Skip to content

Commit 554da0d

Browse files
author
Josh
authored
Merge branch 'rabbitstack:master' into correct-unusual-process-modified-registry-run-key-rule
2 parents 18cc9f3 + 19776aa commit 554da0d

File tree

69 files changed

+3244
-2517
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

69 files changed

+3244
-2517
lines changed

‎cmd/fibratus/app/rules/validate.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"github.com/rabbitstack/fibratus/internal/bootstrap"
2525
"github.com/rabbitstack/fibratus/pkg/filter"
2626
"github.com/rabbitstack/fibratus/pkg/filter/fields"
27+
"github.com/rabbitstack/fibratus/pkg/rules"
2728
"path/filepath"
2829
"strings"
2930
)
@@ -91,7 +92,7 @@ func validateRules() error {
9192
f := filter.New(rule.Condition, cfg)
9293
err := f.Compile()
9394
if err != nil {
94-
return fmt.Errorf("%v %v", emoji.DisappointedFace, filter.ErrInvalidFilter(rule.Name, err))
95+
return fmt.Errorf("%v %v", emoji.DisappointedFace, rules.ErrInvalidFilter(rule.Name, err))
9596
}
9697

9798
w := warning{rule: rule.Name}

‎configs/fibratus.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,10 @@ filament:
131131
# For local file system rule paths, it is possible to use the glob expression to load the
132132
# rules from different directory locations.
133133
filters:
134+
# Indicates if the rule engine match all strategy is enabled. When the match all strategy
135+
# is enabled, a single event can trigger multiple rules.
136+
match-all: true
137+
134138
rules:
135139
# Indicates if the rule engine is enabled and rules loaded
136140
enabled: true

‎go.mod‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ require (
2828
github.com/spf13/viper v1.6.2
2929
github.com/streadway/amqp v1.0.0
3030
github.com/stretchr/testify v1.8.1
31+
github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6
3132
github.com/valyala/bytebufferpool v1.0.0
3233
github.com/valyala/gozstd v1.11.0
3334
github.com/xeipuuv/gojsonschema v1.2.0
@@ -44,9 +45,16 @@ require (
4445
)
4546

4647
require (
48+
github.com/BurntSushi/toml v0.4.1 // indirect
4749
github.com/rivo/uniseg v0.4.2 // indirect
4850
github.com/rogpeppe/go-internal v1.11.0 // indirect
4951
github.com/secDre4mer/pkcs7 v0.0.0-20240322103146-665324a4461d // indirect
52+
go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf // indirect
53+
golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e // indirect
54+
golang.org/x/mod v0.17.0 // indirect
55+
golang.org/x/sync v0.10.0 // indirect
56+
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
57+
honnef.co/go/tools v0.3.2 // indirect
5058
)
5159

