[lttng-tools.git] / src / common / event-rule / syscall.c

/*
 * Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
 *
 * SPDX-License-Identifier: LGPL-2.1-only
 *
 */

#include <assert.h>
#include <common/credentials.h>
#include <common/error.h>
#include <common/macros.h>
#include <common/payload.h>
#include <common/payload-view.h>
#include <common/runas.h>
#include <common/hashtable/hashtable.h>
#include <common/hashtable/utils.h>
#include <lttng/event-rule/event-rule-internal.h>
#include <lttng/event-rule/syscall-internal.h>

#define IS_SYSCALL_EVENT_RULE(rule) \
	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)

static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	if (rule == NULL) {
		return;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	free(syscall->pattern);
	free(syscall->filter_expression);
	free(syscall->internal_filter.filter);
	free(syscall->internal_filter.bytecode);
	free(syscall);
}

static bool lttng_event_rule_syscall_validate(
		const struct lttng_event_rule *rule)
{
	bool valid = false;
	struct lttng_event_rule_syscall *syscall;

	if (!rule) {
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Required field. */
	if (!syscall->pattern) {
		ERR("Invalid syscall event rule: a pattern must be set.");
		goto end;
	}

	valid = true;
end:
	return valid;
}

static int lttng_event_rule_syscall_serialize(
		const struct lttng_event_rule *rule,
		struct lttng_payload *payload)
{
	int ret;
	size_t pattern_len, filter_expression_len;
	struct lttng_event_rule_syscall *syscall;
	struct lttng_event_rule_syscall_comm syscall_comm;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule)) {
		ret = -1;
		goto end;
	}

	DBG("Serializing syscall event rule");
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	pattern_len = strlen(syscall->pattern) + 1;

	if (syscall->filter_expression != NULL) {
		filter_expression_len = strlen(syscall->filter_expression) + 1;
	} else {
		filter_expression_len = 0;
	}

	syscall_comm.pattern_len = pattern_len;
	syscall_comm.filter_expression_len = filter_expression_len;

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, &syscall_comm, sizeof(syscall_comm));
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(
			&payload->buffer, syscall->pattern, pattern_len);
	if (ret) {
		goto end;
	}

	ret = lttng_dynamic_buffer_append(&payload->buffer,
			syscall->filter_expression, filter_expression_len);
end:
	return ret;
}

static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
		const struct lttng_event_rule *_b)
{
	bool is_equal = false;
	struct lttng_event_rule_syscall *a, *b;

	a = container_of(_a, struct lttng_event_rule_syscall, parent);
	b = container_of(_b, struct lttng_event_rule_syscall, parent);

	if (!!a->filter_expression != !!b->filter_expression) {
		goto end;
	}

	assert(a->pattern);
	assert(b->pattern);
	if (strcmp(a->pattern, b->pattern)) {
		goto end;
	}

	if (a->filter_expression && b->filter_expression) {
		if (strcmp(a->filter_expression, b->filter_expression)) {
			goto end;
		}
	} else if (!!a->filter_expression != !!b->filter_expression) {
		/* One is set and not the other. */
		goto end;
	}

	is_equal = true;
end:
	return is_equal;
}

static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
		struct lttng_event_rule *rule,
		const struct lttng_credentials *creds)
{
	int ret;
	enum lttng_error_code ret_code = LTTNG_OK;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status;
	const char *filter;
	struct lttng_filter_bytecode *bytecode = NULL;

	assert(rule);

