4c2d68c14b
This change introduces new filtering architecture primitives: filter, filter_action and bool_expression. Filtering is now done after decoding of syscall and tcp->qual_flg stores filtering results. * basic_actions.c: New file. * filter_action.c: Likewise. * filter_expression.c: Likewise. * filter.c: Likewise. * basic_filters.c (parse_syscall_filter, run_syscall_filter, free_syscall_filter): New functions. * defs.h (filter_syscall, filtering_parsing_finish): Add new declarations. * filter.h: Add new declarations. * filter_qualify.c (abbrev_set, raw_set, trace_set, verbose_set): Remove set variables. (qualify_trace, qualify_abbrev, qualify_verbose, qualify_raw): Use new filtering API. (qual_flags): Remove QUAL_* flags for trace, abbrev, verbose, raw. * strace.c (init): Call filtering_parse_finish after command line parsing. (trace_syscall): Add filtering after syscall decoding. * Makefile.am (strace_SOURCES): Add new files.
256 lines
7.1 KiB
C
256 lines
7.1 KiB
C
/*
|
|
* Copyright (c) 2017 Nikolay Marchuk <marchuk.nikolay.a@gmail.com>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The name of the author may not be used to endorse or promote products
|
|
* derived from this software without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#include "defs.h"
|
|
#include <stdarg.h>
|
|
#include "filter.h"
|
|
|
|
struct expression_token {
|
|
enum token_type {
|
|
TOK_VARIABLE,
|
|
TOK_OPERATOR
|
|
} type;
|
|
union token_data {
|
|
unsigned int variable_id;
|
|
enum operator_type {
|
|
OP_NOT,
|
|
OP_AND,
|
|
OP_OR
|
|
} operator_id;
|
|
} data;
|
|
};
|
|
|
|
struct bool_expression {
|
|
unsigned int ntokens;
|
|
struct expression_token *tokens;
|
|
};
|
|
|
|
struct bool_expression *
|
|
create_expression(void)
|
|
{
|
|
return xcalloc(1, sizeof(struct bool_expression));
|
|
}
|
|
|
|
static void
|
|
reallocate_expression(struct bool_expression *const expr,
|
|
const unsigned int new_ntokens)
|
|
{
|
|
if (!expr)
|
|
error_msg_and_die("invalid expression");
|
|
expr->tokens = xreallocarray(expr->tokens, new_ntokens,
|
|
sizeof(*expr->tokens));
|
|
if (new_ntokens > expr->ntokens)
|
|
memset(expr->tokens + expr->ntokens, 0,
|
|
sizeof(*expr->tokens) * (new_ntokens - expr->ntokens));
|
|
expr->ntokens = new_ntokens;
|
|
}
|
|
|
|
void
|
|
set_expression_qualify_mode(struct bool_expression *expr,
|
|
unsigned int filters_left)
|
|
{
|
|
unsigned int i;
|
|
|
|
if (!expr)
|
|
error_msg_and_die("invalid expression");
|
|
reallocate_expression(expr, 2 * filters_left - 1);
|
|
for (i = 0; i < filters_left; ++i) {
|
|
expr->tokens[i].type = TOK_VARIABLE;
|
|
expr->tokens[i].data.variable_id = i;
|
|
}
|
|
for (; i < 2 * filters_left - 1; ++i) {
|
|
expr->tokens[i].type = TOK_OPERATOR;
|
|
expr->tokens[i].data.operator_id = OP_AND;
|
|
}
|
|
}
|
|
|
|
ATTRIBUTE_FORMAT((printf, 3, 4))
|
|
static int
|
|
printf_append(char **ptr, char *end, const char *fmt, ...)
