microsoft / ntosebpfext

eBPF-For-Windows extension to provide access to Windows kernel functionality
MIT License
11 stars 9 forks source link

Tracelog lib does not implement correct keyword switching. #62

Open gtrevi opened 3 months ago

gtrevi commented 3 months ago

Apparently, in libs\ebpf_ext\ebpf_ext_tracelog.c no #define EBPF_EXT_****_KEYWORD_SWITCH(...) uses the keyword for the switch parameter, but no caller of those macros passes it. Like done in the ebpf-for-windows repo, explicitly specifying the keyword parameter would make understanding the flow easier.

For example:

#define EBPF_EXT_LOG_MESSAGE_STRING_KEYWORD_SWITCH(trace_level, message, string_value)       \
    switch (keyword) {                                                                       \
    CASE_BASE:                                                                               \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_BASE, message, string_value);      \
        break;                                                                               \
    CASE_BIND:                                                                               \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_BIND, message, string_value);      \
        break;                                                                               \
    CASE_EXT:                                                                                \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_EXT, message, string_value);       \
        break;                                                                               \
    CASE_SOCK_ADDR:                                                                          \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_SOCK_ADDR, message, string_value); \
        break;                                                                               \
    CASE_SOCK_OPS:                                                                           \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_SOCK_OPS, message, string_value);  \
        break;                                                                               \
    CASE_XDP:                                                                                \
        _EBPF_EXT_LOG_MESSAGE_STRING(trace_level, KEYWORD_XDP, message, string_value);       \
        break;                                                                               \
    default:                                                                                 \
        ebpf_assert(!"Invalid keyword");                                                     \
        break;                                                                               \
    }
__declspec(noinline) void ebpf_ext_log_message_string(
    ebpf_ext_tracelog_level_t trace_level,
    ebpf_ext_tracelog_keyword_t keyword,
    _In_z_ const char* message,
    _In_z_ const char* string_value)
{
    switch (trace_level) {
    CASE_LOG_ALWAYS:
        EBPF_EXT_LOG_MESSAGE_STRING_KEYWORD_SWITCH(LEVEL_LOG_ALWAYS, message, string_value);
        break;
    ...
}