aboutgitcodelistschat:MatrixIRC
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cooker/filter.c126
-rw-r--r--cooker/filter.h31
2 files changed, 65 insertions, 92 deletions
diff --git a/cooker/filter.c b/cooker/filter.c
index bffdfe4..c7e0ee4 100644
--- a/cooker/filter.c
+++ b/cooker/filter.c
@@ -324,15 +324,14 @@ static unsigned int eq(struct sock_filter filter[],
case BPF_U64:
hi = get_hi(field->value.v64);
lo = get_lo(field->value.v64);
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)EQ(lo, 0, jfalse);
- filter[size++] = (struct sock_filter)LOAD(HI_ARG(field->arg));
- filter[size++] = (struct sock_filter)EQ(hi, jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = EQ(lo, 0, jfalse);
+ filter[size++] = LOAD(HI_ARG(field->arg));
+ filter[size++] = EQ(hi, jtrue, jfalse);
break;
case BPF_U32:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)EQ(
- field->value.v32, jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = EQ(field->value.v32, jtrue, jfalse);
break;
}
@@ -350,15 +349,14 @@ static unsigned int gt(struct sock_filter filter[],
case BPF_U64:
hi = get_hi(field->value.v64);
lo = get_lo(field->value.v64);
- filter[size++] = (struct sock_filter)LOAD(HI_ARG(field->arg));
- filter[size++] = (struct sock_filter)GT(hi, jtrue + 2, 0);
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)GT(lo, jtrue, jfalse);
+ filter[size++] = LOAD(HI_ARG(field->arg));
+ filter[size++] = GT(hi, jtrue + 2, 0);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = GT(lo, jtrue, jfalse);
break;
case BPF_U32:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)GT(
- field->value.v32, jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = GT(field->value.v32, jtrue, jfalse);
break;
}
@@ -376,15 +374,14 @@ static unsigned int lt(struct sock_filter filter[],
case BPF_U64:
hi = get_hi(field->value.v64);
lo = get_lo(field->value.v64);
- filter[size++] = (struct sock_filter)LOAD(HI_ARG(field->arg));
- filter[size++] = (struct sock_filter)LT(hi, jtrue + 2, jfalse);
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)LT(lo, jtrue, jfalse);
+ filter[size++] = LOAD(HI_ARG(field->arg));
+ filter[size++] = LT(hi, jtrue + 2, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = LT(lo, jtrue, jfalse);
break;
case BPF_U32:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)LT(
- field->value.v32, jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = LT(field->value.v32, jtrue, jfalse);
break;
}
@@ -420,23 +417,17 @@ static unsigned int and_eq(struct sock_filter filter[],
switch (field->type) {
case BPF_U64:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)AND(
- get_lo(field->op2.v64));
- filter[size++] = (struct sock_filter)EQ(
- get_lo(field->value.v64), 0, jfalse);
- filter[size++] = (struct sock_filter)LOAD(HI_ARG(field->arg));
- filter[size++] = (struct sock_filter)AND(
- get_hi(field->op2.v64));
- filter[size++] = (struct sock_filter)EQ(
- get_hi(field->value.v64), jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = AND(get_lo(field->op2.v64));
+ filter[size++] = EQ(get_lo(field->value.v64), 0, jfalse);
+ filter[size++] = LOAD(HI_ARG(field->arg));
+ filter[size++] = AND(get_hi(field->op2.v64));
+ filter[size++] = EQ(get_hi(field->value.v64), jtrue, jfalse);
break;
case BPF_U32:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] =
- (struct sock_filter)AND(field->op2.v32);
- filter[size++] = (struct sock_filter)EQ(
