Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
device.c	1.2 KB	-rw-r--r--
device.h	257 B	-rw-r--r--
exec_event.c	7.34 KB	-rw-r--r--
exec_event.h	391 B	-rw-r--r--
exit_event.c	1.5 KB	-rw-r--r--
exit_event.h	291 B	-rw-r--r--
fork_event.c	8.81 KB	-rw-r--r--
fork_event.h	360 B	-rw-r--r--
fs_event.c	35.29 KB	-rw-r--r--
fs_event.h	3.45 KB	-rw-r--r--
message.c	21.41 KB	-rw-r--r--
message.h	4.05 KB	-rw-r--r--
ring.h	2.29 KB	-rw-r--r--
set.h	1.87 KB	-rw-r--r--
subtype.h	4.26 KB	-rw-r--r--
thread_safe_path.h	2.28 KB	-rw-r--r--
transport.c	72.03 KB	-rw-r--r--
transport.h	4.99 KB	-rw-r--r--
transport_id.h	1.75 KB	-rw-r--r--

Code Editor : subtype.h

/**
@file     subtype.h
@brief    Actual message subtype type based on amount of fields
@details  Copyright (c) 2024 Acronis International GmbH
@author   Denis Kopyrin (denis.kopyrin@acronis.com)
@since    $Id: $
*/

#pragma once

#include "transport_protocol.h"

#ifndef BPF_PROGRAM
#include <linux/fcntl.h>
#include <linux/types.h>
#endif

#ifdef KERNEL_MOCK
_Static_assert(FP_SI_ST_COUNT <= 32, "Too many subtypes, increase SUBTYPE_MASK_TYPE");
#endif

#define SUBTYPE_MASK_TYPE uint32_t

#define SUBTYPE_FMODE_READ 1
#define SUBTYPE_FMODE_WRITE 2

static inline uint8_t open_flags_to_subtype_fmode(unsigned int flags)
{
  uint8_t subtype_mask;
  unsigned int accmode = flags & O_ACCMODE;
  switch (accmode)
  {
    case O_RDONLY:
      subtype_mask = SUBTYPE_FMODE_READ;
      break;
    case O_WRONLY:
      subtype_mask = SUBTYPE_FMODE_WRITE;
      break;
    default:
      subtype_mask = SUBTYPE_FMODE_READ | SUBTYPE_FMODE_WRITE;
      break;
  }

// On Linux O_TRUNC will cause file modification so add it in fmode
  if (flags & O_TRUNC) {
    subtype_mask |= SUBTYPE_FMODE_WRITE;
  }

return subtype_mask;
}

typedef struct
{
  uint64_t notify;
  uint64_t sync;
} subtypes_t;

static inline uint64_t fs_generic_subtype(const struct inode* in) {
  uint64_t subtype = 0;
  umode_t mode = KERNEL_READ(in, i_mode);
  if (!S_ISDIR(mode) && !S_ISREG(mode)) {
    subtype |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SPECIAL);
  }

return subtype;
}

#ifdef BPF_PROGRAM
static inline __attribute__((always_inline)) subtypes_t fs_open_subtypes(int flags, const struct inode* in) {
#else 
static inline subtypes_t fs_open_subtypes(int flags, const struct inode* in) {
#endif
  uint8_t fmode_subtype = open_flags_to_subtype_fmode(flags);
  uint64_t generic_subtype = fs_generic_subtype(in);
  subtypes_t subtypes = (subtypes_t){};
  if (fmode_subtype & SUBTYPE_FMODE_WRITE) {
    subtypes.sync   |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_OPEN_MODIFY);
    subtypes.notify |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_OPEN_MODIFY);
  }
  if (fmode_subtype & SUBTYPE_FMODE_READ) {
    subtypes.sync   |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_OPEN_READ);
    subtypes.notify |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_OPEN_READ);
  }
  if (flags & O_CREAT) {
    subtypes.sync   |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_OPEN_MAY_CREATE);
    subtypes.notify |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_OPEN_MAY_CREATE);
  }
  if (S_ISDIR(KERNEL_READ(in, i_mode))) {
    subtypes.sync   |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_OPENDIR);
    subtypes.notify |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_OPENDIR);
  }
  subtypes.notify |= generic_subtype;
  subtypes.sync   |= generic_subtype;

return subtypes;
}

#ifdef BPF_PROGRAM
static inline __attribute__((always_inline)) subtypes_t fs_close_subtypes(bool modified, const struct inode* in) {
#else
static inline subtypes_t fs_close_subtypes(bool modified, const struct inode* in) {
#endif
  subtypes_t subtypes;
  uint64_t generic_subtype = fs_generic_subtype(in);
  if (modified) {
    subtypes.sync   = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_CLOSE_WRITE);
    subtypes.notify = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_CLOSE_WRITE);
  } else {
    subtypes.sync   = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_CLOSE_NON_WRITE);
    subtypes.notify = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_CLOSE_NON_WRITE);
  }
  if (S_ISDIR(KERNEL_READ(in, i_mode))) {
    subtypes.sync   |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_CLOSEDIR);
    subtypes.notify |= MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_CLOSEDIR);
  }
  subtypes.notify |= generic_subtype;
  subtypes.sync   |= generic_subtype;

return subtypes;
}

#ifdef BPF_PROGRAM
static inline __attribute__((always_inline)) subtypes_t fs_mmap_subtypes(bool modified, const struct inode* in) {
#else
static inline subtypes_t fs_mmap_subtypes(bool modified, const struct inode* in) {
#endif
  subtypes_t subtypes;
  uint64_t generic_subtype = fs_generic_subtype(in);
  if (modified) {
    subtypes.sync   = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_MMAP_WRITE);
    subtypes.notify = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_MMAP_WRITE);
  } else {
    subtypes.sync   = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_SYNC_MMAP_NON_WRITE);
    subtypes.notify = MSG_TYPE_TO_EVENT_MASK(FP_SI_ST_NOTIFY_MMAP_NON_WRITE);
  }
  subtypes.notify |= generic_subtype;
  subtypes.sync   |= generic_subtype;

return subtypes;
}

${this.title}

Code Editor : subtype.h