5260
require (

‎go.sum‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
2-
github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
32
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
3+
github.com/BurntSushi/toml v0.4.1 h1:GaI7EiDXDRfa8VshkTj7Fym7ha+y8/XxIgD2okUIjLw=
4+
github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
45
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
56
github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
67
github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
@@ -77,8 +78,9 @@ github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
7778
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
7879
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
7980
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
80-
github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
8181
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
82+
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
83+
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
8284
github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
8385
github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
8486
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
@@ -230,6 +232,8 @@ github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKs
230232
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
231233
github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
232234
github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
235+
github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6 h1:l10Gi6w9jxvinoiq15g8OToDdASBni4CyJOdHY1Hr8M=
236+
github.com/tailscale/wf v0.0.0-20240214030419-6fbb0a674ee6/go.mod h1:ZXRML051h7o4OcI0d3AaILDIad/Xw0IkXaHM17dic1Y=
233237
github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
234238
github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
235239
github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
@@ -254,6 +258,12 @@ go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
254258
go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
255259
go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
256260
go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
261+
go4.org/intern v0.0.0-20211027215823-ae77deb06f29 h1:UXLjNohABv4S58tHmeuIZDO6e3mHpW2Dx33gaNt03LE=
262+
go4.org/intern v0.0.0-20211027215823-ae77deb06f29/go.mod h1:cS2ma+47FKrLPdXFpr7CuxiTW3eyJbWew4qx0qtQWDA=
263+
go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf h1:IdwJUzqoIo5lkr2EOyKoe5qipUaEjbOKKY5+fzPBZ3A=
264+
go4.org/netipx v0.0.0-20220725152314-7e7bdc8411bf/go.mod h1:+QXzaoURFd0rGDIjDNpyIkv+F9R7EmeKorvlKRnhqgA=
265+
go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760 h1:FyBZqvoA/jbNzuAWLQE2kG820zMAkcilx6BMjGbL/E4=
266+
go4.org/unsafe/assume-no-moving-gc v0.0.0-20220617031537-928513b29760/go.mod h1:FftLjUGFEDu5k8lt0ddY+HcrH/qU/0qk+H8j9/nTl3E=
257267
golang.org/x/arch v0.6.0 h1:S0JTfE48HbRj80+4tbvZDYsJ3tGv6BUU3XxyZ7CirAc=
258268
golang.org/x/arch v0.6.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
259269
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -263,10 +273,14 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
263273
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
264274
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
265275
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
276+
golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e h1:qyrTQ++p1afMkO4DPEeLGq/3oTsdlvdH4vqZUBWzUKM=
277+
golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
266278
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
267279
golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
268280
golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
269281
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
282+
golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
283+
golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
270284
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
271285
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
272286
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -289,6 +303,8 @@ golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJ
289303
golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
290304
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
291305
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
306+
golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
307+
golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
292308
golang.org/x/sys v0.0.0-20180816055513-1c9583448a9c/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
293309
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
294310
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -330,6 +346,8 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3
330346
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
331347
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
332348
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
349+
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
350+
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
333351
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
334352
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
335353
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
@@ -363,5 +381,7 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
363381
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
364382
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
365383
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
384+
honnef.co/go/tools v0.3.2 h1:ytYb4rOqyp1TSa2EPvNVwtPQJctSELKaMyLfqNP4+34=
385+
honnef.co/go/tools v0.3.2/go.mod h1:jzwdWgg7Jdq75wlfblQxO4neNaFFSvgc1tD5Wv8U0Yw=
366386
www.velocidex.com/golang/go-ntfs v0.2.1-0.20240818145200-04736de821dc h1:eeL+RUEGr6/lYL8hJEbvugrF88I6W4pBaVtFa1falj4=
367387
www.velocidex.com/golang/go-ntfs v0.2.1-0.20240818145200-04736de821dc/go.mod h1:itvbHQcnLdTVIDY6fI3lR0zeBwXwBYBdUFtswE0x1vc=

‎internal/bootstrap/bootstrap.go‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ import (
3030
"github.com/rabbitstack/fibratus/pkg/handle"
3131
"github.com/rabbitstack/fibratus/pkg/kcap"
3232
"github.com/rabbitstack/fibratus/pkg/ps"
33+
"github.com/rabbitstack/fibratus/pkg/rules"
3334
"github.com/rabbitstack/fibratus/pkg/symbolize"
3435
"github.com/rabbitstack/fibratus/pkg/sys"
3536
"github.com/rabbitstack/fibratus/pkg/util/multierror"
@@ -52,7 +53,7 @@ type App struct {
5253
config *config.Config
5354
evs *EventSourceControl
5455
symbolizer *symbolize.Symbolizer
55-
rules *filter.Rules
56+
engine *rules.Engine
5657
hsnap handle.Snapshotter
5758
psnap ps.Snapshotter
5859
filament filament.Filament
@@ -134,34 +135,34 @@ func NewApp(cfg *config.Config, options ...Option) (*App, error) {
134135
hsnap := handle.NewSnapshotter(cfg, opts.handleSnapshotFn)
135136
psnap := ps.NewSnapshotter(hsnap, cfg)
136137

