linux-kernel - [PATCH v2 tracing 4/6] tracing: support MAC address filter predicates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Apr 2023 16:34:47 +0100
From:   Alan Maguire <alan.maguire@...cle.com>
To:     rostedt@...dmis.org, mhiramat@...nel.org
Cc:     corbet@....net, shuah@...nel.org,
        linux-trace-kernel@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org,
        Alan Maguire <alan.maguire@...cle.com>
Subject: [PATCH v2 tracing 4/6] tracing: support MAC address filter predicates

Support '==' and '!=' predicates for MAC address format;
for example

 cd /sys/kernel/debug/tracing/events/cfg80211/rdev_get_key
 echo "mac_addr == de:ad:be:ef:de:ad"

Signed-off-by: Alan Maguire <alan.maguire@...cle.com>
---
 kernel/trace/trace_events_filter.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index e2521574f3c4..f38023f490b1 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1384,7 +1384,7 @@ static int parse_pred(const char *str, void *data,
 	unsigned long size;
 	unsigned long ip;
 	char num_buf[24];	/* Big enough to hold an address */
-	char scratch[4];	/* Big enough to hold an IPv4 address */
+	char scratch[6];	/* Big enough to hold a MAC address */
 	u8 *pred_val;
 	char *field_name;
 	char *name;
@@ -1738,6 +1738,24 @@ static int parse_pred(const char *str, void *data,
 		if (pred->op == OP_NE)
 			pred->not = 1;
 
+	} else if (field->size == 6 &&
+		   sscanf(&str[i], "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx",
+			  &scratch[0], &scratch[1], &scratch[2], &scratch[3],
+			  &scratch[4], &scratch[5]) == 6) {
+		/* For MAC addresses, only '==' or '!=' are supported. */
+		if (pred->op != OP_EQ && pred->op != OP_NE) {
+			parse_error(pe, FILT_ERR_ILLEGAL_FIELD_OP, pos + i);
+			goto err_free;
+		}
+		while (isalnum(str[i]) || str[i] == ':')
+			i++;
+		pred_val = kzalloc(field->size, GFP_KERNEL);
+		memcpy(pred_val, scratch, field->size);
+		pred->val = (u64)pred_val;
+		pred->fn_num = FILTER_PRED_FN_MEMCMP;
+		if (pred->op == OP_NE)
+			pred->not = 1;
+
 	} else if (str[i] == '0' && tolower(str[i + 1]) == 'x' &&
 		   field->size > 8) {
 		/* For sizes > 8 bytes, we store hex bytes for comparison;
-- 
2.31.1