Skip to content

Commit

Permalink
Rename types to abstract use of registry
Browse files Browse the repository at this point in the history
  • Loading branch information
gtrevi committed Jul 31, 2023
1 parent 07fa08d commit 92cd59b
Show file tree
Hide file tree
Showing 11 changed files with 78 additions and 88 deletions.
4 changes: 2 additions & 2 deletions docs/eBpfExtensions.md
Original file line number Diff line number Diff line change
Expand Up @@ -306,12 +306,12 @@ When an eBPF extension is installed, it must update the eBPF store with the prog

To operate on the eBPF store, the extension must link the `\lib\ebpf_store_helper_km.lib` kernel-mode library and include the related `\include\ebpf_store_helper.h` header file, both distributed within the [eBPF for Windows NuGet package](https://www.nuget.org/packages/eBPF-for-Windows/). With these, the extension can use the following APIs to register program types, attach types and helper functions:

- `ebpf_store_update_helper_prototype`: updates the provider prototype information in the eBPF store, given a pointer to the registry key to be initialized and a pointer to the helper function prototype (i.e., `_ebpf_helper_function_prototype`):
- `ebpf_store_update_helper_prototype`: updates the provider prototype information in the eBPF store, given a pointer to the store key to be initialized and a pointer to the helper function prototype (i.e., `_ebpf_helper_function_prototype`):

```c
ebpf_result_t
ebpf_store_update_helper_prototype(
ebpf_registry_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info);
ebpf_store_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info);
```c
```

Expand Down
10 changes: 5 additions & 5 deletions include/ebpf_store_helper.h
Original file line number Diff line number Diff line change
Expand Up @@ -20,23 +20,23 @@ extern "C"
#endif

#ifndef USER_MODE
typedef HANDLE ebpf_registry_key_t;
typedef HANDLE ebpf_store_key_t;
#else
typedef HKEY ebpf_registry_key_t;
extern ebpf_registry_key_t ebpf_root_registry_key;
typedef HKEY ebpf_store_key_t;
extern ebpf_store_key_t ebpf_store_root_key_t;
#endif

/**
* @brief Update the provider prototype information in the eBPF store.
*
* @param[in] helper_info_key Pointer to the registry key to be initialized.
* @param[in] helper_info_key Pointer to the store key to be initialized.
* @param[in] helper_info Pointer to the helper function prototype.
*
* @return Status of the operation.
*/
ebpf_result_t
ebpf_store_update_helper_prototype(
ebpf_registry_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info);
ebpf_store_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info);

/**
* @brief Update global helper information in the eBPF store.
Expand Down
32 changes: 16 additions & 16 deletions libs/api_common/store_helper_internal.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@
#include "store_helper_internal.h"
#include "utilities.hpp"

ebpf_registry_key_t root_registry_key_current_user = HKEY_CURRENT_USER;
ebpf_registry_key_t root_registry_key_local_machine = HKEY_LOCAL_MACHINE;
ebpf_store_key_t root_registry_key_current_user = HKEY_CURRENT_USER;
ebpf_store_key_t root_registry_key_local_machine = HKEY_LOCAL_MACHINE;
// TODO: Issue #1231 Change to using HKEY_LOCAL_MACHINE
ebpf_registry_key_t ebpf_root_registry_key = HKEY_CURRENT_USER;
ebpf_store_key_t ebpf_store_root_key_t = HKEY_CURRENT_USER;

static ebpf_result_t
_open_ebpf_store_key(_Out_ ebpf_registry_key_t* store_key)
_open_ebpf_store_key(_Out_ ebpf_store_key_t* store_key)
{
// Open root registry path.
*store_key = nullptr;
Expand Down Expand Up @@ -84,7 +84,7 @@ _load_helper_prototype(

Exit:
if (helper_info_key) {
close_registry_key(static_cast<ebpf_registry_key_t>(helper_info_key));
close_registry_key(static_cast<ebpf_store_key_t>(helper_info_key));
}
return result;
}
Expand Down Expand Up @@ -112,7 +112,7 @@ _load_program_data_information(

try {
result =
open_registry_key(program_data_key, program_type_string, KEY_READ, (ebpf_registry_key_t*)&program_info_key);
open_registry_key(program_data_key, program_type_string, KEY_READ, (ebpf_store_key_t*)&program_info_key);
if (result != EBPF_SUCCESS) {
// Registry path is not present.