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	/* Generate the filter bytecode. */
	status = lttng_event_rule_syscall_get_filter(rule, &filter);
	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
		filter = NULL;
	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter && filter[0] == '\0') {
		ret_code = LTTNG_ERR_FILTER_INVAL;
		goto end;
	}

	if (filter == NULL) {
		/* Nothing to do. */
		ret = LTTNG_OK;
		goto end;
	}

	syscall->internal_filter.filter = strdup(filter);
	if (syscall->internal_filter.filter == NULL) {
		ret_code = LTTNG_ERR_NOMEM;
		goto end;
	}

	ret = run_as_generate_filter_bytecode(
			syscall->internal_filter.filter, creds, &bytecode);
	if (ret) {
		ret_code = LTTNG_ERR_FILTER_INVAL;
	}

	syscall->internal_filter.bytecode = bytecode;
	bytecode = NULL;

end:
	free(bytecode);
	return ret_code;
}

static const char *lttng_event_rule_syscall_get_internal_filter(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.filter;
}

static const struct lttng_filter_bytecode *
lttng_event_rule_syscall_get_internal_filter_bytecode(
		const struct lttng_event_rule *rule)
{
	struct lttng_event_rule_syscall *syscall;

	assert(rule);
	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);

	return syscall->internal_filter.bytecode;
}

static struct lttng_event_exclusion *
lttng_event_rule_syscall_generate_exclusions(
		const struct lttng_event_rule *rule)
{
	/* Not supported. */
	return NULL;
}

static unsigned long
lttng_event_rule_syscall_hash(
		const struct lttng_event_rule *rule)
{
	unsigned long hash;
	struct lttng_event_rule_syscall *syscall_rule =
			container_of(rule, typeof(*syscall_rule), parent);

	hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_SYSCALL,
			lttng_ht_seed);
	hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
	if (syscall_rule->filter_expression) {
		hash ^= hash_key_str(syscall_rule->filter_expression,
				lttng_ht_seed);
	}

	return hash;
}

struct lttng_event_rule *lttng_event_rule_syscall_create()
{
	struct lttng_event_rule *rule = NULL;
	struct lttng_event_rule_syscall *syscall_rule;

	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
	if (!syscall_rule) {
		goto end;
	}

	rule = &syscall_rule->parent;
	lttng_event_rule_init(
			&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
	syscall_rule->parent.generate_filter_bytecode =
			lttng_event_rule_syscall_generate_filter_bytecode;
	syscall_rule->parent.get_filter =
			lttng_event_rule_syscall_get_internal_filter;
	syscall_rule->parent.get_filter_bytecode =
			lttng_event_rule_syscall_get_internal_filter_bytecode;
	syscall_rule->parent.generate_exclusions =
			lttng_event_rule_syscall_generate_exclusions;
	syscall_rule->parent.hash = lttng_event_rule_syscall_hash;
end:
	return rule;
}

LTTNG_HIDDEN
ssize_t lttng_event_rule_syscall_create_from_payload(
		struct lttng_payload_view *view,
		struct lttng_event_rule **_event_rule)
{
	ssize_t ret, offset = 0;
	enum lttng_event_rule_status status;
	const struct lttng_event_rule_syscall_comm *syscall_comm;
	const char *pattern;
	const char *filter_expression = NULL;
	struct lttng_buffer_view current_buffer_view;
	struct lttng_event_rule *rule = NULL;

	if (!_event_rule) {
		ret = -1;
		goto end;
	}

	if (view->buffer.size < sizeof(*syscall_comm)) {
		ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
		ret = -1;
		goto end;
	}

	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, sizeof(*syscall_comm));
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
	rule = lttng_event_rule_syscall_create();
	if (!rule) {
		ERR("Failed to create event rule syscall");
		ret = -1;
		goto end;
	}

	/* Skip to payload. */
	offset += current_buffer_view.size;

	/* Map the pattern. */
	current_buffer_view = lttng_buffer_view_from_view(
			&view->buffer, offset, syscall_comm->pattern_len);
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	pattern = current_buffer_view.data;
	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
			syscall_comm->pattern_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->pattern_len;

	if (!syscall_comm->filter_expression_len) {
		goto skip_filter_expression;
	}

	/* Map the filter_expression. */
	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
			syscall_comm->filter_expression_len);
	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
		ret = -1;
		goto end;
	}

	filter_expression = current_buffer_view.data;
	if (!lttng_buffer_view_contains_string(&current_buffer_view,
				filter_expression,
				syscall_comm->filter_expression_len)) {
		ret = -1;
		goto end;
	}