137-
var (
138-
rules *filter.Rules
139-
res *config.RulesCompileResult
140-
)
138+
var engine *rules.Engine
139+
var rs *config.RulesCompileResult
140+
141141
if cfg.Filters.Rules.Enabled && !cfg.ForwardMode && !cfg.IsCaptureSet() {
142-
rules = filter.NewRules(psnap, cfg)
142+
engine = rules.NewEngine(psnap, cfg)
143143
var err error
144-
res, err = rules.Compile()
144+
rs, err = engine.Compile()
145145
if err != nil {
146146
return nil, err
147147
}
148-
if res != nil {
149-
log.Infof("rules compile summary: %s", res)
148+
if rs != nil {
149+
log.Infof("rules compile summary: %s", rs)
150150
}
151151
} else {
152152
log.Info("rule engine is disabled")
153153
}
154154

155-
evs := NewEventSourceControl(psnap, hsnap, cfg, res)
155+
evs := NewEventSourceControl(psnap, hsnap, cfg, rs)
156156

157157
app := &App{
158158
config: cfg,
159159
evs: evs,
160-
rules: rules,
160+
engine: engine,
161161
hsnap: hsnap,
162162
psnap: psnap,
163163
signals: sigs,
164164
}
165+
165166
return app, nil
166167
}
167168

@@ -234,8 +235,8 @@ func (f *App) Run(args []string) error {
234235
f.evs.RegisterEventListener(f.symbolizer)
235236
}
236237
// register rule engine
237-
if f.rules != nil {
238-
f.evs.RegisterEventListener(f.rules)
238+
if f.engine != nil {
239+
f.evs.RegisterEventListener(f.engine)
239240
}
240241
// register YARA scanner
241242
if cfg.Yara.Enabled {

‎internal/etw/processors/registry_windows.go‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,7 @@ func (r *registryProcessor) processEvent(e *kevent.Kevent) (*kevent.Kevent, erro
8787
switch e.Type {
8888
case ktypes.RegKCBRundown, ktypes.RegCreateKCB:
8989
khandle := e.Kparams.MustGetUint64(kparams.RegKeyHandle)
90-
if _, ok := r.keys[khandle]; !ok {
91-
r.keys[khandle], _ = e.Kparams.GetString(kparams.RegPath)
92-
}
90+
r.keys[khandle] = e.Kparams.MustGetString(kparams.RegPath)
9391
kcbCount.Add(1)
9492
case ktypes.RegDeleteKCB:
9593
khandle := e.Kparams.MustGetUint64(kparams.RegKeyHandle)

‎internal/etw/source.go‎

Lines changed: 9 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -71,16 +71,6 @@ var (
7171
buffersRead = expvar.NewInt("kstream.kbuffers.read")
7272
)
7373

74-
// SupportsSystemProviders determines if the support for granular
75-
// system providers in present.
76-
func SupportsSystemProviders() bool {
77-
maj, _, patch := windows.RtlGetNtVersionNumbers()
78-
if maj > 10 {
79-
return true
80-
}
81-
return maj >= 10 && patch >= 20348
82-
}
83-
8474
// EventSource is the core component responsible for
8575
// starting ETW tracing sessions and setting up event
8676
// consumers.
@@ -100,6 +90,8 @@ type EventSource struct {
10090

10191
filter filter.Filter
10292
listeners []kevent.Listener
93+
94+
isClosed bool
10395
}
10496

10597
// NewEventSource creates the new ETW event source.
@@ -177,13 +169,6 @@ func (e *EventSource) Open(config *config.Config) error {
177169

