Граф коммитов

63 Коммитов

Автор SHA1 Сообщение Дата
Shankar Seal b2757bce8e
Fuzzing bug fixes (#3989)
* wip

* Merged PR 28837: Fix CICD

Fix CICD build failures.

* wip

* wip

* Revert "wip"

This reverts commit e7311fef62.

* sync

* sync

* sync

* feedback

* draft

* sync

* sync

* draft

* wip

* nit

* wip

* wip

* wip

* wip

* wip

* wip

* nit

* add AKS evn detection, add TBD check eBPF usage on uninstall

* wip

* Merged PR 30605: Bump bpf_conformance to 0.6.0 to unblock conformance testing

Bump bpf_conformance to 0.6.0 to unblock conformance testing

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30598: Add new onefuzz task to perform continual fuzzing of eBPF for Windows

Add new onefuzz task to perform continual fuzzing of eBPF for Windows

* Merged PR 30633: Add missing bug filing info for netebpfext

Add missing bug filing info for netebpfext

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30634: Add codecoverage for fuzzing pipeline

Add codecoverage for fuzzing pipeline

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* wip

* Merged PR 30808: Apply correct fuzzer settings

Apply correct fuzzer settings

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30804: Fix division by zero in batch delete.

Fix division by zero in batch delete:
`input_count = key_length / map_definition->key_size;`

Related work items: #159139

* Merged PR 30814: Fix OneFuzzConfig.json to fuzz feature/security_fix and correctly assign bugs

Fix OneFuzzConfig.json to fuzz feature/security_fix and correctly assign bugs

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30825: Reformat IOCTL fuzzing seed to include reply length

Reformat IOCTL fuzzing seed to include reply length and regenerate corpus.

Issue:
The fuzzer was always setting an invalid reply length, even for "good" cases. This results in many paths being blocked because reply length != expected reply length in ebpf_core_invoke_protocol_handler.

By including the correct reply length in the seed, we permit the fuzzer to explore more code spaces.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30880: Add ASAN_OPTIONS=allocator_may_return_null=1

Add ASAN_OPTIONS=allocator_may_return_null=1

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30890: Run all libfuzzers in OneFuzz on the feature/security_fix branch

Run all libfuzzers in OneFuzz on the feature/security_fix branch

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30897: _ebpf_program_load_byte_code should reject zero length eBPF programs

_ebpf_program_load_byte_code should reject zero length eBPF programs

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30922: Improve verifier coverage by permitting more program types to run.

Improve verifier coverage by permitting more program types to run.

Due to context create for sample program type, all calls to prog run for a sample program fail with minimal coverage.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30905: Prevent fuzzer from triggering long running bpf_prog_test_run

The execution_context_fuzzer can get hung on executing a BPF program if it fuzzes the iteration count to a huge value, resulting in the test timing out after several minutes. This slows the rate of useful fuzzing.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Fix buffer overflow in ebpf_program_get_info

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Workaround for verifier bug

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Fix division by zero in _ebpf_core_protocol_map_update_element_batch

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30956: Improve code coverage of execution context fuzzer

During creation of the various map types, creation of several map types was failing, preventing fuzzing of those maps.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30819: Check LPM key length

Check LPM key length

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

Related work items: #159141

* Merged PR 30971: Remove PATs from onefuzz task.

As per guidance from the OneFuzz team, a PAT is no longer required, so switch to the new option.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30991: Prevent ebpf_program_t from switching between JIT and interpreter

Prevent ebpf_program_t from switching between JIT and interpreter.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30992: Improve execution context fuzzer - add link object and speed up fuzzing

Improve execution context fuzzer - add link object and speed up fuzzing

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30993: Make helper fuzzer more generic

1. Remove dependency on ebpf_program_t.
2. Bind directly to program info provider.
3. Move ebpf_core_initiate/terminate to global.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 31238: Fix assigned to in .onefuzz\OneFuzzConfig.json

Fix assigned to in .onefuzz\OneFuzzConfig.json

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 31250: Merge main into feature/security_fix

* Merged PR 31358: Add HLK playlist link to the HLK documentation.

Add playlist link, whitespace optimizations.

* Merged PR 31516: Disable onefuzz on main

Disable onefuzz on main

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30823: Quick-guide: how to debug an eBPF program

This is a quick guide on how to use WinDbg to debug kernel code on a target machine.

* add checks for code_type

* Merged PR 31674: Update netebpfext bind context app_id truncation logic for safety

_net_ebpf_ext_resource_truncate_appid made some assumptions about the input data it received. In theory, improper data could be passed into ebpf, which could potentially cause a buffer overrun/crash. Additional checks were added to ensure safety of the truncation logic, even if improper input was passed.

Additional test cases were added to ensure the truncation logic was safe and validating improper input.

Related work items: #159406

* Merged PR 30986: Add LPM map unit tests, fix lookup and input checking bugs

## Description

This improves and adds ebpf map unit testing and fixes some bugs.

Changes:
- `_create_lpm_map`: fixes length calculation for key size bitmap
  - `max_prefix` should be the passed value, bitmap size gets `+1` to account for max length keys
- `_find_lpm_map_entry`: initialize search from search key bit length instead of maximum stored key length
  - reduces number of hashes to try during lookup (for short keys) and fixes bug of looking for map key longer than passed search key
  - adds `ebpf_bitmap_start_reverse_search_at` to initialize set bit search to a specific bit index
- `_create_array_map_with_map_struct_size`: argument check for value size/capacity combination that allocates >128GB
- `_next_lpm_map_key_and_value`/`_next_hash_map_key_and_value` - fix SAL annotation for `next_key` (should be `_Inout_`)
- Refactor lpm key handling to use new `ebpf_core_lpm_key_t` struct instead of pointer to prefix length
- Add, fix, and extend LPM map unit tests

## Testing

Extends the `map_crud_operations_lpm_trie_32` test case and adds a second `[negative]` tagged version which tests operations that shouldn't work (including some edge cases that were previously missed).

