src/common/event-rule/syscall.c

   1 /*
   2  * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
   3  *
   4  * SPDX-License-Identifier: LGPL-2.1-only
   5  *
   6  */
   7
   8 #include <assert.h>
   9 #include <common/credentials.h>
  10 #include <common/error.h>
  11 #include <common/macros.h>
  12 #include <common/payload.h>
  13 #include <common/payload-view.h>
  14 #include <common/runas.h>
  15 #include <common/hashtable/hashtable.h>
  16 #include <common/hashtable/utils.h>
  17 #include <lttng/event-rule/event-rule-internal.h>
  18 #include <lttng/event-rule/syscall-internal.h>
  19
  20 #define IS_SYSCALL_EVENT_RULE(rule) \
  21         (lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)
  22
  23 static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
  24 {
  25         struct lttng_event_rule_syscall *syscall;
  26
  27         if (rule == NULL) {
  28                 return;
  29         }
  30
  31         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
  32
  33         free(syscall->pattern);
  34         free(syscall->filter_expression);
  35         free(syscall->internal_filter.filter);
  36         free(syscall->internal_filter.bytecode);
  37         free(syscall);
  38 }
  39
  40 static bool lttng_event_rule_syscall_validate(
  41                 const struct lttng_event_rule *rule)
  42 {
  43         bool valid = false;
  44         struct lttng_event_rule_syscall *syscall;
  45
  46         if (!rule) {
  47                 goto end;
  48         }
  49
  50         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
  51
  52         /* Required field. */
  53         if (!syscall->pattern) {
  54                 ERR("Invalid syscall event rule: a pattern must be set.");
  55                 goto end;
  56         }
  57
  58         valid = true;
  59 end:
  60         return valid;
  61 }
  62
  63 static int lttng_event_rule_syscall_serialize(
  64                 const struct lttng_event_rule *rule,
  65                 struct lttng_payload *payload)
  66 {
  67         int ret;
  68         size_t pattern_len, filter_expression_len;
  69         struct lttng_event_rule_syscall *syscall;
  70         struct lttng_event_rule_syscall_comm syscall_comm;
  71
  72         if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
  73                 ret = -1;
  74                 goto end;
  75         }
  76
  77         DBG("Serializing syscall event rule");
  78         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
  79
  80         pattern_len = strlen(syscall->pattern) + 1;
  81
  82         if (syscall->filter_expression != NULL) {
  83                 filter_expression_len = strlen(syscall->filter_expression) + 1;
  84         } else {
  85                 filter_expression_len = 0;
  86         }
  87
  88         syscall_comm.pattern_len = pattern_len;
  89         syscall_comm.filter_expression_len = filter_expression_len;
  90
  91         ret = lttng_dynamic_buffer_append(
  92                         &payload->buffer, &syscall_comm, sizeof(syscall_comm));
  93         if (ret) {
  94                 goto end;
  95         }
  96
  97         ret = lttng_dynamic_buffer_append(
  98                         &payload->buffer, syscall->pattern, pattern_len);
  99         if (ret) {
 100                 goto end;
 101         }
 102
 103         ret = lttng_dynamic_buffer_append(&payload->buffer,
 104                         syscall->filter_expression, filter_expression_len);
 105 end:
 106         return ret;
 107 }
 108
 109 static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
 110                 const struct lttng_event_rule *_b)
 111 {
 112         bool is_equal = false;
 113         struct lttng_event_rule_syscall *a, *b;
 114
 115         a = container_of(_a, struct lttng_event_rule_syscall, parent);
 116         b = container_of(_b, struct lttng_event_rule_syscall, parent);
 117
 118         if (!!a->filter_expression != !!b->filter_expression) {
 119                 goto end;
 120         }
 121
 122         assert(a->pattern);
 123         assert(b->pattern);
 124         if (strcmp(a->pattern, b->pattern)) {
 125                 goto end;
 126         }
 127
 128         if (a->filter_expression && b->filter_expression) {
 129                 if (strcmp(a->filter_expression, b->filter_expression)) {
 130                         goto end;
 131                 }
 132         } else if (!!a->filter_expression != !!b->filter_expression) {
 133                 /* One is set and not the other. */
 134                 goto end;
 135         }
 136
 137         is_equal = true;
 138 end:
 139         return is_equal;
 140 }
 141
 142 static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
 143                 struct lttng_event_rule *rule,
 144                 const struct lttng_credentials *creds)
 145 {
 146         int ret;
 147         enum lttng_error_code ret_code = LTTNG_OK;
 148         struct lttng_event_rule_syscall *syscall;
 149         enum lttng_event_rule_status status;
 150         const char *filter;
 151         struct lttng_filter_bytecode *bytecode = NULL;
 152
 153         assert(rule);
 154
 155         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 156
 157         /* Generate the filter bytecode. */
 158         status = lttng_event_rule_syscall_get_filter(rule, &filter);
 159         if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
 160                 filter = NULL;
 161         } else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 162                 ret_code = LTTNG_ERR_FILTER_INVAL;
 163                 goto end;
 164         }
 165
 166         if (filter && filter[0] == '\0') {
 167                 ret_code = LTTNG_ERR_FILTER_INVAL;
 168                 goto end;
 169         }
 170
 171         if (filter == NULL) {
 172                 /* Nothing to do. */
