diff options
| -rw-r--r-- | cooker/cooker.h | 1 | ||||
| -rw-r--r-- | cooker/emit.c | 48 | ||||
| -rw-r--r-- | cooker/emit.h | 2 | ||||
| -rw-r--r-- | cooker/parse.c | 8 | ||||
| -rw-r--r-- | operations.c | 4 | ||||
| -rw-r--r-- | operations.h | 2 |
6 files changed, 58 insertions, 7 deletions
diff --git a/cooker/cooker.h b/cooker/cooker.h index 82b24f7..8dcf93e 100644 --- a/cooker/cooker.h +++ b/cooker/cooker.h @@ -46,6 +46,7 @@ union desc { union value { int v_int; uint32_t v_u32; + uint64_t v_u64; long long v_num; const char *v_str; }; diff --git a/cooker/emit.c b/cooker/emit.c index c233b0a..3fcddba 100644 --- a/cooker/emit.c +++ b/cooker/emit.c @@ -6,6 +6,7 @@ * * Copyright 2023 Red Hat GmbH * Author: Stefano Brivio <sbrivio@redhat.com> + * Alice Frosi <afrosi@redhat.com> */ #include "cooker.h" @@ -136,6 +137,43 @@ void emit_cmp_field(struct gluten_ctx *g, enum op_cmp_type cmp, jmp); } +/** + * emit_return() - Emit OP_RETURN instruction: return value + * @g: gluten context + * @v: Pointer to return value + */ +void emit_return(struct gluten_ctx *g, struct gluten_offset v) +{ + struct op *op = (struct op *)gluten_ptr(&g->g, g->ip); + struct op_return *ret = &op->op.ret; + + op->type = OP_RETURN; + ret->val = v; + + debug(" %i: OP_RETURN:", g->ip.offset); + + if (++g->ip.offset > INST_MAX) + die("Too many instructions"); +} +/** + * emit_block() - Emit OP_BLOCK instruction: return error value + * @g: gluten context + * @error: Error value + */ +void emit_block(struct gluten_ctx *g, int32_t error) +{ + struct op *op = (struct op *)gluten_ptr(&g->g, g->ip); + struct op_block *block = &op->op.block; + + op->type = OP_BLOCK; + block->error = error; + + debug(" %i: OP_BLOCK: %d", g->ip.offset, error); + + if (++g->ip.offset > INST_MAX) + die("Too many instructions"); +} + struct gluten_offset emit_data(struct gluten_ctx *g, enum type type, size_t str_len, union value *value) { @@ -153,6 +191,16 @@ struct gluten_offset emit_data(struct gluten_ctx *g, enum type type, g->cp.offset += sizeof(int); break; + case U64: + if (g->cp.offset + sizeof(uint64_t) > RO_DATA_SIZE) + die(" Read-only data section exceeded"); + + *(uint64_t *)p = value->v_u64; + debug(" C#%i: (%s) %i", g->cp.offset, type_str[type], + value->v_u64); + + g->cp.offset += sizeof(uint64_t); + break; case STRING: if (g->cp.offset + str_len > RO_DATA_SIZE) die(" Read-only data section exceeded"); diff --git a/cooker/emit.h b/cooker/emit.h index 2135052..5d15b1b 100644 --- a/cooker/emit.h +++ b/cooker/emit.h @@ -16,6 +16,8 @@ void emit_cmp_field(struct gluten_ctx *g, enum op_cmp_type cmp, struct field *field, struct gluten_offset base, struct gluten_offset match, enum jump_type jmp); +void emit_return(struct gluten_ctx *g, struct gluten_offset v); +void emit_block(struct gluten_ctx *g, int32_t error); struct gluten_offset emit_data(struct gluten_ctx *g, enum type type, size_t str_len, union value *value); void link_block(struct gluten_ctx *g); diff --git a/cooker/parse.c b/cooker/parse.c index 09b1e46..acb6810 100644 --- a/cooker/parse.c +++ b/cooker/parse.c @@ -38,14 +38,14 @@ static void handle_limit(struct gluten_ctx *g, JSON_Value *value) static void handle_return(struct gluten_ctx *g, JSON_Value *value) { - (void)g; - (void)value; + union value v = { .v_u64 = json_value_get_number(value) }; + + emit_return(g, emit_data(g, U64, sizeof(v.v_u64), &v)); } static void handle_block(struct gluten_ctx *g, JSON_Value *value) { - (void)g; - (void)value; + emit_block(g, json_value_get_number(value)); } static void handle_context(struct gluten_ctx *g, JSON_Value *value) diff --git a/operations.c b/operations.c index f79c41c..60c8410 100644 --- a/operations.c +++ b/operations.c @@ -357,9 +357,9 @@ int op_cmp(const struct seccomp_notif *req, int notifier, struct gluten *g, (res < 0 && (cmp == CMP_LT || cmp == CMP_LE)) || (res > 0 && (cmp == CMP_GT || cmp == CMP_GE)) || (res != 0 && (cmp == CMP_NE))) - return op->jmp.offset; /* TODO: check boundaries */ + return 0; - return 0; + return op->jmp.offset; } int op_resolve_fd(const struct seccomp_notif *req, int notifier, diff --git a/operations.h b/operations.h index 9d017e0..b1d0ac2 100644 --- a/operations.h +++ b/operations.h @@ -21,7 +21,7 @@ if (res == 0) \ (op)++; \ else if (res == -1) \ - return -1; \ + return -1; \ else \ (op) += res; \ } while (0); \ |