`map_create_invalid` test case added to try creating various maps with invalid parameters.

Extends and refactors `map_crud_operations_lpm_trie_128`

## Documentation

Comments in new unit testing functions, and more documentation added in LPM and bitmap code.

## Installation

N/A

Related work items: #159137, #159144, #159270, #159273

* Merged PR 31697: Add map type validation in debug mode

This PR adds map type validation in debug mode.

The map type was already checked on creation and is never user-writeable, so these checks are just against code bugs or outside code modifying the type field.

In ebpf_maps.c lookup into `ebpf_map_metadata_tables` is now factored out into calls to `ebpf_map_get_table()`, which validates the map type with a debug assert.

Related work items: #159405

* Merged PR 31809: Update VM extension script to invoke `export_program_info`

This PR contains changes to the VM extension scripts to invoke `export_program_info.exe`. The invocation is kept optional based on whether the file is present or not. This is for 2 reasons:

1. ebpf v0.11 released earlier to IMDS does not contain this exe. So in case of cleanup or rollback, it is possible that the exe is not available.
2. We should ideally change the store implementation to move from registry to file based. Keeping the new code optional allows to change store implementation without requiring the script to mandatorily updated at the same time.

* Merged PR 32086: Update ADO pipeline

This PR updates the clang version to be used in ADO pipeline. Since the clang version has been updated in GitHub, and correspnding tests have also been updated, CICD is now failing in ADO since then.

#### PR Summary
This pull request updates the ADO pipeline to use Visual Studio LLVM tools instead of installing LLVM via Chocolatey.
- `.pipelines/reusable-build.yml`: Replaced Chocolatey installation of LLVM with Visual Studio LLVM tools installation using PowerShell tasks.
- `.pipelines/reusable-build.yml`: Added MSVC LLVM Clang to PATH and logged the CLANG version.
- `.pipelines/reusable-build.yml`: Set `VSINSTALLDIR` environment variable.

* Merged PR 32085: VM extension script fixes

This PR contains 2 changes:
1. Fix the source path for upgrade flow. The script was incorrectly using a hardcoded path.
2. Suppress error messages from `Get-ItemProperty` when querying for registry path. This change is only cosmetic and has no functional impact.

----
#### AI description  (iteration 1)
#### PR Classification
Bug fix for VM extension scripts.

#### PR Summary
This pull request addresses several issues in the VM extension scripts, primarily focusing on error handling and parameter corrections.
- `/.internal/vm-extension/src/scripts/common.ps1`: Added `-ErrorAction SilentlyContinue` to `Get-ItemProperty` to handle missing registry keys gracefully.
- Corrected parameter usage in `Update-eBPF` and `InstallOrUpdate-eBPF` functions to ensure the correct source path is used during installation.
- Removed trailing whitespace in multiple functions for code cleanliness.

* Merged PR 30804: Fix division by zero in batch delete.

Fix division by zero in batch delete:
`input_count = key_length / map_definition->key_size;`

Related work items: #159139

* Merged PR 30814: Fix OneFuzzConfig.json to fuzz feature/security_fix and correctly assign bugs

Fix OneFuzzConfig.json to fuzz feature/security_fix and correctly assign bugs

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30825: Reformat IOCTL fuzzing seed to include reply length

Reformat IOCTL fuzzing seed to include reply length and regenerate corpus.

Issue:
The fuzzer was always setting an invalid reply length, even for "good" cases. This results in many paths being blocked because reply length != expected reply length in ebpf_core_invoke_protocol_handler.

By including the correct reply length in the seed, we permit the fuzzer to explore more code spaces.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30890: Run all libfuzzers in OneFuzz on the feature/security_fix branch

Run all libfuzzers in OneFuzz on the feature/security_fix branch

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30897: _ebpf_program_load_byte_code should reject zero length eBPF programs

_ebpf_program_load_byte_code should reject zero length eBPF programs

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30922: Improve verifier coverage by permitting more program types to run.

Improve verifier coverage by permitting more program types to run.

Due to context create for sample program type, all calls to prog run for a sample program fail with minimal coverage.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30905: Prevent fuzzer from triggering long running bpf_prog_test_run

The execution_context_fuzzer can get hung on executing a BPF program if it fuzzes the iteration count to a huge value, resulting in the test timing out after several minutes. This slows the rate of useful fuzzing.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Fix division by zero in _ebpf_core_protocol_map_update_element_batch

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Fix buffer overflow in ebpf_program_get_info

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Workaround for verifier bug

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30956: Improve code coverage of execution context fuzzer

During creation of the various map types, creation of several map types was failing, preventing fuzzing of those maps.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30819: Check LPM key length

Check LPM key length

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

Related work items: #159141

* Merged PR 30991: Prevent ebpf_program_t from switching between JIT and interpreter

Prevent ebpf_program_t from switching between JIT and interpreter.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30992: Improve execution context fuzzer - add link object and speed up fuzzing

Improve execution context fuzzer - add link object and speed up fuzzing

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 30993: Make helper fuzzer more generic

1. Remove dependency on ebpf_program_t.
2. Bind directly to program info provider.
3. Move ebpf_core_initiate/terminate to global.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Merged PR 31250: Merge main into feature/security_fix

* Merged PR 31674: Update netebpfext bind context app_id truncation logic for safety

_net_ebpf_ext_resource_truncate_appid made some assumptions about the input data it received. In theory, improper data could be passed into ebpf, which could potentially cause a buffer overrun/crash. Additional checks were added to ensure safety of the truncation logic, even if improper input was passed.

