Method buildTCPIPFilterCheckFromLocalVars

shell/tracescript.go:515–559

buildTCPIPFilterCheckFromLocalVars creates a filter using local vars $s0-$s3 and $d0-$d3. This is required because the BPF verifier doesn't allow reading from different offsets of args after a probe_read. We read bytes into local vars first, then filter. SECURITY: IPs are converted to integer byte v

()

// offsets of args after a probe_read. We read bytes into local vars first, then filter.
// SECURITY: IPs are converted to integer byte values - no string interpolation.
func (g *ScriptGenerator) buildTCPIPFilterCheckFromLocalVars() string {
	if len(g.config.FilterIPs) == 0 && len(g.config.FilterCIDRs) == 0 {
		return "" // No filter
	}

	var conditions []string

	// Add IP filters - compare using local vars
	for _, ip := range g.config.FilterIPs {
		ipv4 := ip.To4()
		if ipv4 == nil {
			continue
		}
		// Match either source or destination using local vars
		conditions = append(conditions, fmt.Sprintf(
			"(($s0 == %d && $s1 == %d && $s2 == %d && $s3 == %d) || ($d0 == %d && $d1 == %d && $d2 == %d && $d3 == %d))",
			ipv4[0], ipv4[1], ipv4[2], ipv4[3],
			ipv4[0], ipv4[1], ipv4[2], ipv4[3]))
	}

	// Add CIDR filters - mask and compare using local vars
	for _, cidr := range g.config.FilterCIDRs {
		if cidr == nil {
			continue
		}
		ipv4 := cidr.IP.To4()
		mask := cidr.Mask
		if ipv4 == nil || len(mask) != 4 {
			continue
		}
		// (byte & mask) == network_byte for each byte
		conditions = append(conditions, fmt.Sprintf(
			"((($s0 & %d) == %d && ($s1 & %d) == %d && ($s2 & %d) == %d && ($s3 & %d) == %d) || (($d0 & %d) == %d && ($d1 & %d) == %d && ($d2 & %d) == %d && ($d3 & %d) == %d))",
			mask[0], ipv4[0], mask[1], ipv4[1], mask[2], ipv4[2], mask[3], ipv4[3],
			mask[0], ipv4[0], mask[1], ipv4[1], mask[2], ipv4[2], mask[3], ipv4[3]))
	}

	if len(conditions) == 0 {
		return ""
	}

	// Generate an if-statement that returns early if no condition matches
	combined := strings.Join(conditions, " || ")
	return fmt.Sprintf("    // IP/CIDR filter: skip if not matching\n    if (!(%s)) { return; }\n\n", combined)
}

// generateTableOutput generates printf for table format.
func (g *ScriptGenerator) generateTableOutput() string {