chore(alertsenders): Generate message compiler input file

rabbitstack · rabbitstack · commit 015e7f04e8cb · 2024-10-20T23:59:56.000+02:00
Automate the generation of the message compiler input file. This way, if a new event type is
added, it will automatically get the respective
message identifier in the eventlog messages.
diff --git a/.gitignore b/.gitignore
@@ -5,7 +5,7 @@ cmd/systray/fibratus-systray.exe
 cmd/systray/fibratus-systray.syso
 
 pkg/outputs/eventlog/mc/*
-!pkg/outputs/eventlog/mc/fibratus.mc
+!pkg/outputs/eventlog/mc/gen.go
 
 build/msi/fibratus-*
 build/msi/*.wixpdb
diff --git a/make.bat b/make.bat
@@ -84,6 +84,8 @@ if errorlevel 1 goto fail
 goto :EOF
 
 :mc
+:: Generate eventlog message compiler input file
+go generate github.com/rabbitstack/fibratus/pkg/outputs/eventlog
 windmc -r pkg/outputs/eventlog/mc pkg/outputs/eventlog/mc/fibratus.mc
 windres -O coff -r -fo pkg/outputs/eventlog/mc/fibratus.res pkg/outputs/eventlog/mc/fibratus.rc
 :: Link the resulting resource object
diff --git a/pkg/kevent/ktypes/category.go b/pkg/kevent/ktypes/category.go
@@ -64,3 +64,20 @@ const (
 func (c Category) Hash() uint32 {
 	return hashers.FnvUint32([]byte(c))
 }
+
+// Categories returns all available categories.
+func Categories() []string {
+	return []string{
+		string(Registry),
+		string(File),
+		string(Net),
+		string(Process),
+		string(Thread),
+		string(Image),
+		string(Handle),
+		string(Mem),
+		string(Driver),
+		string(Other),
+		string(Unknown),
+	}
+}
diff --git a/pkg/kevent/ktypes/metainfo_windows.go b/pkg/kevent/ktypes/metainfo_windows.go
@@ -19,7 +19,8 @@
 package ktypes
 
 import (
-	"sort"
+	"cmp"
+	"slices"
 )
 
 // KeventInfo describes the kernel event meta info such as human-readable name, category
@@ -143,6 +144,64 @@ var ktypes = map[string]Ktype{
 	"ReplyDns":           ReplyDNS,
 }
 
+// indexedKevents keeps the slice of event infos. When the
+// new event type is added, MAKE SURE TO ADD the event info
+// at the END of the slice. This way the event index is guaranteed
+// to remain static which is important for eventlog message identifiers.
+var indexedKevents = []KeventInfo{
+	kevents[CreateProcess],
+	kevents[TerminateProcess],
+	kevents[OpenProcess],
+	kevents[CreateThread],
+	kevents[TerminateThread],
+	kevents[OpenThread],
+	kevents[SetThreadContext],
+	kevents[LoadImage],
+	kevents[UnloadImage],
+	kevents[CreateFile],
+	kevents[CloseFile],
+	kevents[ReadFile],
+	kevents[WriteFile],
+	kevents[SetFileInformation],
+	kevents[DeleteFile],
+	kevents[RenameFile],
+	kevents[EnumDirectory],
+	kevents[RegCreateKey],
+	kevents[RegOpenKey],
+	kevents[RegSetValue],
+	kevents[RegQueryValue],
+	kevents[RegQueryKey],
+	kevents[RegDeleteKey],
+	kevents[RegDeleteValue],
+	kevents[AcceptTCPv4],
+	kevents[AcceptTCPv6],
+	kevents[SendTCPv4],
+	kevents[SendTCPv6],
+	kevents[SendUDPv4],
+	kevents[SendUDPv6],
+	kevents[RecvTCPv4],
+	kevents[RecvTCPv6],
+	kevents[RecvUDPv4],
+	kevents[RecvUDPv6],
+	kevents[ConnectTCPv4],
+	kevents[ConnectTCPv6],
+	kevents[ReconnectTCPv4],
+	kevents[ReconnectTCPv6],
+	kevents[DisconnectTCPv4],
+	kevents[DisconnectTCPv6],
+	kevents[RetransmitTCPv4],
+	kevents[RetransmitTCPv6],
+	kevents[CreateHandle],
+	kevents[CloseHandle],
+	kevents[DuplicateHandle],
+	kevents[VirtualAlloc],
+	kevents[VirtualFree],
+	kevents[MapViewFile],
+	kevents[UnmapViewFile],
+	kevents[QueryDNS],
+	kevents[ReplyDNS],
+}
+
 // All returns all event types.
 func All() []Ktype {
 	s := make([]Ktype, 0, len(ktypes))
@@ -204,6 +263,12 @@ outer:
 		}
 		ktypes = append(ktypes, ktyp)
 	}
-	sort.Slice(ktypes, func(i, j int) bool { return ktypes[i].Category < ktypes[j].Category })
+	slices.SortFunc(ktypes, func(a, b KeventInfo) int {
+		return cmp.Or(cmp.Compare(a.Category, b.Category), cmp.Compare(a.Name, b.Name))
+	})
 	return ktypes
 }
+
+// GetKtypesMetaIndexed returns indexed event types metadata
+// that is guaranteed to always return the same event indices.
+func GetKtypesMetaIndexed() []KeventInfo { return indexedKevents }
diff --git a/pkg/outputs/eventlog/api.go b/pkg/outputs/eventlog/api.go
@@ -26,6 +26,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"github.com/rabbitstack/fibratus/pkg/kevent/ktypes"
 	"syscall"
 
