tetragon: add negative resolve argsMatch test

When a pointer to a BTF struct is NULL, every type of matchArgs selector
should fail to match, because the argument was not really resolved.

Signed-off-by: Andy Strohman <[email protected]>

Author: andrewstrohman

contrib/tester-progs/uprobe-resolve.c

@@ -22,11 +22,13 @@ struct mystruct {
 void usage(char *argv0)
 {
 	fprintf(stderr, "Usage: %s <field> <val>\n", argv0);
-	fprintf(stderr, "field can be one of: v8, v16, v32, v64, sub.v32\n");
+	fprintf(stderr, "field can be one of: v8, v16, v32, v64, sub.v32, null\n");
 }
 
 // without noinline, the symbol is found, but no event fires
 __attribute__((noinline)) int func(int ret, struct mystruct *ms) {
+	if (ms == NULL)
+		return ret;
 	// without doing something with ms, all the resolved args have
 	// value 0, presumably due to optimization
 	printf("v64:%lu\n", ms->v64);
@@ -58,6 +60,8 @@ int main(int argc, char *argv[])
 		s.v64 = val;
 	} else if (!strcmp(field, "sub.v32")) {
 		s.sub.v32 = val;
+	} else if (!strcmp(field, "null")) {
+		return func(0, NULL);
 	} else {
 		usage(argv[0]);
 		exit(1);

pkg/sensors/tracing/uprobe_amd64_test.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/cilium/tetragon/api/v1/tetragon/codegen/eventchecker"
 	ec "github.com/cilium/tetragon/api/v1/tetragon/codegen/eventchecker"
 	"github.com/cilium/tetragon/pkg/bpf"
 	"github.com/cilium/tetragon/pkg/config"
@@ -157,6 +158,25 @@ spec:
 	require.NoError(t, err)
 }
 
+type TestInvocation struct {
+	specTy    string
+	filterVal int
+	field     string
+	kpArgs    []*ec.KprobeArgumentChecker
+}
+
+func get_checker(ti TestInvocation, uprobe string) *eventchecker.ProcessUprobeChecker {
+	return ec.NewProcessUprobeChecker("uprobe-resolve").
+		WithProcess(ec.NewProcessChecker().
+			WithBinary(sm.Full(uprobe)).
+			WithArguments(
+				sm.Full(ti.field + " " + strconv.Itoa(ti.filterVal)),
+			),
+		).WithArgs(ec.NewKprobeArgumentListMatcher().
+		WithOperator(lc.Ordered).
+		WithValues(ti.kpArgs...))
+}
+
 func TestUprobeResolve(t *testing.T) {
 	if !config.EnableLargeProgs() || !bpf.HasUprobeRefCtrOffset() {
 		t.Skip("Need 5.3 or newer kernel for uprobe ref_ctr_off support for this test.")
@@ -169,33 +189,39 @@ func TestUprobeResolve(t *testing.T) {
 	uprobe := testutils.RepoRootPath("contrib/tester-progs/uprobe-resolve")
 	uprobeBtf := testutils.RepoRootPath("contrib/tester-progs/uprobe-resolve.btf")
 
