Skip to content

Commit e8a7183

Browse files
SeeFlowerXSeeFlowerX
committed
代码简化
1 parent 35e1eaf commit e8a7183

7 files changed

Lines changed: 48 additions & 54 deletions

File tree

‎src/common/consts.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
#define TASK_COMM_LEN 16
1313
#define MAX_COUNT 20
14+
#define MAX_WATCH_PROC_COUNT 256
1415
#define MAX_PATH_COMPONENTS 48
1516

1617
// clang-format off

‎src/common/filtering.h‎

Lines changed: 4 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -55,12 +55,11 @@ static __always_inline u64 should_trace(program_data_t *p)
5555
// 考虑到指明了过滤模式 那么就不需要使用 MAGIC_PID 去判断了 因为对应的模式下对应参数必须有值
5656

5757
u32 filter_key = 0;
58-
58+
common_filter_t* filter = bpf_map_lookup_elem(&common_filter, &filter_key);
59+
if (filter == NULL) {
60+
return 0;
61+
}
5962
if (config->filter_mode == UID_MODE) {
60-
common_filter_t* filter = bpf_map_lookup_elem(&common_filter, &filter_key);
61-
if (filter == NULL) {
62-
return 0;
63-
}
6463
if (filter->uid == context->uid) {
6564
for (int i = 0; i < MAX_COUNT; i++) {
6665
// 因为列表肯定是挨着填充的 所以遇到 MAGIC 就可以直接结束循环了
@@ -83,10 +82,6 @@ static __always_inline u64 should_trace(program_data_t *p)
8382
}
8483
return 0;
8584
} else if (config->filter_mode == PID_MODE) {
86-
common_filter_t* filter = bpf_map_lookup_elem(&common_filter, &filter_key);
87-
if (filter == NULL) {
88-
return 0;
89-
}
9085
if (filter->pid == context->pid) {
9186
for (int i = 0; i < MAX_COUNT; i++) {
9287
if (filter->blacklist_tids[i] == MAGIC_TID) break;
@@ -102,10 +97,6 @@ static __always_inline u64 should_trace(program_data_t *p)
10297
}
10398
return 0;
10499
} else if (config->filter_mode == PID_TID_MODE) {
105-
common_filter_t* filter = bpf_map_lookup_elem(&common_filter, &filter_key);
106-
if (filter == NULL) {
107-
return 0;
108-
}
109100
if (filter->pid == context->pid && filter->tid == context->tid) {
110101
return 1;
111102
}
@@ -114,23 +105,6 @@ static __always_inline u64 should_trace(program_data_t *p)
114105
return 0;
115106
}
116107

117-
// 首先取出 common_filter
118-
// u32 trace_flag = 0;
119-
// u32 filter_key = 0;
120-
// common_filter_t* filter = bpf_map_lookup_elem(&common_filter, &filter_key);
121-
// if (filter == NULL) {
122-
// return 0;
123-
// }
124-
// if (trace_flag != 1 && filter->uid != MAGIC_UID && filter->uid == context->uid) {
125-
// trace_flag = 1;
126-
// }
127-
// if (trace_flag != 1 && filter->pid != MAGIC_PID && filter->pid == context->pid) {
128-
// trace_flag = 1;
129-
// }
130-
// if (trace_flag != 1 && filter->tid != MAGIC_TID && filter->tid == context->tid) {
131-
// trace_flag = 1;
132-
// }
133-
134108
// 有时候希望对一些额外的进程进行追踪或者屏蔽
135109
// 还需要提供 uid pid tid 的黑白名单列表以达成更加精细的追踪
136110

‎src/stack.c‎

Lines changed: 35 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,13 @@ int probe_stack(struct pt_regs* ctx) {
124124
return 0;
125125
}
126126

127+
struct {
128+
__uint(type, BPF_MAP_TYPE_HASH);
129+
__type(key, u32);
130+
__type(value, u32);
131+
__uint(max_entries, MAX_WATCH_PROC_COUNT);
132+
} watch_proc_map SEC(".maps");
133+
127134
// raw_tracepoint hook
128135

129136
struct {
@@ -139,10 +146,6 @@ typedef struct point_arg_t {
139146
} point_arg;
140147

141148
#define MAX_POINT_ARG_COUNT 6
142-
// typedef struct point_args_t {
143-
// u32 count;
144-
// point_arg_t point_args[MAX_POINT_ARG_COUNT];
145-
// } point_args;
146149

147150
typedef struct syscall_point_args_t {
148151
// u32 nr;
@@ -151,13 +154,6 @@ typedef struct syscall_point_args_t {
151154
point_arg point_arg_ret;
152155
} syscall_point_args;
153156