 173                 ret = LTTNG_OK;
 174                 goto end;
 175         }
 176
 177         syscall->internal_filter.filter = strdup(filter);
 178         if (syscall->internal_filter.filter == NULL) {
 179                 ret_code = LTTNG_ERR_NOMEM;
 180                 goto end;
 181         }
 182
 183         ret = run_as_generate_filter_bytecode(
 184                         syscall->internal_filter.filter, creds, &bytecode);
 185         if (ret) {
 186                 ret_code = LTTNG_ERR_FILTER_INVAL;
 187         }
 188
 189         syscall->internal_filter.bytecode = bytecode;
 190         bytecode = NULL;
 191
 192 end:
 193         free(bytecode);
 194         return ret_code;
 195 }
 196
 197 static const char *lttng_event_rule_syscall_get_internal_filter(
 198                 const struct lttng_event_rule *rule)
 199 {
 200         struct lttng_event_rule_syscall *syscall;
 201
 202         assert(rule);
 203         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 204
 205         return syscall->internal_filter.filter;
 206 }
 207
 208 static const struct lttng_filter_bytecode *
 209 lttng_event_rule_syscall_get_internal_filter_bytecode(
 210                 const struct lttng_event_rule *rule)
 211 {
 212         struct lttng_event_rule_syscall *syscall;
 213
 214         assert(rule);
 215         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 216
 217         return syscall->internal_filter.bytecode;
 218 }
 219
 220 static struct lttng_event_exclusion *
 221 lttng_event_rule_syscall_generate_exclusions(
 222                 const struct lttng_event_rule *rule)
 223 {
 224         /* Not supported. */
 225         return NULL;
 226 }
 227
 228 static unsigned long
 229 lttng_event_rule_syscall_hash(
 230                 const struct lttng_event_rule *rule)
 231 {
 232         unsigned long hash;
 233         struct lttng_event_rule_syscall *syscall_rule =
 234                         container_of(rule, typeof(*syscall_rule), parent);
 235
 236         hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_SYSCALL,
 237                         lttng_ht_seed);
 238         hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
 239         if (syscall_rule->filter_expression) {
 240                 hash ^= hash_key_str(syscall_rule->filter_expression,
 241                                 lttng_ht_seed);
 242         }
 243
 244         return hash;
 245 }
 246
 247 struct lttng_event_rule *lttng_event_rule_syscall_create()
 248 {
 249         struct lttng_event_rule *rule = NULL;
 250         struct lttng_event_rule_syscall *syscall_rule;
 251
 252         syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
 253         if (!syscall_rule) {
 254                 goto end;
 255         }
 256
 257         rule = &syscall_rule->parent;
 258         lttng_event_rule_init(
 259                         &syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
 260         syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
 261         syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
 262         syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
 263         syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
 264         syscall_rule->parent.generate_filter_bytecode =
 265                         lttng_event_rule_syscall_generate_filter_bytecode;
 266         syscall_rule->parent.get_filter =
 267                         lttng_event_rule_syscall_get_internal_filter;
 268         syscall_rule->parent.get_filter_bytecode =
 269                         lttng_event_rule_syscall_get_internal_filter_bytecode;
 270         syscall_rule->parent.generate_exclusions =
 271                         lttng_event_rule_syscall_generate_exclusions;
 272         syscall_rule->parent.hash = lttng_event_rule_syscall_hash;
 273 end:
 274         return rule;
 275 }
 276
 277 LTTNG_HIDDEN
 278 ssize_t lttng_event_rule_syscall_create_from_payload(
 279                 struct lttng_payload_view *view,
 280                 struct lttng_event_rule **_event_rule)
 281 {
 282         ssize_t ret, offset = 0;
 283         enum lttng_event_rule_status status;
 284         const struct lttng_event_rule_syscall_comm *syscall_comm;
 285         const char *pattern;
 286         const char *filter_expression = NULL;
 287         struct lttng_buffer_view current_buffer_view;
 288         struct lttng_event_rule *rule = NULL;
 289
 290         if (!_event_rule) {
 291                 ret = -1;
 292                 goto end;
 293         }
 294
 295         if (view->buffer.size < sizeof(*syscall_comm)) {
 296                 ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
 297                 ret = -1;
 298                 goto end;
 299         }
 300
 301         current_buffer_view = lttng_buffer_view_from_view(
 302                         &view->buffer, offset, sizeof(*syscall_comm));
 303         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 304                 ret = -1;
 305                 goto end;
 306         }
 307
 308         syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
 309         rule = lttng_event_rule_syscall_create();
 310         if (!rule) {
 311                 ERR("Failed to create event rule syscall");
 312                 ret = -1;
 313                 goto end;
 314         }
 315
 316         /* Skip to payload. */
 317         offset += current_buffer_view.size;
 318
 319         /* Map the pattern. */
 320         current_buffer_view = lttng_buffer_view_from_view(
 321                         &view->buffer, offset, syscall_comm->pattern_len);
 322         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 323                 ret = -1;
 324                 goto end;
 325         }
 326
 327         pattern = current_buffer_view.data;
 328         if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
