event-rule: introduce event rule syscall
authorJonathan Rajotte <jonathan.rajotte-julien@efficios.com>
Wed, 11 Mar 2020 17:55:16 +0000 (13:55 -0400)
committerJérémie Galarneau <jeremie.galarneau@efficios.com>
Fri, 11 Sep 2020 15:19:27 +0000 (11:19 -0400)
This is the "--syscall" option of the enable-event command line.

Signed-off-by: Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
Signed-off-by: Jérémie Galarneau <jeremie.galarneau@efficios.com>
Change-Id: I9c36cb0440e1f26a3b436782eb437a8ddffbe4fa

include/Makefile.am
include/lttng/event-rule/syscall-internal.h [new file with mode: 0644]
include/lttng/event-rule/syscall.h [new file with mode: 0644]
include/lttng/lttng.h
src/common/Makefile.am
src/common/event-rule/event-rule.c
src/common/event-rule/syscall.c [new file with mode: 0644]

index 3ba967e0a1fca4d75d721d6656bbd4b9cf89d56d..92b5c75bd26c4260b9fe47d2b16973e67988463f 100644 (file)
@@ -145,7 +145,8 @@ lttngtriggerinclude_HEADERS= \
 
 lttngeventruleinclude_HEADERS= \
        lttng/event-rule/event-rule.h \
-       lttng/event-rule/kprobe.h
+       lttng/event-rule/kprobe.h \
+       lttng/event-rule/syscall.h
 
 noinst_HEADERS = \
        lttng/snapshot-internal.h \
@@ -179,5 +180,6 @@ noinst_HEADERS = \
        lttng/kernel-probe-internal.h \
        lttng/event-rule/event-rule-internal.h \
        lttng/event-rule/kprobe-internal.h \
+       lttng/event-rule/syscall-internal.h \
        version.h \
        version.i
diff --git a/include/lttng/event-rule/syscall-internal.h b/include/lttng/event-rule/syscall-internal.h
new file mode 100644 (file)
index 0000000..e99b69a
--- /dev/null
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.1-only
+ *
+ */
+
+#ifndef LTTNG_EVENT_RULE_SYSCALL_INTERNAL_H
+#define LTTNG_EVENT_RULE_SYSCALL_INTERNAL_H
+
+#include <common/payload-view.h>
+#include <common/macros.h>
+#include <lttng/event-rule/event-rule-internal.h>
+#include <lttng/event-rule/syscall.h>
+
+struct lttng_event_rule_syscall {
+       struct lttng_event_rule parent;
+       char *pattern;
+       char *filter_expression;
+
+       /* Internal use only. */
+       struct {
+               char *filter;
+               struct lttng_filter_bytecode *bytecode;
+       } internal_filter;
+};
+
+struct lttng_event_rule_syscall_comm {
+       /* Includes terminator `\0`. */
+       uint32_t pattern_len;
+       /* Includes terminator `\0`. */
+       uint32_t filter_expression_len;
+       /*
+        * Payload is composed of, in that order:
+        *   - Pattern (null terminated),
+        *   - Filter expression (null terminated).
+        */
+       char payload[];
+} LTTNG_PACKED;
+
+LTTNG_HIDDEN
+ssize_t lttng_event_rule_syscall_create_from_payload(
+               struct lttng_payload_view *view,
+               struct lttng_event_rule **rule);
+
+#endif /* LTTNG_EVENT_RULE_SYSCALL_INTERNAL_H */
diff --git a/include/lttng/event-rule/syscall.h b/include/lttng/event-rule/syscall.h
new file mode 100644 (file)
index 0000000..baf8432
--- /dev/null
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.1-only
+ *
+ */
+
+#ifndef LTTNG_EVENT_RULE_SYSCALL_H
+#define LTTNG_EVENT_RULE_SYSCALL_H
+
+#include <lttng/event-rule/event-rule.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Create a newly allocated syscall event rule.
+ *
+ * Returns a new event rule on success, NULL on failure. This event rule must be
+ * destroyed using lttng_event_rule_destroy().
+ */
+extern struct lttng_event_rule *lttng_event_rule_syscall_create(void);
+
+/*
+ * Set the pattern of a syscall event rule.
+ *
+ * Pattern can contain wildcard '*'. See man lttng-enable-event.
