[lttng-tools.git] / src / common / event-rule / syscall.c

/*
 * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-only
 *
 */

#include <assert.h>
#include <common/credentials.h>
#include <common/error.h>
#include <common/macros.h>
#include <common/payload.h>
#include <common/payload-view.h>
#include <common/runas.h>
#include <common/hashtable/hashtable.h>
#include <common/hashtable/utils.h>
#include <common/string-utils/string-utils.h>
#include <lttng/event-rule/event-rule-internal.h>
#include <lttng/event-rule/syscall-internal.h>

#define IS_SYSCALL_EVENT_RULE(rule) \
	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)

static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	if (rule == NULL) {
		return;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	free(syscall->pattern);
	free(syscall->filter_expression);
	free(syscall->internal_filter.filter);
	free(syscall->internal_filter.bytecode);
	free(syscall);
}

static bool lttng_event_rule_syscall_validate(
		const struct lttng_event_rule *rule)
{
	bool valid = false;
	struct lttng_event_rule_syscall *syscall;

	if (!rule) {
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Required field. */
	if (!syscall->pattern) {
		ERR("Invalid syscall event rule: a pattern must be set.");
		goto end;
	}

	valid = true;
end:
	return valid;
}

static int lttng_event_rule_syscall_serialize(
		const struct lttng_event_rule *rule,
		struct lttng_payload *payload)
{
	int ret;
	size_t pattern_len, filter_expression_len;
	struct lttng_event_rule_syscall *syscall;
	struct lttng_event_rule_syscall_comm syscall_comm;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
		ret = -1;
		goto end;
	}

	DBG("Serializing syscall event rule");
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	pattern_len = strlen(syscall->pattern) + 1;

	if (syscall->filter_expression != NULL) {
		filter_expression_len = strlen(syscall->filter_expression) + 1;
	} else {
		filter_expression_len = 0;
	}

	syscall_comm.pattern_len = pattern_len;
	syscall_comm.filter_expression_len = filter_expression_len;
	syscall_comm.emission_site_type = syscall->emission_site_type;

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, &syscall_comm, sizeof(syscall_comm));
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, syscall->pattern, pattern_len);
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(&payload->buffer,
			syscall->filter_expression, filter_expression_len);
end:
	return ret;
}

static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
		const struct lttng_event_rule *_b)
{
	bool is_equal = false;
	struct lttng_event_rule_syscall *a, *b;

	a = container_of(_a, struct lttng_event_rule_syscall, parent);
	b = container_of(_b, struct lttng_event_rule_syscall, parent);

	if (!!a->filter_expression != !!b->filter_expression) {
		goto end;
	}

	assert(a->pattern);
	assert(b->pattern);
	if (strcmp(a->pattern, b->pattern)) {
		goto end;
	}

	if (a->filter_expression && b->filter_expression) {
		if (strcmp(a->filter_expression, b->filter_expression)) {
			goto end;
		}
	} else if (!!a->filter_expression != !!b->filter_expression) {
		/* One is set and not the other. */
		goto end;
	}

	is_equal = true;
end:
	return is_equal;
}

static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
		struct lttng_event_rule *rule,
		const struct lttng_credentials *creds)
{
	int ret;
	enum lttng_error_code ret_code = LTTNG_OK;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status;
	const char *filter;
	struct lttng_bytecode *bytecode = NULL;

	assert(rule);

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Generate the filter bytecode. */
	status = lttng_event_rule_syscall_get_filter(rule, &filter);
	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
		filter = NULL;
	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter && filter[0] == '\0') {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter == NULL) {
		/* Nothing to do. */
		ret = LTTNG_OK;
		goto end;
	}

	syscall->internal_filter.filter = strdup(filter);
	if (syscall->internal_filter.filter == NULL) {
		ret_code = LTTNG_ERR_NOMEM;
		goto end;
	}

	ret = run_as_generate_filter_bytecode(
			syscall->internal_filter.filter, creds, &bytecode);
	if (ret) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
	}

	syscall->internal_filter.bytecode = bytecode;
	bytecode = NULL;