Additional test cases were added to ensure the truncation logic was safe and validating improper input.

Related work items: #159406

* Merged PR 30986: Add LPM map unit tests, fix lookup and input checking bugs

## Description

This improves and adds ebpf map unit testing and fixes some bugs.

Changes:
- `_create_lpm_map`: fixes length calculation for key size bitmap
  - `max_prefix` should be the passed value, bitmap size gets `+1` to account for max length keys
- `_find_lpm_map_entry`: initialize search from search key bit length instead of maximum stored key length
  - reduces number of hashes to try during lookup (for short keys) and fixes bug of looking for map key longer than passed search key
  - adds `ebpf_bitmap_start_reverse_search_at` to initialize set bit search to a specific bit index
- `_create_array_map_with_map_struct_size`: argument check for value size/capacity combination that allocates >128GB
- `_next_lpm_map_key_and_value`/`_next_hash_map_key_and_value` - fix SAL annotation for `next_key` (should be `_Inout_`)
- Refactor lpm key handling to use new `ebpf_core_lpm_key_t` struct instead of pointer to prefix length
- Add, fix, and extend LPM map unit tests

## Testing

Extends the `map_crud_operations_lpm_trie_32` test case and adds a second `[negative]` tagged version which tests operations that shouldn't work (including some edge cases that were previously missed).

`map_create_invalid` test case added to try creating various maps with invalid parameters.

Extends and refactors `map_crud_operations_lpm_trie_128`

## Documentation

Comments in new unit testing functions, and more documentation added in LPM and bitmap code.

## Installation

N/A

Related work items: #159137, #159144, #159270, #159273

* Merged PR 31697: Add map type validation in debug mode

This PR adds map type validation in debug mode.

The map type was already checked on creation and is never user-writeable, so these checks are just against code bugs or outside code modifying the type field.

In ebpf_maps.c lookup into `ebpf_map_metadata_tables` is now factored out into calls to `ebpf_map_get_table()`, which validates the map type with a debug assert.

Related work items: #159405

* add checks for code_type

* fix bad merge

* Override `bpf_get_current_pid_tgid` for sock_ops hook. (#3765)

* initial changes.

* sock_addr.

* fixes.

* Update include/ebpf_nethooks.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

---------

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* Add ADO pipelines (#3741)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>

* Bump external/ubpf from `19cd22c` to `762a98d` (#3783)

Bumps [external/ubpf](https://github.com/iovisor/ubpf) from `19cd22c` to `762a98d`.
- [Commits](19cd22c6fb...762a98dd1a)

---
updated-dependencies:
- dependency-name: external/ubpf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump external/usersim from `46c6b4a` to `ca8f2de` (#3782)

Bumps [external/usersim](https://github.com/microsoft/usersim) from `46c6b4a` to `ca8f2de`.
- [Commits](46c6b4adf1...ca8f2defc6)

---
updated-dependencies:
- dependency-name: external/usersim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump external/ebpf-verifier from `dc2d6ea` to `cd9344b` (#3784)

Bumps [external/ebpf-verifier](https://github.com/vbpf/ebpf-verifier) from `dc2d6ea` to `cd9344b`.
- [Release notes](https://github.com/vbpf/ebpf-verifier/releases)
- [Commits](dc2d6ea75a...cd9344bdbb)

---
updated-dependencies:
- dependency-name: external/ebpf-verifier
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump github/codeql-action from 3.26.2 to 3.26.5 in the actions group (#3790)

Bumps the actions group with 1 update: [github/codeql-action](https://github.com/github/codeql-action).


Updates `github/codeql-action` from 3.26.2 to 3.26.5
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](429e197704...2c779ab0d0)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Stamp all tools with version information. (#3792)

* Stamp all tools with version information.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Add commit id to nuget package

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Move versioning to Directory.Build.props

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Set correct project type in sample.vcxproj

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Add version info to fuzz tests

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Update tests/socket/resource.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* Revert editor change

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* First string functions for ebpf general helpers. (#3780)

* Initial progress on function implementations.

* Moved code.

* Updated kernel project.

* Working on parallel user and kernel mode versions.

* Work in Progress.

* Added tests, added a lot.

* Cleaned up test code some, still doesn't build.

* Re-enabled some tests.

* Got a working set of tests, now to figure out what to do with this in the interim.

* Removing as-yet-unimplemented functions for now.

* Fixed a name.

* Doxygen fixes. Also removed a function header that'll be needed another time.

* Got down to one source file, got a build working in user mode.

* Renamed string_opts to ebpf_strings

* Corrected build issues, removed other extraneous comments.

* Fixed the test selection name, and suppressed an analysis error in a Windows header.

