tetragon: Allow retry logic for clone events

The AddCloneEvent fails to add process the the cache if the parent does not exist - there's no record of it. This can happen for example in TestFork test where fork events can be delivered out of order and tetragon sees the child fork event before the parent's one. Adding retry logic for clone events, which will retry the fork event processing and adding the child process entry after the timeout. During the timeout the parent is updated and following retry logic will add the child's entry properly. Signed-off-by: Jiri Olsa <[email protected]>
cilium · Aug 26, 2022 · a34d1ff · a34d1ff
1 parent ec51b2e
commit a34d1ff
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/pkg/grpc/exec/exec.go b/pkg/grpc/exec/exec.go
@@ -151,17 +151,22 @@ func (msg *MsgCloneEventUnix) Notify() bool {
 }
 
 func (msg *MsgCloneEventUnix) RetryInternal(ev notify.Event, timestamp uint64) (*process.ProcessInternal, error) {
-	return nil, fmt.Errorf("Unreachable state: MsgCloneEventUnix with missing internal")
+	return nil, process.AddCloneEvent(&msg.MsgCloneEvent)
 }
 
 func (msg *MsgCloneEventUnix) Retry(internal *process.ProcessInternal, ev notify.Event) error {
-	return eventcache.HandleGenericEvent(internal, ev)
+	return nil
 }
 
 func (msg *MsgCloneEventUnix) HandleMessage() *tetragon.GetEventsResponse {
 	switch msg.Common.Op {
 	case ops.MSG_OP_CLONE:
-		process.AddCloneEvent(&msg.MsgCloneEvent)
+		if err := process.AddCloneEvent(&msg.MsgCloneEvent); err != nil {
+			ec := eventcache.Get()
+			if ec != nil {
+				ec.Add(nil, nil, msg.MsgCloneEvent.Ktime, msg)
+			}
+		}
 	default:
 		logger.GetLogger().WithField("message", msg).Warn("HandleCloneMessage: Unhandled event")
 	}

diff --git a/pkg/process/process.go b/pkg/process/process.go
@@ -268,12 +268,12 @@ func AddExecEvent(event *tetragonAPI.MsgExecveEventUnix) *ProcessInternal {
 }
 
 // AddCloneEvent adds a new process into the cache from a CloneEvent
-func AddCloneEvent(event *tetragonAPI.MsgCloneEvent) {
+func AddCloneEvent(event *tetragonAPI.MsgCloneEvent) error {
 	parentExecId := GetProcessID(event.Parent.Pid, event.Parent.Ktime)
 	parent, err := Get(parentExecId)
 	if err != nil {
 		logger.GetLogger().WithField("parent-exec-id", parentExecId).Debug("AddCloneEvent: process not found in cache")
-		return
+		return err
 	}
 	pi := parent.GetProcessInternalCopy()
 	if pi.process != nil {
@@ -288,6 +288,7 @@ func AddCloneEvent(event *tetragonAPI.MsgCloneEvent) {
 		}
 	}
 	procCache.Add(pi)
+	return nil
 }
 
 func Get(execId string) (*ProcessInternal, error) {