end:
	free(bytecode);
	return ret_code;
}

static const char *lttng_event_rule_syscall_get_internal_filter(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.filter;
}

static const struct lttng_bytecode *
lttng_event_rule_syscall_get_internal_filter_bytecode(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.bytecode;
}

static enum lttng_event_rule_generate_exclusions_status
lttng_event_rule_syscall_generate_exclusions(const struct lttng_event_rule *rule,
		struct lttng_event_exclusion **exclusions)
{
	/* Unsupported. */
	*exclusions = NULL;
	return LTTNG_EVENT_RULE_GENERATE_EXCLUSIONS_STATUS_NONE;
}

static unsigned long
lttng_event_rule_syscall_hash(
		const struct lttng_event_rule *rule)
{
	unsigned long hash;
	struct lttng_event_rule_syscall *syscall_rule =
			container_of(rule, typeof(*syscall_rule), parent);

	hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_SYSCALL,
			lttng_ht_seed);
	hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
	if (syscall_rule->filter_expression) {
		hash ^= hash_key_str(syscall_rule->filter_expression,
				lttng_ht_seed);
	}

	return hash;
}

struct lttng_event_rule *lttng_event_rule_syscall_create(
		enum lttng_event_rule_syscall_emission_site_type
				emission_site_type)
{
	struct lttng_event_rule *rule = NULL;
	struct lttng_event_rule_syscall *syscall_rule;
	enum lttng_event_rule_status status;

	/* Validate the emission site type */
	switch (emission_site_type) {
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY:
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_EXIT:
		break;
	default:
		/* Invalid emission type */
		goto end;
	}

	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
	if (!syscall_rule) {
		goto end;
	}

	rule = &syscall_rule->parent;
	lttng_event_rule_init(
			&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
	syscall_rule->parent.generate_filter_bytecode =
			lttng_event_rule_syscall_generate_filter_bytecode;
	syscall_rule->parent.get_filter =
			lttng_event_rule_syscall_get_internal_filter;
	syscall_rule->parent.get_filter_bytecode =
			lttng_event_rule_syscall_get_internal_filter_bytecode;
	syscall_rule->parent.generate_exclusions =
			lttng_event_rule_syscall_generate_exclusions;
	syscall_rule->parent.hash = lttng_event_rule_syscall_hash;

	/* Default pattern is '*'. */
	status = lttng_event_rule_syscall_set_name_pattern(rule, "*");
	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		lttng_event_rule_destroy(rule);
		rule = NULL;
	}

	/* Emission site type */
	syscall_rule->emission_site_type = emission_site_type;

end:
	return rule;
}

LTTNG_HIDDEN
ssize_t lttng_event_rule_syscall_create_from_payload(
		struct lttng_payload_view *view,
		struct lttng_event_rule **_event_rule)
{
	ssize_t ret, offset = 0;
	enum lttng_event_rule_status status;
	const struct lttng_event_rule_syscall_comm *syscall_comm;
	const char *pattern;
	const char *filter_expression = NULL;
	struct lttng_buffer_view current_buffer_view;
	struct lttng_event_rule *rule = NULL;

	if (!_event_rule) {
		ret = -1;
		goto end;
	}

	if (view->buffer.size < sizeof(*syscall_comm)) {
		ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
		ret = -1;
		goto end;
	}

	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, sizeof(*syscall_comm));
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
	rule = lttng_event_rule_syscall_create(syscall_comm->emission_site_type);
	if (!rule) {
		ERR("Failed to create event rule syscall");
		ret = -1;
		goto end;
	}

	/* Skip to payload. */
	offset += current_buffer_view.size;