	/* Skip after the pattern. */
	offset += syscall_comm->filter_expression_len;

skip_filter_expression:

	status = lttng_event_rule_syscall_set_pattern(rule, pattern);
	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
		ERR("Failed to set event rule syscall pattern");
		ret = -1;
		goto end;
	}

	if (filter_expression) {
		status = lttng_event_rule_syscall_set_filter(
				rule, filter_expression);
		if (status != LTTNG_EVENT_RULE_STATUS_OK) {
			ERR("Failed to set event rule syscall pattern");
			ret = -1;
			goto end;
		}
	}

	*_event_rule = rule;
	rule = NULL;
	ret = offset;
end:
	lttng_event_rule_destroy(rule);
	return ret;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
		struct lttng_event_rule *rule, const char *pattern)
{
	char *pattern_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern ||
			strlen(pattern) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	pattern_copy = strdup(pattern);
	if (!pattern_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	if (syscall->pattern) {
		free(syscall->pattern);
	}

	syscall->pattern = pattern_copy;
	pattern_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
		const struct lttng_event_rule *rule, const char **pattern)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !pattern) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->pattern) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*pattern = syscall->pattern;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
		struct lttng_event_rule *rule, const char *expression)
{
	char *expression_copy = NULL;
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	/* TODO: validate that the passed expression is valid. */

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression ||
			strlen(expression) == 0) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	expression_copy = strdup(expression);
	if (!expression_copy) {
		status = LTTNG_EVENT_RULE_STATUS_ERROR;
		goto end;
	}

	if (syscall->filter_expression) {
		free(syscall->filter_expression);
	}

	syscall->filter_expression = expression_copy;
	expression_copy = NULL;
end:
	return status;
}

enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
		const struct lttng_event_rule *rule, const char **expression)
{
	struct lttng_event_rule_syscall *syscall;
	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;

	if (!rule || !IS_SYSCALL_EVENT_RULE(rule) || !expression) {
		status = LTTNG_EVENT_RULE_STATUS_INVALID;
		goto end;
	}

	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	if (!syscall->filter_expression) {
		status = LTTNG_EVENT_RULE_STATUS_UNSET;
		goto end;
	}

