170

72-
__submit_event(event, m, FILE_ACTIVITY_UNLINK, filename, inode, parent_inode, path_hooks_support_bpf_d_path);
71+
__submit_event(args);
7372
}
7473

75-
__always_inline static void submit_mode_event(struct metrics_by_hook_t* m,
76-
const char filename[PATH_MAX],
77-
inode_key_t* inode,
78-
inode_key_t* parent_inode,
74+
__always_inline static void submit_mode_event(struct event_args_t* args,
7975
umode_t mode,
8076
umode_t old_mode) {
81-
struct event_t* event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
82-
if (event == NULL) {
83-
m->ringbuffer_full++;
77+
args->event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
78+
if (args->event == NULL) {
79+
args->metrics->ringbuffer_full++;
8480
return;
8581
}
8682

87-
event->chmod.new = mode;
88-
event->chmod.old = old_mode;
83+
args->event->type = FILE_ACTIVITY_CHMOD;
84+
args->event->chmod.new = mode;
85+
args->event->chmod.old = old_mode;
8986

90-
__submit_event(event, m, FILE_ACTIVITY_CHMOD, filename, inode, parent_inode, path_hooks_support_bpf_d_path);
87+
__submit_event(args);
9188
}
9289

93-
__always_inline static void submit_ownership_event(struct metrics_by_hook_t* m,
94-
const char filename[PATH_MAX],
95-
inode_key_t* inode,
96-
inode_key_t* parent_inode,
90+
__always_inline static void submit_ownership_event(struct event_args_t* args,
9791
unsigned long long uid,
9892
unsigned long long gid,
9993
unsigned long long old_uid,
10094
unsigned long long old_gid) {
101-
struct event_t* event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
102-
if (event == NULL) {
103-
m->ringbuffer_full++;
95+
args->event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
96+
if (args->event == NULL) {
97+
args->metrics->ringbuffer_full++;
10498
return;
10599
}
106100

107-
event->chown.new.uid = uid;
108-
event->chown.new.gid = gid;
109-
event->chown.old.uid = old_uid;
110-
event->chown.old.gid = old_gid;
101+
args->event->type = FILE_ACTIVITY_CHOWN;
102+
args->event->chown.new.uid = uid;
103+
args->event->chown.new.gid = gid;
104+
args->event->chown.old.uid = old_uid;
105+
args->event->chown.old.gid = old_gid;
111106

112-
__submit_event(event, m, FILE_ACTIVITY_CHOWN, filename, inode, parent_inode, path_hooks_support_bpf_d_path);
107+
__submit_event(args);
113108
}
114109

115-
__always_inline static void submit_rename_event(struct metrics_by_hook_t* m,
116-
const char new_filename[PATH_MAX],
110+
__always_inline static void submit_rename_event(struct event_args_t* args,
117111
const char old_filename[PATH_MAX],
118-
inode_key_t* new_inode,
119-
inode_key_t* old_inode,
120-
inode_key_t* new_parent_inode) {
121-
struct event_t* event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
122-
if (event == NULL) {
123-
m->ringbuffer_full++;
112+
inode_key_t* old_inode) {
113+
args->event = bpf_ringbuf_reserve(&rb, sizeof(struct event_t), 0);
114+
if (args->event == NULL) {
115+
args->metrics->ringbuffer_full++;
124116
return;
125117
}
126118

127-
bpf_probe_read_str(event->rename.old_filename, PATH_MAX, old_filename);
128-
inode_copy_or_reset(&event->rename.old_inode, old_inode);
119+
args->event->type = FILE_ACTIVITY_RENAME;
120+
bpf_probe_read_str(args->event->rename.old_filename, PATH_MAX, old_filename);
121+
inode_copy_or_reset(&args->event->rename.old_inode, old_inode);
129122

130-
__submit_event(event, m, FILE_ACTIVITY_RENAME, new_filename, new_inode, new_parent_inode, path_hooks_support_bpf_d_path);
123+
__submit_event(args);
131124
}

0 commit comments

Comments
 (0)