	/* Map the pattern. */
	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, syscall_comm->pattern_len);
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	pattern = current_buffer_view.data;
	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
			syscall_comm->pattern_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->pattern_len;

	if (!syscall_comm->filter_expression_len) {
		goto skip_filter_expression;
	}

	/* Map the filter_expression. */
	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
			syscall_comm->filter_expression_len);
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	filter_expression = current_buffer_view.data;
	if (!lttng_buffer_view_contains_string(&current_buffer_view,
				filter_expression,
				syscall_comm->filter_expression_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->filter_expression_len;

skip_filter_expression:

	status = lttng_event_rule_syscall_set_name_pattern(rule, pattern);
	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ERR("Failed to set event rule syscall pattern");
		ret = -1;
		goto end;
	}

	if (filter_expression) {
		status = lttng_event_rule_syscall_set_filter(
				rule, filter_expression);
		if (status != LTTNG_EVENT_RULE_STATUS_OK) {
			ERR("Failed to set event rule syscall pattern");
			ret = -1;
			goto end;
		}
	}

	*_event_rule = rule;
	rule = NULL;
	ret = offset;
end:
	lttng_event_rule_destroy(rule);
	return ret;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_name_pattern(
		struct lttng_event_rule *rule, const char *pattern)
{
	char *pattern_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
			strlen(pattern) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	pattern_copy = strdup(pattern);
	if (!pattern_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	strutils_normalize_star_glob_pattern(pattern_copy);

	free(syscall->pattern);

	syscall->pattern = pattern_copy;
	pattern_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_name_pattern(
		const struct lttng_event_rule *rule, const char **pattern)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->pattern) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*pattern = syscall->pattern;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
		struct lttng_event_rule *rule, const char *expression)
{
	char *expression_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	/* TODO: validate that the passed expression is valid. */

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
			strlen(expression) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	expression_copy = strdup(expression);
	if (!expression_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	if (syscall->filter_expression) {
		free(syscall->filter_expression);
	}

	syscall->filter_expression = expression_copy;
	expression_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
		const struct lttng_event_rule *rule, const char **expression)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->filter_expression) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*expression = syscall->filter_expression;
end:
	return status;
}
extern enum lttng_event_rule_syscall_emission_site_type
lttng_event_rule_syscall_get_emission_site_type(
		const struct lttng_event_rule *rule)
{
	enum lttng_event_rule_syscall_emission_site_type emission_site_type =
		LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_UNKNOWN;
	struct lttng_event_rule_syscall *syscall;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	emission_site_type = syscall->emission_site_type;

