File agent/ninedogs.c changed (mode: 100644) (index 0d7bb0d..0619a40) |
... |
... |
static ssize_t (*old_getrandom)(void *buf, size_t buflen, unsigned int flags); |
134 |
134 |
static int (*old_nanosleep)(const struct timespec *req, struct timespec *rem); |
static int (*old_nanosleep)(const struct timespec *req, struct timespec *rem); |
135 |
135 |
static int (*old_unlink)(const char *pathname); |
static int (*old_unlink)(const char *pathname); |
136 |
136 |
static int (*old_listen)(int sock, int backlog); |
static int (*old_listen)(int sock, int backlog); |
|
137 |
|
static void (*old_syslog)(int priority, const char *format, ...); |
|
138 |
|
static int (*old_fstatat)(int dirfd, const char *restrict pathname, |
|
139 |
|
struct stat *restrict statbuf, int flags); |
|
140 |
|
static int (*old_fstatat64)(int dirfd, const char *restrict pathname, |
|
141 |
|
struct stat64 *restrict statbuf, int flags); |
137 |
142 |
|
|
138 |
143 |
/* fd helpers */ |
/* fd helpers */ |
139 |
144 |
static struct fd_node *fd_search(const int fd) |
static struct fd_node *fd_search(const int fd) |
|
... |
... |
static void my_trace_sockaddr(unsigned char *buf, unsigned int *i, |
231 |
236 |
my_trace_put(buf, i, a, a ? len : 0); |
my_trace_put(buf, i, a, a ? len : 0); |
232 |
237 |
} |
} |
233 |
238 |
|
|
|
239 |
|
static void my_trace_put_stat(unsigned char *buf, unsigned int *i, struct stat *s) |
|
240 |
|
{ |
|
241 |
|
my_trace_put64(buf, i, s->st_dev); |
|
242 |
|
my_trace_put64(buf, i, s->st_ino); |
|
243 |
|
my_trace_put32(buf, i, s->st_mode); |
|
244 |
|
my_trace_put64(buf, i, s->st_nlink); |
|
245 |
|
my_trace_put32(buf, i, s->st_uid); |
|
246 |
|
my_trace_put32(buf, i, s->st_gid); |
|
247 |
|
my_trace_put64(buf, i, s->st_rdev); |
|
248 |
|
my_trace_put64(buf, i, s->st_size); |
|
249 |
|
my_trace_put64(buf, i, s->st_blksize); |
|
250 |
|
my_trace_put64(buf, i, s->st_blocks); |
|
251 |
|
my_trace_put64(buf, i, s->st_atim.tv_sec); |
|
252 |
|
my_trace_put32(buf, i, s->st_atim.tv_nsec); |
|
253 |
|
my_trace_put64(buf, i, s->st_mtim.tv_sec); |
|
254 |
|
my_trace_put32(buf, i, s->st_mtim.tv_nsec); |
|
255 |
|
my_trace_put64(buf, i, s->st_ctim.tv_sec); |
|
256 |
|
my_trace_put32(buf, i, s->st_ctim.tv_nsec); |
|
257 |
|
} |
|
258 |
|
|
234 |
259 |
/* |
/* |
235 |
260 |
* Returns how many byte were stored in |
* Returns how many byte were stored in |
236 |
261 |
*/ |
*/ |
|
... |
... |
static unsigned int my_trace_encode(unsigned char *buf, |
371 |
396 |
} |
} |
372 |
397 |
} break; |
} break; |
373 |
398 |
|
|
|
399 |
|
case 'f': |
|
400 |
|
if ((strcmp(func, "fstatat") == 0) |
|
401 |
|