---------

Co-authored-by: Ben Lewis (REDMOND) <Ben.Lewis@microsoft.com>

* Bump external/ubpf from `762a98d` to `f1ecb7a` (#3797)

Bumps [external/ubpf](https://github.com/iovisor/ubpf) from `762a98d` to `f1ecb7a`.
- [Commits](762a98dd1a...f1ecb7a245)

---
updated-dependencies:
- dependency-name: external/ubpf
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump external/usersim from `ca8f2de` to `bded12c` (#3796)

Bumps [external/usersim](https://github.com/microsoft/usersim) from `ca8f2de` to `bded12c`.
- [Commits](ca8f2defc6...bded12ceee)

---
updated-dependencies:
- dependency-name: external/usersim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Added ntosext extensions in the GettingStarted.md document. (#3785)

* Added ntosext extension in the doc

* Addressed PR comment

* Update docs/GettingStarted.md

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

---------

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* relocate installer license to avoid "multiple licenses" text on GitHub (#3802)

* Inline _ebpf_adjust_value_pointer to reduce cost of ebpf_map_find_entry (#3804)

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>

* Bump external/ebpf-verifier from `cd9344b` to `559482c` (#3807)

Bumps [external/ebpf-verifier](https://github.com/vbpf/ebpf-verifier) from `cd9344b` to `559482c`.
- [Release notes](https://github.com/vbpf/ebpf-verifier/releases)
- [Commits](cd9344bdbb...559482ccaf)

---
updated-dependencies:
- dependency-name: external/ebpf-verifier
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump the actions group with 2 updates (#3806)

Bumps the actions group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).


Updates `actions/upload-artifact` from 4.3.6 to 4.4.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](834a144ee9...50769540e7)

Updates `github/codeql-action` from 3.26.5 to 3.26.6
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](2c779ab0d0...4dd16135b6)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Switch to crc32 if available for hashing function (#3803)

* Switch to crc32 if available for hashing function

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Only do crc32 when keys are directly accessible

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Minimize branches and extra ALU ops

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>

* Multi-attach support for SOCK_ADDR programs (#3751)

* initial commit

* second commit

* third commit

* update lock logic

* fix analysis errors

* backup

* Add tests

* fix

* fix

* fix

* code refactor

* update test

* Revert "update test"

This reverts commit 6770269907.

* Revert "code refactor"

This reverts commit fae36a7d0e.

* Revert "Revert "code refactor""

This reverts commit 3b8e762d33.

* Revert "Revert "update test""

This reverts commit 11610f06ce.

* fix capability in xdp

* add tests, remove filter weight

* invoke wildcard programs, update tests

* fix wildcard invocation logic

* fix wildcard invocation logic, remove sleep from concurrency tests

* move invocation out of the lock, fix tests

* code cleanup, update test

* code cleanup

* remove trace

* cleanup

* update wildcard invocation logic

* code cleanup

* code cleanup

* code cleanup, CR comments

* cr comments, code cleanup

* Update netebpfext/net_ebpf_ext_hook_provider.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* cr comments

* add tests

* cr comments

* code cleanup

* tracing changes

* fix sal

* code cleanup

* code cleanup

* Update netebpfext/net_ebpf_ext.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

---------

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

fix.

* Updated onebranch.vcxproj

* Updated post-build.ps1

* Stack expansion in netebpfext (#3817)

* expand stack

* update usersim submodule

* fix analysis build

* cr comments

* fix analysis failure

* cr comments

* Update netebpfext/net_ebpf_ext_hook_provider.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

---------

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* Bump external/usersim from `bded12c` to `a1ba035` (#3818)

Bumps [external/usersim](https://github.com/microsoft/usersim) from `bded12c` to `a1ba035`.
- [Commits](bded12ceee...a1ba0355fb)

---
updated-dependencies:
- dependency-name: external/usersim
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* change expanded stack size to 16KB.

* Merged PR 11480212: Update store APIs to also update HKLM (#3660) (#3853)

Update store APIs to also update HKLM (#3660) (#3853)

Cherry-picked from commit `462b8e3c`.

----
#### AI description  (iteration 1)
#### PR Classification
API change to update store APIs to also update HKLM.

#### PR Summary
This pull request updates the store APIs to handle both HKCU and HKLM registry keys, ensuring that operations are attempted on both keys and errors are suppressed if access to HKLM is denied.
- `ebpf_store_helper.c`: Added functions to update and delete program and section information for both HKCU and HKLM.
- `store_helper_internal.cpp`: Modified functions to handle both HKCU and HKLM registry keys.
- `Product.wxs`: Updated installer scripts to clear and set up eBPF store for both HKCU and HKLM.
- `ebpf_store_helper.h` and `ebpf_registry_helper.cpp`: Introduced separate variables for HKCU and HKLM root keys.

* Merged PR 11486801: Update version to 0.19.1

update version to 0.19.1

* remove .internal

* Miscellaneous fixes.

* PR Feedback.

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Co-authored-by: Anurag Saxena <anusa@microsoft.com>
Co-authored-by: Microsoft.VisualStudio.Services.TFS <Microsoft.VisualStudio.Services.TFS@microsoft.com>
Co-authored-by: Gianni Trevisiol <gtrevi@microsoft.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Alan Jowett <Alan Jowett@microsoft.com>
Co-authored-by: Igor Klemenski <igklemen@microsoft.com>
Co-authored-by: Shankar Seal <Shankar Seal@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Matt Ige <maige@microsoft.com>
Co-authored-by: Michael Agun <danielagun@microsoft.com>
Co-authored-by: Dave Thaler <dthaler1968@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ben Lewis <1884340+ben-zen@users.noreply.github.com>
Co-authored-by: Ben Lewis (REDMOND) <Ben.Lewis@microsoft.com>
Co-authored-by: Sharmi <shpalan@microsoft.com>
Co-authored-by: Michael Friesen <3517159+mtfriesen@users.noreply.github.com>
Co-authored-by: Anurag Saxena <43585259+saxena-anurag@users.noreply.github.com>
2024-11-19 18:28:39 +00:00
Alan Jowett 0a14ab3c68
Build using WDK Nuget for more consistent builds (#4024)
* Build with WDK as nuget