+ *
+ * The pattern is copied internally.
+ *
+ * Returns LTTNG_EVENT_RULE_STATUS_OK on success, LTTNG_EVENT_RULE_STATUS_INVALID
+ * if invalid parameters are passed.
+ */
+extern enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
+               struct lttng_event_rule *rule, const char *pattern);
+
+/*
+ * Get the pattern of a syscall event rule.
+ *
+ * The caller does not assume the ownership of the returned pattern. The
+ * pattern shall only only be used for the duration of the event rule's
+ * lifetime, or before a different pattern is set.
+ *
+ * Returns LTTNG_EVENT_RULE_STATUS_OK and a pointer to the event rule's pattern
+ * on success, LTTNG_EVENT_RULE_STATUS_INVALID if an invalid
+ * parameter is passed, or LTTNG_EVENT_RULE_STATUS_UNSET if a pattern
+ * was not set prior to this call.
+ */
+extern enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
+               const struct lttng_event_rule *rule, const char **pattern);
+
+/*
+ * Set the filter expression of a syscall event rule.
+ *
+ * The expression is copied internally.
+ *
+ * Returns LTTNG_EVENT_RULE_STATUS_OK on success, LTTNG_EVENT_RULE_STATUS_INVALID
+ * if invalid parameters are passed.
+ */
+extern enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
+               struct lttng_event_rule *rule, const char *expression);
+
+/*
+ * Get the filter expression of a syscall event rule.
+ *
+ * The caller does not assume the ownership of the returned filter expression.
+ * The filter expression shall only only be used for the duration of the event
+ * rule's lifetime, or before a different filter expression is set.
+ *
+ * Returns LTTNG_EVENT_RULE_STATUS_OK and a pointer to the event rule's filter
+ * expression on success, LTTNG_EVENT_RULE_STATUS_INVALID if an invalid
+ * parameter is passed, or LTTNG_EVENT_RULE_STATUS_UNSET if a filter expression
+ * was not set prior to this call.
+ */
+extern enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
+               const struct lttng_event_rule *rule, const char **expression);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* LTTNG_EVENT_RULE_SYSCALL_H */
index a7fef39c34f8e7bf34a2eb475b5e7e2f37241bb7..8686643b8ae9044ac2034c3e13b23dc22771c9c6 100644 (file)
@@ -36,6 +36,7 @@
 #include <lttng/endpoint.h>
 #include <lttng/event-rule/event-rule.h>
 #include <lttng/event-rule/kprobe.h>
+#include <lttng/event-rule/syscall.h>
 #include <lttng/event.h>
 #include <lttng/handle.h>
 #include <lttng/health.h>
index b31e6c5466d20e4577fd78ff5ebd302e23d9ffe4..556c557777bfd35dc1b3a50d65cf84311c30f0ef 100644 (file)
@@ -50,6 +50,7 @@ libcommon_la_SOURCES = \
        event.c \
        event-rule/event-rule.c \
        event-rule/kprobe.c \
+       event-rule/syscall.c \
        filter.c filter.h \
        fd-handle.c fd-handle.h \
        fs-handle.c fs-handle.h fs-handle-internal.h \
index e5736d6f9288e8eb716464f6ef4ffeb77c2ce692..7070115867d3fd91fb30ef1283e46133d6bf5f9f 100644 (file)
@@ -13,6 +13,7 @@
 #include <common/payload-view.h>
 #include <lttng/event-rule/event-rule-internal.h>
 #include <lttng/event-rule/kprobe-internal.h>
+#include <lttng/event-rule/syscall-internal.h>
 #include <stdbool.h>
 
 enum lttng_event_rule_type lttng_event_rule_get_type(
@@ -165,7 +166,8 @@ ssize_t lttng_event_rule_create_from_payload(
                /* TODO */
                break;
        case LTTNG_EVENT_RULE_TYPE_SYSCALL:
-               /* TODO */
+               create_from_payload =
+                               lttng_event_rule_syscall_create_from_payload;
                break;
        default:
                ERR("Attempted to create event rule of unknown type (%i)",
diff --git a/src/common/event-rule/syscall.c b/src/common/event-rule/syscall.c
new file mode 100644 (file)
index 0000000..ef7ccd0
--- /dev/null
@@ -0,0 +1,468 @@
+/*
+ * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
+ *
+ * SPDX-License-Identifier: LGPL-2.1-only
+ *
+ */
+
+#include <assert.h>
+#include <common/error.h>
+#include <common/macros.h>
+#include <common/payload.h>
+#include <common/payload-view.h>
+#include <common/runas.h>
+#include <lttng/event-rule/event-rule-internal.h>
+#include <lttng/event-rule/syscall-internal.h>
+
+#define IS_SYSCALL_EVENT_RULE(rule) \
+       (lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)
+
+static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
+{
+       struct lttng_event_rule_syscall *syscall;
+
+       if (rule == NULL) {
+               return;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       free(syscall->pattern);