|| (strcmp(func, "fstatat64") == 0)) { |
|
402 |
|
my_trace_put16(buf, &i, va_arg(va, int)); // dirfd |
|
403 |
|
char *pathname = va_arg(va, char *); |
|
404 |
|
unsigned short len = strlen(pathname); |
|
405 |
|
my_trace_put16(buf, &i, len); |
|
406 |
|
my_trace_put(buf, &i, pathname, len); |
|
407 |
|
struct stat *s = va_arg(va, void *); |
|
408 |
|
my_trace_put_stat(buf, &i, s); |
|
409 |
|
my_trace_put32(buf, &i, va_arg(va, int)); // flags |
|
410 |
|
if (type == 'r') { |
|
411 |
|
int ret = va_arg(va, int); |
|
412 |
|
my_trace_put32(buf, &i, ret); |
|
413 |
|
if (ret == -1) |
|
414 |
|
my_trace_put32(buf, &i, save_errno); |
|
415 |
|
} |
|
416 |
|
} break; |
|
417 |
|
|
374 |
418 |
case 'g': |
case 'g': |
375 |
419 |
if (strcmp(func, "getaddrinfo") == 0) { |
if (strcmp(func, "getaddrinfo") == 0) { |
376 |
420 |
uint16_t len; |
uint16_t len; |
|
... |
... |
static unsigned int my_trace_encode(unsigned char *buf, |
585 |
629 |
if (ret == -1) |
if (ret == -1) |
586 |
630 |
my_trace_put32(buf, &i, save_errno); |
my_trace_put32(buf, &i, save_errno); |
587 |
631 |
} |
} |
|
632 |
|
} else if (strcmp(func, "stat") == 0) { |
|
633 |
|
char *pathname = va_arg(va, char *); |
|
634 |
|
unsigned short len = strlen(pathname); |
|
635 |
|
my_trace_put16(buf, &i, len); |
|
636 |
|
my_trace_put(buf, &i, pathname, len); |
|
637 |
|
struct stat *s = va_arg(va, void *); |
|
638 |
|
my_trace_put_stat(buf, &i, s); |
|
639 |
|
if (type == 'r') { |
|
640 |
|
int ret = va_arg(va, int); |
|
641 |
|
my_trace_put32(buf, &i, ret); |
|
642 |
|
if (ret == -1) |
|
643 |
|
my_trace_put32(buf, &i, save_errno); |
|
644 |
|
} |
|
645 |
|
} else if (strcmp(func, "syslog") == 0) { |
|
646 |
|
my_trace_put32(buf, &i, va_arg(va, int)); // prio |
|
647 |
|
char *str = va_arg(va, char *); |
|
648 |
|
unsigned short len = strlen(str); |
|
649 |
|
my_trace_put16(buf, &i, len); |
|
650 |
|
my_trace_put(buf, &i, str, len); |
588 |
651 |
} break; |
} break; |
589 |
652 |
|
|
590 |
653 |
case 'u': |
case 'u': |
|
... |
... |
__attribute__((constructor)) void ninedogs_init(void) |
1102 |
1165 |
exit(1); |
exit(1); |
1103 |
1166 |
} |
} |
1104 |
1167 |
|
|
|
1168 |
|
old_syslog = old_dlsym(RTLD_NEXT, "syslog"); |
|
1169 |
|
if (old_syslog == NULL) { |
|
1170 |
|
xlog(0, " cannot resolve 'syslog'!\n"); |
|
1171 |
|
exit(1); |
|
1172 |
|
} |
|
1173 |
|
|
|
1174 |
|
old_fstatat = old_dlsym(RTLD_NEXT, "fstatat"); |
|
1175 |
|
if (old_fstatat == NULL) { |
|
1176 |
|
xlog(0, " cannot resolve 'fstatat'!\n"); |
|
1177 |
|
exit(1); |
|
1178 |
|
} |
|
1179 |
|
|
|
1180 |
|
old_fstatat64 = old_dlsym(RTLD_NEXT, "fstatat64"); |
