linux-kernel - [PATCH v2 tracing 2/6] tracing: support IPv4 address filter predicate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1682696089-27937-3-git-send-email-alan.maguire@oracle.com>
Date:   Fri, 28 Apr 2023 16:34:45 +0100
From:   Alan Maguire <alan.maguire@...cle.com>
To:     rostedt@...dmis.org, mhiramat@...nel.org
Cc:     corbet@....net, shuah@...nel.org,
        linux-trace-kernel@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org,
        Alan Maguire <alan.maguire@...cle.com>
Subject: [PATCH v2 tracing 2/6] tracing: support IPv4 address filter predicate

Support '==' and '!=' predicates for IPv4 address format;
for example

 cd /sys/kernel/debug/tracing/events/tcp/tcp_receive_reset
 echo "saddr == 127.0.0.1" > filter

Signed-off-by: Alan Maguire <alan.maguire@...cle.com>
---
 kernel/trace/trace_events_filter.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 64f1dfb72cb5..d8e08d3c3594 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1384,6 +1384,7 @@ static int parse_pred(const char *str, void *data,
 	unsigned long size;
 	unsigned long ip;
 	char num_buf[24];	/* Big enough to hold an address */
+	char scratch[4];	/* Big enough to hold an IPv4 address */
 	u8 *pred_val;
 	char *field_name;
 	char *name;
@@ -1646,6 +1647,24 @@ static int parse_pred(const char *str, void *data,
 		/* go past the last quote */
 		i++;
 
+	} else if (field->size == 4 &&
+		   sscanf(&str[i], "%hhd.%hhd.%hhd.%hhd",
+			  /* assume address in network byte order */
+			  &scratch[0], &scratch[1], &scratch[2], &scratch[3]) == 4) {
+		/* For IPv4 addresses, only '==' or '!=' are supported. */
+		if (pred->op != OP_EQ && pred->op != OP_NE) {
+			parse_error(pe, FILT_ERR_ILLEGAL_FIELD_OP, pos + i);
+			goto err_free;
+		}
+		while (isdigit(str[i]) || str[i] == '.')
+			i++;
+		pred_val = kzalloc(field->size, GFP_KERNEL);
+		memcpy(pred_val, scratch, field->size);
+		pred->val = (u64)pred_val;
+		pred->fn_num = FILTER_PRED_FN_MEMCMP;
+		if (pred->op == OP_NE)
+			pred->not = 1;
+
 	} else if (str[i] == '0' && tolower(str[i + 1]) == 'x' &&
 		   field->size > 8) {
 		/* For sizes > 8 bytes, we store hex bytes for comparison;
-- 
2.31.1