178170
e.addTrace(etw.KernelLoggerSession, etw.KernelTraceControlGUID)
179171

180-
if SupportsSystemProviders() && !config.IsCaptureSet() {
181-
log.Info("system providers support detected")
182-
if config.Kstream.EnableRegistryKevents {
183-
e.addTraceKeywords(etw.SystemRegistrySession, etw.SystemRegistryProviderID, etw.RegistryKeywordGeneral)
184-
}
185-
}
186-
187172
if config.Kstream.EnableDNSEvents {
188173
e.addTrace(etw.DNSClientSession, etw.DNSClientGUID)
189174
}
@@ -268,11 +253,16 @@ func (e *EventSource) Open(config *config.Config) error {
268253
// signal the event callback to stop consuming more events.
269254
// Finally, the trace is stopped along with all event consumers.
270255
func (e *EventSource) Close() error {
256+
if e.isClosed {
257+
return nil
258+
}
259+
271260
for _, consumer := range e.consumers {
272261
if err := consumer.Close(); err != nil {
273262
log.Warnf("couldn't close consumer: %v", err)
274263
}
275264
}
265+
276266
for _, trace := range e.traces {
277267
if !trace.IsStarted() {
278268
continue
@@ -292,6 +282,8 @@ func (e *EventSource) Close() error {
292282

293283
close(e.stop)
294284

285+
e.isClosed = true
286+
295287
return e.sequencer.Shutdown()
296288
}
297289

@@ -321,7 +313,3 @@ func (e *EventSource) RegisterEventListener(lis kevent.Listener) {
321313
func (e *EventSource) addTrace(name string, guid windows.GUID) {
322314
e.traces = append(e.traces, NewTrace(name, guid, 0x0, e.config))
323315
}
324-
325-
func (e *EventSource) addTraceKeywords(name string, guid windows.GUID, keywords uint64) {
326-
e.traces = append(e.traces, NewTrace(name, guid, keywords, e.config))
327-
}

‎internal/etw/source_test.go‎

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -127,21 +127,17 @@ func TestEventSourceStartTraces(t *testing.T) {
127127
evs := NewEventSource(psnap, hsnap, tt.cfg, nil)
128128
require.NoError(t, evs.Open(tt.cfg))
129129
defer evs.Close()
130-
if !SupportsSystemProviders() {
131-
assert.Equal(t, tt.wantSessions, len(evs.(*EventSource).traces))
132-
}
130+
assert.Equal(t, tt.wantSessions, len(evs.(*EventSource).traces))
133131

134132
for _, trace := range evs.(*EventSource).traces {
135133
require.True(t, trace.Handle().IsValid())
136134
require.NoError(t, etw.ControlTrace(0, trace.Name, trace.GUID, etw.Query))
137-
if !SupportsSystemProviders() {
138-
if tt.wantFlags != nil && trace.IsKernelTrace() {
139-
flags, err := etw.GetTraceSystemFlags(trace.Handle())
140-
require.NoError(t, err)
141-
// check enabled system event flags
142-
require.Equal(t, tt.wantFlags[0], flags[0])
143-
require.Equal(t, tt.wantFlags[1], flags[4])
144-
}
135+
if tt.wantFlags != nil && trace.IsKernelTrace() {
136+
flags, err := etw.GetTraceSystemFlags(trace.Handle())
137+
require.NoError(t, err)
138+
// check enabled system event flags
139+
require.Equal(t, tt.wantFlags[0], flags[0])
140+
require.Equal(t, tt.wantFlags[1], flags[4])
145141
}
146142
}
147143
})
@@ -204,11 +200,7 @@ func TestEventSourceEnableFlagsDynamically(t *testing.T) {
204200

205201
flags := evs.(*EventSource).traces[0].enableFlagsDynamically(cfg.Kstream)
206202

207-
if SupportsSystemProviders() {
208-
require.Len(t, evs.(*EventSource).traces, 3)
209-
} else {
210-
require.Len(t, evs.(*EventSource).traces, 2)
211-
}
203+
require.Len(t, evs.(*EventSource).traces, 2)
212204

213205
require.True(t, flags&etw.FileIO != 0)
214206
require.True(t, flags&etw.Process != 0)

0 commit comments

Comments
 (0)