|
1181 |
|
if (old_fstatat64 == NULL) { |
|
1182 |
|
xlog(0, " cannot resolve 'fstatat64'!\n"); |
|
1183 |
|
exit(1); |
|
1184 |
|
} |
|
1185 |
|
|
1105 |
1186 |
|
|
1106 |
1187 |
x = getenv("NINEDOGS_VERBOSE"); |
x = getenv("NINEDOGS_VERBOSE"); |
1107 |
1188 |
if (x != NULL) |
if (x != NULL) |
|
... |
... |
int listen(int sock, int backlog) |
2142 |
2223 |
|
|
2143 |
2224 |
return ret; |
return ret; |
2144 |
2225 |
} |
} |
|
2226 |
|
|
|
2227 |
|
void syslog(int priority, const char *format, ...) |
|
2228 |
|
{ |
|
2229 |
|
va_list va; |
|
2230 |
|
char buf[64000]; |
|
2231 |
|
|
|
2232 |
|
if (!old_syslog) |
|
2233 |
|
ninedogs_init(); |
|
2234 |
|
|
|
2235 |
|
xlog(20, "%s(%d)\n", __func__, priority); |
|
2236 |
|
|
|
2237 |
|
va_start(va, format); |
|
2238 |
|
vsnprintf(buf, sizeof(buf), format, va); |
|
2239 |
|
va_end(va); |
|
2240 |
|
|
|
2241 |
|
old_syslog(priority, buf); |
|
2242 |
|
my_trace(__func__, 'r', priority, buf); |
|
2243 |
|
} |
|
2244 |
|
|
|
2245 |
|
int fstatat(int dirfd, const char *restrict pathname, |
|
2246 |
|
struct stat *restrict statbuf, int flags) |
|
2247 |
|
{ |
|
2248 |
|
int ret; |
|
2249 |
|
|
|
2250 |
|
if (!old_fstatat) |
|
2251 |
|
ninedogs_init(); |
|
2252 |
|
|
|
2253 |
|
xlog(20, "%s(%d, %s, %p, 0x%x)\n", __func__, dirfd, pathname, statbuf, flags); |
|
2254 |
|
|
|
2255 |
|
my_trace(__func__, 'c', dirfd, pathname, flags); |
|
2256 |
|
ret = old_fstatat(dirfd, pathname, statbuf, flags); |
|
2257 |
|
my_trace(__func__, 'r', dirfd, pathname, statbuf, flags, ret); |
|
2258 |
|
|
|
2259 |
|
return ret; |
|
2260 |
|
} |
|
2261 |
|
|
|
2262 |
|
int fstatat64(int dirfd, const char *restrict pathname, |
|
2263 |
|
struct stat64 *restrict statbuf, int flags) |
|
2264 |
|
{ |
|
2265 |
|
int ret; |
|
2266 |
|
|
|
2267 |
|
if (!old_fstatat64) |
|
2268 |
|
ninedogs_init(); |
|
2269 |
|
|
|
2270 |
|
xlog(20, "%s(%d, %s, %p, 0x%x)\n", |
|
2271 |
|
__func__, dirfd, pathname, statbuf, flags); |
|
2272 |
|
|
|
2273 |
|
my_trace(__func__, 'c', dirfd, pathname, flags); |
|
2274 |
|
ret = old_fstatat64(dirfd, pathname, statbuf, flags); |
|
2275 |
|
my_trace(__func__, 'r', dirfd, pathname, statbuf, flags, ret); |
|
2276 |
|
|
|
2277 |
|
return ret; |
|
2278 |
|
} |
|
2279 |
|
|
|
2280 |
|
int newfstatat(int dirfd, const char *restrict pathname, |
|
2281 |
|
struct stat64 *restrict statbuf, int flags) |
|
2282 |
|
{ |
|
2283 |
|
int ret; |
|
2284 |
|
|
|
2285 |
|
if (!old_fstatat64) |
|
2286 |
|
ninedogs_init(); |
|
2287 |
|
|
|
2288 |
|
xlog(20, "%s(%d, %s, %p, 0x%x)\n", |
|
2289 |
|
__func__, dirfd, pathname, statbuf, flags); |
|
2290 |