+       free(syscall->filter_expression);
+       free(syscall->internal_filter.filter);
+       free(syscall->internal_filter.bytecode);
+       free(syscall);
+}
+
+static bool lttng_event_rule_syscall_validate(
+               const struct lttng_event_rule *rule)
+{
+       bool valid = false;
+       struct lttng_event_rule_syscall *syscall;
+
+       if (!rule) {
+               goto end;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       /* Required field. */
+       if (!syscall->pattern) {
+               ERR("Invalid syscall event rule: a pattern must be set.");
+               goto end;
+       }
+
+       valid = true;
+end:
+       return valid;
+}
+
+static int lttng_event_rule_syscall_serialize(
+               const struct lttng_event_rule *rule,
+               struct lttng_payload *payload)
+{
+       int ret;
+       size_t pattern_len, filter_expression_len;
+       struct lttng_event_rule_syscall *syscall;
+       struct lttng_event_rule_syscall_comm syscall_comm;
+
+       if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
+               ret = -1;
+               goto end;
+       }
+
+       DBG("Serializing syscall event rule");
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       pattern_len = strlen(syscall->pattern) + 1;
+
+       if (syscall->filter_expression != NULL) {
+               filter_expression_len = strlen(syscall->filter_expression) + 1;
+       } else {
+               filter_expression_len = 0;
+       }
+
+       syscall_comm.pattern_len = pattern_len;
+       syscall_comm.filter_expression_len = filter_expression_len;
+
+       ret = lttng_dynamic_buffer_append(
+                       &payload->buffer, &syscall_comm, sizeof(syscall_comm));
+       if (ret) {
+               goto end;
+       }
+
+       ret = lttng_dynamic_buffer_append(
+                       &payload->buffer, syscall->pattern, pattern_len);
+       if (ret) {
+               goto end;
+       }
+
+       ret = lttng_dynamic_buffer_append(&payload->buffer,
+                       syscall->filter_expression, filter_expression_len);
+end:
+       return ret;
+}
+
+static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
+               const struct lttng_event_rule *_b)
+{
+       bool is_equal = false;
+       struct lttng_event_rule_syscall *a, *b;
+
+       a = container_of(_a, struct lttng_event_rule_syscall, parent);
+       b = container_of(_b, struct lttng_event_rule_syscall, parent);
+
+       if (!!a->filter_expression != !!b->filter_expression) {
+               goto end;
+       }
+
+       assert(a->pattern);
+       assert(b->pattern);
+       if (strcmp(a->pattern, b->pattern)) {
+               goto end;
+       }
+
+       if (a->filter_expression && b->filter_expression) {
+               if (strcmp(a->filter_expression, b->filter_expression)) {
+                       goto end;
+               }
+       } else if (!!a->filter_expression != !!b->filter_expression) {
+               /* One is set and not the other. */
+               goto end;
+       }
+
+       is_equal = true;
+end:
+       return is_equal;
+}
+
+static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
+               struct lttng_event_rule *rule, uid_t uid, gid_t gid)
+{
+       int ret;
+       enum lttng_error_code ret_code = LTTNG_OK;
+       struct lttng_event_rule_syscall *syscall;
+       enum lttng_event_rule_status status;
+       const char *filter;
+       struct lttng_filter_bytecode *bytecode = NULL;
+
+       assert(rule);
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       /* Generate the filter bytecode. */
+       status = lttng_event_rule_syscall_get_filter(rule, &filter);
+       if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
+               filter = NULL;
+       } else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
+               ret_code = LTTNG_ERR_FILTER_INVAL;
+               goto end;
+       }
+
+       if (filter && filter[0] == '\0') {
+               ret_code = LTTNG_ERR_FILTER_INVAL;
+               goto end;
+       }
+
+       if (filter == NULL) {
+               /* Nothing to do. */
+               ret = LTTNG_OK;
+               goto end;
+       }
+
+       syscall->internal_filter.filter = strdup(filter);
+       if (syscall->internal_filter.filter == NULL) {
+               ret_code = LTTNG_ERR_NOMEM;
+               goto end;
+       }
+
+       ret = run_as_generate_filter_bytecode(
+                       syscall->internal_filter.filter, uid, gid, &bytecode);