end:
	return emission_site_type;
}

LTTNG_HIDDEN
const char *lttng_event_rule_syscall_emission_site_str(
		enum lttng_event_rule_syscall_emission_site_type type)
{
	switch (type) {
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY:
		return "entry";
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
		return "entry+exit";
	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_EXIT:
		return "exit";
	default:
		return "???";
	}
}
Commit	Line	Data
e6a39346 JR	1	/*
	2	* Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
	3	*
	4	* SPDX-License-Identifier: LGPL-2.1-only
	5	*
	6	*/
	7
	8	#include <assert.h>
58daac01	9	#include <common/credentials.h>
e6a39346 JR	10	#include <common/error.h>
	11	#include <common/macros.h>
	12	#include <common/payload.h>
	13	#include <common/payload-view.h>
	14	#include <common/runas.h>
959e3c66 JR	15	#include <common/hashtable/hashtable.h>
959e3c66 JR	16	#include <common/hashtable/utils.h>
40fd2ccf	17	#include <common/string-utils/string-utils.h>
e6a39346 JR	18	#include <lttng/event-rule/event-rule-internal.h>
	19	#include <lttng/event-rule/syscall-internal.h>
	20
	21	#define IS_SYSCALL_EVENT_RULE(rule) \
	22	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)
	23
	24	static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
	25	{
	26	struct lttng_event_rule_syscall *syscall;
	27
	28	if (rule == NULL) {
	29	return;
	30	}
	31
	32	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	33
	34	free(syscall->pattern);
	35	free(syscall->filter_expression);
	36	free(syscall->internal_filter.filter);
	37	free(syscall->internal_filter.bytecode);
	38	free(syscall);
	39	}
	40
	41	static bool lttng_event_rule_syscall_validate(
	42	const struct lttng_event_rule *rule)
	43	{
	44	bool valid = false;
	45	struct lttng_event_rule_syscall *syscall;
	46
	47	if (!rule) {
	48	goto end;
	49	}
	50
	51	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	52
	53	/* Required field. */
	54	if (!syscall->pattern) {
	55	ERR("Invalid syscall event rule: a pattern must be set.");
	56	goto end;
	57	}
	58
	59	valid = true;
	60	end:
	61	return valid;
	62	}
	63
	64	static int lttng_event_rule_syscall_serialize(
	65	const struct lttng_event_rule *rule,
	66	struct lttng_payload *payload)
	67	{
	68	int ret;
	69	size_t pattern_len, filter_expression_len;
	70	struct lttng_event_rule_syscall *syscall;
	71	struct lttng_event_rule_syscall_comm syscall_comm;
	72
	73	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule)) {
	74	ret = -1;
	75	goto end;
	76	}
	77
	78	DBG("Serializing syscall event rule");
	79	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	80
	81	pattern_len = strlen(syscall->pattern) + 1;
82
83	if (syscall->filter_expression != NULL) {
84	filter_expression_len = strlen(syscall->filter_expression) + 1;
85	} else {
86	filter_expression_len = 0;
87	}
88
89	syscall_comm.pattern_len = pattern_len;
90	syscall_comm.filter_expression_len = filter_expression_len;
57739a6b	91	syscall_comm.emission_site_type = syscall->emission_site_type;
e6a39346 JR	92
	93	ret = lttng_dynamic_buffer_append(
	94	&payload->buffer, &syscall_comm, sizeof(syscall_comm));
	95	if (ret) {
	96	goto end;
	97	}
	98
	99	ret = lttng_dynamic_buffer_append(
	100	&payload->buffer, syscall->pattern, pattern_len);
	101	if (ret) {
	102	goto end;
	103	}
	104
	105	ret = lttng_dynamic_buffer_append(&payload->buffer,
	106	syscall->filter_expression, filter_expression_len);
	107	end:
	108	return ret;
	109	}
	110
	111	static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
	112	const struct lttng_event_rule *_b)
	113	{
	114	bool is_equal = false;
	115	struct lttng_event_rule_syscall a, b;
	116
	117	a = container_of(_a, struct lttng_event_rule_syscall, parent);
	118	b = container_of(_b, struct lttng_event_rule_syscall, parent);
	119
	120	if (!!a->filter_expression != !!b->filter_expression) {
	121	goto end;
	122	}
	123
	124	assert(a->pattern);
	125	assert(b->pattern);
	126	if (strcmp(a->pattern, b->pattern)) {
	127	goto end;
	128	}
	129
	130	if (a->filter_expression && b->filter_expression) {
	131	if (strcmp(a->filter_expression, b->filter_expression)) {
	132	goto end;
	133	}
	134	} else if (!!a->filter_expression != !!b->filter_expression) {
	135	/* One is set and not the other. */
