blob: b8ce4611056499d3bbf9affc864a7d96e59dd512 [file] [log] [blame]
Jorge Lucangeli Obesa6b034d2012-08-07 15:29:20 -07001/* Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -07002 * Use of this source code is governed by a BSD-style license that can be
3 * found in the LICENSE file.
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -07004 */
5
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -07006#include <stdio.h>
7#include <stdlib.h>
8#include <string.h>
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -07009
10#include "syscall_filter.h"
11
Jorge Lucangeli Obesa6b034d2012-08-07 15:29:20 -070012#include "util.h"
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -070013
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -070014#define MAX_LINE_LENGTH 1024
15#define MAX_POLICY_LINE_LENGTH 1024
16
Jorge Lucangeli Obesa6b034d2012-08-07 15:29:20 -070017#define ONE_INSTR 1
18#define TWO_INSTRS 2
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -070019
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070020int str_to_op(const char *op_str)
21{
22 if (!strcmp(op_str, "==")) {
23 return EQ;
24 } else if (!strcmp(op_str, "!=")) {
25 return NE;
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -080026 } else if (!strcmp(op_str, "&")) {
27 return SET;
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070028 } else {
29 return 0;
30 }
31}
32
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070033struct sock_filter *new_instr_buf(size_t count)
34{
35 struct sock_filter *buf = calloc(count, sizeof(struct sock_filter));
36 if (!buf)
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -070037 die("could not allocate BPF instruction buffer");
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070038
39 return buf;
40}
41
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -070042struct filter_block *new_filter_block()
43{
44 struct filter_block *block = calloc(1, sizeof(struct filter_block));
45 if (!block)
46 die("could not allocate BPF filter block");
47
48 block->instrs = NULL;
49 block->last = block->next = NULL;
50
51 return block;
52}
53
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070054void append_filter_block(struct filter_block *head,
55 struct sock_filter *instrs, size_t len)
56{
57 struct filter_block *new_last;
58
59 /*
60 * If |head| has no filter assigned yet,
61 * we don't create a new node.
62 */
63 if (head->instrs == NULL) {
64 new_last = head;
65 } else {
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -070066 new_last = new_filter_block();
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070067 if (head->next != NULL) {
68 head->last->next = new_last;
69 head->last = new_last;
70 } else {
71 head->last = head->next = new_last;
72 }
73 head->total_len += len;
74 }
75
76 new_last->instrs = instrs;
77 new_last->total_len = new_last->len = len;
78 new_last->last = new_last->next = NULL;
79}
80
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -070081void extend_filter_block_list(struct filter_block *list,
82 struct filter_block *another)
83{
84 if (list->last != NULL) {
85 list->last->next = another;
86 list->last = another->last;
87 } else {
88 list->next = another;
89 list->last = another->last;
90 }
91 list->total_len += another->total_len;
92}
93
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -070094void append_ret_kill(struct filter_block *head)
95{
96 struct sock_filter *filter = new_instr_buf(ONE_INSTR);
97 set_bpf_ret_kill(filter);
98 append_filter_block(head, filter, ONE_INSTR);
99}
100
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700101void append_ret_trap(struct filter_block *head)
102{
103 struct sock_filter *filter = new_instr_buf(ONE_INSTR);
104 set_bpf_ret_trap(filter);
