tetragon

1
// SPDX-License-Identifier: Apache-2.0
2
// Copyright Authors of Tetragon
3

4
package filters
5

6
import (
7
	"context"
8
	"fmt"
9
	"regexp"
10

11
	hubbleV1 "github.com/cilium/cilium/pkg/hubble/api/v1"
12
	hubbleFilters "github.com/cilium/cilium/pkg/hubble/filters"
13
	"github.com/cilium/tetragon/api/v1/tetragon"
14
)
15

16
func filterByArgumentsRegex(argumentsPatterns []string) (hubbleFilters.FilterFunc, error) {
17
	var argsRegexList []*regexp.Regexp
18
	for _, pattern := range argumentsPatterns {
19
		query, err := regexp.Compile(pattern)
20
		if err != nil {
21
			return nil, fmt.Errorf("failed to compile regexp: %v", err)
22
		}
23
		argsRegexList = append(argsRegexList, query)
24
	}
25
	return func(ev *hubbleV1.Event) bool {
26
		process := GetProcess(ev)
27
		if process == nil {
28
			return false
29
		}
30
		for _, argRegex := range argsRegexList {
31
			if argRegex.MatchString(process.Arguments) {
32
				return true
33
			}
34
		}
35
		return false
36
	}, nil
37
}
38

39
type ArgumentsRegexFilter struct{}
40

41
func (f *ArgumentsRegexFilter) OnBuildFilter(_ context.Context, ff *tetragon.Filter) ([]hubbleFilters.FilterFunc, error) {
42
	var fs []hubbleFilters.FilterFunc
43
	if ff.ArgumentsRegex != nil {
44
		argumentsFilters, err := filterByArgumentsRegex(ff.ArgumentsRegex)
45
		if err != nil {
46
			return nil, err
47
		}
48
		fs = append(fs, argumentsFilters)
49
	}
50
	return fs, nil
51
}
52