Skip to content

Commit 6d0b123

Browse files
ekoopsekoops
committed
feat!: drop send enter evts gen, testing and parsing code
As the `send` exit events contain all the information needed, drop `send` enter events generation from all drivers, and all related testing and parsing code. BREAKING CHANGE: drop `send` enter evts gen and parsing Signed-off-by: Leonardo Di Giovanna <[email protected]>
1 parent 1f3cd06 commit 6d0b123

File tree

12 files changed

+15
-173
lines changed

12 files changed

+15
-173
lines changed

‎driver/bpf/fillers.h‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1627,19 +1627,6 @@ FILLER(sys_getsockopt_x, true) {
16271627
return bpf_push_u32_to_ring(data, optlen);
16281628
}
16291629

1630-
FILLER(sys_send_e, true) {
1631-
int res;
1632-
1633-
/* Parameter 1: fd (type: PT_FD) */
1634-
int64_t fd = (int64_t)(int32_t)bpf_syscall_get_argument(data, 0);
1635-
res = bpf_push_s64_to_ring(data, fd);
1636-
CHECK_RES(res);
1637-
1638-
/* Parameter 2: size (type: PT_UINT32) */
1639-
uint32_t size = (uint32_t)bpf_syscall_get_argument(data, 2);
1640-
return bpf_push_u32_to_ring(data, size);
1641-
}
1642-
16431630
FILLER(sys_send_x, true) {
16441631
/* Parameter 1: res (type: PT_ERRNO) */
16451632
long retval = bpf_syscall_get_retval(data->ctx);

‎driver/fillers_table.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
4545
[PPME_SOCKET_CONNECT_X] = {FILLER_REF(sys_connect_x)},
4646
[PPME_SOCKET_LISTEN_E] = {FILLER_DISABLED},
4747
[PPME_SOCKET_LISTEN_X] = {FILLER_REF(sys_listen_x)},
48-
[PPME_SOCKET_SEND_E] = {FILLER_REF(sys_send_e)},
48+
[PPME_SOCKET_SEND_E] = {FILLER_DISABLED},
4949
[PPME_SOCKET_SEND_X] = {FILLER_REF(sys_send_x)},
5050
[PPME_SOCKET_SENDTO_E] = {FILLER_DISABLED},
5151
[PPME_SOCKET_SENDTO_X] = {FILLER_REF(sys_sendto_x)},

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c‎

Lines changed: 0 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -9,42 +9,6 @@
99
#include <helpers/interfaces/variable_size_event.h>
1010
#include <helpers/interfaces/fixed_size_event.h>
1111

12-
/*=============================== ENTER EVENT ===========================*/
13-
14-
SEC("tp_btf/sys_enter")
15-
int BPF_PROG(send_e, struct pt_regs *regs, long id) {
16-
/* We need to keep this at the beginning of the program because otherwise we alter the state of
17-
* the ebpf registers causing a verifier issue.
18-
*/
19-
unsigned long args[3] = {0};
20-
extract__network_args(args, 3, regs);
21-
22-
struct ringbuf_struct ringbuf;
23-
if(!ringbuf__reserve_space(&ringbuf, SEND_E_SIZE, PPME_SOCKET_SEND_E)) {
24-
return 0;
25-
}
26-
27-
ringbuf__store_event_header(&ringbuf);
28-
29-
/*=============================== COLLECT PARAMETERS ===========================*/
30-
31-
/* Parameter 1: fd (type: PT_FD) */
32-
int64_t fd = (int32_t)args[0];
33-
ringbuf__store_s64(&ringbuf, fd);
34-
35-
/* Parameter 2: size (type: PT_UINT32) */
36-
uint32_t size = (uint32_t)args[2];
37-
ringbuf__store_u32(&ringbuf, size);
38-
39-
/*=============================== COLLECT PARAMETERS ===========================*/
40-
41-
ringbuf__submit_event(&ringbuf);
42-
43-
return 0;
44-
}
45-
46-
/*=============================== ENTER EVENT ===========================*/
47-
4812
/*=============================== EXIT EVENT ===========================*/
4913

5014
SEC("tp_btf/sys_exit")

‎driver/ppm_fillers.c‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2275,27 +2275,6 @@ int f_sys_accept_x(struct event_filler_arguments *args) {
22752275
return add_sentinel(args);
22762276
}
22772277

2278-
int f_sys_send_e(struct event_filler_arguments *args) {
2279-
int res;
2280-
unsigned long val;
2281-
int64_t fd;
2282-
uint32_t size;
2283-
2284-
/* Parameter 1: fd (type: PT_FD) */
2285-
syscall_get_arguments_deprecated(args, 0, 1, &val);
2286-
fd = (int64_t)(int32_t)val;
2287-
res = val_to_ring(args, fd, 0, false, 0);
2288-
CHECK_RES(res);
2289-
2290-
/* Parameter 2: size (type: PT_UINT32) */
2291-
syscall_get_arguments_deprecated(args, 2, 1, &val);
2292-
size = (uint32_t)val;
2293-
res = val_to_ring(args, size, 0, false, 0);
2294-
CHECK_RES(res);
2295-
2296-
return add_sentinel(args);
2297-
}
2298-
22992278
int f_sys_send_x(struct event_filler_arguments *args) {
23002279
int res;
23012280
int64_t retval;

‎driver/ppm_fillers.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ or GPL2.txt for full copies of the license.
3838
FN(sys_accept4_e) \
3939
FN(sys_accept4_x) \
4040
FN(sys_accept_x) \
41-
FN(sys_send_e) \
4241
FN(sys_send_x) \
4342
FN(sys_sendto_x) \
4443
FN(sys_sendmsg_x) \