105 append_filter_block(head, filter, ONE_INSTR);
106}
107
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700108void append_ret_errno(struct filter_block *head, int errno_val)
109{
110 struct sock_filter *filter = new_instr_buf(ONE_INSTR);
111 set_bpf_ret_errno(filter, errno_val);
112 append_filter_block(head, filter, ONE_INSTR);
113}
114
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -0700115void append_allow_syscall(struct filter_block *head, int nr)
116{
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700117 struct sock_filter *filter = new_instr_buf(ALLOW_SYSCALL_LEN);
118 size_t len = bpf_allow_syscall(filter, nr);
119 if (len != ALLOW_SYSCALL_LEN)
120 die("error building syscall number comparison");
121
122 append_filter_block(head, filter, len);
123}
124
125void allow_log_syscalls(struct filter_block *head)
126{
127 unsigned int i;
Kees Cook03b2af22014-12-18 17:11:13 -0800128 for (i = 0; i < log_syscalls_len; i++) {
129 warn("allowing syscall: %s", log_syscalls[i]);
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700130 append_allow_syscall(head, lookup_syscall(log_syscalls[i]));
Kees Cook03b2af22014-12-18 17:11:13 -0800131 }
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700132}
133
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700134unsigned int get_label_id(struct bpf_labels *labels, const char *label_str)
135{
136 int label_id = bpf_label_id(labels, label_str);
137 if (label_id < 0)
Jorge Lucangeli Obes224e4272012-08-02 14:31:39 -0700138 die("could not allocate BPF label string");
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700139 return label_id;
140}
141
142unsigned int group_end_lbl(struct bpf_labels *labels, int nr, int idx)
143{
144 char lbl_str[MAX_BPF_LABEL_LEN];
145 snprintf(lbl_str, MAX_BPF_LABEL_LEN, "%d_%d_end", nr, idx);
146 return get_label_id(labels, lbl_str);
147}
148
149unsigned int success_lbl(struct bpf_labels *labels, int nr)
150{
151 char lbl_str[MAX_BPF_LABEL_LEN];
152 snprintf(lbl_str, MAX_BPF_LABEL_LEN, "%d_success", nr);
153 return get_label_id(labels, lbl_str);
154}
155
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800156int compile_atom(struct filter_block *head, char *atom,
157 struct bpf_labels *labels, int nr, int group_idx)
158{
159 /* Splits the atom. */
160 char *atom_ptr;
161 char *argidx_str = strtok_r(atom, " ", &atom_ptr);
162 char *operator_str = strtok_r(NULL, " ", &atom_ptr);
163 char *constant_str = strtok_r(NULL, " ", &atom_ptr);
164
165 if (argidx_str == NULL || operator_str == NULL || constant_str == NULL)
166 return -1;
167
168 int op = str_to_op(operator_str);
169 if (op < MIN_OPERATOR)
170 return -1;
171
172 if (strncmp(argidx_str, "arg", 3)) {
173 return -1;
174 }
175
176 char *argidx_ptr;
177 long int argidx = strtol(argidx_str + 3, &argidx_ptr, 10);
178 /*
179 * Checks to see if an actual argument index
180 * was parsed.
181 */
182 if (argidx_ptr == argidx_str + 3)
183 return -1;
184
Luis Hector Chavez40b25742013-09-22 19:44:06 -0700185 char *constant_str_ptr;
186 long int c = parse_constant(constant_str, &constant_str_ptr);
187 if (constant_str_ptr == constant_str)
188 return -1;
189
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800190 /*
191 * Looks up the label for the end of the AND statement
192 * this atom belongs to.
193 */
194 unsigned int id = group_end_lbl(labels, nr, group_idx);
195
196 /*
197 * Builds a BPF comparison between a syscall argument
198 * and a constant.
199 * The comparison lives inside an AND statement.
200 * If the comparison succeeds, we continue
201 * to the next comparison.
202 * If this comparison fails, the whole AND statement
203 * will fail, so we jump to the end of this AND statement.