result = EBPF_FILE_NOT_FOUND;
Expand Down Expand Up @@ -301,7 +301,7 @@ ebpf_store_load_program_information(
wchar_t program_type_key[GUID_STRING_LENGTH + 1];
unsigned long key_size = 0;
uint32_t index = 0;
ebpf_registry_key_t store_key = nullptr;
ebpf_store_key_t store_key = nullptr;
std::vector<ebpf_program_info_t*> program_info_array;

*program_info = nullptr;
Expand All @@ -316,8 +316,8 @@ ebpf_store_load_program_information(
}

// Open program data registry path.
result = open_registry_key(
store_key, EBPF_PROGRAM_DATA_REGISTRY_PATH, KEY_READ, (ebpf_registry_key_t*)&program_data_key);
result =
open_registry_key(store_key, EBPF_PROGRAM_DATA_REGISTRY_PATH, KEY_READ, (ebpf_store_key_t*)&program_data_key);
if (result != EBPF_SUCCESS) {
if (result == EBPF_FILE_NOT_FOUND) {
result = EBPF_SUCCESS;
Expand Down Expand Up @@ -404,7 +404,7 @@ _load_section_data_information(
ebpf_section_definition_t* section_information = nullptr;

try {
result = open_registry_key(section_data_key, section_name, KEY_READ, (ebpf_registry_key_t*)&section_info_key);
result = open_registry_key(section_data_key, section_name, KEY_READ, (ebpf_store_key_t*)&section_info_key);
if (result != EBPF_SUCCESS) {
// Registry path is not present.
result = EBPF_FILE_NOT_FOUND;
Expand Down Expand Up @@ -502,7 +502,7 @@ ebpf_store_load_section_information(
wchar_t section_name_key[MAX_PATH];
unsigned long key_size = 0;
uint32_t index = 0;
ebpf_registry_key_t store_key = nullptr;
ebpf_store_key_t store_key = nullptr;
std::vector<ebpf_section_definition_t*> section_info_array;

*section_info = nullptr;
Expand Down Expand Up @@ -601,7 +601,7 @@ ebpf_store_load_global_helper_information(
uint32_t max_helpers_count = 0;
ebpf_helper_function_prototype_t* helper_prototype = nullptr;
uint32_t index = 0;
ebpf_registry_key_t store_key = nullptr;
ebpf_store_key_t store_key = nullptr;

*global_helper_info = nullptr;
*global_helper_info_count = 0;
Expand All @@ -616,7 +616,7 @@ ebpf_store_load_global_helper_information(

// Open program data registry path.
result = open_registry_key(
store_key, EBPF_GLOBAL_HELPERS_REGISTRY_PATH, KEY_READ, (ebpf_registry_key_t*)&global_helpers_key);
store_key, EBPF_GLOBAL_HELPERS_REGISTRY_PATH, KEY_READ, (ebpf_store_key_t*)&global_helpers_key);
if (result != EBPF_SUCCESS) {
if (result == EBPF_FILE_NOT_FOUND) {
result = EBPF_SUCCESS;
Expand Down Expand Up @@ -705,10 +705,10 @@ ebpf_store_load_global_helper_information(
}

_Must_inspect_result_ ebpf_result_t
ebpf_store_clear(_In_ const ebpf_registry_key_t root_key_path)
ebpf_store_clear(_In_ const ebpf_store_key_t root_key_path)
{
ebpf_registry_key_t root_handle = {0};
ebpf_registry_key_t provider_handle = {0};
ebpf_store_key_t root_handle = {0};
ebpf_store_key_t provider_handle = {0};
ebpf_result_t result = EBPF_FAILED;

// Open root registry key.
Expand Down
2 changes: 1 addition & 1 deletion libs/api_common/store_helper_internal.h
Original file line number Diff line number Diff line change
Expand Up @@ -21,4 +21,4 @@ ebpf_store_load_global_helper_information(
_Out_ uint32_t* global_helper_info_count);

_Must_inspect_result_ ebpf_result_t
ebpf_store_clear(_In_ const ebpf_registry_key_t root_key_path);
ebpf_store_clear(_In_ const ebpf_store_key_t root_key_path);
28 changes: 14 additions & 14 deletions libs/store_helper/ebpf_store_helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@
#define IS_SUCCESS(x) (x == EBPF_SUCCESS)

static ebpf_result_t
_ebpf_store_open_or_create_provider_registry_key(_Out_ ebpf_registry_key_t* provider_key)
_ebpf_store_open_or_create_provider_registry_key(_Out_ ebpf_store_key_t* provider_key)
{
ebpf_result_t result = EBPF_SUCCESS;
ebpf_registry_key_t root_key = NULL;
ebpf_store_key_t root_key = NULL;
*provider_key = NULL;

// Open (or create) root eBPF registry path.
