bool sinsp_filter_check::flt_compare(cmpop op, ppm_param_type type, void* operand1, uint32_t op1_len, uint32_t op2_len) { if (op == CO_IN) { if (op1_len) { throw sinsp_exception("filter error: cannot use 'in' operator with param type "+ to_string(type)); } for (uint16_t i=0; i < m_val_storages.size(); i++) { if (::flt_compare(CO_EQ, type, operand1, filter_value_p(i))) { return true; } } return false; } else { return (::flt_compare(op, type, operand1, filter_value_p(), op1_len, op2_len) ); } }
void sinsp_filter_check::add_filter_value(const char* str, uint32_t len, uint16_t i) { if (i >= m_val_storages.size()) { m_val_storages.push_back(vector<uint8_t>(256)); } parse_filter_value(str, len, filter_value_p(i), filter_value(i).size()); // XXX/mstemm this doesn't work if someone called // add_filter_value more than once for a given index. filter_value_t item(filter_value_p(i), len); m_val_storages_members.insert(item); if(len < m_val_storages_min_size) { m_val_storages_min_size = len; } if(len > m_val_storages_max_size) { m_val_storages_max_size = len; } // If the operator is CO_PMATCH, also add the value to the paths set. if (m_cmpop == CO_PMATCH) { m_val_storages_paths.add_search_path(item); } }
void sinsp_filter_check::add_filter_value(const char* str, uint32_t len, uint16_t i) { if (i >= m_val_storages.size()) { m_val_storages.push_back(vector<uint8_t>(256)); } parse_filter_value(str, len, filter_value_p(i), filter_value(i).size()); }
bool sinsp_filter_check::flt_compare(cmpop op, ppm_param_type type, void* operand1, uint32_t op1_len, uint32_t op2_len) { if (op == CO_IN || op == CO_PMATCH) { // For raw strings, the length may not be set. So we do a strlen to find it. if(type == PT_CHARBUF && op1_len == 0) { op1_len = strlen((char *) operand1); } filter_value_t item((uint8_t *) operand1, op1_len); if (op == CO_IN) { if(op1_len >= m_val_storages_min_size && op1_len <= m_val_storages_max_size && m_val_storages_members.find(item) != m_val_storages_members.end()) { return true; } } else { if (m_val_storages_paths.match(item)) { return true; } } return false; } else { return (::flt_compare(op, type, operand1, filter_value_p(), op1_len, op2_len) ); } }
char* sinsp_filter_check::rawval_to_string(uint8_t* rawval, const filtercheck_field_info* finfo, uint32_t len) { char* prfmt; ASSERT(rawval != NULL); ASSERT(finfo != NULL); switch(finfo->m_type) { case PT_INT8: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRId8; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIX8; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(int8_t *)rawval); return m_getpropertystr_storage; case PT_INT16: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRId16; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIX16; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(int16_t *)rawval); return m_getpropertystr_storage; case PT_INT32: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRId32; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIX32; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(int32_t *)rawval); return m_getpropertystr_storage; case PT_INT64: case PT_PID: case PT_ERRNO: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRId64; } else if(finfo->m_print_format == PF_10_PADDED_DEC) { prfmt = (char*)"%09" PRId64; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIX64; } else { prfmt = (char*)"%" PRId64; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(int64_t *)rawval); return m_getpropertystr_storage; case PT_L4PROTO: // This can be resolved in the future case PT_UINT8: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRIu8; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIu8; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(uint8_t *)rawval); return m_getpropertystr_storage; case PT_PORT: // This can be resolved in the future case PT_UINT16: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRIu16; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIu16; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(uint16_t *)rawval); return m_getpropertystr_storage; case PT_UINT32: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRIu32; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIu32; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(uint32_t *)rawval); return m_getpropertystr_storage; case PT_UINT64: case PT_RELTIME: case PT_ABSTIME: if(finfo->m_print_format == PF_DEC || finfo->m_print_format == PF_ID) { prfmt = (char*)"%" PRIu64; } else if(finfo->m_print_format == PF_10_PADDED_DEC) { prfmt = (char*)"%09" PRIu64; } else if(finfo->m_print_format == PF_HEX) { prfmt = (char*)"%" PRIX64; } else { ASSERT(false); return NULL; } snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), prfmt, *(uint64_t *)rawval); return m_getpropertystr_storage; case PT_CHARBUF: return (char*)rawval; case PT_BYTEBUF: if(rawval[len] == 0) { return (char*)rawval; } else { ASSERT(len < 1024 * 1024); if(len >= filter_value().size()) { filter_value().resize(len + 1); } memcpy(filter_value_p(), rawval, len); filter_value_p()[len] = 0; return (char*)filter_value_p(); } case PT_SOCKADDR: ASSERT(false); return NULL; case PT_SOCKFAMILY: ASSERT(false); return NULL; case PT_BOOL: if(*(uint32_t*)rawval != 0) { return (char*)"true"; } else { return (char*)"false"; } case PT_IPV4ADDR: snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), "%" PRIu8 ".%" PRIu8 ".%" PRIu8 ".%" PRIu8, rawval[0], rawval[1], rawval[2], rawval[3]); return m_getpropertystr_storage; case PT_DOUBLE: snprintf(m_getpropertystr_storage, sizeof(m_getpropertystr_storage), "%.1lf", *(double*)rawval); return m_getpropertystr_storage; default: ASSERT(false); throw sinsp_exception("wrong event type " + to_string((long long) finfo->m_type)); } }