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Update test collateral

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Doc update

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Add old and new sizes

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2024-11-19 16:02:06 +00:00
Alan Jowett 4572f8848e
Switch to cxplat_get_current_processor_number (#3959)
* Switch to cxplat_get_current_processor_number

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Fix runtime failure

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2024-10-28 20:00:19 +00:00
Alan Jowett 735ec5277f
Refactor common platform and config into Directory.Build.props (#3891)
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2024-10-02 19:14:14 +00:00
Anurag Saxena 99c4e48856
direct call for prog array, add spd file (#3816) 2024-09-07 05:06:00 +00:00
Alan Jowett 8c838d1ab5
Stamp all tools with version information. (#3792)
* Stamp all tools with version information.

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Add commit id to nuget package

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Move versioning to Directory.Build.props

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Set correct project type in sample.vcxproj

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Add version info to fuzz tests

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Update tests/socket/resource.h

Co-authored-by: Dave Thaler <dthaler1968@gmail.com>

* Revert editor change

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Dave Thaler <dthaler1968@gmail.com>
2024-08-27 16:30:12 +00:00
Dave Thaler d096b21ac5
Update copyright to be eBPF for Windows contributors (#3508)
* Update copyright to be eBPF for Windows contributors

Fixes #3507

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>

* Undo gratuitous formatting changes in expected files

---------

Signed-off-by: Dave Thaler <dthaler1968@gmail.com>
2024-05-04 19:55:56 +00:00
Sharmi 41e686d267
Fix ASAN linker error (#3027)
* Remove enable asan

* Test

* Test 2

* Change /spgo

* Add LTCG and WPO asan condition
2023-11-07 21:02:16 +00:00
Amit Schendel 16658f4d11
Adding a call to ebpf_trace_terminate in case of subsequent APIs faliure (#2921)
* Adding a call to ebpf_trace_terminate in case of subsequent APIs faliure

Signed-off-by: Amit Schendel <amithagever@gmail.com>

* Adding ebpf_trace_terminate to the Exit section of the DriverEntry

Signed-off-by: Amit Schendel <amitschendel@gmail.com>

---------

Signed-off-by: Amit Schendel <amithagever@gmail.com>
Signed-off-by: Amit Schendel <amitschendel@gmail.com>
2023-10-05 15:19:51 +00:00
Alan Jowett 80067fc00a
Link against optional SPGO database (#2871)
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2023-09-21 17:12:07 +00:00
Alan Jowett 66588bdc27
Remove check that prevents fuzzing below minimum size (#2849)
* Remove check that prevents fuzzing below minimum size

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* WIP

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Cleanup handling of request lengths in _ebpf_core_protocol_program_test_run

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Update libs/execution_context/ebpf_core.c

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* Fix break

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Enable warning 4062

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Remove overactive assert

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

---------

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2023-09-20 19:31:54 +00:00
Dave Thaler 83de72512b
Update to use latest usersim (#2858)
* Update to use latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update to latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Use NonPagedPoolNx instead of NonPagedPool for netebpfext state

NonPagedPool is executable, which we don't want

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2023-09-20 01:07:46 +00:00
Alan Jowett cf0ff81a0f
Disable reference history on release builds (#2819)
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2023-09-06 19:45:51 +00:00
Dave Thaler c947ca63b9
Make runtime binaries not depend on usersim (#2783)
* build ebpfcore under usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Work around analysis warnings

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix installer project

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Temporarily use ubpf branch with memory fix

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* WIP

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* WIP

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Create project for files shared between ebpfapi and the ebpf runtime

Move existing files from libs/platform either to:
* libs/shared, if meant to be common between user-mode and ebpf runtime
* libs/runtime, if meant to be used by the ebpf runtime only (whether in
  user or kernel mode)

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Move ebpf_tracelog.c to shared

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Create shared_user and shared_kernel projects

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* WIP

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* WIP

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Remove usersim from ebpfsvc

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update to cxplat branch of usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Use cxplat_utf8_string

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Cleanup

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix build errors

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix ebpf_allocate_with_tag

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fixes

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Bug fixes

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix use of ebpf_reallocate to not pass a null pointer

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix printf tests

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix memory leaks

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Temporary change to help debug double-free in test

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update to latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix analysis warnings

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update to latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update usersim to latest

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Change native module to use latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update nuget package

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Only call cxplat_cleanup if cxplat_initialize succeeds

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

* Revert setup_build.vcxproj change

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update usersim to latest

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
2023-09-05 17:57:21 +00:00
Dave Thaler b7f82b66c5
Remove cmake build (#2764)
Other projects can now consume ebpf-for-windows in binary form,
using either nuget or MSI install.  We no longer need to build
ebpf-for-windows both ways, so removing the cmake build to free
up build resources and reduce the development cost of maintaining
both msbuild and cmake builds.