204 */
205 struct sock_filter *comp_block;
206 size_t len = bpf_arg_comp(&comp_block, op, argidx, c, id);
207 if (len == 0)
208 return -1;
209
210 append_filter_block(head, comp_block, len);
211 return 0;
212}
213
Jorge Lucangeli Obesc8b21e12014-06-13 14:26:16 -0700214int compile_errno(struct filter_block *head, char *ret_errno)
215{
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800216 char *errno_ptr;
217
218 /* Splits the 'return' keyword and the actual errno value. */
219 char *ret_str = strtok_r(ret_errno, " ", &errno_ptr);
220 if (strncmp(ret_str, "return", strlen("return")))
221 return -1;
222
223 char *errno_val_str = strtok_r(NULL, " ", &errno_ptr);
224
225 if (errno_val_str) {
226 char *errno_val_ptr;
Luis Hector Chavez40b25742013-09-22 19:44:06 -0700227 int errno_val = parse_constant(errno_val_str, &errno_val_ptr);
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800228 /* Checks to see if we parsed an actual errno. */
Luis Hector Chavez40b25742013-09-22 19:44:06 -0700229 if (errno_val_ptr == errno_val_str || errno_val == -1)
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800230 return -1;
231
232 append_ret_errno(head, errno_val);
233 } else {
234 append_ret_kill(head);
235 }
236 return 0;
237}
238
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700239struct filter_block *compile_section(int nr, const char *policy_line,
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700240 unsigned int entry_lbl_id, struct bpf_labels *labels)
241{
242 /*
243 * |policy_line| should be an expression of the form:
244 * "arg0 == 3 && arg1 == 5 || arg0 == 0x8"
245 *
246 * This is, an expression in DNF (disjunctive normal form);
247 * a disjunction ('||') of one or more conjunctions ('&&')
248 * of one or more atoms.
249 *
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700250 * Atoms are of the form "arg{DNUM} {OP} {NUM}"
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700251 * where:
252 * - DNUM is a decimal number.
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800253 * - OP is an operator: ==, !=, or & (flags set).
254 * - NUM is an octal, decimal, or hexadecimal number.
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700255 *
256 * When the syscall arguments make the expression true,
257 * the syscall is allowed. If not, the process is killed.
258 *
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700259 * To block a syscall without killing the process,
260 * |policy_line| can be of the form:
261 * "return <errno>"
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700262 *
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700263 * This "return {NUM}" policy line will block the syscall,
264 * make it return -1 and set |errno| to NUM.
265 *
266 * A regular policy line can also include a "return <errno>" clause,
267 * separated by a semicolon (';'):
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700268 * "arg0 == 3 && arg1 == 5 || arg0 == 0x8; return {NUM}"
269 *
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700270 * If the syscall arguments don't make the expression true,
271 * the syscall will be blocked as above instead of killing the process.
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700272 */
273
274 size_t len = 0;
275 int group_idx = 0;
276
277 /* Checks for overly long policy lines. */
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700278 if (strlen(policy_line) >= MAX_POLICY_LINE_LENGTH)
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700279 return NULL;
280
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700281 /* We will modify |policy_line|, so let's make a copy. */
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700282 char *line = strndup(policy_line, MAX_POLICY_LINE_LENGTH);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700283 if (!line)
284 return NULL;
285
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700286 /*
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700287 * We build the filter section as a collection of smaller
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700288 * "filter blocks" linked together in a singly-linked list.
289 */
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700290 struct filter_block *head = new_filter_block();
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700291
292 /*
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700293 * Filter sections begin with a label where the main filter
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700294 * will jump after checking the syscall number.
295 */
296 struct sock_filter *entry_label = new_instr_buf(ONE_INSTR);
297 set_bpf_lbl(entry_label, entry_lbl_id);
298 append_filter_block(head, entry_label, ONE_INSTR);
299
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700300 /* Checks whether we're unconditionally blocking this syscall. */
301 if (strncmp(line, "return", strlen("return")) == 0) {
302 if (compile_errno(head, line) < 0)
303 return NULL;
304 free(line);
305 return head;
306 }
307
308 /* Splits the optional "return <errno>" part. */
309 char *line_ptr;
310 char *arg_filter = strtok_r(line, ";", &line_ptr);
311 char *ret_errno = strtok_r(NULL, ";", &line_ptr);
312
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700313 /*
314 * Splits the policy line by '||' into conjunctions and each conjunction
315 * by '&&' into atoms.