|
|
|
2291 |
|
my_trace(__func__, 'c', dirfd, pathname, flags); |
|
2292 |
|
ret = old_fstatat64(dirfd, pathname, statbuf, flags); |
|
2293 |
|
my_trace(__func__, 'r', dirfd, pathname, statbuf, flags, ret); |
|
2294 |
|
|
|
2295 |
|
return ret; |
|
2296 |
|
} |
|
2297 |
|
|
|
2298 |
|
int stat(const char *restrict pathname, struct stat *restrict statbuf) |
|
2299 |
|
{ |
|
2300 |
|
int ret; |
|
2301 |
|
|
|
2302 |
|
if (!old_stat) |
|
2303 |
|
ninedogs_init(); |
|
2304 |
|
|
|
2305 |
|
xlog(20, "%s(%s, %p)\n", |
|
2306 |
|
__func__, pathname, statbuf); |
|
2307 |
|
|
|
2308 |
|
my_trace(__func__, 'c', pathname); |
|
2309 |
|
ret = old_stat(pathname, statbuf); |
|
2310 |
|
my_trace(__func__, 'r', pathname, statbuf, ret); |
|
2311 |
|
|
|
2312 |
|
return ret; |
|
2313 |
|
} |
File trace/nd-trace.c changed (mode: 100644) (index f0bd9c9..8c2ffa7) |
20 |
20 |
#include <stdio.h> |
#include <stdio.h> |
21 |
21 |
#include <stdlib.h> |
#include <stdlib.h> |
22 |
22 |
#include <string.h> |
#include <string.h> |
|
23 |
|
#include <syslog.h> |
23 |
24 |
#include <unistd.h> |
#include <unistd.h> |
24 |
25 |
|
|
25 |
26 |
#include "shared.h" |
#include "shared.h" |
|
... |
... |
static void *decode_ret_pointer(char *out, unsigned out_max, |
201 |
202 |
return ret; |
return ret; |
202 |
203 |
} |
} |
203 |
204 |
|
|
204 |
|
static void decode_dirfd(char *out, int v, const char *postfix) |
|
|
205 |
|
static void decode_dirfd(char *out, unsigned out_size, |
|
206 |
|
unsigned char *d, unsigned int *i, const char *postfix) |
205 |
207 |
{ |
{ |
|
208 |
|
int v = decode32(d, i); |
206 |
209 |
switch (v) { |
switch (v) { |
207 |
|
case AT_FDCWD: sprintf(out, "AT_FDCWD%s", postfix); return; |
|
208 |
|
default: sprintf(out, "%d%s", v, postfix); return; |
|
|
210 |
|
case AT_FDCWD: snprintf(out, out_size, "AT_FDCWD%s", postfix); return; |
|
211 |
|
default: sprintf(out, "todo(%d)%s", v, postfix); return; |
209 |
212 |
} |
} |
210 |
213 |
} |
} |
211 |
214 |
|
|
|
... |
... |
static void decode_sock_optname(char *out, unsigned out_size, |
507 |
510 |
snprintf(out, out_size, "%d", v); |
snprintf(out, out_size, "%d", v); |
508 |
511 |
} |
} |
509 |
512 |
|
|
|
513 |
|
static void decode_syslog_prio(char *out, unsigned out_size, |
|
514 |
|
unsigned char *d, unsigned int *i) |
|
515 |
|
{ |
|
516 |
|
int v = decode32(d, i); |
|
517 |
|
int facility = v >> 3; |
|
518 |
|
char sfac[16]; |
|
519 |
|
|
|
520 |
|
if (facility) |
|
521 |
|
snprintf(sfac, sizeof(sfac), "/fac=%d", facility); |
|
522 |
|
else |
|
523 |
|
sfac[0] = '\0'; |
|
524 |
|
|
|
525 |
|
switch (v & 7) { |
|
526 |
|