#ifdef USER_MODE
result = create_registry_key(ebpf_root_registry_key, EBPF_ROOT_RELATIVE_PATH, REG_CREATE_FLAGS, &root_key);
result = create_registry_key(ebpf_store_root_key_t, EBPF_ROOT_RELATIVE_PATH, REG_CREATE_FLAGS, &root_key);
#else
result = create_registry_key(NULL, EBPF_ROOT_REGISTRY_PATH, REG_CREATE_FLAGS, &root_key);
#endif
Expand All @@ -39,11 +39,11 @@ _ebpf_store_open_or_create_provider_registry_key(_Out_ ebpf_registry_key_t* prov

ebpf_result_t
ebpf_store_update_helper_prototype(
ebpf_registry_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info)
ebpf_store_key_t helper_info_key, _In_ const ebpf_helper_function_prototype_t* helper_info)
{
ebpf_result_t result = EBPF_SUCCESS;
uint32_t offset;
ebpf_registry_key_t helper_function_key = NULL;
ebpf_store_key_t helper_function_key = NULL;
char serialized_data[sizeof(ebpf_helper_function_prototype_t)] = {0};

result = create_registry_key_ansi(helper_info_key, helper_info->name, REG_CREATE_FLAGS, &helper_function_key);
Expand Down Expand Up @@ -80,8 +80,8 @@ ebpf_store_update_global_helper_information(
_In_reads_(helper_info_count) ebpf_helper_function_prototype_t* helper_info, uint32_t helper_info_count)
{
ebpf_result_t result = EBPF_SUCCESS;
ebpf_registry_key_t provider_key = NULL;
ebpf_registry_key_t helper_info_key = NULL;
ebpf_store_key_t provider_key = NULL;
ebpf_store_key_t helper_info_key = NULL;

if (helper_info_count == 0) {
return result;
Expand Down Expand Up @@ -119,8 +119,8 @@ ebpf_store_update_section_information(
_In_reads_(section_info_count) const ebpf_program_section_info_t* section_info, uint32_t section_info_count)
{
ebpf_result_t result = EBPF_SUCCESS;
ebpf_registry_key_t provider_key = NULL;
ebpf_registry_key_t section_info_key = NULL;
ebpf_store_key_t provider_key = NULL;
ebpf_store_key_t section_info_key = NULL;

if (section_info_count == 0) {
return result;
Expand All @@ -139,7 +139,7 @@ ebpf_store_update_section_information(
}

for (uint32_t i = 0; i < section_info_count; i++) {
ebpf_registry_key_t section_key = NULL;
ebpf_store_key_t section_key = NULL;

// Open or create the registry path.
result = create_registry_key(section_info_key, section_info[i].section_name, REG_CREATE_FLAGS, &section_key);
Expand Down Expand Up @@ -198,8 +198,8 @@ ebpf_store_update_program_information(
_In_reads_(program_info_count) const ebpf_program_info_t* program_info, uint32_t program_info_count)
{
ebpf_result_t result = EBPF_SUCCESS;
ebpf_registry_key_t provider_key = NULL;
ebpf_registry_key_t program_info_key = NULL;
ebpf_store_key_t provider_key = NULL;
ebpf_store_key_t program_info_key = NULL;

if (program_info_count == 0) {
return result;
Expand All @@ -218,8 +218,8 @@ ebpf_store_update_program_information(
}

for (uint32_t i = 0; i < program_info_count; i++) {
ebpf_registry_key_t program_key = {0};
ebpf_registry_key_t helper_info_key = {0};
ebpf_store_key_t program_key = {0};
ebpf_store_key_t helper_info_key = {0};

// Convert program type GUID to string.