- field->value.v32, jtrue, jfalse);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = AND(field->op2.v32);
+ filter[size++] = EQ(field->value.v32, jtrue, jfalse);
break;
}
@@ -451,23 +442,17 @@ static unsigned int and_ne(struct sock_filter filter[],
switch (field->type) {
case BPF_U64:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] = (struct sock_filter)AND(
- get_lo(field->op2.v64));
- filter[size++] = (struct sock_filter)EQ(
- get_lo(field->value.v64), 0, jtrue + 3);
- filter[size++] = (struct sock_filter)LOAD(HI_ARG(field->arg));
- filter[size++] = (struct sock_filter)AND(
- get_hi(field->op2.v64));
- filter[size++] = (struct sock_filter)EQ(
- get_hi(field->value.v64), jfalse, jtrue);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = AND(get_lo(field->op2.v64));
+ filter[size++] = EQ(get_lo(field->value.v64), 0, jtrue + 3);
+ filter[size++] = LOAD(HI_ARG(field->arg));
+ filter[size++] = AND(get_hi(field->op2.v64));
+ filter[size++] = EQ(get_hi(field->value.v64), jfalse, jtrue);
break;
case BPF_U32:
- filter[size++] = (struct sock_filter)LOAD(LO_ARG(field->arg));
- filter[size++] =
- (struct sock_filter)AND(field->op2.v32);
- filter[size++] = (struct sock_filter)EQ(
- field->value.v32, jfalse, jtrue);
+ filter[size++] = LOAD(LO_ARG(field->arg));
+ filter[size++] = AND(field->op2.v32);
+ filter[size++] = EQ(field->value.v32, jfalse, jtrue);
break;
}
@@ -530,8 +515,8 @@ static unsigned int insert_args(struct sock_filter filter[], long nr)
/* If there were no arguments for this entry, then we don't need
* to add the notification */
if (n_checks > 0)
- filter[size++] = (struct sock_filter)BPF_STMT(
- BPF_RET | BPF_K, SECCOMP_RET_ALLOW);
+ filter[size++] = STMT(BPF_RET | BPF_K,
+ SECCOMP_RET_ALLOW);
}
return size;
@@ -556,16 +541,14 @@ unsigned int filter_build(struct sock_filter filter[], unsigned n)
/* Pre */
/* cppcheck-suppress badBitmaskCheck */
- filter[size++] = (struct sock_filter)BPF_STMT(
- BPF_LD | BPF_W | BPF_ABS,
- (offsetof(struct seccomp_data, arch)));
- filter[size++] = (struct sock_filter)BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K,
- SEITAN_AUDIT_ARCH, 1, 0);
- filter[size++] = (struct sock_filter)BPF_STMT(BPF_RET | BPF_K,
- SECCOMP_RET_ALLOW);
+ filter[size++] = STMT(BPF_LD | BPF_W | BPF_ABS,
+ offsetof(struct seccomp_data, arch));
+ filter[size++] = JUMP(BPF_JMP | BPF_JEQ | BPF_K,
+ SEITAN_AUDIT_ARCH, 1, 0);
+ filter[size++] = STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW);
/* cppcheck-suppress badBitmaskCheck */
- filter[size++] = (struct sock_filter)BPF_STMT(
- BPF_LD | BPF_W | BPF_ABS, (offsetof(struct seccomp_data, nr)));
+ filter[size++] = STMT(BPF_LD | BPF_W | BPF_ABS,
+ offsetof(struct seccomp_data, nr));
/* pre-check instruction + load syscall number (4 instructions) */
accept = size + n_nodes + n;
@@ -574,14 +557,12 @@ unsigned int filter_build(struct sock_filter filter[], unsigned n)
/* Insert nodes */
for (i = 0; i < n_nodes; i++) {
if (nodes[i] == EMPTY) {
- filter[size++] =
- (struct sock_filter)JUMPA(accept - size);
+ filter[size++] = JUMPA(accept - size);
} else {
nr = get_syscall(nodes[i]);
offset_left = left_child(i) - i - 1;
offset_right = right_child(i) - i - 1;
- filter[size++] = (struct sock_filter)JGE(
- nr, offset_right, offset_left);
+ filter[size++] = JGE(nr, offset_right, offset_left);
}
}
@@ -595,19 +576,16 @@ unsigned int filter_build(struct sock_filter filter[], unsigned n)
/* If the syscall doesn't have any arguments, then notify */