case LOG_EMERG: snprintf(out, out_size, "LOG_EMERG%s", sfac); break; |
|
527 |
|
case LOG_ALERT: snprintf(out, out_size, "LOG_ALERT%s", sfac); break; |
|
528 |
|
case LOG_CRIT: snprintf(out, out_size, "LOG_CRIT%s", sfac); break; |
|
529 |
|
case LOG_ERR: snprintf(out, out_size, "LOG_ERR%s", sfac); break; |
|
530 |
|
case LOG_WARNING: snprintf(out, out_size, "LOG_WARNING%s", sfac); break; |
|
531 |
|
case LOG_NOTICE: snprintf(out, out_size, "LOG_NOTICE%s", sfac); break; |
|
532 |
|
case LOG_INFO: snprintf(out, out_size, "LOG_INFO%s", sfac); break; |
|
533 |
|
case LOG_DEBUG: snprintf(out, out_size, "LOG_DEBUG%s", sfac); break; |
|
534 |
|
default: snprintf(out, out_size, "todo(%d/%s)", v & 7, sfac); |
|
535 |
|
} |
|
536 |
|
} |
|
537 |
|
|
|
538 |
|
static void decode_stat(char *out, unsigned out_size, |
|
539 |
|
unsigned char *d, unsigned int *i) |
|
540 |
|
{ |
|
541 |
|
struct stat s; |
|
542 |
|
|
|
543 |
|
s.st_dev = decode64(d, i); |
|
544 |
|
s.st_ino = decode64(d, i); |
|
545 |
|
s.st_mode = decode32(d, i); |
|
546 |
|
s.st_nlink = decode64(d, i); |
|
547 |
|
s.st_uid = decode32(d, i); |
|
548 |
|
s.st_gid = decode32(d, i); |
|
549 |
|
s.st_rdev = decode64(d, i); |
|
550 |
|
s.st_size = decode64(d, i); |
|
551 |
|
s.st_blksize = decode64(d, i); |
|
552 |
|
s.st_blocks = decode64(d, i); |
|
553 |
|
s.st_atim.tv_sec = decode64(d, i); |
|
554 |
|
s.st_atim.tv_nsec = decode32(d, i); |
|
555 |
|
s.st_mtim.tv_sec = decode64(d, i); |
|
556 |
|
s.st_mtim.tv_nsec = decode32(d, i); |
|
557 |
|
s.st_ctim.tv_sec = decode64(d, i); |
|
558 |
|
s.st_ctim.tv_nsec = decode32(d, i); |
|
559 |
|
|
|
560 |
|
snprintf(out, out_size, |
|
561 |
|
"dev=%lu ino=%lu mode=0x%u nlink=%lu uid=%u gid=%u rdev=%lu" |
|
562 |
|
" size=%lu blksize=%lu blocks=%lu atime=%ld.%010ld" |
|
563 |
|
" mtime=%ld.%010ld ctime=%ld.%010ld", |
|
564 |
|
s.st_dev, s.st_ino, s.st_mode, s.st_nlink, s.st_uid, s.st_gid, s.st_rdev, |
|
565 |
|
s.st_size, s.st_blksize, s.st_blocks, s.st_atim.tv_sec, s.st_atim.tv_nsec, |
|
566 |
|
s.st_mtim.tv_sec, s.st_mtim.tv_nsec, s.st_ctim.tv_sec, s.st_ctim.tv_nsec); |
|
567 |
|
} |
|
568 |
|
|
510 |
569 |
static void decode_func(unsigned char *d) |
static void decode_func(unsigned char *d) |
511 |
570 |
{ |
{ |
512 |
571 |
unsigned int i = 0; |
unsigned int i = 0; |
|
... |
... |
static void decode_func(unsigned char *d) |
514 |
573 |
char type, line[64000], rest[2000]; |
char type, line[64000], rest[2000]; |
515 |
574 |
uint64_t t; |
uint64_t t; |
516 |
575 |
|
|
|
576 |
|
line[0] = '\0'; |
517 |
577 |
rest[0] = '\0'; |
rest[0] = '\0'; |
518 |
578 |
|
|
519 |
579 |
t = decode64(d, &i); |