316 */
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800317 char *arg_filter_str = arg_filter;
318 char *group;
319 while ((group = tokenize(&arg_filter_str, "||")) != NULL) {
320 char *group_str = group;
321 char *comp;
322 while ((comp = tokenize(&group_str, "&&")) != NULL) {
323 /* Compiles each atom into a BPF block. */
324 if (compile_atom(head, comp, labels, nr, group_idx) < 0)
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700325 return NULL;
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700326 }
327 /*
328 * If the AND statement succeeds, we're done,
329 * so jump to SUCCESS line.
330 */
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700331 unsigned int id = success_lbl(labels, nr);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700332 struct sock_filter *group_end_block = new_instr_buf(TWO_INSTRS);
333 len = set_bpf_jump_lbl(group_end_block, id);
334 /*
335 * The end of each AND statement falls after the
336 * jump to SUCCESS.
337 */
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700338 id = group_end_lbl(labels, nr, group_idx++);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700339 len += set_bpf_lbl(group_end_block + len, id);
340 append_filter_block(head, group_end_block, len);
341 }
342
343 /*
344 * If no AND statements succeed, we end up here,
345 * because we never jumped to SUCCESS.
346 * If we have to return an errno, do it,
347 * otherwise just kill the task.
348 */
349 if (ret_errno) {
Jorge Lucangeli Obes66cfc142012-11-30 15:42:52 -0800350 if (compile_errno(head, ret_errno) < 0)
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700351 return NULL;
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700352 } else {
353 append_ret_kill(head);
354 }
355
356 /*
357 * Every time the filter succeeds we jump to a predefined SUCCESS
358 * label. Add that label and BPF RET_ALLOW code now.
359 */
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700360 unsigned int id = success_lbl(labels, nr);
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700361 struct sock_filter *success_block = new_instr_buf(TWO_INSTRS);
362 len = set_bpf_lbl(success_block, id);
363 len += set_bpf_ret_allow(success_block + len);
364 append_filter_block(head, success_block, len);
365
366 free(line);
367 return head;
368}
369
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800370int compile_filter(FILE *policy_file, struct sock_fprog *prog,
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700371 int log_failures)
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700372{
373 char line[MAX_LINE_LENGTH];
374 int line_count = 0;
375
376 struct bpf_labels labels;
377 labels.count = 0;
378
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800379 if (!policy_file)
Jorge Lucangeli Obes6135db92012-07-27 13:37:30 -0700380 return -1;
381
Jorge Lucangeli Obesd96baf42013-03-26 15:11:30 -0700382 struct filter_block *head = new_filter_block();
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700383 struct filter_block *arg_blocks = NULL;
384
385 /* Start filter by validating arch. */
386 struct sock_filter *valid_arch = new_instr_buf(ARCH_VALIDATION_LEN);
387 size_t len = bpf_validate_arch(valid_arch);
388 append_filter_block(head, valid_arch, len);
389
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700390 /* Load syscall number. */
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700391 struct sock_filter *load_nr = new_instr_buf(ONE_INSTR);
392 len = bpf_load_syscall_nr(load_nr);
393 append_filter_block(head, load_nr, len);
394
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700395 /* If we're logging failures, allow the necessary syscalls first. */
396 if (log_failures)
397 allow_log_syscalls(head);
398
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700399 /*
400 * Loop through all the lines in the policy file.
401 * Build a jump table for the syscall number.
402 * If the policy line has an arg filter, build the arg filter
403 * as well.
404 * Chain the filter sections together and dump them into
405 * the final buffer at the end.
406 */
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800407 while (fgets(line, sizeof(line), policy_file)) {
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700408 ++line_count;
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800409 char *policy_line = line;
410 char *syscall_name = strsep(&policy_line, ":");
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700411 int nr = -1;
412
413 syscall_name = strip(syscall_name);
414
415 /* Allow comments and empty lines. */
416 if (*syscall_name == '#' || *syscall_name == '\0')
417 continue;
418
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800419 if (!policy_line)
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700420 return -1;
421
422 nr = lookup_syscall(syscall_name);
Jorge Lucangeli Obes275b07f2012-08-28 11:50:29 -0700423 if (nr < 0) {
424 warn("compile_filter: nonexistent syscall '%s'",
425 syscall_name);
Jorge Lucangeli Obesbe351a22016-01-22 17:18:51 -0800426 if (log_failures) {
427 /*
428 * If we're logging failures, assume we're in a
429 * debugging case and continue.