	136	goto end;
	137	}
	138
	139	is_equal = true;
	140	end:
	141	return is_equal;
	142	}
	143
	144	static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
58daac01 JR	145	struct lttng_event_rule *rule,
58daac01 JR	146	const struct lttng_credentials *creds)
e6a39346 JR	147	{
	148	int ret;
	149	enum lttng_error_code ret_code = LTTNG_OK;
	150	struct lttng_event_rule_syscall *syscall;
	151	enum lttng_event_rule_status status;
	152	const char *filter;
2b00d462	153	struct lttng_bytecode *bytecode = NULL;
e6a39346 JR	154
	155	assert(rule);
	156
	157	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	158
	159	/* Generate the filter bytecode. */
	160	status = lttng_event_rule_syscall_get_filter(rule, &filter);
	161	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
	162	filter = NULL;
	163	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	164	ret_code = LTTNG_ERR_FILTER_INVAL;
	165	goto end;
	166	}
	167
	168	if (filter && filter[0] == '\0') {
	169	ret_code = LTTNG_ERR_FILTER_INVAL;
	170	goto end;
	171	}
	172
	173	if (filter == NULL) {
	174	/* Nothing to do. */
	175	ret = LTTNG_OK;
	176	goto end;
	177	}
	178
	179	syscall->internal_filter.filter = strdup(filter);
	180	if (syscall->internal_filter.filter == NULL) {
	181	ret_code = LTTNG_ERR_NOMEM;
	182	goto end;
	183	}
	184
	185	ret = run_as_generate_filter_bytecode(
58daac01	186	syscall->internal_filter.filter, creds, &bytecode);
e6a39346 JR	187	if (ret) {
	188	ret_code = LTTNG_ERR_FILTER_INVAL;
	189	}
	190
	191	syscall->internal_filter.bytecode = bytecode;
	192	bytecode = NULL;
	193
	194	end:
	195	free(bytecode);
	196	return ret_code;
	197	}
	198
	199	static const char *lttng_event_rule_syscall_get_internal_filter(
	200	const struct lttng_event_rule *rule)
	201	{
	202	struct lttng_event_rule_syscall *syscall;
	203
	204	assert(rule);
	205	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	206
	207	return syscall->internal_filter.filter;
	208	}
	209
2b00d462	210	static const struct lttng_bytecode *
e6a39346 JR	211	lttng_event_rule_syscall_get_internal_filter_bytecode(
	212	const struct lttng_event_rule *rule)
	213	{
	214	struct lttng_event_rule_syscall *syscall;
	215
	216	assert(rule);
	217	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	218
	219	return syscall->internal_filter.bytecode;
	220	}
	221
993578ff JR	222	static enum lttng_event_rule_generate_exclusions_status
	223	lttng_event_rule_syscall_generate_exclusions(const struct lttng_event_rule *rule,
	224	struct lttng_event_exclusion **exclusions)
e6a39346	225	{
993578ff JR	226	/* Unsupported. */
	227	*exclusions = NULL;
	228	return LTTNG_EVENT_RULE_GENERATE_EXCLUSIONS_STATUS_NONE;
e6a39346 JR	229	}
e6a39346 JR	230
959e3c66 JR	231	static unsigned long
	232	lttng_event_rule_syscall_hash(
	233	const struct lttng_event_rule *rule)
	234	{
	235	unsigned long hash;
	236	struct lttng_event_rule_syscall *syscall_rule =
	237	container_of(rule, typeof(*syscall_rule), parent);
	238
	239	hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_SYSCALL,
	240	lttng_ht_seed);
	241	hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
	242	if (syscall_rule->filter_expression) {
	243	hash ^= hash_key_str(syscall_rule->filter_expression,
	244	lttng_ht_seed);
	245	}
	246
	247	return hash;
	248	}
	249
57739a6b JR	250	struct lttng_event_rule *lttng_event_rule_syscall_create(
	251	enum lttng_event_rule_syscall_emission_site_type
	252	emission_site_type)
e6a39346 JR	253	{
	254	struct lttng_event_rule *rule = NULL;
	255	struct lttng_event_rule_syscall *syscall_rule;
67d38b93	256	enum lttng_event_rule_status status;
e6a39346	257
57739a6b JR	258	/* Validate the emission site type */
	259	switch (emission_site_type) {
	260	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
	261	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY:
	262	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_EXIT:
	263	break;
	264	default:
	265	/* Invalid emission type */
	266	goto end;
	267	}
	268
e6a39346 JR	269	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
	270	if (!syscall_rule) {
	271	goto end;
	272	}
	273
	274	rule = &syscall_rule->parent;
	275	lttng_event_rule_init(
	276	&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
	277	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