154-
// struct {
155-
// __uint(type, BPF_MAP_TYPE_HASH);
156-
// __type(key, u32);
157-
// __type(value, struct point_args_t);
158-
// __uint(max_entries, 512);
159-
// } point_args_map SEC(".maps");
160-
161157
// syscall_point_args_map 的 key 就是 nr
162158
struct {
163159
__uint(type, BPF_MAP_TYPE_HASH);
@@ -166,17 +162,6 @@ struct {
166162
__uint(max_entries, 512);
167163
} syscall_point_args_map SEC(".maps");
168164

169-
// struct arg_ret_mask_t {
170-
// u32 ret_mask;
171-
// };
172-
173-
// struct {
174-
// __uint(type, BPF_MAP_TYPE_HASH);
175-
// __type(key, u32);
176-
// __type(value, struct arg_ret_mask_t);
177-
// __uint(max_entries, 512);
178-
// } arg_ret_mask_map SEC(".maps");
179-
180165
// syscall过滤配置
181166
struct syscall_filter_t {
182167
u32 is_32bit;
@@ -255,6 +240,34 @@ static __always_inline u32 read_args(program_data_t p, struct point_arg_t* point
255240
return next_arg_index;
256241
}
257242

243+
SEC("raw_tracepoint/sched_process_fork")
244+
int tracepoint__sched__sched_process_fork(struct bpf_raw_tracepoint_args *ctx)
245+
{
246+
long ret = 0;
247+
program_data_t p = {};
248+
if (!init_program_data(&p, ctx))
249+
return 0;
250+
251+
struct task_struct *parent = (struct task_struct *) ctx->args[0];
252+
struct task_struct *child = (struct task_struct *) ctx->args[1];
253+
254+
// 为了实现仅指定单个pid时 能追踪其产生的子进程的相关系统调用 设计如下
255+
// 维护一个 map
256+
// - 其 key 为进程 pid
257+
// - 其 value 为其父进程 pid
258+
// 逻辑如下
259+
// 当进入此处后，先获取进程本身信息，然后通过自己的父进程 pid 去 map 中取出对应的value
260+
// 如果没有取到则说明这个进程不是要追踪的进程
261+
// 取到了，则说明这个是之前产生的进程，然后向map存入进程信息 key 就是进程本身 pid 而 value则是父进程pid
262+
// 那么最开始的 pid 从哪里来呢 答案是从首次通过 sys_enter 的过滤之后 向该map存放第一个key value
263+
// 1. parent_child_map => {}
264+
// 2. 出现第一个通过 sys_enter 处的过滤的进程，则更新map -> parent_child_map => {12345: 12345}
265+
// 3. sched_process_fork 获取进程的父进程信息，检查map，发现父进程存在其中，则更新map -> parent_child_map => {12345: 12345, 22222: 12345}
266+
// 4. sys_enter/sys_exit 有限次遍历 parent_child_map 取出key逐个比较当前进程的pid
267+
// 待实现...
268+
return 0;
269+
}
270+
258271
SEC("raw_tracepoint/sys_enter")
259272
int raw_syscalls_sys_enter(struct bpf_raw_tracepoint_args* ctx) {
260273

‎src/types.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ typedef struct common_filter {
88
u32 uid;
99
u32 pid;
1010
u32 tid;
11-
u32 blacklist_pids[20];
12-
u32 blacklist_tids[20];
11+
u32 pid_list[MAX_WATCH_PROC_COUNT];
12+
u32 blacklist_pids[MAX_COUNT];
13+
u32 blacklist_tids[MAX_COUNT];
1314
u32 blacklist_comms;
1415
} common_filter_t;
1516

‎user/config/config_filter.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ type CommonFilter struct {
2828
uid uint32
2929
pid uint32
3030
tid uint32
31+
pid_list [MAX_WATCH_PROC_COUNT]uint32
3132
blacklist_pids [MAX_COUNT]uint32
3233
blacklist_tids [MAX_COUNT]uint32
3334
blacklist_comms uint32

‎user/config/config_module.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,9 @@ func (this *ModuleConfig) GetCommonFilter() unsafe.Pointer {
262262
filter.pid = this.Pid
263263
filter.tid = this.Tid
264264
// 这些暂时硬编码
265+
for i := 0; i < MAX_COUNT; i++ {
266+
filter.pid_list[i] = MAGIC_PID
267+
}
265268
for i := 0; i < MAX_COUNT; i++ {
266269
filter.blacklist_pids[i] = this.PidsBlacklist[i]
267270
}

‎user/config/iconfig.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package config
33
import "log"
44

55
const MAX_COUNT = 20
6+
const MAX_WATCH_PROC_COUNT = 256
67

78
// stackplz => 737461636b706c7a
89
const MAGIC_UID = 0x73746163

0 commit comments

Comments
 (0)