 	"golang.org/x/sys/windows"
@@ -34,7 +35,7 @@ import (
 
 const addKeyName = `SYSTEM\CurrentControlSet\Services\EventLog\Application`
 
-const categoryCount = 8
+var categoryCount = len(ktypes.Categories())
 
 // ErrKeyExists signals that the registry key already exists
 var ErrKeyExists = fmt.Errorf("%s\\%s already exists", addKeyName, source)
@@ -119,7 +120,7 @@ func Install(src, msgFile string, useExpandKey bool, eventsSupported uint32) err
 	if err != nil {
 		return err
 	}
-	err = sk.SetDWordValue("CategoryCount", categoryCount)
+	err = sk.SetDWordValue("CategoryCount", uint32(categoryCount))
 	if err != nil {
 		return err
 	}
diff --git a/pkg/outputs/eventlog/eventlog.go b/pkg/outputs/eventlog/eventlog.go
@@ -16,6 +16,8 @@
  * limitations under the License.
  */
 
+//go:generate go run github.com/rabbitstack/fibratus/pkg/outputs/eventlog/mc
+
 package eventlog
 
 import (
@@ -35,8 +37,9 @@ const (
 	levels = uint32(Info | Warn | Erro)
 	// msgFile specifies the location of the eventlog message DLL
 	msgFile = "%ProgramFiles%\\Fibratus\\fibratus.dll"
-	// unknownEventID represents the unknown event identifier
-	unknownEventID = 0
+
+	// categoryOffset specifies the start of the event id number space
+	categoryOffset = 25
 )
 
 // ErrUnknownEventID represents the error for signaling unknown event identifiers. This error
@@ -47,6 +50,8 @@ type evtlog struct {
 	evtlog *Eventlog // eventlog writer
 	config Config
 	tmpl   *template.Template
+	events []ktypes.KeventInfo
+	cats   []string
 }
 
 func init() {
@@ -67,6 +72,8 @@ func initEventlog(config outputs.Config) (outputs.OutputGroup, error) {
 	}
 	evtlog := &evtlog{
 		config: cfg,
+		events: ktypes.GetKtypesMetaIndexed(),
+		cats:   ktypes.Categories(),
 	}
 	evtlog.tmpl, err = cfg.parseTemplate()
 	if err != nil {
@@ -113,11 +120,11 @@ func (e *evtlog) publish(kevt *kevent.Kevent) error {
 	if err != nil {
 		return err
 	}
-	eventID := ktypeToEventID(kevt)
-	if eventID == unknownEventID {
+	eid := e.eventID(kevt)
+	if eid == 0 {
 		return ErrUnknownEventID
 	}
-	err = e.log(eventID, categoryID(kevt), buf)
+	err = e.log(eid, e.categoryID(kevt), buf)
 	if err != nil {
 		return err
 	}
@@ -138,114 +145,21 @@ func (e *evtlog) log(eventID uint32, categoryID uint16, buf []byte) error {
 }
 
 // categoryID maps category name to eventlog identifier.
-func categoryID(kevt *kevent.Kevent) uint16 {
-	switch kevt.Category {
-	case ktypes.Registry:
-		return 1
-	case ktypes.File:
-		return 2
-	case ktypes.Net:
-		return 3
-	case ktypes.Process:
-		return 4
-	case ktypes.Thread:
-		return 5
-	case ktypes.Image:
-		return 6
-	case ktypes.Handle:
-		return 7
-	case ktypes.Other:
-		return 8
-	case ktypes.Mem:
-		return 9
-	default:
-		return 0
+func (e *evtlog) categoryID(kevt *kevent.Kevent) uint16 {
+	for i, cat := range e.cats {
+		if cat == string(kevt.Category) {
+			return uint16(i + 1)
+		}
 	}
+	return 0
 }
 
