Skip to content

Commit

Permalink
internal/pwru: Match entire string for --filter-func
Browse files Browse the repository at this point in the history
Currently --filter-func=kfree_skb matches all functions whose name
contains the "kfree_skb" string, including __kfree_skb(), kfree_skbmem()
etc.  To match kfree_skb() only, one has to do something like
--filter-func="^kfree_skb$".

This is counterintuitive.  Match the entire string instead in
GetFuncs(), so that --filter-func=kfree_skb only matches kfree_skb().
To match all function names containing "kfree_skb", one should do
something like --filter-func=".*kfree_skb.*" instead.

Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
  • Loading branch information
ypl-coffee authored and brb committed Jan 21, 2022
1 parent ec75700 commit ea2dca0
Show file tree
Hide file tree
Showing 3 changed files with 9 additions and 4 deletions.
6 changes: 5 additions & 1 deletion README.md
Expand Up @@ -96,7 +96,7 @@ the eBPF bytecode from the [release page](https://github.com/cilium/pwru/release
Usage of ./pwru:
--filter-dst-ip string filter destination IP addr
--filter-dst-port uint16 filter destination port
--filter-func string filter the kernel functions that can be probed; the filter can be a regular expression (RE2)
--filter-func string filter kernel functions to be probed by name (exact match, supports RE2 regular expression)
--filter-mark uint32 filter skb mark
--filter-netns uint32 filter netns inode
--filter-proto string filter L4 protocol (tcp, udp, icmp)
Expand All @@ -113,6 +113,10 @@ Usage of ./pwru:
If multiple filters are specified, all of them have to match in order for a
packet to be traced.
The `--filter-func` switch does an exact match on function names i.e.
`--filter-func=foo` only matches `foo()`; for a wildcarded match, try
`--filter-func=".*foo.*"` instead.
## Developing
### Dependencies
Expand Down
2 changes: 1 addition & 1 deletion internal/pwru/types.go
Expand Up @@ -31,7 +31,7 @@ type Flags struct {
}

func (f *Flags) SetFlags() {
flag.StringVar(&f.FilterFunc, "filter-func", "", "filter the kernel functions that can be probed; the filter can be a regular expression (RE2)")
flag.StringVar(&f.FilterFunc, "filter-func", "", "filter kernel functions to be probed by name (exact match, supports RE2 regular expression)")
flag.StringVar(&f.FilterProto, "filter-proto", "", "filter L4 protocol (tcp, udp, icmp, icmp6)")
flag.StringVar(&f.FilterSrcIP, "filter-src-ip", "", "filter source IP addr")
flag.StringVar(&f.FilterDstIP, "filter-dst-ip", "", "filter destination IP addr")
Expand Down
5 changes: 3 additions & 2 deletions internal/pwru/utils.go
Expand Up @@ -26,8 +26,9 @@ func GetFuncs(pattern string) (Funcs, error) {
}
callback := func(typ btf.Type) {
fn := typ.(*btf.Func)
fnName := string(fn.Name)

if pattern != "" && !reg.Match([]byte(fn.Name)) {
if pattern != "" && reg.FindString(fnName) != fnName {
return
}

Expand All @@ -37,7 +38,7 @@ func GetFuncs(pattern string) (Funcs, error) {
if ptr, ok := p.Type.(*btf.Pointer); ok {
if strct, ok := ptr.Target.(*btf.Struct); ok {
if strct.Name == "sk_buff" && i <= 5 {
funcs[string(fn.Name)] = i
funcs[fnName] = i
return
}
}
Expand Down

0 comments on commit ea2dca0

Please sign in to comment.