+       if (ret) {
+               ret_code = LTTNG_ERR_FILTER_INVAL;
+       }
+
+       syscall->internal_filter.bytecode = bytecode;
+       bytecode = NULL;
+
+end:
+       free(bytecode);
+       return ret_code;
+}
+
+static const char *lttng_event_rule_syscall_get_internal_filter(
+               const struct lttng_event_rule *rule)
+{
+       struct lttng_event_rule_syscall *syscall;
+
+       assert(rule);
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       return syscall->internal_filter.filter;
+}
+
+static const struct lttng_filter_bytecode *
+lttng_event_rule_syscall_get_internal_filter_bytecode(
+               const struct lttng_event_rule *rule)
+{
+       struct lttng_event_rule_syscall *syscall;
+
+       assert(rule);
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+
+       return syscall->internal_filter.bytecode;
+}
+
+static struct lttng_event_exclusion *
+lttng_event_rule_syscall_generate_exclusions(
+               const struct lttng_event_rule *rule)
+{
+       /* Not supported. */
+       return NULL;
+}
+
+struct lttng_event_rule *lttng_event_rule_syscall_create()
+{
+       struct lttng_event_rule *rule = NULL;
+       struct lttng_event_rule_syscall *syscall_rule;
+
+       syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
+       if (!syscall_rule) {
+               goto end;
+       }
+
+       rule = &syscall_rule->parent;
+       lttng_event_rule_init(
+                       &syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
+       syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
+       syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
+       syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
+       syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
+       syscall_rule->parent.generate_filter_bytecode =
+                       lttng_event_rule_syscall_generate_filter_bytecode;
+       syscall_rule->parent.get_filter =
+                       lttng_event_rule_syscall_get_internal_filter;
+       syscall_rule->parent.get_filter_bytecode =
+                       lttng_event_rule_syscall_get_internal_filter_bytecode;
+       syscall_rule->parent.generate_exclusions =
+                       lttng_event_rule_syscall_generate_exclusions;
+end:
+       return rule;
+}
+
+LTTNG_HIDDEN
+ssize_t lttng_event_rule_syscall_create_from_payload(
+               struct lttng_payload_view *view,
+               struct lttng_event_rule **_event_rule)
+{
+       ssize_t ret, offset = 0;
+       enum lttng_event_rule_status status;
+       const struct lttng_event_rule_syscall_comm *syscall_comm;
+       const char *pattern;
+       const char *filter_expression = NULL;
+       struct lttng_buffer_view current_buffer_view;
+       struct lttng_event_rule *rule = NULL;
+
+       if (!_event_rule) {
+               ret = -1;
+               goto end;
+       }
+
+       if (view->buffer.size < sizeof(*syscall_comm)) {
+               ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
+               ret = -1;
+               goto end;
+       }
+
+       current_buffer_view = lttng_buffer_view_from_view(
+                       &view->buffer, offset, sizeof(*syscall_comm));
+       syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
+
+       if (!syscall_comm) {
+               ret = -1;
+               goto end;
+       }
+
+       rule = lttng_event_rule_syscall_create();
+       if (!rule) {
+               ERR("Failed to create event rule syscall");
+               ret = -1;
+               goto end;
+       }
+
+       /* Skip to payload. */
+       offset += current_buffer_view.size;
+
+       /* Map the pattern. */
+       current_buffer_view = lttng_buffer_view_from_view(
+                       &view->buffer, offset, syscall_comm->pattern_len);
+       pattern = current_buffer_view.data;
+       if (!pattern) {
+               ret = -1;
+               goto end;
+       }
+
+       if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
+                       syscall_comm->pattern_len)) {
+               ret = -1;
+               goto end;
+       }
+
+       /* Skip after the pattern. */
+       offset += syscall_comm->pattern_len;
+
+       if (!syscall_comm->filter_expression_len) {
+               goto skip_filter_expression;
+       }
+
+       /* Map the filter_expression. */
+       current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
+                       syscall_comm->filter_expression_len);
+       filter_expression = current_buffer_view.data;
