| Index: sandbox/linux/bpf_dsl/bpf_dsl.cc
|
| diff --git a/sandbox/linux/bpf_dsl/bpf_dsl.cc b/sandbox/linux/bpf_dsl/bpf_dsl.cc
|
| index e9057aed43613deeea283e007c9f4abbc8a86ce5..ac16051ccbf4312fb4e8cbf2836c6c964b389946 100644
|
| --- a/sandbox/linux/bpf_dsl/bpf_dsl.cc
|
| +++ b/sandbox/linux/bpf_dsl/bpf_dsl.cc
|
| @@ -6,67 +6,75 @@
|
|
|
| #include <errno.h>
|
|
|
| +#include <limits>
|
| +
|
| #include "base/logging.h"
|
| #include "base/memory/ref_counted.h"
|
| #include "sandbox/linux/seccomp-bpf/errorcode.h"
|
| #include "sandbox/linux/seccomp-bpf/sandbox_bpf.h"
|
|
|
| -using namespace sandbox::bpf_dsl::internal;
|
| -typedef ::sandbox::Trap::TrapFnc TrapFnc;
|
| -
|
| namespace sandbox {
|
| namespace bpf_dsl {
|
| namespace {
|
|
|
| -class AllowResultExprImpl : public ResultExprImpl {
|
| +class AllowResultExprImpl : public internal::ResultExprImpl {
|
| public:
|
| AllowResultExprImpl() {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE {
|
| return ErrorCode(ErrorCode::ERR_ALLOWED);
|
| }
|
|
|
| private:
|
| virtual ~AllowResultExprImpl() {}
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(AllowResultExprImpl);
|
| };
|
|
|
| -class ErrorResultExprImpl : public ResultExprImpl {
|
| +class ErrorResultExprImpl : public internal::ResultExprImpl {
|
| public:
|
| explicit ErrorResultExprImpl(int err) : err_(err) {
|
| CHECK(err_ >= ErrorCode::ERR_MIN_ERRNO && err_ <= ErrorCode::ERR_MAX_ERRNO);
|
| }
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE {
|
| return ErrorCode(err_);
|
| }
|
|
|
| private:
|
| virtual ~ErrorResultExprImpl() {}
|
| +
|
| int err_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(ErrorResultExprImpl);
|
| };
|
|
|
| -class TrapResultExprImpl : public ResultExprImpl {
|
| +class TrapResultExprImpl : public internal::ResultExprImpl {
|
| public:
|
| - TrapResultExprImpl(TrapFnc func, void* arg) : func_(func), arg_(arg) {
|
| + TrapResultExprImpl(Trap::TrapFnc func, void* arg) : func_(func), arg_(arg) {
|
| DCHECK(func_);
|
| }
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE {
|
| return sb->Trap(func_, arg_);
|
| }
|
|
|
| private:
|
| virtual ~TrapResultExprImpl() {}
|
| - TrapFnc func_;
|
| +
|
| + Trap::TrapFnc func_;
|
| void* arg_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(TrapResultExprImpl);
|
| };
|
|
|
| -class IfThenResultExprImpl : public ResultExprImpl {
|
| +class IfThenResultExprImpl : public internal::ResultExprImpl {
|
| public:
|
| - IfThenResultExprImpl(BoolExpr cond,
|
| - ResultExpr then_result,
|
| - ResultExpr else_result)
|
| + IfThenResultExprImpl(const BoolExpr& cond,
|
| + const ResultExpr& then_result,
|
| + const ResultExpr& else_result)
|
| : cond_(cond), then_result_(then_result), else_result_(else_result) {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb) const OVERRIDE {
|
| return cond_->Compile(
|
| sb, then_result_->Compile(sb), else_result_->Compile(sb));
|
| @@ -74,19 +82,22 @@ class IfThenResultExprImpl : public ResultExprImpl {
|
|
|
| private:
|
| virtual ~IfThenResultExprImpl() {}
|
| +
|
| BoolExpr cond_;
|
| ResultExpr then_result_;
|
| ResultExpr else_result_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(IfThenResultExprImpl);
|
| };
|
|
|
| -class PrimitiveBoolExprImpl : public BoolExprImpl {
|
| +class PrimitiveBoolExprImpl : public internal::BoolExprImpl {
|
| public:
|
| PrimitiveBoolExprImpl(int argno,
|
| ErrorCode::ArgType is_32bit,
|
| ErrorCode::Operation op,
|
| uint64_t value)
|
| : argno_(argno), is_32bit_(is_32bit), op_(op), value_(value) {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb,
|
| ErrorCode true_ec,
|
| ErrorCode false_ec) const OVERRIDE {
|
| @@ -95,16 +106,19 @@ class PrimitiveBoolExprImpl : public BoolExprImpl {
|
|
|
| private:
|
| virtual ~PrimitiveBoolExprImpl() {}
|
| +
|
| int argno_;
|
| ErrorCode::ArgType is_32bit_;
|
| ErrorCode::Operation op_;
|
| uint64_t value_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(PrimitiveBoolExprImpl);
|
| };
|
|
|
| -class NegateBoolExprImpl : public BoolExprImpl {
|
| +class NegateBoolExprImpl : public internal::BoolExprImpl {
|
| public:
|
| - explicit NegateBoolExprImpl(BoolExpr cond) : cond_(cond) {}