wchar_t guid_string[GUID_STRING_LENGTH + 1];
Expand Down
12 changes: 6 additions & 6 deletions libs/store_helper/kernel/ebpf_registry_helper.c
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ convert_guid_to_string(_In_ const GUID* guid, _Out_writes_all_(string_length) wc
}

void
close_registry_key(ebpf_registry_key_t key)
close_registry_key(ebpf_store_key_t key)
{
if (key) {
ZwClose(key);
Expand All @@ -49,7 +49,7 @@ close_registry_key(ebpf_registry_key_t key)

_Must_inspect_result_ ebpf_result_t
write_registry_value_binary(
ebpf_registry_key_t key, _In_z_ const wchar_t* value_name, _In_reads_(value_size) uint8_t* value, size_t value_size)
ebpf_store_key_t key, _In_z_ const wchar_t* value_name, _In_reads_(value_size) uint8_t* value, size_t value_size)
{
UNICODE_STRING unicode_value_name;

Expand All @@ -58,7 +58,7 @@ write_registry_value_binary(
}

_Must_inspect_result_ ebpf_result_t
write_registry_value_ansi_string(ebpf_registry_key_t key, _In_z_ const wchar_t* value_name, _In_z_ const char* value)
write_registry_value_ansi_string(ebpf_store_key_t key, _In_z_ const wchar_t* value_name, _In_z_ const char* value)
{
NTSTATUS status;
UNICODE_STRING unicode_value;
Expand All @@ -81,7 +81,7 @@ write_registry_value_ansi_string(ebpf_registry_key_t key, _In_z_ const wchar_t*
}

_Must_inspect_result_ ebpf_result_t
write_registry_value_dword(ebpf_registry_key_t key, _In_z_ const wchar_t* value_name, uint32_t value)
write_registry_value_dword(ebpf_store_key_t key, _In_z_ const wchar_t* value_name, uint32_t value)
{
UNICODE_STRING unicode_name;
RtlInitUnicodeString(&unicode_name, value_name);
Expand All @@ -90,7 +90,7 @@ write_registry_value_dword(ebpf_registry_key_t key, _In_z_ const wchar_t* value_

_Must_inspect_result_ ebpf_result_t
create_registry_key(
ebpf_registry_key_t root_key, _In_z_ const wchar_t* sub_key, uint32_t flags, _Out_ ebpf_registry_key_t* key)
ebpf_store_key_t root_key, _In_z_ const wchar_t* sub_key, uint32_t flags, _Out_ ebpf_store_key_t* key)
{
UNICODE_STRING registry_path;
OBJECT_ATTRIBUTES object_attributes = {0};
Expand All @@ -106,7 +106,7 @@ create_registry_key(

_Must_inspect_result_ ebpf_result_t
create_registry_key_ansi(
ebpf_registry_key_t root_key, _In_z_ const char* sub_key, uint32_t flags, _Out_ ebpf_registry_key_t* key)
ebpf_store_key_t root_key, _In_z_ const char* sub_key, uint32_t flags, _Out_ ebpf_store_key_t* key)
{
NTSTATUS status = STATUS_SUCCESS;
UNICODE_STRING registry_path;
Expand Down
15 changes: 6 additions & 9 deletions libs/store_helper/kernel/ebpf_registry_helper.h
Original file line number Diff line number Diff line change
Expand Up @@ -11,25 +11,22 @@ ebpf_result_t
convert_guid_to_string(_In_ const GUID* guid, _Out_writes_all_(string_length) wchar_t* string, size_t string_length);

void
close_registry_key(ebpf_registry_key_t key);
close_registry_key(ebpf_store_key_t key);

_Must_inspect_result_ ebpf_result_t
write_registry_value_binary(
ebpf_registry_key_t key,
_In_z_ const wchar_t* value_name,
_In_reads_(value_size) uint8_t* value,
size_t value_size);
ebpf_store_key_t key, _In_z_ const wchar_t* value_name, _In_reads_(value_size) uint8_t* value, size_t value_size);

_Must_inspect_result_ ebpf_result_t
write_registry_value_ansi_string(ebpf_registry_key_t key, _In_z_ const wchar_t* value_name, _In_z_ const char* value);
write_registry_value_ansi_string(ebpf_store_key_t key, _In_z_ const wchar_t* value_name, _In_z_ const char* value);

_Must_inspect_result_ ebpf_result_t
write_registry_value_dword(ebpf_registry_key_t key, _In_z_ const wchar_t* value_name, uint32_t value);
write_registry_value_dword(ebpf_store_key_t key, _In_z_ const wchar_t* value_name, uint32_t value);

_Must_inspect_result_ ebpf_result_t
create_registry_key(
ebpf_registry_key_t root_key, _In_z_ const wchar_t* sub_key, uint32_t flags, _Out_ ebpf_registry_key_t* key);
ebpf_store_key_t root_key, _In_z_ const wchar_t* sub_key, uint32_t flags, _Out_ ebpf_store_key_t* key);

_Must_inspect_result_ ebpf_result_t
create_registry_key_ansi(
ebpf_registry_key_t root_key, _In_z_ const char* sub_key, uint32_t flags, _Out_ ebpf_registry_key_t* key);
ebpf_store_key_t root_key, _In_z_ const char* sub_key, uint32_t flags, _Out_ ebpf_store_key_t* key);
Loading

0 comments on commit 92cd59b

Please sign in to comment.