	*expression = syscall->filter_expression;
end:
	return status;
}
Commit	Line	Data
e6a39346 JR	1	/*
	2	* Copyright (C) 2019 Jonathan Rajotte <jonathan.rajotte-julien@efficios.com>
	3	*
	4	* SPDX-License-Identifier: LGPL-2.1-only
	5	*
	6	*/
	7
	8	#include <assert.h>
58daac01	9	#include <common/credentials.h>
e6a39346 JR	10	#include <common/error.h>
	11	#include <common/macros.h>
	12	#include <common/payload.h>
	13	#include <common/payload-view.h>
	14	#include <common/runas.h>
959e3c66 JR	15	#include <common/hashtable/hashtable.h>
959e3c66 JR	16	#include <common/hashtable/utils.h>
e6a39346 JR	17	#include <lttng/event-rule/event-rule-internal.h>
	18	#include <lttng/event-rule/syscall-internal.h>
	19
	20	#define IS_SYSCALL_EVENT_RULE(rule) \
	21	(lttng_event_rule_get_type(rule) == LTTNG_EVENT_RULE_TYPE_SYSCALL)
	22
	23	static void lttng_event_rule_syscall_destroy(struct lttng_event_rule *rule)
	24	{
	25	struct lttng_event_rule_syscall *syscall;
	26
	27	if (rule == NULL) {
	28	return;
	29	}
	30
	31	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	32
	33	free(syscall->pattern);
	34	free(syscall->filter_expression);
	35	free(syscall->internal_filter.filter);
	36	free(syscall->internal_filter.bytecode);
	37	free(syscall);
	38	}
	39
	40	static bool lttng_event_rule_syscall_validate(
	41	const struct lttng_event_rule *rule)
	42	{
	43	bool valid = false;
	44	struct lttng_event_rule_syscall *syscall;
	45
	46	if (!rule) {
	47	goto end;
	48	}
	49
	50	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	51
	52	/* Required field. */
	53	if (!syscall->pattern) {
	54	ERR("Invalid syscall event rule: a pattern must be set.");
	55	goto end;
	56	}
	57
	58	valid = true;
	59	end:
	60	return valid;
	61	}
	62
	63	static int lttng_event_rule_syscall_serialize(
	64	const struct lttng_event_rule *rule,
	65	struct lttng_payload *payload)
	66	{
	67	int ret;
	68	size_t pattern_len, filter_expression_len;
	69	struct lttng_event_rule_syscall *syscall;
	70	struct lttng_event_rule_syscall_comm syscall_comm;
	71
	72	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule)) {
	73	ret = -1;
	74	goto end;
	75	}
	76
	77	DBG("Serializing syscall event rule");
	78	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	79
	80	pattern_len = strlen(syscall->pattern) + 1;
81
82	if (syscall->filter_expression != NULL) {
83	filter_expression_len = strlen(syscall->filter_expression) + 1;
84	} else {
85	filter_expression_len = 0;
86	}
87
88	syscall_comm.pattern_len = pattern_len;
89	syscall_comm.filter_expression_len = filter_expression_len;
90
91	ret = lttng_dynamic_buffer_append(
92	&payload->buffer, &syscall_comm, sizeof(syscall_comm));
93	if (ret) {
94	goto end;
95	}
96
97	ret = lttng_dynamic_buffer_append(
98	&payload->buffer, syscall->pattern, pattern_len);
99	if (ret) {
100	goto end;
101	}
102
103	ret = lttng_dynamic_buffer_append(&payload->buffer,
104	syscall->filter_expression, filter_expression_len);
105	end:
106	return ret;
107	}
108
109	static bool lttng_event_rule_syscall_is_equal(const struct lttng_event_rule *_a,
110	const struct lttng_event_rule *_b)
111	{
112	bool is_equal = false;
113	struct lttng_event_rule_syscall a, b;
114
115	a = container_of(_a, struct lttng_event_rule_syscall, parent);
116	b = container_of(_b, struct lttng_event_rule_syscall, parent);
117
118	if (!!a->filter_expression != !!b->filter_expression) {
119	goto end;
120	}
121
122	assert(a->pattern);
123	assert(b->pattern);
124	if (strcmp(a->pattern, b->pattern)) {
125	goto end;
126	}
127
128	if (a->filter_expression && b->filter_expression) {
