Analyze new eBPF programs.

[NikolaBo]

• [x] fluvia (new xdp)
• [x] hercules (new xdp)
• [ ] dae (tc/cgroup)
• [ ] sysmon (tracepoints)
• [ ] falco (tracepoints)

[NikolaBo]

Analyze falco programs:

attached/dispatchers

• [x] syscall_enter
• [x] syscall_exit

attached/events

• [x] page_fault_kernel
• [x] page_fault_user
• [ ] sched_process_exit
• [ ] sched_process_exec
• [ ] sched_process_fork
  • [ ] sched_p_fork
  • [ ] t1_sched_p_fork
  • [x] t2_sched_p_fork
• [x] sched_switch
• [x] signal_deliver

tail_called/events/custom_logic

• [x] drop
• [x] hotplug

tail_called/events/syscall_dispatched_events

• [ ] accept
  • [x] enter
  • [ ] exit (socktuple extraction)
• [ ] accept4
  • [x] enter
  • [ ] exit (socktuple extraction)
• [ ] access
  • [x] enter
  • [ ] exit (path extraction)
• [ ] bind
  • [x] enter
  • [ ] exit (sockaddr path extraction)
• [x] bpf
  • [x] enter
  • [x] exit
• [x] brk
  • [x] enter
  • [x] exit
• [ ] capset
  • [x] enter
  • [ ] exit (capability extraction)
• [ ] chdir
  • [x] enter
  • [ ] exit (tried path extraction - auxmap + symbolic string leads to huge symbex time)
• [ ] chmod
  • [x] enter
  • [ ] exit (path extraction)
• [ ] chown
  • [x] enter
  • [ ] exit (path extraction)
• [ ] chroot
  • [x] enter
  • [ ] exit (path extraction)
• [ ] clone
  • [x] enter
  • [ ] exit (path extraction + potentially tricky pf extraction)
  • [ ] t1_exit (cgroup extraction)
  • [x] t2_exit
• [ ] clone3
  • [x] enter
  • [ ] exit (path extraction + potentially tricky pf extraction)
  • [ ] t1_exit (cgroup extraction)
  • [x] t2_exit
• [x] close
  • [x] enter
  • [x] exit
• [ ] connect
  • [ ] enter (sockaddr path extraction)
  • [ ] exit (socktuple extraction)
• [x] copy_file_range
  • [x] enter
  • [x] exit
• [ ] creat
  • [ ] enter (path extraction)
  • [ ] exit (path extraction)
• [x] dup
  • [x] enter
  • [x] exit
• [x] dup2
  • [x] enter
  • [x] exit
• [x] dup3
  • [x] enter
  • [x] exit
• [x] epoll_create
  • [x] enter
  • [x] exit
• [x] epoll_create1
  • [x] enter
  • [x] exit
• [x] epoll_wait
  • [x] enter
  • [x] exit
• [x] eventfd
  • [x] enter
  • [x] exit
• [x] eventfd2
  • [x] enter
  • [x] exit
• [ ] execve
  • [ ] enter (path extraction)
  • [ ] exit (path extraction)
  • [ ] t1_exit (capability + path extraction)
  • [ ] t2_exit (path extraction)
• [ ] execveat
  • [ ] enter (path extraction)
  • [ ] exit (path extraction)
  • [ ] t1_exit (capability + path extraction)
  • [ ] t2_exit (path extraction)
• [x] fchdir
  • [x] enter
  • [x] exit
• [x] fchmod
  • [x] enter
  • [x] exit
• [ ] fchmodat
  • [x] enter
  • [ ] exit (path extraction)
• [x] fchown
  • [x] enter
  • [x] exit
• [ ] fchownat
  • [x] enter
  • [ ] exit (path extraction)
• [x] fcntl
  • [x] enter
  • [x] exit
• [ ] finit_module
  • [x] enter
  • [ ] exit (string extraction)
• [x] flock
  • [x] enter
  • [x] exit
• [ ] fork
  • [x] enter
  • [ ] exit (path extraction + potentially tricky pf extraction)
  • [ ] t1_exit (clone flag extraction)
  • [x] t2_exit
• [ ] fsconfig
  • [x] enter