Fixes #2743

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2023-08-18 00:48:10 +00:00
Dave Thaler 4e6bed34e8
Build ebpfcore as a DLL for testing (#2744)
* Update to use latest usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* build ebpfcore under usersim

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update usersim to latest

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix compilation

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Work around analysis warnings

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix installer project

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix memory issues in libbpf implementation

Found my latest usersim code

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update usersim to latest

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix mismatched calloc/free function in ubpf_user.c

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix mismatched alloc/free in verifier_fuzzer

The verifier_fuzzer used ebpf_allocate() but then called free()

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Temporarily use ubpf branch with memory fix

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix memory issues in ebpfsvc

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* PR feedback from Anurag

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2023-08-17 22:55:15 +00:00
Gianni Trevisiol 4cb79e547d
Isolate eBPF store APIs into atomic km & um libraries. (#2690)
* draft

* wip

* wip

* wip

* wip

* wip - km & um compile

* fix

* fix include order

* wip

* wip

* wip

* wip - api_common

* wip - updated projects

* wip

* wip

* fix merge issues

* wip

* fix C28196/C6387

* wip

* wip

* fix SAL

* cleanup

* fix SAL bugs

* wip - cmake

* add cmake files

* wip

* wip

* update msi artifacts

* wip

* cleanup

* collapse null-checks

* clean-up headers

* refactor return types to ebpf_result_t

* replace ebpf_registry_result_t with ebpf_result_t

* update header

* remove cpp wrapper, misc cleanup.

* rename um/km registry helpers

* cleanup

* cleanup

* update

* nit

* fix

* Added KERNEL_MODE var, so to default to USER_MODE.

* fix cmake

* align result var names with ebpf_result_t

* pr feedback

* add project refs

* Add NativeOnly* cfgs to ebpf_store_helper_km

* Update docs, API reordering in source.

* pr feedback

* Rename types to abstract use of registry

* Normalize all registry API names.

* rename

* merge sln

* fix var typo

* refactor store root keys

* feedback

* doc/comments

* remove KERNEL_MODE

* Force ignore format on all preprocessor code paths.
2023-08-07 19:53:24 +00:00
Dave Thaler ec27659adf
Move usersim code into a separate repo (#2596)
* Use usersim repo

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Remove DISPATCH test code from _preprocess_load_native_module

Per Anurag: the code was added earlier to execute the 2 paths in
native module, and it is not needed anmore IIRC, as the "DISPATCH"
code has been removed now from the native module

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Bug fixes

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Unify some APIs

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix warnings and clean up code

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* updated

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2023-06-27 15:26:46 +00:00
Dave Thaler 87b6520c34
Remove JIT and interpreter code from NativeOnly builds (#2475)
* Remove JIT and interpreter code from NativeOnly builds

Fixes #2030
Fixes #2488

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Try conditional project references

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Various test fixes

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Native-only fixes to deploy-ebpf.ps1

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Native-only support for setup-ebpf.ps1

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Native-only support for api_test.exe

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Add connect_redirect_tests to deploy-ebpf.ps1

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* PR feedback from Anurag

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2023-06-07 15:49:03 +00:00
Gianni Trevisiol d6bcf1958c
Refactor eBPFCore tracing to use less stack space. (#2501)
* refactor ebpfcore tracing

* feedback
2023-05-31 17:26:09 +00:00
Alan Jowett 6abbb511f7
Fix ProductVersion string in ebpf_resource.rc (#2377)
* Fix ProductVersion string in ebpf_resource.rc
Add git commit hash as "FileVersion" in ebpf_resource.rc

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Add version string to drivers

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix cmake build

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

---------

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2023-04-26 03:45:54 +00:00
Alan Jowett c55748d6df
Wrap calls from ebpf_drv.c in epoch calls (#2189)
* Replace dynamically sized thread table with fixed
capacity table to avoid memory allocation failures.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Isolate hash-table search logic

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix code analysis failure and test failure

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

---------

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2023-03-22 22:14:43 +00:00
Delaram Amiri 4283733f25
Replace Windows style type names with types names that match the coding guidelines (#2019)
* clean up code

* fixing the build

* Update libs/ebpfnetsh/elf.cpp

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* fixing the build

* fixing the build

* fixing the build

* fixing the build

* fixing the build

* fixing the build

* revert HRESULT

* change BOOL type

* change BOOL type

* change BOOL type

* change BOOL type

* change BOOL type

* change BOOL type

* revert LPSERVICE_MAIN_FUNCTION

* revert SERVICE_MAIN_FUNCTION*

* SAL annotation for svcmain.cpp

* revert some SAL annotation

* remove some extra spaces

* fix tests

* change to bool type

* Update map_dll.c

* fix according to dll_main prototype

* fix BOOL

* fix according to dll_main prototype

* BOOl type

* BOOl type

* modify doc for self host runner setup

* modify doc for self host runner setup

* update tests with bool

* Update tests/unit/wer_report_test_wrapper.cpp

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* Update libs/platform/user/ebpf_platform_user.cpp

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* Update libs/ebpfnetsh/programs.cpp

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* change _Null_terminated_ to _Field_z_

* address PR comment

---------

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
Co-authored-by: Gianni Trevisiol <gtrevi@users.noreply.github.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2023-02-16 11:56:32 -08:00
Dave Thaler 3d626ff9c1
Clean up order of includes (#2015)
* Clean up order of includes

Fixes #1963

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update clang-format

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Clean up headers

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update sort

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* FIx various build errors

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix ordering if including a .c file

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix cmake build

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* More header cleanup

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update expected bpf2c output

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* More header fixes

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update expected bpf2c output for custom bpf.c

The generate script does not handle this file.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix tests

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix more expected bpf2c output

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

---------

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
Co-authored-by: Anurag Saxena <43585259+saxena-anurag@users.noreply.github.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2023-02-07 18:32:19 +00:00
Alan Jowett 3840b31fc0
Check program_info hash during attach to provider (#1760)
* Check program_info hash during attach to provider

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2022-12-19 19:22:41 +00:00
Alan Jowett 0b293ad804
Fix code analysis annotations for In and In_opt parameters by adding const where appropriate or changing to Inout where appropriate. (#1749)
* Fix code analysis annotations for _In_ and _In_opt_ parameters,
add const where appropriate or change to _Inout_ where appropriate.