|
|
{
|
|
int ret;
|
|
va_list args;
|
|
|
|
va_start(args, fmt);
|
|
ret = vsnprintf(*ptr, end - *ptr, fmt, args);
|
|
va_end(args);
|
|
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
*ptr += MIN(ret, end - *ptr);
|
|
return ret;
|
|
}
|
|
|
|
/* Print full diagnostics for corrupted expression */
|
|
ATTRIBUTE_NORETURN
|
|
static void
|
|
handle_corrupted_expression(struct bool_expression *expr, bool *stack,
|
|
unsigned int stack_size, unsigned int current_pos,
|
|
bool *variables, unsigned int variables_num)
|
|
{
|
|
char *buf, *pos, *end;
|
|
unsigned int buf_size;
|
|
unsigned int i;
|
|
|
|
/* Calculate buffer size. */
|
|
buf_size = sizeof("corrupted filter expression:");
|
|
buf_size += sizeof("expression (ntokens = ):")
|
|
+ 3 * sizeof(unsigned int)
|
|
+ (sizeof("op_") + 3 * sizeof(int)) * expr->ntokens;
|
|
buf_size += sizeof("variables (nvariables = ):") + 3 * sizeof(int)
|
|
+ sizeof("false") * variables_num;
|
|
buf_size += sizeof("current position: ") + 3 * sizeof(int);
|
|
buf_size += sizeof("stack (stack_size = ):") + 3 * sizeof(int)
|
|
+ sizeof("false") * stack_size;
|
|
|
|
buf = xcalloc(buf_size, 1);
|
|
pos = buf;
|
|
end = buf + buf_size;
|
|
|
|
printf_append(&pos, end, "corrupted filter expression:\n");
|
|
|
|
/* Print expression. */
|
|
printf_append(&pos, end, "expression (ntokens = %u):", expr->ntokens);
|
|
for (i = 0; i < expr->ntokens; ++i) {
|
|
switch (expr->tokens[i].type) {
|
|
case TOK_VARIABLE:
|
|
printf_append(&pos, end, " v_%u",
|
|
expr->tokens[i].data.variable_id);
|
|
break;
|
|
case TOK_OPERATOR:
|
|
switch (expr->tokens[i].data.operator_id) {
|
|
case OP_NOT:
|
|
printf_append(&pos, end, " not");
|
|
break;
|
|
case OP_AND:
|
|
printf_append(&pos, end, " and");
|
|
break;
|
|
case OP_OR:
|
|
printf_append(&pos, end, " or");
|
|
break;
|
|
default:
|
|
printf_append(&pos, end, " op_%d",
|
|
expr->tokens[i].data.operator_id);
|
|
}
|
|
break;
|
|
default:
|
|
printf_append(&pos, end, " ?_%d", expr->tokens[i].type);
|
|
}
|
|
}
|
|
printf_append(&pos, end, "\n");
|
|
|
|
/* Print variables. */
|
|
printf_append(&pos, end, "variables (nvariables = %u):", variables_num);
|
|
for (i = 0; i < variables_num; ++i)
|
|
printf_append(&pos, end, !variables[i] ? " false" : " true");
|
|
printf_append(&pos, end, "\n");
|
|
|
|
printf_append(&pos, end, "current position: %u\n", current_pos);
|
|
|
|
/* Print current stack state. */
|
|
printf_append(&pos, end, "stack (stack_size = %u):", stack_size);
|
|
for (i = 0; i < stack_size; ++i)
|
|
printf_append(&pos, end, !stack[i] ? " false" : " true");
|
|
|
|
error_msg_and_die("%s", buf);
|
|
}
|
|
|
|
#define MAX_STACK_SIZE 32
|
|
|
|
bool
|
|
run_expression(struct bool_expression *expr, bool *variables,
|
|
unsigned int variables_num)
|
|
{
|
|
bool stack[MAX_STACK_SIZE];
|
|
unsigned int stack_size = 0;
|
|
unsigned int i;
|
|
|
|
for (i = 0; i < expr->ntokens; ++i) {
|
|
struct expression_token *tok = &expr->tokens[i];
|
|
|
|
switch (tok->type) {
|
|
case TOK_VARIABLE:
|
|
if (stack_size == MAX_STACK_SIZE)
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
|
|
if (tok->data.variable_id >= variables_num)
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
stack[stack_size++] = variables[tok->data.variable_id];
|
|
break;
|
|
case TOK_OPERATOR:
|
|
switch (tok->data.operator_id) {
|
|
case OP_NOT:
|
|
if (stack_size == 0)
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
stack[stack_size - 1] = !stack[stack_size - 1];
|
|
break;
|
|
case OP_AND:
|
|
if (stack_size < 2)
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
stack[stack_size - 2] = stack[stack_size - 2]
|
|
&& stack[stack_size - 1];
|
|
--stack_size;
|
|
break;
|
|
case OP_OR:
|
|
if (stack_size < 2)
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
stack[stack_size - 2] = stack[stack_size - 2]
|
|
|| stack[stack_size - 1];
|
|
--stack_size;
|
|
break;
|
|
default:
|
|
handle_corrupted_expression(expr, stack,
|
|
stack_size, i,
|
|
variables,
|
|
variables_num);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (stack_size != 1)
|
|
handle_corrupted_expression(expr, stack, stack_size, i,
|
|
variables, variables_num);
|
|
return stack[0];
|
|
}
|