tetragon

1
// SPDX-License-Identifier: Apache-2.0
2
// Copyright Authors of Tetragon
3

4
package test
5

6
// Test sensor that uses an lseek hook that generates TEST events when BogusFd
7
// and BogusWhenceVal are used.
8

9
import (
10
	"bytes"
11
	"encoding/binary"
12
	"fmt"
13

14
	"sync/atomic"
15

16
	"github.com/cilium/tetragon/pkg/api/ops"
17
	api "github.com/cilium/tetragon/pkg/api/testapi"
18
	"github.com/cilium/tetragon/pkg/grpc/test"
19
	"github.com/cilium/tetragon/pkg/observer"
20
	"github.com/cilium/tetragon/pkg/sensors"
21
	"github.com/cilium/tetragon/pkg/sensors/program"
22
)
23

24
var (
25

26
	// BogusFd is the fd value required to trigger the lseek test probe
27
	BogusFd = -1
28
	// BogusWhenceVal is the whence value required to trigger the lseek test probe
29
	BogusWhenceVal = 4729
30
)
31

32
var (
33
	// (atomic) counter for sensor names. Initialized at 0 so that first sensor is "1"
34
	sensorCounter uint64
35
)
36

37
func init() {
38
	AddTest()
39
}
40
func AddTest() {
41
	observer.RegisterEventHandlerAtInit(ops.MSG_OP_TEST, handleTest)
42
}
43

44
func msgToTestUnix(m *api.MsgTestEvent) *test.MsgTestEventUnix {
45
	return &test.MsgTestEventUnix{
46
		Msg: m,
47
	}
48
}
49

50
func handleTest(r *bytes.Reader) ([]observer.Event, error) {
51
	m := api.MsgTestEvent{}
52
	if err := binary.Read(r, binary.LittleEndian, &m); err != nil {
53
		return nil, err
54
	}
55
	msgUnix := msgToTestUnix(&m)
56
	return []observer.Event{msgUnix}, nil
57
}
58

59
// GetTestSensor creates a new test sensor.
60
func GetTestSensor() *sensors.Sensor {
61
	sensorName := fmt.Sprintf("test-sensor-%d", atomic.AddUint64(&sensorCounter, 1))
62
	progs := []*program.Program{program.Builder(
63
		"bpf_lseek.o",
64
		"syscalls/sys_enter_lseek",
65
		"tracepoint/sys_enter_lseek",
66
		sensors.PathJoin(sensorName, "test_lseek_prog"),
67
		"tracepoint",
68
	)}
69
	maps := []*program.Map{}
70
	sensor := &sensors.Sensor{Name: sensorName, Progs: progs, Maps: maps}
71
	return sensor
72
}
73