The following regex expressions were used to find the problems:
Find _In_ or _In_opt_ that are not const and are not followed by _Post_invalid_ or _Frees_ptr_ or _Post_ptr_invalid_:
```_In_[ ]+(?!.*(const|_Post_invalid_|_Frees_ptr_|_Post_ptr_invalid_))```
```_In_opt_[ ]+(?!.*(const|_Post_invalid_|_Frees_ptr_|_Post_ptr_invalid_))```

Some of the _In_ and _In_opt_ parameters are not const due to required compatibility with the Windows API.
Pointers to functions are const by definition, so the const qualifier is not required.

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix code analysis failure

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2022-12-15 15:58:33 -08:00
Gianni Trevisiol 99b7ece81f
Visual Studio 2022 porting (#1521)
* Draft

* wip - full build

* wip

* Docs & scripts update

* revert test

* Updates to overall GettingStarted.md guide.

* Updated CI/CD scripts

* Update ebpf-verifier cache key

* Fix #1513. Next action forwarded to #1563.

* Bump up epbfverifier to 05bca47

* Fix CRT path.

* Disable sanitizing

* fix cmake build

* Removed unsupported x86 and ARM configurations.

* Test address sanitizer off

* wip -full build w/asan

* asan enabled on ci/cd

* update wdk version to 22621

* wip - full build

* add mock asan

* Update CL param

* wip - proj sync

* wip - ltcg

* wip - driver settings

* wip-build props

* wip - asan opts

* wip-plat asan

* wip-asan

* wip

* wip

* wip-debug

* Branch resync

* Mitigate compiler OOM.

* remove asan mock

* doc update

* doc update

* Removed commented code.

* Added comments for pragma-s
2022-12-08 20:06:57 -07:00
Anurag Saxena ed291b80c9
Return module handle on native module load (#1547)
* kernel and platform changes

* fix

* user mode changes, other fixes

* fix test failure

* change function name

* add tests

* fix failing test

* cr comments

* CR comments

* fix cmake build

* fix

* Apply suggestions from code review

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* fix assert

* cr comments

* fix analysis failure

* fix test to avoid double close of fd

* test case fixes

* test fix

* fix unit test, analysis failure

* fix tests

* fix memory leak, possible race condition

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2022-11-29 23:36:58 +00:00
Alan Jowett 58cdfdcf8a
Spelling (#1601)
* Fix spelling in docs

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix spelling in ebpfsvc

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix include

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix libs part 1

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix libs part 2

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix tests

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix tools

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix build

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix generated files

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Anurag Saxena <43585259+saxena-anurag@users.noreply.github.com>
2022-11-16 14:06:14 -07:00
Dhiren Vispute 6af44399e2
Add Tracelogging to ebfcore driver (#1565) (#1566)
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2022-11-10 10:17:32 +00:00
Alan Jowett 50844a88eb
Fix leak of reference on WDFREQUEST (#1383)
Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>

Signed-off-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2022-08-29 18:04:05 -06:00
saxena-anurag 1160f7914e
Registry changes for program and section data. (#1192)
* fix

* backup

* fix backup

* msbuild compiling

* fix release build

* fixes

* cmake build fix

* fix cmake build

* fix analyse build

* fix

Signed-off-by: Anurag Saxena <43585259+saxena-anurag@users.noreply.github.com>

* fix expected output

* add pre step for tests

* add pre step for tests

* add -s option, revert this later

* Revert "add -s option, revert this later"

This reverts commit 1f42d100e4.

* code cleanup

Signed-off-by: Anurag Saxena <anusa@microsoft.com>

* rename driver_registry_helper.h

* delete bpf_structs.h

* fix

* hardcode HKLM

* code cleanup

* fix

* backup

* fix backup

* msbuild compiling

* fix release build

* fixes

* cmake build fix

* fix cmake build

* fix analyse build

* fix

Signed-off-by: Anurag Saxena <43585259+saxena-anurag@users.noreply.github.com>

* add pre step for tests

* add pre step for tests

* add -s option, revert this later

* Revert "add -s option, revert this later"

This reverts commit 1f42d100e4.

* code cleanup

Signed-off-by: Anurag Saxena <anusa@microsoft.com>

* rename driver_registry_helper.h

* delete bpf_structs.h

* fix

* hardcode HKLM

* code cleanup

* fix build break

* fix build break, enable warning

* fix bad merge

* cleanup

* fix

* fix tests

* add tests, make ebpf_store_helper platform agnostic

* fixes, cleanup, common code for store APIs

* fix cmake build, driver tests

* cleanup

* code cleanup

* cr comments

* code cleanup

* cleanup

* bugfix

* Apply suggestions from code review

Co-authored-by: Dave Thaler <dthaler@microsoft.com>

* cr comments

* fix build break

* move UM read store APIs to a different file

* cr comments

* cr comments

* cr comments

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2022-06-30 16:53:03 -07:00
Alessandro Gario 6a54714ec2
cmake: Add base targets (#882)
Signed-off-by: Alessandro Gario <alessandro.gario@gmail.com>
2022-04-26 05:39:37 -07:00
Dave Thaler 086b80149d
Nuget package (#999)
* WIP: Developer nuget package

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Add bpf2c utility

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Build nupkg from within VisualStudio

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Don't use relative path to externals

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update props file in nuget package

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix include and library paths

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix debug build

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: saxena-anurag <43585259+saxena-anurag@users.noreply.github.com>
2022-04-25 10:26:56 -07:00
Dave Thaler b01dea6d55
Fix reply id/length on failure in KM (#950)
* Fix reply id/length on failure in KM

And make UM and KM more closely follow the same logic to catch this sort
of bug in the future.  Before this, UM would succeed and KM would fail,
and there were only UM tests for this case.