129	if (strcmp(a->filter_expression, b->filter_expression)) {
130	goto end;
131	}
132	} else if (!!a->filter_expression != !!b->filter_expression) {
133	/* One is set and not the other. */
134	goto end;
135	}
136
137	is_equal = true;
138	end:
139	return is_equal;
140	}
141
142	static enum lttng_error_code lttng_event_rule_syscall_generate_filter_bytecode(
58daac01 JR	143	struct lttng_event_rule *rule,
58daac01 JR	144	const struct lttng_credentials *creds)
e6a39346 JR	145	{
	146	int ret;
	147	enum lttng_error_code ret_code = LTTNG_OK;
	148	struct lttng_event_rule_syscall *syscall;
	149	enum lttng_event_rule_status status;
	150	const char *filter;
	151	struct lttng_filter_bytecode *bytecode = NULL;
	152
	153	assert(rule);
	154
	155	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	156
	157	/* Generate the filter bytecode. */
	158	status = lttng_event_rule_syscall_get_filter(rule, &filter);
	159	if (status == LTTNG_EVENT_RULE_STATUS_UNSET) {
	160	filter = NULL;
	161	} else if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	162	ret_code = LTTNG_ERR_FILTER_INVAL;
	163	goto end;
	164	}
	165
	166	if (filter && filter[0] == '\0') {
	167	ret_code = LTTNG_ERR_FILTER_INVAL;
	168	goto end;
	169	}
	170
	171	if (filter == NULL) {
	172	/* Nothing to do. */
	173	ret = LTTNG_OK;
	174	goto end;
	175	}
	176
	177	syscall->internal_filter.filter = strdup(filter);
	178	if (syscall->internal_filter.filter == NULL) {
	179	ret_code = LTTNG_ERR_NOMEM;
	180	goto end;
	181	}
	182
	183	ret = run_as_generate_filter_bytecode(
58daac01	184	syscall->internal_filter.filter, creds, &bytecode);
e6a39346 JR	185	if (ret) {
	186	ret_code = LTTNG_ERR_FILTER_INVAL;
	187	}
	188
	189	syscall->internal_filter.bytecode = bytecode;
	190	bytecode = NULL;
	191
	192	end:
	193	free(bytecode);
	194	return ret_code;
	195	}
	196
	197	static const char *lttng_event_rule_syscall_get_internal_filter(
	198	const struct lttng_event_rule *rule)
	199	{
	200	struct lttng_event_rule_syscall *syscall;
	201
	202	assert(rule);
	203	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	204
	205	return syscall->internal_filter.filter;
	206	}
	207
	208	static const struct lttng_filter_bytecode *
	209	lttng_event_rule_syscall_get_internal_filter_bytecode(
	210	const struct lttng_event_rule *rule)
	211	{
	212	struct lttng_event_rule_syscall *syscall;
	213
	214	assert(rule);
	215	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	216
	217	return syscall->internal_filter.bytecode;
	218	}
	219
	220	static struct lttng_event_exclusion *
	221	lttng_event_rule_syscall_generate_exclusions(
	222	const struct lttng_event_rule *rule)
	223	{
	224	/* Not supported. */
	225	return NULL;
	226	}
	227
959e3c66 JR	228	static unsigned long
	229	lttng_event_rule_syscall_hash(
	230	const struct lttng_event_rule *rule)
	231	{
	232	unsigned long hash;
	233	struct lttng_event_rule_syscall *syscall_rule =
	234	container_of(rule, typeof(*syscall_rule), parent);
	235
	236	hash = hash_key_ulong((void *) LTTNG_EVENT_RULE_TYPE_SYSCALL,
	237	lttng_ht_seed);
	238	hash ^= hash_key_str(syscall_rule->pattern, lttng_ht_seed);
	239	if (syscall_rule->filter_expression) {
	240	hash ^= hash_key_str(syscall_rule->filter_expression,
	241	lttng_ht_seed);
	242	}
	243
	244	return hash;
	245	}
	246
e6a39346 JR	247	struct lttng_event_rule *lttng_event_rule_syscall_create()
	248	{
	249	struct lttng_event_rule *rule = NULL;
	250	struct lttng_event_rule_syscall *syscall_rule;
	251
	252	syscall_rule = zmalloc(sizeof(struct lttng_event_rule_syscall));
	253	if (!syscall_rule) {
	254	goto end;
	255	}
	256
