Skip to content

Commit

Permalink
Convert lib/bpf to use slog
Browse files Browse the repository at this point in the history
  • Loading branch information
@rosstimothy
rosstimothy committed Dec 16, 2024
1 parent af2db96 commit 1a7b98e
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 25 deletions.
43 changes: 23 additions & 20 deletions lib/bpf/bpf.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -123,15 +123,15 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
return nil, trace.Wrap(err)
}

closeContext, closeFunc := context.WithCancel(context.Background())

// If BPF-based auditing is not enabled, don't configure anything return
// right away.
if !config.Enabled {
log.Debugf("Enhanced session recording is not enabled, skipping.")
logger.DebugContext(closeContext, "Enhanced session recording is not enabled, skipping")
return &NOP{}, nil
}

closeContext, closeFunc := context.WithCancel(context.Background())

s := &Service{
BPFConfig: config,
watch: NewSessionWatch(),
Expand All @@ -150,7 +150,7 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
defer func() {
if err != nil {
if err := s.cgroup.Close(true); err != nil {
log.WithError(err).Warn("Failed to close cgroup")
logger.WarnContext(closeContext, "Failed to close cgroup", "error", err)
}
}
}()
Expand All @@ -163,7 +163,7 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
}

start := time.Now()
log.Debugf("Starting enhanced session recording.")
logger.DebugContext(closeContext, "Starting enhanced session recording")

// Compile and start BPF programs if they are enabled (buffer size given).
s.exec, err = startExec(*config.CommandBufferSize)
Expand All @@ -181,10 +181,13 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
return nil, trace.Wrap(err)
}

log.Debugf("Started enhanced session recording with buffer sizes (command=%v, "+
"disk=%v, network=%v) and cgroup mount path: %v. Took %v.",
*s.CommandBufferSize, *s.DiskBufferSize, *s.NetworkBufferSize,
s.CgroupPath, time.Since(start))
logger.DebugContext(closeContext, "Started enhanced session recording",
"command_buffer_size", *s.CommandBufferSize,
"disk_buffer_size", *s.DiskBufferSize,
"network_buffer_size", *s.NetworkBufferSize,
"cgroup_mount_path", s.CgroupPath,
"elapsed", time.Since(start),
)

go s.processNetworkEvents()

Expand Down Expand Up @@ -213,7 +216,7 @@ func (s *Service) Close(restarting bool) error {
// we're restarting.
skipCgroupUnmount := restarting
if err := s.cgroup.Close(skipCgroupUnmount); err != nil {
log.WithError(err).Warn("Failed to close cgroup")
logger.WithError(err).WarnContext(s.closeContext, "Failed to close cgroup")
}

// Signal to the processAccessEvents pulling events off the perf buffer to shutdown.
Expand Down Expand Up @@ -247,7 +250,7 @@ func (s *Service) OpenSession(ctx *SessionContext) (uint64, error) {
// Clean up all already opened modules.
for _, closer := range initializedModClosures {
if closeErr := closer.endSession(cgroupID); closeErr != nil {
log.Debugf("failed to close session: %v", closeErr)
logger.DebugContext(s.closeContext, "failed to close session", "error", closeErr)
}
}
return 0, trace.Wrap(err)
Expand Down Expand Up @@ -343,7 +346,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
var event rawExecEvent
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand All @@ -369,7 +372,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
return make([]string, 0), nil
})
if err != nil {
log.WithError(err).Warn("Unable to retrieve args from FnCahe - this is a bug!")
logger.WarnContext(s.closeContext, "Unable to retrieve args from FnCahe - this is a bug!", "error", err)
args = []string{}
}

Expand All @@ -387,7 +390,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
})

if err != nil {
log.Debugf("Got event with missing args: skipping.")
logger.DebugContext(s.closeContext, "Got event with missing args, skipping")
lostCommandEvents.Add(float64(1))
return
}
Expand Down Expand Up @@ -422,7 +425,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
Argv: args[1:],
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionCommandEvent); err != nil {
log.WithError(err).Warn("Failed to emit command event.")
logger.WarnContext(ctx.Context, "Failed to emit command event", "error", err)
}

// Now that the event has been processed, remove from cache.
Expand All @@ -436,7 +439,7 @@ func (s *Service) emitDiskEvent(eventBytes []byte) {
var event rawOpenEvent
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -489,7 +492,7 @@ func (s *Service) emit4NetworkEvent(eventBytes []byte) {
var event rawConn4Event
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -536,7 +539,7 @@ func (s *Service) emit4NetworkEvent(eventBytes []byte) {
TCPVersion: 4,
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionNetworkEvent); err != nil {
log.WithError(err).Warn("Failed to emit network event.")
logger.WarnContext(ctx.Context, "Failed to emit network event", "error", err)
}
}

Expand All @@ -546,7 +549,7 @@ func (s *Service) emit6NetworkEvent(eventBytes []byte) {
var event rawConn6Event
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -593,7 +596,7 @@ func (s *Service) emit6NetworkEvent(eventBytes []byte) {
TCPVersion: 6,
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionNetworkEvent); err != nil {
log.WithError(err).Warn("Failed to emit network event.")
logger.WarnContext(ctx.Context, "Failed to emit network event", "error", err)
}
}

Expand Down
9 changes: 4 additions & 5 deletions lib/bpf/helper.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
package bpf

import (
"context"
"encoding/binary"
"os"
"sync"
Expand All @@ -30,14 +31,12 @@ import (
"github.com/aquasecurity/libbpfgo"
"github.com/gravitational/trace"
"github.com/prometheus/client_golang/prometheus"
"github.com/sirupsen/logrus"

"github.com/gravitational/teleport"
logutils "github.com/gravitational/teleport/lib/utils/log"
)

var log = logrus.WithFields(logrus.Fields{
teleport.ComponentKey: teleport.ComponentBPF,
})
var logger = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentBPF)

const (
kprobeProgPrefix = "kprobe__"
Expand Down Expand Up @@ -224,7 +223,7 @@ func (c *Counter) loop() {
var key int32 = 0
cntBytes, err := c.arr.GetValue(unsafe.Pointer(&key))
if err != nil {
log.Errorf("Error reading array value at index 0")
logger.ErrorContext(context.Background(), "Error reading array value at index 0")
continue
}

Expand Down

0 comments on commit 1a7b98e

Please sign in to comment.