-	tt := []struct {
-		specTy    string
-		filterVal int
-		returnVal int
-		field     string
-		kpArgs    []*ec.KprobeArgumentChecker
-	}{
-		{"uint64", 10, 120, "v64", []*ec.KprobeArgumentChecker{
+	tt := []TestInvocation{
+		{"uint64", 10, "v64", []*ec.KprobeArgumentChecker{
 			ec.NewKprobeArgumentChecker().WithIntArg(0),
 			ec.NewKprobeArgumentChecker().WithSizeArg(10), // uint64(10)
 			ec.NewKprobeArgumentChecker().WithUintArg(0),
 			ec.NewKprobeArgumentChecker().WithUintArg(0),
+			ec.NewKprobeArgumentChecker().WithUintArg(0),
 		}},
-		{"uint32", 11, 130, "v32", []*ec.KprobeArgumentChecker{
+		{"uint32", 11, "v32", []*ec.KprobeArgumentChecker{
 			ec.NewKprobeArgumentChecker().WithIntArg(0),
 			ec.NewKprobeArgumentChecker().WithSizeArg(0),
 			ec.NewKprobeArgumentChecker().WithUintArg(11), // uint32(11)
 			ec.NewKprobeArgumentChecker().WithUintArg(0),
+			ec.NewKprobeArgumentChecker().WithUintArg(0),
 		}},
-		{"uint32", 12, 140, "sub.v32", []*ec.KprobeArgumentChecker{
+		{"uint32", 12, "sub.v32", []*ec.KprobeArgumentChecker{
 			ec.NewKprobeArgumentChecker().WithIntArg(0),
 			ec.NewKprobeArgumentChecker().WithSizeArg(0),
 			ec.NewKprobeArgumentChecker().WithUintArg(0),
 			ec.NewKprobeArgumentChecker().WithUintArg(12), // uint32(12)
+			ec.NewKprobeArgumentChecker().WithUintArg(0),
 		}},
 	}
 
+	/* filterVal is ignored by uprobe-resolve "null" type mode */
+	negative_tests := []TestInvocation{{"uint8", 7, "null", []*ec.KprobeArgumentChecker{
+		ec.NewKprobeArgumentChecker().WithIntArg(0),
+		ec.NewKprobeArgumentChecker().WithSizeArg(0),
+		ec.NewKprobeArgumentChecker().WithUintArg(0),
+		ec.NewKprobeArgumentChecker().WithUintArg(0),
+		ec.NewKprobeArgumentChecker().WithUintArg(0),
+	}}}
+
 	uprobeHook := `
 apiVersion: cilium.io/v1alpha1
 kind: TracingPolicy
@@ -222,6 +248,17 @@ spec:
       type: "` + tt[2].specTy + `"
       btfType: "mystruct"
       resolve: "` + tt[2].field + `"
+    - index: 1
+      type: "uint8"
+      btfType: "mystruct"
+      resolve: "sub.v8"
+    selectors:
+    - matchArgs:
+      - args: [4]
+        operator: "Equal"
+        values:
+        - "0"
+
 `
 
 	uprobeConfigHook := []byte(uprobeHook)
@@ -231,16 +268,13 @@ spec:
 	}
 
 	var checkers []ec.EventChecker
-	for i := range tt {
-		checkers = append(checkers, ec.NewProcessUprobeChecker("uprobe-resolve").
-			WithProcess(ec.NewProcessChecker().
-				WithBinary(sm.Full(uprobe)).
-				WithArguments(
-					sm.Full(tt[i].field+" "+strconv.Itoa(tt[i].filterVal)),
-				),
-			).WithArgs(ec.NewKprobeArgumentListMatcher().
-			WithOperator(lc.Ordered).
-			WithValues(tt[i].kpArgs...)))
+	for _, ti := range tt {
+		checkers = append(checkers, get_checker(ti, uprobe))
+	}
+
+	var negative_checkers []ec.EventChecker
+	for _, ti := range negative_tests {
+		negative_checkers = append(negative_checkers, get_checker(ti, uprobe))
 	}
 
 	var doneWG, readyWG sync.WaitGroup
@@ -256,12 +290,15 @@ spec:
 	observertesthelper.LoopEvents(ctx, t, &doneWG, &readyWG, obs)
 	readyWG.Wait()
 
-	for i := range tt {
-		cmd := exec.Command(uprobe, tt[i].field, strconv.Itoa(tt[i].filterVal))
+	for _, ti := range append(tt, negative_tests...) {
+		cmd := exec.Command(uprobe, ti.field, strconv.Itoa(ti.filterVal))
 		cmdErr := testutils.RunCmdAndLogOutput(t, cmd)
 		require.NoError(t, cmdErr)
 	}
 
 	err = jsonchecker.JsonTestCheck(t, ec.NewUnorderedEventChecker(checkers...))
 	require.NoError(t, err)
+
+	err = jsonchecker.JsonTestCheckExpect(t, ec.NewUnorderedEventChecker(negative_checkers...), true)
+	require.NoError(t, err)
 }