Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert lib/bpf to use slog #50313

Merged
merged 1 commit into from
Dec 17, 2024
Merged

Convert lib/bpf to use slog #50313

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 23 additions & 20 deletions lib/bpf/bpf.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,15 +123,15 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
return nil, trace.Wrap(err)
}

closeContext, closeFunc := context.WithCancel(context.Background())

// If BPF-based auditing is not enabled, don't configure anything return
// right away.
if !config.Enabled {
log.Debugf("Enhanced session recording is not enabled, skipping.")
logger.DebugContext(closeContext, "Enhanced session recording is not enabled, skipping")
return &NOP{}, nil
}

closeContext, closeFunc := context.WithCancel(context.Background())

s := &Service{
BPFConfig: config,
watch: NewSessionWatch(),
Expand All @@ -150,7 +150,7 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
defer func() {
if err != nil {
if err := s.cgroup.Close(true); err != nil {
log.WithError(err).Warn("Failed to close cgroup")
logger.WarnContext(closeContext, "Failed to close cgroup", "error", err)
}
}
}()
Expand All @@ -163,7 +163,7 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
}

start := time.Now()
log.Debugf("Starting enhanced session recording.")
logger.DebugContext(closeContext, "Starting enhanced session recording")

// Compile and start BPF programs if they are enabled (buffer size given).
s.exec, err = startExec(*config.CommandBufferSize)
Expand All @@ -181,10 +181,13 @@ func New(config *servicecfg.BPFConfig) (bpf BPF, err error) {
return nil, trace.Wrap(err)
}

log.Debugf("Started enhanced session recording with buffer sizes (command=%v, "+
"disk=%v, network=%v) and cgroup mount path: %v. Took %v.",
*s.CommandBufferSize, *s.DiskBufferSize, *s.NetworkBufferSize,
s.CgroupPath, time.Since(start))
logger.DebugContext(closeContext, "Started enhanced session recording",
"command_buffer_size", *s.CommandBufferSize,
"disk_buffer_size", *s.DiskBufferSize,
"network_buffer_size", *s.NetworkBufferSize,
"cgroup_mount_path", s.CgroupPath,
"elapsed", time.Since(start),
)

go s.processNetworkEvents()

Expand Down Expand Up @@ -213,7 +216,7 @@ func (s *Service) Close(restarting bool) error {
// we're restarting.
skipCgroupUnmount := restarting
if err := s.cgroup.Close(skipCgroupUnmount); err != nil {
log.WithError(err).Warn("Failed to close cgroup")
logger.WarnContext(s.closeContext, "Failed to close cgroup", "error", err)
}

// Signal to the processAccessEvents pulling events off the perf buffer to shutdown.
Expand Down Expand Up @@ -247,7 +250,7 @@ func (s *Service) OpenSession(ctx *SessionContext) (uint64, error) {
// Clean up all already opened modules.
for _, closer := range initializedModClosures {
if closeErr := closer.endSession(cgroupID); closeErr != nil {
log.Debugf("failed to close session: %v", closeErr)
logger.DebugContext(s.closeContext, "failed to close session", "error", closeErr)
}
}
return 0, trace.Wrap(err)
Expand Down Expand Up @@ -343,7 +346,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
var event rawExecEvent
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand All @@ -369,7 +372,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
return make([]string, 0), nil
})
if err != nil {
log.WithError(err).Warn("Unable to retrieve args from FnCahe - this is a bug!")
logger.WarnContext(s.closeContext, "Unable to retrieve args from FnCahe - this is a bug!", "error", err)
args = []string{}
}

Expand All @@ -387,7 +390,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
})

if err != nil {
log.Debugf("Got event with missing args: skipping.")
logger.DebugContext(s.closeContext, "Got event with missing args, skipping")
lostCommandEvents.Add(float64(1))
return
}
Expand Down Expand Up @@ -422,7 +425,7 @@ func (s *Service) emitCommandEvent(eventBytes []byte) {
Argv: args[1:],
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionCommandEvent); err != nil {
log.WithError(err).Warn("Failed to emit command event.")
logger.WarnContext(ctx.Context, "Failed to emit command event", "error", err)
}

// Now that the event has been processed, remove from cache.
Expand All @@ -436,7 +439,7 @@ func (s *Service) emitDiskEvent(eventBytes []byte) {
var event rawOpenEvent
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -489,7 +492,7 @@ func (s *Service) emit4NetworkEvent(eventBytes []byte) {
var event rawConn4Event
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -536,7 +539,7 @@ func (s *Service) emit4NetworkEvent(eventBytes []byte) {
TCPVersion: 4,
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionNetworkEvent); err != nil {
log.WithError(err).Warn("Failed to emit network event.")
logger.WarnContext(ctx.Context, "Failed to emit network event", "error", err)
}
}

Expand All @@ -546,7 +549,7 @@ func (s *Service) emit6NetworkEvent(eventBytes []byte) {
var event rawConn6Event
err := unmarshalEvent(eventBytes, &event)
if err != nil {
log.Debugf("Failed to read binary data: %v.", err)
logger.DebugContext(s.closeContext, "Failed to read binary data", "error", err)
return
}

Expand Down Expand Up @@ -593,7 +596,7 @@ func (s *Service) emit6NetworkEvent(eventBytes []byte) {
TCPVersion: 6,
}
if err := ctx.Emitter.EmitAuditEvent(ctx.Context, sessionNetworkEvent); err != nil {
log.WithError(err).Warn("Failed to emit network event.")
logger.WarnContext(ctx.Context, "Failed to emit network event", "error", err)
}
}

Expand Down
9 changes: 4 additions & 5 deletions lib/bpf/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
package bpf

import (
"context"
"encoding/binary"
"os"
"sync"
Expand All @@ -30,14 +31,12 @@ import (
"github.com/aquasecurity/libbpfgo"
"github.com/gravitational/trace"
"github.com/prometheus/client_golang/prometheus"
"github.com/sirupsen/logrus"

"github.com/gravitational/teleport"
logutils "github.com/gravitational/teleport/lib/utils/log"
)

var log = logrus.WithFields(logrus.Fields{
teleport.ComponentKey: teleport.ComponentBPF,
})
var logger = logutils.NewPackageLogger(teleport.ComponentKey, teleport.ComponentBPF)

const (
kprobeProgPrefix = "kprobe__"
Expand Down Expand Up @@ -224,7 +223,7 @@ func (c *Counter) loop() {
var key int32 = 0
cntBytes, err := c.arr.GetValue(unsafe.Pointer(&key))
if err != nil {
log.Errorf("Error reading array value at index 0")
logger.ErrorContext(context.Background(), "Error reading array value at index 0")
continue
}

Expand Down
Loading