From f36a005f7658a1d9428dfd7febb30e0aad98ad35 Mon Sep 17 00:00:00 2001
From: Alon Zivony <alon.zivony@aquasec.com>
Date: Sun, 7 Apr 2024 23:36:35 +0300
Subject: [PATCH] feat(ebpf): support events fallback with events state

---
 pkg/ebpf/tracee.go | 44 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/pkg/ebpf/tracee.go b/pkg/ebpf/tracee.go
index 2c7f4b359523..40564f87199f 100644
--- a/pkg/ebpf/tracee.go
+++ b/pkg/ebpf/tracee.go
@@ -211,6 +211,33 @@ func (t *Tracee) addDependencyEventToState(evtID events.ID, dependentEvts []even
 	}
 }
 
+// updateDependenciesStateRecursive change all dependencies submit states to match
+// their submit states, and current submit state of their dependents.
+// This should be called in the case of a fallback dependencies, as the events
+// dependencies change, on the older dependencies.
+// This should make sure that their submit will match their new dependents and
+// emit state.
+func (t *Tracee) updateDependenciesStateRecursive(eventNode *dependencies.EventNode) {
+	for _, dependencyEventID := range eventNode.GetDependencies().GetIDs() {
+		dependencyNode, err := t.eventsDependencies.GetEvent(dependencyEventID)
+		if err != nil { // event does not exist anymore in dependencies
+			t.removeEventFromState(dependencyEventID)
+			continue
+		}
+		dependencyState := t.eventsState[dependencyEventID]
+		newState := events.EventState{
+			Emit:   dependencyState.Emit,
+			Submit: dependencyState.Emit,
+		}
+		for _, dependantID := range dependencyNode.GetDependents() {
+			dependantState := t.eventsState[dependantID]
+			newState.Submit |= dependantState.Submit
+		}
+		t.eventsState[dependencyEventID] = newState
+		t.updateDependenciesStateRecursive(dependencyNode)
+	}
+}
+
 func (t *Tracee) removeEventFromState(evtID events.ID) {
 	logger.Debugw("Remove event from state", "event", events.Core.GetDefinitionByID(evtID).GetName())
 	delete(t.eventsState, evtID)
@@ -270,6 +297,23 @@ func New(cfg config.Config) (*Tracee, error) {
 			t.removeEventFromState(eventNode.GetID())
 			return nil
 		})
+	t.eventsDependencies.SubscribeChange(
+		dependencies.EventNodeType,
+		func(oldNode interface{}, newNode interface{}) []dependencies.Action {
+			oldEventNode, ok := oldNode.(*dependencies.EventNode)
+			if !ok {
+				logger.Errorw("Got node from type not requested")
+				return nil
+			}
+			newEventNode, ok := newNode.(*dependencies.EventNode)
+			if !ok {
+				logger.Errorw("Got node from type not requested")
+				return nil
+			}
+			t.updateDependenciesStateRecursive(oldEventNode)
+			t.addDependenciesToStateRecursive(newEventNode)
+			return nil
+		})
 
 	// Initialize capabilities rings soon