	278	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
	279	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
	280	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
	281	syscall_rule->parent.generate_filter_bytecode =
	282	lttng_event_rule_syscall_generate_filter_bytecode;
	283	syscall_rule->parent.get_filter =
	284	lttng_event_rule_syscall_get_internal_filter;
	285	syscall_rule->parent.get_filter_bytecode =
	286	lttng_event_rule_syscall_get_internal_filter_bytecode;
	287	syscall_rule->parent.generate_exclusions =
	288	lttng_event_rule_syscall_generate_exclusions;
959e3c66	289	syscall_rule->parent.hash = lttng_event_rule_syscall_hash;
67d38b93 JR	290
67d38b93 JR	291	/* Default pattern is ''. /
b2eeb0d5	292	status = lttng_event_rule_syscall_set_name_pattern(rule, "*");
67d38b93 JR	293	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	294	lttng_event_rule_destroy(rule);
	295	rule = NULL;
	296	}
	297
57739a6b JR	298	/* Emission site type */
	299	syscall_rule->emission_site_type = emission_site_type;
	300
e6a39346 JR	301	end:
	302	return rule;
	303	}
	304
	305	LTTNG_HIDDEN
	306	ssize_t lttng_event_rule_syscall_create_from_payload(
	307	struct lttng_payload_view *view,
	308	struct lttng_event_rule **_event_rule)
	309	{
	310	ssize_t ret, offset = 0;
	311	enum lttng_event_rule_status status;
	312	const struct lttng_event_rule_syscall_comm *syscall_comm;
	313	const char *pattern;
	314	const char *filter_expression = NULL;
	315	struct lttng_buffer_view current_buffer_view;
	316	struct lttng_event_rule *rule = NULL;
	317
	318	if (!_event_rule) {
	319	ret = -1;
	320	goto end;
	321	}
	322
	323	if (view->buffer.size < sizeof(*syscall_comm)) {
	324	ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
	325	ret = -1;
	326	goto end;
	327	}
	328
	329	current_buffer_view = lttng_buffer_view_from_view(
	330	&view->buffer, offset, sizeof(*syscall_comm));
3e6e0df2	331	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	332	ret = -1;
	333	goto end;
	334	}
	335
3e6e0df2	336	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
57739a6b	337	rule = lttng_event_rule_syscall_create(syscall_comm->emission_site_type);
e6a39346 JR	338	if (!rule) {
	339	ERR("Failed to create event rule syscall");
	340	ret = -1;
	341	goto end;
	342	}
	343
	344	/* Skip to payload. */
	345	offset += current_buffer_view.size;
	346
	347	/* Map the pattern. */
	348	current_buffer_view = lttng_buffer_view_from_view(
	349	&view->buffer, offset, syscall_comm->pattern_len);
3e6e0df2	350	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	351	ret = -1;
	352	goto end;
	353	}
	354
3e6e0df2	355	pattern = current_buffer_view.data;
e6a39346 JR	356	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
	357	syscall_comm->pattern_len)) {
	358	ret = -1;
	359	goto end;
	360	}
	361
	362	/* Skip after the pattern. */
	363	offset += syscall_comm->pattern_len;
	364
	365	if (!syscall_comm->filter_expression_len) {
	366	goto skip_filter_expression;
	367	}
	368
	369	/* Map the filter_expression. */
	370	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
	371	syscall_comm->filter_expression_len);
3e6e0df2	372	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	373	ret = -1;
	374	goto end;
	375	}
	376
3e6e0df2	377	filter_expression = current_buffer_view.data;
e6a39346 JR	378	if (!lttng_buffer_view_contains_string(&current_buffer_view,
	379	filter_expression,
	380	syscall_comm->filter_expression_len)) {
	381	ret = -1;
	382	goto end;
	383	}
	384
	385	/* Skip after the pattern. */
	386	offset += syscall_comm->filter_expression_len;
	387
	388	skip_filter_expression:
	389
b2eeb0d5	390	status = lttng_event_rule_syscall_set_name_pattern(rule, pattern);
e6a39346 JR	391	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	392	ERR("Failed to set event rule syscall pattern");
	393	ret = -1;
	394	goto end;
	395	}
	396
	397	if (filter_expression) {
	398	status = lttng_event_rule_syscall_set_filter(
	399	rule, filter_expression);
	400	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	401	ERR("Failed to set event rule syscall pattern");
	402	ret = -1;
	403	goto end;
	404	}
	405	}
	406
	407	*_event_rule = rule;
	408	rule = NULL;
	409	ret = offset;
	410	end:
	411	lttng_event_rule_destroy(rule);