‎test/drivers/test_suites/actions_suite/ia32.cpp.in‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,6 @@ TEST(Actions, ia32)
7575
* Since SYS_SEND exists but __NR_send does not on x86_64,
7676
* convert_network_syscalls() returns -1 and we don't push anything to consumers.
7777
*/
78-
evt_test->assert_event_absence(ret_pid, PPME_SOCKET_SEND_E);
7978
evt_test->assert_event_absence(ret_pid, PPME_SOCKET_SEND_X);
8079

8180
/*
@@ -90,7 +89,6 @@ TEST(Actions, ia32)
9089
* Kmod and old bpf jump table is events-indexed.
9190
* We are able to fallback at sending the events.
9291
*/
93-
evt_test->assert_event_presence(ret_pid, PPME_SOCKET_SEND_E);
9492
evt_test->assert_event_presence(ret_pid, PPME_SOCKET_SEND_X);
9593

9694
/*

‎test/drivers/test_suites/syscall_enter_suite/send_e.cpp‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

‎test/drivers/test_suites/syscall_enter_suite/socketcall_e.cpp‎

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -173,55 +173,6 @@ TEST(SyscallEnter, socketcall_accept4E) {
173173
}
174174
#endif
175175

176-
#ifdef __NR_send
177-
178-
TEST(SyscallEnter, socketcall_sendE) {
179-
auto evt_test = get_syscall_event_test(__NR_send, ENTER_EVENT);
180-
181-
evt_test->enable_capture();
182-
183-
/*=============================== TRIGGER SYSCALL ===========================*/
184-
185-
int32_t mock_fd = -1;
186-
char mock_buf[8];
187-
size_t mock_count = 4096;
188-
int flags = 0;
189-
190-
unsigned long args[4]{};
191-
args[0] = mock_fd;
192-
args[1] = (unsigned long)mock_buf;
193-
args[2] = mock_count;
194-
args[3] = (unsigned long)flags;
195-
assert_syscall_state(SYSCALL_FAILURE, "send", syscall(__NR_socketcall, SYS_SEND, args));
196-
197-
/*=============================== TRIGGER SYSCALL ===========================*/
198-
199-
evt_test->disable_capture();
200-
201-
evt_test->assert_event_presence();
202-
203-
if(HasFatalFailure()) {
204-
return;
205-
}
206-
207-
evt_test->parse_event();
208-
209-
evt_test->assert_header();
210-
211-
/*=============================== ASSERT PARAMETERS ===========================*/
212-
213-
/* Parameter 1: fd (type: PT_FD) */
214-
evt_test->assert_numeric_param(1, (int64_t)mock_fd);
215-
216-
/* Parameter 2: size (type: PT_UINT32)*/
217-
evt_test->assert_numeric_param(2, (uint32_t)mock_count);
218-
219-
/*=============================== ASSERT PARAMETERS ===========================*/
220-
221-
evt_test->assert_num_params_pushed(2);
222-
}
223-
#endif
224-
225176
TEST(SyscallEnter, socketcall_wrong_code_socketcall_interesting) {
226177
// We send a wrong code so the event will be dropped
227178
auto evt_test = get_syscall_event_test(__NR_socketcall, ENTER_EVENT);

‎test/libsinsp_e2e/tcp_client_server.cpp‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -207,8 +207,7 @@ void runtest(iotype iot,
207207
// 32bit uses send() and recv(), while 64bit always uses sendto() and
208208
// recvfrom() and sets the address to NULL
209209
//
210-
if((evt->get_type() == PPME_SOCKET_SEND_E || evt->get_type() == PPME_SYSCALL_READ_E ||
211-
evt->get_type() == PPME_SYSCALL_WRITE_E) &&
210+
if((evt->get_type() == PPME_SYSCALL_READ_E || evt->get_type() == PPME_SYSCALL_WRITE_E) &&
212211
evt->get_fd_info()->m_type == SCAP_FD_IPV4_SOCK) {
213212
std::string tuple = evt->get_param_value_str("fd");
214213
tuple = tuple.substr(tuple.find(">") + 1);
@@ -253,6 +252,16 @@ void runtest(iotype iot,
253252
EXPECT_EQ(sport, dst_port);
254253
EXPECT_EQ(SERVER_PORT_STR, src_port);
255254
}*/
255+
} else if(evt->get_type() == PPME_SOCKET_SEND_X) {
256+
if(!parse_tuple(evt->get_param_value_str("tuple"),
257+
src_addr,
258+
src_port,
259+
dst_addr,
260+
dst_port)) {
261+
return;
262+
}
263+
EXPECT_EQ(server_address, src_addr);
264+
EXPECT_EQ(server_address, dst_addr);
256265
}
257266

258267
EXPECT_EQ(payload, evt->get_param_value_str("data"));

‎test/libsinsp_e2e/tcp_client_server_ipv4_mapped.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ void runtest_ipv4m(iotype iot,
487487
// 32bit uses send() and recv(), while 64bit always uses sendto() and
488488
// recvfrom() and sets the address to NULL
489489
//
490-
if(evt->get_type() == PPME_SOCKET_SEND_E) {
490+
if(evt->get_type() == PPME_SOCKET_SEND_X) {
491491
std::string tuple = evt->get_param_value_str("fd");
492492
tuple = tuple.substr(tuple.find(">") + 1);
493493
if(!parse_tuple(tuple, src_addr, src_port, dst_addr, dst_port)) {

0 commit comments

Comments
 (0)