augmented_filename_syscall_enter(newstat);
+#ifndef _K_SS_MAXSIZE
+#define _K_SS_MAXSIZE 128
+#endif
+
+#define augmented_sockaddr_syscall_enter(syscall) \
+struct augmented_enter_##syscall##_args { \
+ struct syscall_enter_##syscall##_args args; \
+ struct sockaddr_storage addr; \
+}; \
+int syscall_enter(syscall)(struct syscall_enter_##syscall##_args *args) \
+{ \
+ struct augmented_enter_##syscall##_args augmented_args; \
+ unsigned long addrlen = sizeof(augmented_args.addr); \
+ probe_read(&augmented_args.args, sizeof(augmented_args.args), args); \
+/* FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK */ \
+/* if (addrlen > augmented_args.args.addrlen) */ \
+/* addrlen = augmented_args.args.addrlen; */ \
+/* */ \
+ probe_read(&augmented_args.addr, addrlen, args->addr_ptr); \
+ perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, \
+ &augmented_args, \
+ sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen); \
+ return 0; \
+}
+
struct sockaddr;
struct syscall_enter_connect_args {
unsigned long addrlen;
};
-struct augmented_enter_connect_args {
- struct syscall_enter_connect_args args;
- struct sockaddr_storage addr;
-};
-
-int syscall_enter(connect)(struct syscall_enter_connect_args *args)
-{
- struct augmented_enter_connect_args augmented_args;
- unsigned long addrlen = sizeof(augmented_args.addr);
-
- probe_read(&augmented_args.args, sizeof(augmented_args.args), args);
-#ifdef FIXME_CLANG_OPTIMIZATION_THAT_ACCESSES_USER_CONTROLLED_ADDRLEN_DESPITE_THIS_CHECK
- if (addrlen > augmented_args.args.addrlen)
- addrlen = augmented_args.args.addrlen;
-#endif
- probe_read(&augmented_args.addr, addrlen, args->addr_ptr);
- perf_event_output(args, &__augmented_syscalls__, BPF_F_CURRENT_CPU, &augmented_args,
- sizeof(augmented_args) - sizeof(augmented_args.addr) + addrlen);
- return 0;
-}
+augmented_sockaddr_syscall_enter(connect);
license(GPL);