t = decode64(d, &i); |
520 |
580 |
func_len = decode16(d, &i); |
func_len = decode16(d, &i); |
521 |
|
char func[func_len + 1]; |
|
522 |
|
memcpy(func, d + i, func_len); i += func_len; |
|
523 |
|
func[func_len] = '\0'; |
|
|
581 |
|
char func[func_len * 4 + 1]; |
|
582 |
|
bin2hex_ascii(func, d + i, func_len); i += func_len; |
524 |
583 |
type = d[i++]; |
type = d[i++]; |
525 |
584 |
uint32_t pid = decode32(d, &i); |
uint32_t pid = decode32(d, &i); |
526 |
585 |
uint32_t tid = decode32(d, &i); |
uint32_t tid = decode32(d, &i); |
|
... |
... |
static void decode_func(unsigned char *d) |
538 |
597 |
sprintf(line, ":"); |
sprintf(line, ":"); |
539 |
598 |
for (int j = 0; j < r; j++) { |
for (int j = 0; j < r; j++) { |
540 |
599 |
unsigned char len = decode8(d, &i); |
unsigned char len = decode8(d, &i); |
541 |
|
char l[len + 1]; |
|
542 |
|
memcpy(l, d + i, len); i += len; |
|
543 |
|
l[len] = '\0'; |
|
|
600 |
|
char l[len * 4 + 1]; |
|
601 |
|
bin2hex(l, d + i, len); i += len; |
544 |
602 |
strcat(line, " "); |
strcat(line, " "); |
545 |
603 |
strcat(line, l); |
strcat(line, l); |
546 |
604 |
} |
} |
|
... |
... |
static void decode_func(unsigned char *d) |
607 |
665 |
case 'd': |
case 'd': |
608 |
666 |
if (strcmp(func, "dlopen") == 0) { |
if (strcmp(func, "dlopen") == 0) { |
609 |
667 |
uint16_t len = decode16(d, &i); |
uint16_t len = decode16(d, &i); |
610 |
|
char filename[len + 1]; |
|
611 |
|
memcpy(filename, d + i, len); i += len; |
|
612 |
|
filename[len] = '\0'; |
|
|
668 |
|
char filename[len * 4 + 1]; |
|
669 |
|
bin2hex_ascii(filename, d + i, len); i += len; |
613 |
670 |
int flags = decode32(d, &i); |
int flags = decode32(d, &i); |
614 |
671 |
if (type == 'r') |
if (type == 'r') |
615 |
672 |
decode_ret_pointer(rest, sizeof(rest), d, &i); |
decode_ret_pointer(rest, sizeof(rest), d, &i); |
|
... |
... |
static void decode_func(unsigned char *d) |
621 |
678 |
sprintf(line, "(%p)%s", h, rest); |
sprintf(line, "(%p)%s", h, rest); |
622 |
679 |
} break; |
} break; |
623 |
680 |
|
|
|
681 |
|
case 'f': |
|
682 |
|
if ((strcmp(func, "fstatat") == 0) |
|
683 |
|
|| (strcmp(func, "fstat64") == 0)) { |
|
684 |
|
char dirfd[32], sstat[512]; |
|
685 |
|
decode_dirfd(dirfd, sizeof(dirfd), d, &i, ""); |
|
686 |
|
uint16_t len = decode16(d, &i); |
|
687 |
|
char pathname[len * 4 + 1]; |
|
688 |
|
bin2hex_ascii(pathname, d + i, len); i += len; |
|
689 |
|
decode_stat(sstat, sizeof(sstat), d, &i); |
|
690 |
|
int flags = decode32(d, &i); |
|
691 |
|
if (type == 'r') |
|
692 |
|
decode_ret_pointer(rest, sizeof(rest), d, &i); |
|
693 |
|
sprintf(line, "(%s, '%s', {%s}, 0x%x)%s", |