	257	rule = &syscall_rule->parent;
	258	lttng_event_rule_init(
	259	&syscall_rule->parent, LTTNG_EVENT_RULE_TYPE_SYSCALL);
	260	syscall_rule->parent.validate = lttng_event_rule_syscall_validate;
	261	syscall_rule->parent.serialize = lttng_event_rule_syscall_serialize;
	262	syscall_rule->parent.equal = lttng_event_rule_syscall_is_equal;
	263	syscall_rule->parent.destroy = lttng_event_rule_syscall_destroy;
	264	syscall_rule->parent.generate_filter_bytecode =
	265	lttng_event_rule_syscall_generate_filter_bytecode;
	266	syscall_rule->parent.get_filter =
	267	lttng_event_rule_syscall_get_internal_filter;
	268	syscall_rule->parent.get_filter_bytecode =
	269	lttng_event_rule_syscall_get_internal_filter_bytecode;
	270	syscall_rule->parent.generate_exclusions =
	271	lttng_event_rule_syscall_generate_exclusions;
959e3c66	272	syscall_rule->parent.hash = lttng_event_rule_syscall_hash;
e6a39346 JR	273	end:
	274	return rule;
	275	}
	276
	277	LTTNG_HIDDEN
	278	ssize_t lttng_event_rule_syscall_create_from_payload(
	279	struct lttng_payload_view *view,
	280	struct lttng_event_rule **_event_rule)
	281	{
	282	ssize_t ret, offset = 0;
	283	enum lttng_event_rule_status status;
	284	const struct lttng_event_rule_syscall_comm *syscall_comm;
	285	const char *pattern;
	286	const char *filter_expression = NULL;
	287	struct lttng_buffer_view current_buffer_view;
	288	struct lttng_event_rule *rule = NULL;
	289
	290	if (!_event_rule) {
	291	ret = -1;
	292	goto end;
	293	}
	294
	295	if (view->buffer.size < sizeof(*syscall_comm)) {
	296	ERR("Failed to initialize from malformed event rule syscall: buffer too short to contain header");
	297	ret = -1;
	298	goto end;
	299	}
	300
	301	current_buffer_view = lttng_buffer_view_from_view(
	302	&view->buffer, offset, sizeof(*syscall_comm));
3e6e0df2	303	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	304	ret = -1;
	305	goto end;
	306	}
	307
3e6e0df2	308	syscall_comm = (typeof(syscall_comm)) current_buffer_view.data;
e6a39346 JR	309	rule = lttng_event_rule_syscall_create();
	310	if (!rule) {
	311	ERR("Failed to create event rule syscall");
	312	ret = -1;
	313	goto end;
	314	}
	315
	316	/* Skip to payload. */
	317	offset += current_buffer_view.size;
	318
	319	/* Map the pattern. */
	320	current_buffer_view = lttng_buffer_view_from_view(
	321	&view->buffer, offset, syscall_comm->pattern_len);
3e6e0df2	322	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	323	ret = -1;
	324	goto end;
	325	}
	326
3e6e0df2	327	pattern = current_buffer_view.data;
e6a39346 JR	328	if (!lttng_buffer_view_contains_string(&current_buffer_view, pattern,
	329	syscall_comm->pattern_len)) {
	330	ret = -1;
	331	goto end;
	332	}
	333
	334	/* Skip after the pattern. */
	335	offset += syscall_comm->pattern_len;
	336
	337	if (!syscall_comm->filter_expression_len) {
	338	goto skip_filter_expression;
	339	}
	340
	341	/* Map the filter_expression. */
	342	current_buffer_view = lttng_buffer_view_from_view(&view->buffer, offset,
	343	syscall_comm->filter_expression_len);
3e6e0df2	344	if (!lttng_buffer_view_is_valid(&current_buffer_view)) {
e6a39346 JR	345	ret = -1;
	346	goto end;
	347	}
	348
3e6e0df2	349	filter_expression = current_buffer_view.data;
e6a39346 JR	350	if (!lttng_buffer_view_contains_string(&current_buffer_view,
	351	filter_expression,
	352	syscall_comm->filter_expression_len)) {
	353	ret = -1;
	354	goto end;
	355	}
	356
	357	/* Skip after the pattern. */
	358	offset += syscall_comm->filter_expression_len;
	359
	360	skip_filter_expression:
	361
	362	status = lttng_event_rule_syscall_set_pattern(rule, pattern);