-// ktypeToEventID returns the event ID from the event type.
-func ktypeToEventID(kevt *kevent.Kevent) uint32 {
-	switch kevt.Type {
-	case ktypes.CreateProcess:
-		return 15
-	case ktypes.TerminateProcess:
-		return 16
-	case ktypes.OpenProcess:
-		return 17
-	case ktypes.LoadImage:
-		return 18
-	case ktypes.ConnectTCPv4, ktypes.ConnectTCPv6:
-		return 19
-	case ktypes.CreateFile:
-		return 20
-	case ktypes.RegDeleteKey:
-		return 21
-	case ktypes.RegDeleteValue:
-		return 22
-	case ktypes.RegCreateKey:
-		return 23
-	case ktypes.RegSetValue:
-		return 24
-	case ktypes.CreateHandle:
-		return 25
-	case ktypes.DeleteFile:
-		return 26
-	case ktypes.CreateThread:
-		return 27
-	case ktypes.TerminateThread:
-		return 28
-	case ktypes.OpenThread:
-		return 29
-	case ktypes.UnloadImage:
-		return 30
-	case ktypes.WriteFile:
-		return 31
-	case ktypes.ReadFile:
-		return 32
-	case ktypes.RenameFile:
-		return 33
-	case ktypes.CloseFile:
-		return 34
-	case ktypes.SetFileInformation:
-		return 35
-	case ktypes.EnumDirectory:
-		return 36
-	case ktypes.RegOpenKey:
-		return 37
-	case ktypes.RegQueryKey:
-		return 38
-	case ktypes.RegQueryValue:
-		return 39
-	case ktypes.AcceptTCPv4, ktypes.AcceptTCPv6:
-		return 40
-	case ktypes.SendTCPv4, ktypes.SendTCPv6, ktypes.SendUDPv4, ktypes.SendUDPv6:
-		return 41
-	case ktypes.RecvTCPv4, ktypes.RecvTCPv6, ktypes.RecvUDPv4, ktypes.RecvUDPv6:
-		return 42
-	case ktypes.DisconnectTCPv4, ktypes.DisconnectTCPv6:
-		return 43
-	case ktypes.ReconnectTCPv4, ktypes.ReconnectTCPv6:
-		return 44
-	case ktypes.RetransmitTCPv4, ktypes.RetransmitTCPv6:
-		return 45
-	case ktypes.CloseHandle:
-		return 46
-	case ktypes.RegCloseKey:
-		return 47
-	case ktypes.VirtualAlloc:
-		return 49
-	case ktypes.VirtualFree:
-		return 50
-	case ktypes.MapViewFile:
-		return 51
-	case ktypes.UnmapViewFile:
-		return 52
-	case ktypes.DuplicateHandle:
-		return 53
-	case ktypes.QueryDNS:
-		return 54
-	case ktypes.ReplyDNS:
-		return 55
+// eventID returns the event ID from the event type.
+func (e *evtlog) eventID(kevt *kevent.Kevent) uint32 {
+	for i, evt := range e.events {
+		if evt.Name == kevt.Name {
+			return uint32(i + categoryOffset)
+		}
 	}
-	return unknownEventID
+	return 0
 }
diff --git a/pkg/outputs/eventlog/eventlog_test.go b/pkg/outputs/eventlog/eventlog_test.go
@@ -25,8 +25,6 @@ import (
 	"testing"
 	"time"
 
-	"golang.org/x/sys/windows/svc/eventlog"
-
 	htypes "github.com/rabbitstack/fibratus/pkg/handle/types"
 	"github.com/rabbitstack/fibratus/pkg/kevent"
 	"github.com/rabbitstack/fibratus/pkg/kevent/kparams"
@@ -45,8 +43,10 @@ func TestEvtlogPublish(t *testing.T) {
 	el := &evtlog{
 		config: c,
 		tmpl:   tmpl,
+		events: ktypes.GetKtypesMetaIndexed(),
+		cats:   ktypes.Categories(),
 	}
-	err = eventlog.InstallAsEventCreate(source, levels)
+	err = Install(source, msgFile, false, levels)
 	if err != nil && !errors.Is(err, ErrKeyExists) {
 		require.NoError(t, err)
 	}
diff --git a/pkg/outputs/eventlog/mc/fibratus.mc b/pkg/outputs/eventlog/mc/fibratus.mc
diff --git a/pkg/outputs/eventlog/mc/gen.go b/pkg/outputs/eventlog/mc/gen.go