	412	return ret;
	413	}
	414
b2eeb0d5	415	enum lttng_event_rule_status lttng_event_rule_syscall_set_name_pattern(
e6a39346 JR	416	struct lttng_event_rule rule, const char pattern)
	417	{
	418	char *pattern_copy = NULL;
	419	struct lttng_event_rule_syscall *syscall;
	420	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
	421
	422	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern \|\|
	423	strlen(pattern) == 0) {
	424	status = LTTNG_EVENT_RULE_STATUS_INVALID;
	425	goto end;
	426	}
	427
	428	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	429	pattern_copy = strdup(pattern);
	430	if (!pattern_copy) {
	431	status = LTTNG_EVENT_RULE_STATUS_ERROR;
	432	goto end;
	433	}
	434
40fd2ccf JR	435	strutils_normalize_star_glob_pattern(pattern_copy);
	436
	437	free(syscall->pattern);
e6a39346 JR	438
	439	syscall->pattern = pattern_copy;
	440	pattern_copy = NULL;
	441	end:
	442	return status;
	443	}
	444
b2eeb0d5	445	enum lttng_event_rule_status lttng_event_rule_syscall_get_name_pattern(
e6a39346 JR	446	const struct lttng_event_rule rule, const char *pattern)
	447	{
	448	struct lttng_event_rule_syscall *syscall;
	449	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
	450
	451	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern) {
	452	status = LTTNG_EVENT_RULE_STATUS_INVALID;
	453	goto end;
	454	}
	455
	456	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	457	if (!syscall->pattern) {
	458	status = LTTNG_EVENT_RULE_STATUS_UNSET;
	459	goto end;
	460	}
	461
	462	*pattern = syscall->pattern;
	463	end:
	464	return status;
	465	}
	466
	467	enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
	468	struct lttng_event_rule rule, const char expression)
	469	{
	470	char *expression_copy = NULL;
	471	struct lttng_event_rule_syscall *syscall;
	472	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
	473
	474	/* TODO: validate that the passed expression is valid. */
	475
	476	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression \|\|
	477	strlen(expression) == 0) {
	478	status = LTTNG_EVENT_RULE_STATUS_INVALID;
	479	goto end;
	480	}
	481
	482	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	483	expression_copy = strdup(expression);
	484	if (!expression_copy) {
	485	status = LTTNG_EVENT_RULE_STATUS_ERROR;
	486	goto end;
	487	}
	488
	489	if (syscall->filter_expression) {
	490	free(syscall->filter_expression);
	491	}
	492
	493	syscall->filter_expression = expression_copy;
	494	expression_copy = NULL;
	495	end:
	496	return status;
	497	}
	498
	499	enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
	500	const struct lttng_event_rule rule, const char *expression)
	501	{
	502	struct lttng_event_rule_syscall *syscall;
	503	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
	504
	505	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression) {
	506	status = LTTNG_EVENT_RULE_STATUS_INVALID;
	507	goto end;
	508	}
	509
510	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
511	if (!syscall->filter_expression) {
512	status = LTTNG_EVENT_RULE_STATUS_UNSET;
513	goto end;
514	}
515
516	*expression = syscall->filter_expression;
517	end:
518	return status;
519	}
57739a6b JR	520	extern enum lttng_event_rule_syscall_emission_site_type
	521	lttng_event_rule_syscall_get_emission_site_type(
	522	const struct lttng_event_rule *rule)
	523	{
	524	enum lttng_event_rule_syscall_emission_site_type emission_site_type =
	525	LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_UNKNOWN;
	526	struct lttng_event_rule_syscall *syscall;
	527
	528	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule)) {
	529	goto end;
	530	}
	531
	532	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	533	emission_site_type = syscall->emission_site_type;
	534
	535	end:
	536	return emission_site_type;
	537	}
	538
	539	LTTNG_HIDDEN
	540	const char *lttng_event_rule_syscall_emission_site_str(
	541	enum lttng_event_rule_syscall_emission_site_type type)
	542	{
	543	switch (type) {
	544	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY:
	545	return "entry";
	546	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
	547	return "entry+exit";
	548	case LTTNG_EVENT_RULE_SYSCALL_EMISSION_SITE_EXIT:
	549	return "exit";
	550	default:
	551	return "???";
	552	}
	553	}