new(driver/modern_bpf,userspace/libpman): support multiple programs f…

…or each event. Try to inject each of them until success. This allows us to inject `bpf_loop` sendmmsg and recvmmsg programs where supported, and fallback at just sending first message where it isn't. Signed-off-by: Federico Di Pierro <[email protected]>
falcosecurity · Jan 24, 2025 · aa354b6 · aa354b6
1 parent 6c46ed3
commit aa354b6
Show file tree

Hide file tree

Showing 10 changed files with 526 additions and 363 deletions.
diff --git a/driver/modern_bpf/helpers/base/shared_size.h b/driver/modern_bpf/helpers/base/shared_size.h
@@ -26,9 +26,6 @@
 /* Maximum number of `iovec` structures that we can analyze. */
 #define MAX_IOVCNT 32
 
-/* Maximum number of supported sendmmsg/recvmmsg messages */
-#define MAX_SENDMMSG_RECVMMSG_SIZE 8
-
 /* Maximum number of `pollfd` structures that we can analyze. */
 #define MAX_POLLFD 16
 

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c
@@ -159,17 +159,60 @@ int BPF_PROG(recvmmsg_x, struct pt_regs *regs, long ret) {
 	        .ctx = ctx,
 	};
 
-	// We can't use bpf_loop() helper since the below check triggers a verifier failure:
-	// see
-	// https://lore.kernel.org/bpf/CAGQdkDt9zyQwr5JyftXqL=OLKscNcqUtEteY4hvOkx2S4GdEkQ@mail.gmail.com/T/#u
-	/*if(bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_loop)) {
-	    uint32_t nr_loops = ret < 1024 ? ret : 1024;
-	    bpf_loop(nr_loops, handle_exit, &data, 0);
-	} else {*/
-	for(int i = 0; i < ret && i < MAX_SENDMMSG_RECVMMSG_SIZE; i++) {
-		handle_exit(i, &data);
+	uint32_t nr_loops = ret < 1024 ? ret : 1024;
+	bpf_loop(nr_loops, handle_exit, &data, 0);
+
+	return 0;
+}
+
+SEC("tp_btf/sys_exit")
+int BPF_PROG(recvmmsg_old_x, struct pt_regs *regs, long ret) {
+	if(ret <= 0) {
+		unsigned long fd = 0;
+		struct auxiliary_map *auxmap = auxmap__get();
+		if(!auxmap) {
+			return 0;
+		}
+
+		auxmap__preload_event_header(auxmap, PPME_SOCKET_RECVMMSG_X);
+
+		/* Parameter 1: res (type: PT_ERRNO) */
+		auxmap__store_s64_param(auxmap, ret);
+
+		/* Parameter 2: fd (type: PT_FD) */
+		extract__network_args(&fd, 1, regs);
+		auxmap__store_s64_param(auxmap, (int64_t)(int32_t)fd);
+
+		/* Parameter 3: size (type: PT_UINT32) */
+		auxmap__store_u32_param(auxmap, 0);
+
+		/* Parameter 4: data (type: PT_BYTEBUF) */
+		auxmap__store_empty_param(auxmap);
+
+		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
+		auxmap__store_empty_param(auxmap);
+
+		/* Parameter 6: msg_control (type: PT_BYTEBUF) */
+		auxmap__store_empty_param(auxmap);
+
+		auxmap__finalize_event_header(auxmap);
+
+		auxmap__submit_event(auxmap);
+		return 0;
 	}
-	//}
+
+	/* Collect parameters at the beginning to manage socketcalls */
+	unsigned long args[2];
+	extract__network_args(args, 2, regs);
+	recvmmsg_data_t data = {
+	        .fd = args[0],
+	        .mmh = (struct mmsghdr *)args[1],
+	        .regs = regs,
+	        .ctx = ctx,
+	};
+
+	// Send only first message
+	handle_exit(0, &data);
 
 	return 0;
 }

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c
@@ -152,17 +152,57 @@ int BPF_PROG(sendmmsg_x, struct pt_regs *regs, long ret) {
 	        .ctx = ctx,
 	};
 
-	// We can't use bpf_loop() helper since the below check triggers a verifier failure:
-	// see
-	// https://lore.kernel.org/bpf/CAGQdkDt9zyQwr5JyftXqL=OLKscNcqUtEteY4hvOkx2S4GdEkQ@mail.gmail.com/T/#u
-	/*if(bpf_core_enum_value_exists(enum bpf_func_id, BPF_FUNC_loop)) {
-	    uint32_t nr_loops = ret < 1024 ? ret : 1024;
-	    bpf_loop(nr_loops, handle_exit, &data, 0);
-	} else {*/
-	for(int i = 0; i < ret && i < MAX_SENDMMSG_RECVMMSG_SIZE; i++) {
-		handle_exit(i, &data);
+	uint32_t nr_loops = ret < 1024 ? ret : 1024;
+	bpf_loop(nr_loops, handle_exit, &data, 0);
+
+	return 0;
+}
+
+SEC("tp_btf/sys_exit")
+int BPF_PROG(sendmmsg_old_x, struct pt_regs *regs, long ret) {
+	if(ret <= 0) {
+		unsigned long fd = 0;
+		struct auxiliary_map *auxmap = auxmap__get();
+		if(!auxmap) {
+			return 0;
+		}
+
+		auxmap__preload_event_header(auxmap, PPME_SOCKET_SENDMMSG_X);
+
+		/* Parameter 1: res (type: PT_ERRNO) */
+		auxmap__store_s64_param(auxmap, ret);
+
+		/* Parameter 2: fd (type: PT_FD) */
+		extract__network_args(&fd, 1, regs);
+		auxmap__store_s64_param(auxmap, (int64_t)(int32_t)fd);
+
+		/* Parameter 3: size (type: PT_UINT32) */
+		auxmap__store_u32_param(auxmap, 0);
+
+		/* Parameter 4: data (type: PT_BYTEBUF) */
+		auxmap__store_empty_param(auxmap);
+
+		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
+		auxmap__store_empty_param(auxmap);
+
+		auxmap__finalize_event_header(auxmap);
+
+		auxmap__submit_event(auxmap);
+		return 0;
 	}
-	//}
+
+	/* Collect parameters at the beginning to manage socketcalls */
+	unsigned long args[2];
+	extract__network_args(args, 2, regs);
+	sendmmsg_exit_t data = {
+	        .fd = args[0],
+	        .mmh = (struct mmsghdr *)args[1],
+	        .regs = regs,
+	        .ctx = ctx,
+	};
+
+	// Only first message
+	handle_exit(0, &data);
 
 	return 0;
 }

diff --git a/userspace/libpman/CMakeLists.txt b/userspace/libpman/CMakeLists.txt
@@ -27,6 +27,7 @@ add_library(
 	src/configuration.c
 	src/state.c
 	src/sc_set.c
+	src/events_prog_names.c
 )
 
 target_include_directories(

diff --git a/userspace/libpman/include/libpman.h b/userspace/libpman/include/libpman.h
@@ -94,6 +94,14 @@ bool pman_check_support();
  */
 int pman_open_probe(void);
 
+/**
+ * @brief Prepares the bpf skeleton object checking if
+ * it satisfies each events_prog_name feature requirements for each prog.
+ *
+ * @return `0` on success, `errno` in case of error.
+ */
+int pman_prepare_progs_before_loading(void);
+
 /**
  * @brief Load into the kernel all the programs and maps
  * contained into the skeleton.