430 * This is not super risky because an invalid
431 * syscall name is likely caused by a typo or by
432 * leftover lines from a different architecture.
433 * In either case, not including a policy line
434 * is equivalent to killing the process if the
435 * syscall is made, so there's no added attack
436 * surface.
437 */
438 continue;
439 }
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700440 return -1;
Jorge Lucangeli Obes275b07f2012-08-28 11:50:29 -0700441 }
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700442
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800443 policy_line = strip(policy_line);
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700444
445 /*
446 * For each syscall, add either a simple ALLOW,
447 * or an arg filter block.
448 */
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800449 if (strcmp(policy_line, "1") == 0) {
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700450 /* Add simple ALLOW. */
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700451 append_allow_syscall(head, nr);
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700452 } else {
453 /*
454 * Create and jump to the label that will hold
455 * the arg filter block.
456 */
457 unsigned int id = bpf_label_id(&labels, syscall_name);
458 struct sock_filter *nr_comp =
459 new_instr_buf(ALLOW_SYSCALL_LEN);
460 bpf_allow_syscall_args(nr_comp, nr, id);
461 append_filter_block(head, nr_comp, ALLOW_SYSCALL_LEN);
462
463 /* Build the arg filter block. */
464 struct filter_block *block =
Jorge Lucangeli Obesb0cea432013-02-04 11:55:30 -0800465 compile_section(nr, policy_line, id, &labels);
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700466
467 if (!block)
468 return -1;
469
470 if (arg_blocks) {
471 extend_filter_block_list(arg_blocks, block);
472 } else {
473 arg_blocks = block;
474 }
475 }
476 }
477
Jorge Lucangeli Obesbda833c2012-07-31 16:25:56 -0700478 /*
479 * If none of the syscalls match, either fall back to KILL,
480 * or return TRAP.
481 */
482 if (!log_failures)
483 append_ret_kill(head);
484 else
485 append_ret_trap(head);
Jorge Lucangeli Obesd4467262012-03-23 16:19:59 -0700486
487 /* Allocate the final buffer, now that we know its size. */
488 size_t final_filter_len = head->total_len +
489 (arg_blocks? arg_blocks->total_len : 0);
490 if (final_filter_len > BPF_MAXINSNS)
491 return -1;
492
493 struct sock_filter *final_filter =
494 calloc(final_filter_len, sizeof(struct sock_filter));
495
496 if (flatten_block_list(head, final_filter, 0, final_filter_len) < 0)
497 return -1;
498
499 if (flatten_block_list(arg_blocks, final_filter,
500 head->total_len, final_filter_len) < 0)
501 return -1;
502
503 free_block_list(head);
504 free_block_list(arg_blocks);
505
506 bpf_resolve_jumps(&labels, final_filter, final_filter_len);
507
508 free_label_strings(&labels);
509
510 prog->filter = final_filter;
511 prog->len = final_filter_len;
512 return 0;
513}
514
515int flatten_block_list(struct filter_block *head, struct sock_filter *filter,
516 size_t index, size_t cap)
517{
518 size_t _index = index;
519
520 struct filter_block *curr;
521 size_t i;
522
523 for (curr = head; curr; curr = curr->next) {
524 for (i = 0; i < curr->len; i++) {
525 if (_index >= cap)
526 return -1;
527 filter[_index++] = curr->instrs[i];
528 }
529 }
530 return 0;
531}
532
Jorge Lucangeli Obesfc8ab532012-03-20 10:14:31 -0700533void free_block_list(struct filter_block *head)
534{
535 struct filter_block *current, *prev;
536
537 current = head;
538 while (current) {
539 free(current->instrs);
540 prev = current;
541 current = current->next;
542 free(prev);
543 }
544}