|
694 |
|
dirfd, pathname, sstat, flags, rest); |
|
695 |
|
} else if (strcmp(func, "dlclose") == 0) { |
|
696 |
|
void *h = (void *) decode64(d, &i); |
|
697 |
|
if (type == 'r') |
|
698 |
|
decode_ret_int(rest, sizeof(rest), d, &i); |
|
699 |
|
sprintf(line, "(%p)%s", h, rest); |
|
700 |
|
} break; |
|
701 |
|
|
624 |
702 |
case 'g': |
case 'g': |
625 |
703 |
if (strcmp(func, "getaddrinfo") == 0) { |
if (strcmp(func, "getaddrinfo") == 0) { |
626 |
704 |
uint16_t len; |
uint16_t len; |
|
... |
... |
static void decode_func(unsigned char *d) |
654 |
732 |
node, service, rest); |
node, service, rest); |
655 |
733 |
} else if (strcmp(func, "gethostbyname") == 0) { |
} else if (strcmp(func, "gethostbyname") == 0) { |
656 |
734 |
uint16_t len = decode16(d, &i); |
uint16_t len = decode16(d, &i); |
657 |
|
char host[len + 1]; |
|
658 |
|
memcpy(host, d + i, len); i += len; |
|
|
735 |
|
char host[len * 4 + 1]; |
|
736 |
|
bin2hex_ascii(host, d + i, len); i += len; |
659 |
737 |
if (type == 'r') |
if (type == 'r') |
660 |
738 |
decode_ret_int(rest, sizeof(rest), d, &i); |
decode_ret_int(rest, sizeof(rest), d, &i); |
661 |
739 |
sprintf(line, "('%s')%s", host, rest); |
sprintf(line, "('%s')%s", host, rest); |
|
... |
... |
static void decode_func(unsigned char *d) |
723 |
801 |
case 'o': |
case 'o': |
724 |
802 |
if ((strcmp(func, "open") == 0) || (strcmp(func, "open64") == 0) |
if ((strcmp(func, "open") == 0) || (strcmp(func, "open64") == 0) |
725 |
803 |
|| (strcmp(func, "openat") == 0)) { |
|| (strcmp(func, "openat") == 0)) { |
726 |
|
char dirfd_decoded[32]; |
|
|
804 |
|
char dirfd[32]; |
727 |
805 |
if (strcmp(func, "openat") == 0) |
if (strcmp(func, "openat") == 0) |
728 |
|
decode_dirfd(dirfd_decoded, decode32(d, &i), " ,"); |
|
|
806 |
|
decode_dirfd(dirfd, sizeof(dirfd), d, &i, " ,"); |
729 |
807 |
else |
else |
730 |
|
dirfd_decoded[0] = '\0'; |
|
|
808 |
|
dirfd[0] = '\0'; |
731 |
809 |
uint16_t len = decode16(d, &i); |
uint16_t len = decode16(d, &i); |
732 |
|
char filename[len + 1]; |
|
733 |
|
memcpy(filename, d + i, len); i += len; |
|
734 |
|
filename[len] = '\0'; |
|
|
810 |
|
char filename[len * 4 + 1]; |
|
811 |
|
bin2hex_ascii(filename, d + i, len); i += len; |
735 |
812 |
int flags = decode32(d, &i); |
int flags = decode32(d, &i); |
736 |
813 |
mode_t mode = decode32(d, &i); |
mode_t mode = decode32(d, &i); |
737 |
814 |
if (type == 'r') |
if (type == 'r') |
738 |
815 |
decode_ret_int(rest, sizeof(rest), d, &i); |
decode_ret_int(rest, sizeof(rest), d, &i); |
739 |
816 |
sprintf(line, "('%s'%s, 0x%x, 0x%x)%s", |
sprintf(line, "('%s'%s, 0x%x, 0x%x)%s", |