	363	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	364	ERR("Failed to set event rule syscall pattern");
	365	ret = -1;
	366	goto end;
	367	}
	368
	369	if (filter_expression) {
	370	status = lttng_event_rule_syscall_set_filter(
	371	rule, filter_expression);
	372	if (status != LTTNG_EVENT_RULE_STATUS_OK) {
	373	ERR("Failed to set event rule syscall pattern");
	374	ret = -1;
	375	goto end;
	376	}
	377	}
	378
	379	*_event_rule = rule;
	380	rule = NULL;
	381	ret = offset;
	382	end:
	383	lttng_event_rule_destroy(rule);
	384	return ret;
	385	}
	386
	387	enum lttng_event_rule_status lttng_event_rule_syscall_set_pattern(
	388	struct lttng_event_rule rule, const char pattern)
	389	{
	390	char *pattern_copy = NULL;
	391	struct lttng_event_rule_syscall *syscall;
	392	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
	393
	394	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern \|\|
	395	strlen(pattern) == 0) {
	396	status = LTTNG_EVENT_RULE_STATUS_INVALID;
	397	goto end;
	398	}
	399
	400	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
	401	pattern_copy = strdup(pattern);
	402	if (!pattern_copy) {
	403	status = LTTNG_EVENT_RULE_STATUS_ERROR;
	404	goto end;
	405	}
	406
	407	if (syscall->pattern) {
	408	free(syscall->pattern);
	409	}
	410
	411	syscall->pattern = pattern_copy;
	412	pattern_copy = NULL;
	413	end:
414	return status;
415	}
416
417	enum lttng_event_rule_status lttng_event_rule_syscall_get_pattern(
418	const struct lttng_event_rule rule, const char *pattern)
419	{
420	struct lttng_event_rule_syscall *syscall;
421	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
422
423	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !pattern) {
424	status = LTTNG_EVENT_RULE_STATUS_INVALID;
425	goto end;
426	}
427
428	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
429	if (!syscall->pattern) {
430	status = LTTNG_EVENT_RULE_STATUS_UNSET;
431	goto end;
432	}
433
434	*pattern = syscall->pattern;
435	end:
436	return status;
437	}
438
439	enum lttng_event_rule_status lttng_event_rule_syscall_set_filter(
440	struct lttng_event_rule rule, const char expression)
441	{
442	char *expression_copy = NULL;
443	struct lttng_event_rule_syscall *syscall;
444	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
445
446	/* TODO: validate that the passed expression is valid. */
447
448	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression \|\|
449	strlen(expression) == 0) {
450	status = LTTNG_EVENT_RULE_STATUS_INVALID;
451	goto end;
452	}
453
454	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
455	expression_copy = strdup(expression);
456	if (!expression_copy) {
457	status = LTTNG_EVENT_RULE_STATUS_ERROR;
458	goto end;
459	}
460
461	if (syscall->filter_expression) {
462	free(syscall->filter_expression);
463	}
464
465	syscall->filter_expression = expression_copy;
466	expression_copy = NULL;
467	end:
468	return status;
469	}
470
471	enum lttng_event_rule_status lttng_event_rule_syscall_get_filter(
472	const struct lttng_event_rule rule, const char *expression)
473	{
474	struct lttng_event_rule_syscall *syscall;
475	enum lttng_event_rule_status status = LTTNG_EVENT_RULE_STATUS_OK;
476
477	if (!rule \|\| !IS_SYSCALL_EVENT_RULE(rule) \|\| !expression) {
478	status = LTTNG_EVENT_RULE_STATUS_INVALID;
479	goto end;
480	}
481
482	syscall = container_of(rule, struct lttng_event_rule_syscall, parent);
483	if (!syscall->filter_expression) {
484	status = LTTNG_EVENT_RULE_STATUS_UNSET;
485	goto end;
486	}
487
488	*expression = syscall->filter_expression;
489	end:
490	return status;
491	}