+       if (!filter_expression) {
+               ret = -1;
+               goto end;
+       }
+
+       if (!lttng_buffer_view_contains_string(&current_buffer_view,
+                               filter_expression,
+                               syscall_comm->filter_expression_len)) {
+               ret = -1;
+               goto end;
+       }
+
+       /* Skip after the pattern. */
+       offset += syscall_comm->filter_expression_len;
+
+skip_filter_expression:
+
+       status = lttng_event_rule_syscall_set_pattern(rule, pattern);
+       if (status != LTTNG_EVENT_RULE_STATUS_OK) {
+               ERR("Failed to set event rule syscall pattern");
+               ret = -1;
+               goto end;
+       }
+
+       if (filter_expression) {
+               status = lttng_event_rule_syscall_set_filter(
+                               rule, filter_expression);
+               if (status != LTTNG_EVENT_RULE_STATUS_OK) {
+                       ERR("Failed to set event rule syscall pattern");
+                       ret = -1;
+                       goto end;
+               }
+       }
+
+       *_event_rule = rule;
+       rule = NULL;
+       ret = offset;
+end:
+       lttng_event_rule_destroy(rule);
+       return ret;
+}
+
+enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
+               struct lttng_event_rule *rule, const char *pattern)
+{
+       char *pattern_copy = NULL;
+       struct lttng_event_rule_syscall *syscall;
+       enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
+
+       if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
+                       strlen(pattern) == 0) {
+               status = LTTNG_EVENT_RULE_STATUS_INVALID;
+               goto end;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+       pattern_copy = strdup(pattern);
+       if (!pattern_copy) {
+               status = LTTNG_EVENT_RULE_STATUS_ERROR;
+               goto end;
+       }
+
+       if (syscall->pattern) {
+               free(syscall->pattern);
+       }
+
+       syscall->pattern = pattern_copy;
+       pattern_copy = NULL;
+end:
+       return status;
+}
+
+enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
+               const struct lttng_event_rule *rule, const char **pattern)
+{
+       struct lttng_event_rule_syscall *syscall;
+       enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
+
+       if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
+               status = LTTNG_EVENT_RULE_STATUS_INVALID;
+               goto end;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+       if (!syscall->pattern) {
+               status = LTTNG_EVENT_RULE_STATUS_UNSET;
+               goto end;
+       }
+
+       *pattern = syscall->pattern;
+end:
+       return status;
+}
+
+enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
+               struct lttng_event_rule *rule, const char *expression)
+{
+       char *expression_copy = NULL;
+       struct lttng_event_rule_syscall *syscall;
+       enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
+
+       /* TODO: validate that the passed expression is valid. */
+
+       if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
+                       strlen(expression) == 0) {
+               status = LTTNG_EVENT_RULE_STATUS_INVALID;
+               goto end;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+       expression_copy = strdup(expression);
+       if (!expression_copy) {
+               status = LTTNG_EVENT_RULE_STATUS_ERROR;
+               goto end;
+       }
+
+       if (syscall->filter_expression) {
+               free(syscall->filter_expression);
+       }
+
+       syscall->filter_expression = expression_copy;
+       expression_copy = NULL;
+end:
+       return status;
+}
+
+enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
+               const struct lttng_event_rule *rule, const char **expression)
+{
+       struct lttng_event_rule_syscall *syscall;
+       enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
+
+       if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
+               status = LTTNG_EVENT_RULE_STATUS_INVALID;
+               goto end;
+       }
+
+       syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
+       if (!syscall->filter_expression) {
+               status = LTTNG_EVENT_RULE_STATUS_UNSET;
+               goto end;
+       }
+
+       *expression = syscall->filter_expression;
+end:
+       return status;
+}
This page took 0.046942 seconds and 4 git commands to generate.