offset = notify - size - 1;
}
- filter[size++] =
- (struct sock_filter)EQ(nr, offset, accept - size);
+ filter[size++] = EQ(nr, offset, accept - size);
/* The arguments block of the next entry are after the total
* number of the instructions for checking the arguments of the current entry
*/
next_offset += get_n_args_syscall_instr(nr) - 1;
}
/* Seccomp accept and notify instruction */
- filter[size++] = (struct sock_filter)BPF_STMT(BPF_RET | BPF_K,
- SECCOMP_RET_ALLOW);
+ filter[size++] = STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW);
if (!call_entry_count(nr))
- filter[size++] = (struct sock_filter)BPF_STMT(BPF_RET | BPF_K,
- SECCOMP_RET_USER_NOTIF);
+ filter[size++] = STMT(BPF_RET | BPF_K, SECCOMP_RET_USER_NOTIF);
/*
@@ -618,8 +596,8 @@ unsigned int filter_build(struct sock_filter filter[], unsigned n)
for (i = 0; i < n; i++) {
size += insert_args(&filter[size], nr);
if (call_entry_count(nr))
- filter[size++] = (struct sock_filter)BPF_STMT(
- BPF_RET | BPF_K, SECCOMP_RET_USER_NOTIF);
+ filter[size++] = STMT(BPF_RET | BPF_K,
+ SECCOMP_RET_USER_NOTIF);
}
debug(" BPF: filter with %i call%s has %i instructions",
diff --git a/cooker/filter.h b/cooker/filter.h
index 5257f69..8efdc47 100644
--- a/cooker/filter.h
+++ b/cooker/filter.h
@@ -29,26 +29,25 @@
#error "Unknown endianness"
#endif
+#define JUMP(...) ((struct sock_filter)BPF_JUMP(__VA_ARGS__))
+#define STMT(...) ((struct sock_filter)BPF_STMT(__VA_ARGS__))
+
#define JGE(nr, right, left) \
- BPF_JUMP(BPF_JMP | BPF_JGE | BPF_K, (nr), (right), (left))
-#define JUMPA(jump) BPF_JUMP(BPF_JMP | BPF_JA, (jump), 0, 0)
-#define EQ(x, a1, a2) BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, (x), (a1), (a2))
+ JUMP(BPF_JMP | BPF_JGE | BPF_K, (nr), (right), (left))
+#define JUMPA(jump) JUMP(BPF_JMP | BPF_JA, (jump), 0, 0)
+#define EQ(x, a1, a2) JUMP(BPF_JMP | BPF_JEQ | BPF_K, (x), (a1), (a2))
#define NEQ(x, a1, a2) EQ((x), (a2), (a1))
-#define GT(x, a1, a2) BPF_JUMP(BPF_JMP + BPF_JGT + BPF_K, (x), (a1), (a2))
-#define GE(x, a1, a2) BPF_JUMP(BPF_JMP + BPF_JGE + BPF_K, (x), (a1), (a2))
+#define GT(x, a1, a2) JUMP(BPF_JMP + BPF_JGT + BPF_K, (x), (a1), (a2))
+#define GE(x, a1, a2) JUMP(BPF_JMP + BPF_JGE + BPF_K, (x), (a1), (a2))
#define LT(x, a1, a2) GE((x), (a2), (a1))
#define LE(x, a1, a2) GT((x), (a2), (a1))
-#define LOAD(x) BPF_STMT(BPF_LD | BPF_W | BPF_ABS, (x))
-#define AND(x) BPF_STMT(BPF_ALU | BPF_AND | BPF_IMM, (x))
+#define LOAD(x) STMT(BPF_LD | BPF_W | BPF_ABS, (x))
+#define AND(x) STMT(BPF_ALU | BPF_AND | BPF_IMM, (x))
#define MAX_FILTER 1024
#define MAX_JUMPS 128
#define EMPTY -1
-#define N_SYSCALL 512
-#define MAX_ENTRIES_SYSCALL 16
-#define MAX_ENTRIES N_SYSCALL * MAX_ENTRIES_SYSCALL
-
enum bpf_type { BPF_U32, BPF_U64 };
union bpf_value {
@@ -59,21 +58,17 @@ union bpf_value {
extern const char *bpf_cmp_str[];
enum bpf_cmp { NO_CHECK = 0, EQ, NE, LE, LT, GE, GT, AND_EQ, AND_NE };
-struct bpf_arg {
+struct bpf_field {
+ int arg;
union bpf_value value;
enum bpf_type type;
enum bpf_cmp cmp;
union bpf_value op2;
};
-struct bpf_entry {
- struct bpf_arg args[6];
-};
-
void filter_notify(long nr);
void filter_needs_deref(void);
-void filter_add_arg(int index, struct bpf_arg arg);
+void filter_add_check(struct bpf_field *field);
void filter_write(const char *path);
-void filter_flush_args();
#endif
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-22 13:29:29 +0000