  • [ ] exit (path extraction)
• [x] fstat
  • [x] enter
  • [x] exit
• [x] futex
  • [x] enter
  • [x] exit
• [x] generic
  • [x] enter
  • [x] exit
• [x] getcwd
  • [x] enter
  • [x] exit
• [x] getdents
  • [x] enter
  • [x] exit
• [x] getdents64
  • [x] enter
  • [x] exit
• [x] getegid
  • [x] enter
  • [x] exit
• [x] geteuid
  • [x] enter
  • [x] exit
• [x] getgid
  • [x] enter
  • [x] exit
• [x] getpeername
  • [x] enter
  • [x] exit
• [x] getresgid
  • [x] enter
  • [x] exit
• [x] getresuid
  • [x] enter
  • [x] exit
• [x] getrlimit
  • [x] enter
  • [x] exit
• [x] getsockname
  • [x] enter
  • [x] exit
• [ ] getsockopt
  • [x] enter
  • [ ] exit (sockopt extraction)
• [x] getuid
  • [x] enter
  • [x] exit
• [ ] init_module
  • [x] enter
  • [ ] exit (path extraction)
• [x] inotify_init
  • [x] enter
  • [x] exit
• [x] inotify_init1
  • [x] enter
  • [x] exit
• [x] io_uring_enter
  • [x] enter
  • [x] exit
• [x] io_uring_register
  • [x] enter
  • [x] exit
• [x] io_uring_setup
  • [x] enter
  • [x] exit
• [x] ioctl
  • [x] enter
  • [x] exit
• [x] kill
  • [x] enter
  • [x] exit
• [ ] lchown
  • [x] enter
  • [ ] exit (path extraction)
• [ ] link
  • [x] enter
  • [ ] exit (path extraction)
• [ ] linkat
  • [x] enter
  • [ ] exit (path extraction)
• [ ] listen
  • [x] enter
  • [x] exit
• [x] llseek
  • [x] enter
  • [x] exit
• [x] llseek
  • [x] enter
  • [x] exit
• [ ] lstat
  • [x] enter
  • [ ] exit (path extraction)
• [ ] memfd_create
  • [x] enter
  • [ ] exit (string extraction)
• [ ] mkdir
  • [x] enter
  • [ ] exit (path extraction)
• [ ] mkdirat
  • [x] enter
  • [ ] exit (path extraction)
• [ ] mknod
  • [x] enter
  • [ ] exit (path extraction)
• [ ] mknodat
  • [x] enter
  • [ ] exit (path extraction)
• [x] mlock
  • [x] enter
  • [x] exit
• [x] mlock2
  • [x] enter
  • [x] exit
• [x] mlockall
  • [x] enter
  • [x] exit
• [ ] mmap
  • [ ] enter (path explosion tied to flag extraction?)
  • [x] exit
• [ ] mmap2
  • [ ] enter (path explosion tied to flag extraction?)
  • [x] exit
• [ ] mount
  • [x] enter
  • [ ] exit (path extraction)
• [x] mprotect
  • [x] enter
  • [x] exit
• [x] munlock
  • [x] enter
  • [x] exit
• [x] munlockall
  • [x] enter
  • [x] exit
• [x] munmap
  • [x] enter
  • [x] exit
• [x] nanosleep
  • [x] enter
  • [x] exit
• [ ] open_by_handle_at
  • [x] enter
  • [ ] exit (file struct extraction)
  • [ ] t1_exit (path extraction)
• [ ] open
  • [ ] enter (path extraction)
  • [ ] exit (file struct extraction)

86 syscalls so far 183 total programs 134 symbexed programs 49 unsymbexed programs

[NikolaBo]

Analyze dae programs:

tc

• [ ] tproxy_lan_egress (tc/egress)
• [ ] tproxy_lan_ingress (tc/ingress)
• [ ] tproxy_wan_egress (tc/wan_egress)
• [ ] tproxy_wan_ingress (tc/wan_ingress)

cgroup

• [x] tproxy_wan_cg_sock_create (cgroup/sock_create)
• [x] tproxy_wan_cg_sock_release (cgroup/sock_release)
• [x] tproxy_wan_cg_connect4 (cgroup/connect4)
• [x] tproxy_wan_cg_connect6 (cgroup/connect6)
• [x] tproxy_wan_cg_sendmsg4 (cgroup/sendmsg4)
• [x] tproxy_wan_cg_sendmsg6 (cgroup/sendmsg6)