 329                         syscall_comm->pattern_len)) {
 330                 ret = -1;
 331                 goto end;
 332         }
 333
 334         /* Skip after the pattern. */
 335         offset += syscall_comm->pattern_len;
 336
 337         if (!syscall_comm->filter_expression_len) {
 338                 goto skip_filter_expression;
 339         }
 340
 341         /* Map the filter_expression. */
 342         current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
 343                         syscall_comm->filter_expression_len);
 344         if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
 345                 ret = -1;
 346                 goto end;
 347         }
 348
 349         filter_expression = current_buffer_view.data;
 350         if (!lttng_buffer_view_contains_string(&current_buffer_view,
 351                                 filter_expression,
 352                                 syscall_comm->filter_expression_len)) {
 353                 ret = -1;
 354                 goto end;
 355         }
 356
 357         /* Skip after the pattern. */
 358         offset += syscall_comm->filter_expression_len;
 359
 360 skip_filter_expression:
 361
 362         status = lttng_event_rule_syscall_set_pattern(rule, pattern);
 363         if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 364                 ERR("Failed to set event rule syscall pattern");
 365                 ret = -1;
 366                 goto end;
 367         }
 368
 369         if (filter_expression) {
 370                 status = lttng_event_rule_syscall_set_filter(
 371                                 rule, filter_expression);
 372                 if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 373                         ERR("Failed to set event rule syscall pattern");
 374                         ret = -1;
 375                         goto end;
 376                 }
 377         }
 378
 379         *_event_rule = rule;
 380         rule = NULL;
 381         ret = offset;
 382 end:
 383         lttng_event_rule_destroy(rule);
 384         return ret;
 385 }
 386
 387 enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
 388                 struct lttng_event_rule *rule, const char *pattern)
 389 {
 390         char *pattern_copy = NULL;
 391         struct lttng_event_rule_syscall *syscall;
 392         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 393
 394         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
 395                         strlen(pattern) == 0) {
 396                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 397                 goto end;
 398         }
 399
 400         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 401         pattern_copy = strdup(pattern);
 402         if (!pattern_copy) {
 403                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 404                 goto end;
 405         }
 406
 407         if (syscall->pattern) {
 408                 free(syscall->pattern);
 409         }
 410
 411         syscall->pattern = pattern_copy;
 412         pattern_copy = NULL;
 413 end:
 414         return status;
 415 }
 416
 417 enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
 418                 const struct lttng_event_rule *rule, const char **pattern)
 419 {
 420         struct lttng_event_rule_syscall *syscall;
 421         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 422
 423         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
 424                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 425                 goto end;
 426         }
 427
 428         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 429         if (!syscall->pattern) {
 430                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 431                 goto end;
 432         }
 433
 434         *pattern = syscall->pattern;
 435 end:
 436         return status;
 437 }
 438
 439 enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
 440                 struct lttng_event_rule *rule, const char *expression)
 441 {
 442         char *expression_copy = NULL;
 443         struct lttng_event_rule_syscall *syscall;
 444         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 445
 446         /* TODO: validate that the passed expression is valid. */
 447
 448         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
 449                         strlen(expression) == 0) {
 450                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 451                 goto end;
 452         }
 453
 454         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 455         expression_copy = strdup(expression);
 456         if (!expression_copy) {
 457                 status = LTTNG_EVENT_RULE_STATUS_ERROR;
 458                 goto end;
 459         }
 460
 461         if (syscall->filter_expression) {
 462                 free(syscall->filter_expression);
 463         }
 464
 465         syscall->filter_expression = expression_copy;
 466         expression_copy = NULL;
 467 end:
 468         return status;
 469 }
 470
 471 enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
 472                 const struct lttng_event_rule *rule, const char **expression)
 473 {
 474         struct lttng_event_rule_syscall *syscall;
 475         enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
 476
 477         if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
 478                 status = LTTNG_EVENT_RULE_STATUS_INVALID;
 479                 goto end;
 480         }
 481
 482         syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
 483         if (!syscall->filter_expression) {
 484                 status = LTTNG_EVENT_RULE_STATUS_UNSET;
 485                 goto end;
 486         }
 487
 488         *expression = syscall->filter_expression;
 489 end:
 490         return status;
 491 }