740 |
|
dirfd_decoded, filename, flags, mode, rest); |
|
|
817 |
|
dirfd, filename, flags, mode, rest); |
741 |
818 |
} break; |
} break; |
742 |
819 |
|
|
743 |
820 |
case 'p': |
case 'p': |
|
... |
... |
static void decode_func(unsigned char *d) |
782 |
859 |
sock, data, |
sock, data, |
783 |
860 |
max < ret ? "..." : "", rest); |
max < ret ? "..." : "", rest); |
784 |
861 |
} else { |
} else { |
785 |
|
sprintf(line, "(%d, [])%s", |
|
786 |
|
sock, rest); |
|
|
862 |
|
sprintf(line, "(%d)%s", sock, rest); |
787 |
863 |
} |
} |
788 |
864 |
} |
} |
789 |
865 |
} break; |
} break; |
|
... |
... |
static void decode_func(unsigned char *d) |
852 |
928 |
sprintf(line, "(%s, %s, %d)%s", |
sprintf(line, "(%s, %s, %d)%s", |
853 |
929 |
decode_socket_domain(xdomain), |
decode_socket_domain(xdomain), |
854 |
930 |
decode_socket_type(xtype), xprotocol, rest); |
decode_socket_type(xtype), xprotocol, rest); |
|
931 |
|
} else if (strcmp(func, "stat") == 0) { |
|
932 |
|
uint16_t len = decode16(d, &i); |
|
933 |
|
char pathname[len * 4 + 1]; |
|
934 |
|
bin2hex_ascii(pathname, d + i, len); i += len; |
|
935 |
|
if (type == 'c') { |
|
936 |
|
sprintf(line, "('%s')", pathname); |
|
937 |
|
} else { |
|
938 |
|
char sstat[512]; |
|
939 |
|
decode_stat(sstat, sizeof(sstat), d, &i); |
|
940 |
|
decode_ret_int(rest, sizeof(rest), d, &i); |
|
941 |
|
sprintf(line, "('%s', {%s})%s", pathname, sstat, rest); |
|
942 |
|
} |
|
943 |
|
} else if (strcmp(func, "syslog") == 0) { |
|
944 |
|
//char dump[4096]; bin2hex_ascii(dump, d + i, 128); fprintf(out, "DUMP[%s][%c]: %s\n", func, type, dump); |
|
945 |
|
char sprio[32]; |
|
946 |
|
decode_syslog_prio(sprio, sizeof(sprio), d, &i); |
|
947 |
|
int len = decode16(d, &i); |
|
948 |
|
char data[len * 4 + 1]; |
|
949 |
|
bin2hex_ascii(data, d + i, len); i += len; |
|
950 |
|
sprintf(line, "(%s, '%s')", sprio, data); |
855 |
951 |
} break; |
} break; |
856 |
952 |
|
|
857 |
953 |
case 'u': |
case 'u': |
858 |
954 |
if (strcmp(func, "unlink") == 0) { |
if (strcmp(func, "unlink") == 0) { |
859 |
955 |
uint16_t len = decode16(d, &i); |
uint16_t len = decode16(d, &i); |
860 |
|
char pathname[len + 1]; |
|
861 |
|
memcpy(pathname, d + i, len); i += len; |
|
862 |
|
pathname[len] = '\0'; |
|
|
956 |
|
char pathname[len * 4 + 1]; |
|
957 |
|
bin2hex_ascii(pathname, d + i, len); i += len; |
863 |
958 |
if (type == 'r') |
if (type == 'r') |
864 |
959 |
decode_ret_int(rest, sizeof(rest), d, &i); |
decode_ret_int(rest, sizeof(rest), d, &i); |
865 |
960 |
sprintf(line, "('%s')%s", pathname, rest); |
sprintf(line, "('%s')%s", pathname, rest); |