Fixes #946

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix device_helper.hpp

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix reply length

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Cleanup

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* PR feedback

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

Co-authored-by: Alan Jowett <alanjo@microsoft.com>
2022-04-18 10:26:29 -06:00
Alan Jowett 59716dfa16
Fuzz testing of execution context (#896)
* Fuzz testing of execution context

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix workflow

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix fuzzing workflow

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix formatting

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix tests

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedbac

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix analysis failures

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fixup edit

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix build

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* Fix break found during fuzzing

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2022-04-07 10:50:52 -07:00
Alan Jowett fd94c807a5
Centralize compiler options (#823)
* Centralize all compiler options

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2022-03-29 10:41:09 -06:00
Shankar Seal 91e74be955
ring buffer map. (#659)
* ring buffer map.

* PR Feedback iteration 0.

* PR Feedback iteration 1

* Fix race.

* PR Feedback iteration 2

* bugfix.

* Bug fix.

* Fix test issue

* PR Feedback.

* Update libs/api_common/device_helper.cpp

Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-12-03 13:19:21 -08:00
Alan Jowett be119ea8b6
Add code in mock layer and driver to handle async requests (#632)
* Add logic to track asynchronous operations

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-10-14 14:22:35 -06:00
Dave Thaler cd77fe694b
Add libbpf bpf_create_map_in_map() API (#613)
* Add libbpf bpf_create_map_in_map() API

* bpf_create_map() now fails for outer maps.  You must use
  bpf_create_map_in_map() instead.
* Fix bug where EBPF_INVALID_FD was incorrectly converted to
  EBPF_INVALID_ARGUMENT by ioctl handling code (part of issue #595)
  One symptom of this bug was that errno was being set to EINVAL
  in a number of cases which should have been EBADF.
* Fix bug where a HASH_OF_MAPS (unlike ARRAY_OF_MAPS) wasn't enforcing
  that an inner map value had to match the inner map template.
  Refactored the code in ebpf_maps.c so the checking is in done in one
  place called by both maps, to ensure consistency.
* Fix bug in HASH_OF_MAPS where if an update failed, it would leave
  the old entry but incorrectly drop the reference it held.  It now
  preserves the reference since the entry is unchanged.
* Added test case for ARRAY_OF_MAPS created via libbpf.  Previously
  only HASH_OF_MAPS creation was tested for that path.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Fix bug caught by kernel test

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-09-29 14:13:24 -07:00
Alan Jowett 6bb51b9e0d
Fix stack overrun and fix EC to return correct size (#604)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-24 21:05:03 -07:00
Dave Thaler 65390d8baa
Simple error code conversion fixes (#596)
Addresses part of issue #595
A more comprehensive fix is left for a separate PR.
This PR fixes some bad error messages from bpftool.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-09-24 10:58:57 -07:00
Dave Thaler 17dbbefaad
Fix sample project dependencies (#591)
* Fix sample project dependencies

Bug was that if you cleaned everything and then tried to build just the
sample_ebpf_ext project, building would fail.  A race condition also
existed when trying to build everything in that if
execution_context_kernel wasn't't done building by the
time sample_ebpf_ext was ready to link, the build would also fail.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Clean up other linker inputs

Signed-off-by: Dave Thaler <dthaler@microsoft.com>
2021-09-22 12:12:20 -07:00
Alan Jowett cdcf793a54
Move generated include to include (#564)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-17 17:13:14 -06:00
Alan Jowett 488a4bf6d3
Switch to SHA256 digest algorithm (#550)
* Switch to SHA256 digest algorithm

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-16 10:24:45 -06:00
Alan Jowett e553150b1b
Switch from MultiThreadedDebug to MultiThreadedDebugDll (#528)
* Switch from MultiThreadedDebug to MultiThreadedDebugDll
* Pull in latest ebpf-verifier

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-14 08:46:01 -06:00
Alan Jowett 866f8a6917
Fix non-determinism in build due to multiple projects generating header (#496)
* Fix non-determinism in build due to multiple projects generating header
* Only regenerate git_commit_id.h on change

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-07 13:22:49 -06:00
Alan Jowett 74daa0fcec
Set ps unrestricted (#483)
* Set ExecutionPolicy Unrestricted for PS script in build

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-09-02 14:54:03 -06:00
Alan Jowett ac9b6282b8
Add version info to ebpfcore.sys, ebpfapi.dll, netebpfext.sys, and ebpfsvc.exe (#478)
Signed-off-by: Alan Jowett <alanjo@microsoft.com>
Co-authored-by: Dave Thaler <dthaler@microsoft.com>
2021-09-01 17:57:35 -06:00
Alan Jowett 91879afa7b
Set device type to something _open_osfhandle understands (#346)
* Set device type to something _open_osfhandle understands

Signed-off-by: Alan Jowett <alanjo@microsoft.com>

* PR feedback

Signed-off-by: Alan Jowett <alanjo@microsoft.com>
2021-07-26 17:06:12 -06:00