1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
#![no_std]
#![feature(c_size_t)]
use aya_ebpf::cty::c_long;
use core::ffi::c_int;
use core::ffi::c_longlong;
use core::ffi::CStr;
use core::ffi::{c_size_t, c_uint};
use core::fmt::{self, Formatter};
use core::str;
mod vmlinux;
use crate::vmlinux::umode_t;
pub enum SyscallInfo {
Write(WriteSyscallBPF),
Open(OpenSyscallBPF),
Close(CloseSyscallBPF),
FSeek(FSeekSyscallBPF),
}
#[derive(Clone, Copy)]
pub struct WriteSyscallBPF {
pub pid: u32,
pub fd: c_int,
pub buf: [u8; 96], //TODO: might want to use c_char here
pub count: i64,
pub ret: c_long,
}
unsafe impl Sync for WriteSyscallBPF {}
impl fmt::Debug for WriteSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("WriteSyscallBPF")
.field("pid", &self.pid)
.field("fd", &self.fd)
.field("buf", &str::from_utf8(&self.buf).unwrap_or(""))
.field("count", &self.count)
.field("ret", &self.ret)
.finish()
}
}
#[derive(Clone, Copy)]
pub struct OpenSyscallBPF {
pub pid: u32,
pub dfd: c_int,
pub filename: [u8; 96],
pub flags: c_int,
pub mode: umode_t,
pub ret: c_int,
}
unsafe impl Sync for OpenSyscallBPF {}
impl fmt::Debug for OpenSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("OpenSyscallBPF")
.field("pid", &self.pid)
.field("dfd", &self.dfd)
.field(
"filename",
&CStr::from_bytes_until_nul(&self.filename).unwrap_or_default(),
)
.field("flags", &self.flags)
.field("ret", &self.ret)
.finish()
}
}
#[derive(Clone, Copy)]
pub struct CloseSyscallBPF {
pub pid: u32,
pub fd: c_int,
pub ret: c_long,
}
unsafe impl Sync for CloseSyscallBPF {}
impl fmt::Debug for CloseSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("CloseSyscallBPF")
.field("pid", &self.pid)
.field("fd", &self.fd)
.field("ret", &self.ret)
.finish()
}
}
#[derive(Clone, Copy)]
pub struct FSeekSyscallBPF {
pub pid: u32,
pub fd: c_int,
pub offset: i64,
pub whence: c_uint,
pub ret: c_long,
}
unsafe impl Sync for FSeekSyscallBPF {}
impl fmt::Debug for FSeekSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("FSeekSyscallBPF")
.field("pid", &self.pid)
.field("fd", &self.fd)
.field("offset", &self.offset)
.field("whence", &self.whence)
.field("ret", &self.ret)
.finish()
}
}
|