|
| + explicit NegateBoolExprImpl(const BoolExpr& cond) : cond_(cond) {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb,
|
| ErrorCode true_ec,
|
| ErrorCode false_ec) const OVERRIDE {
|
| @@ -113,13 +127,17 @@ class NegateBoolExprImpl : public BoolExprImpl {
|
|
|
| private:
|
| virtual ~NegateBoolExprImpl() {}
|
| +
|
| BoolExpr cond_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(NegateBoolExprImpl);
|
| };
|
|
|
| -class AndBoolExprImpl : public BoolExprImpl {
|
| +class AndBoolExprImpl : public internal::BoolExprImpl {
|
| public:
|
| - AndBoolExprImpl(BoolExpr lhs, BoolExpr rhs) : lhs_(lhs), rhs_(rhs) {}
|
| + AndBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs)
|
| + : lhs_(lhs), rhs_(rhs) {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb,
|
| ErrorCode true_ec,
|
| ErrorCode false_ec) const OVERRIDE {
|
| @@ -128,13 +146,18 @@ class AndBoolExprImpl : public BoolExprImpl {
|
|
|
| private:
|
| virtual ~AndBoolExprImpl() {}
|
| - BoolExpr lhs_, rhs_;
|
| +
|
| + BoolExpr lhs_;
|
| + BoolExpr rhs_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(AndBoolExprImpl);
|
| };
|
|
|
| -class OrBoolExprImpl : public BoolExprImpl {
|
| +class OrBoolExprImpl : public internal::BoolExprImpl {
|
| public:
|
| - OrBoolExprImpl(BoolExpr lhs, BoolExpr rhs) : lhs_(lhs), rhs_(rhs) {}
|
| + OrBoolExprImpl(const BoolExpr& lhs, const BoolExpr& rhs)
|
| + : lhs_(lhs), rhs_(rhs) {}
|
| +
|
| virtual ErrorCode Compile(SandboxBPF* sb,
|
| ErrorCode true_ec,
|
| ErrorCode false_ec) const OVERRIDE {
|
| @@ -143,7 +166,10 @@ class OrBoolExprImpl : public BoolExprImpl {
|
|
|
| private:
|
| virtual ~OrBoolExprImpl() {}
|
| - BoolExpr lhs_, rhs_;
|
| +
|
| + BoolExpr lhs_;
|
| + BoolExpr rhs_;
|
| +
|
| DISALLOW_COPY_AND_ASSIGN(OrBoolExprImpl);
|
| };
|
|
|
| @@ -161,23 +187,27 @@ BoolExpr ArgEq(int num, size_t size, uint64_t mask, uint64_t val) {
|
| const ErrorCode::ArgType arg_type =
|
| (size <= 4) ? ErrorCode::TP_32BIT : ErrorCode::TP_64BIT;
|
|
|
| - if (mask == static_cast<uint64_t>(-1)) {
|
| + if (mask == std::numeric_limits<uint64_t>::max()) {
|
| // Arg == Val
|
| return BoolExpr(new const PrimitiveBoolExprImpl(
|
| num, arg_type, ErrorCode::OP_EQUAL, val));
|
| - } else if (mask == val) {
|
| + }
|
| +
|
| + if (mask == val) {
|
| // (Arg & Mask) == Mask
|
| return BoolExpr(new const PrimitiveBoolExprImpl(
|
| num, arg_type, ErrorCode::OP_HAS_ALL_BITS, mask));
|
| - } else if (val == 0) {
|
| + }
|
| +
|
| + if (val == 0) {
|
| // (Arg & Mask) == 0, which is semantically equivalent to !((arg & mask) !=
|
| // 0).
|
| return !BoolExpr(new const PrimitiveBoolExprImpl(
|
| num, arg_type, ErrorCode::OP_HAS_ANY_BITS, mask));
|
| - } else {
|
| - CHECK(false) << "Unimplemented ArgEq case";
|
| - return BoolExpr();
|
| }
|
| +
|
| + CHECK(false) << "Unimplemented ArgEq case";
|
| + return BoolExpr();
|
| }
|
|
|
| } // namespace internal
|
| @@ -190,23 +220,23 @@ ResultExpr Error(int err) {
|
| return ResultExpr(new const ErrorResultExprImpl(err));
|
| }
|
|
|
| -ResultExpr Trap(TrapFnc trap_func, void* aux) {
|
| +ResultExpr Trap(Trap::TrapFnc trap_func, void* aux) {
|
| return ResultExpr(new const TrapResultExprImpl(trap_func, aux));
|
| }
|
|
|
| -BoolExpr operator!(BoolExpr cond) {
|
| +BoolExpr operator!(const BoolExpr& cond) {
|
| return BoolExpr(new const NegateBoolExprImpl(cond));
|
| }
|
|
|
| -BoolExpr operator&&(BoolExpr lhs, BoolExpr rhs) {
|
| +BoolExpr operator&&(const BoolExpr& lhs, const BoolExpr& rhs) {
|
| return BoolExpr(new const AndBoolExprImpl(lhs, rhs));
|
| }
|
|
|
| -BoolExpr operator||(BoolExpr lhs, BoolExpr rhs) {
|
| +BoolExpr operator||(const BoolExpr& lhs, const BoolExpr& rhs) {
|
| return BoolExpr(new const OrBoolExprImpl(lhs, rhs));
|
| }
|
|
|
| -Elser If(BoolExpr cond, ResultExpr then_result) {
|
| +Elser If(const BoolExpr& cond, const ResultExpr& then_result) {
|
| return Elser(Cons<Elser::Clause>::List()).ElseIf(cond, then_result);
|
| }
|
|
|
| @@ -219,12 +249,12 @@ Elser::Elser(const Elser& elser) : clause_list_(elser.clause_list_) {
|
| Elser::~Elser() {
|
| }
|
|
|
| -Elser Elser::ElseIf(BoolExpr cond, ResultExpr then_result) const {
|
| +Elser Elser::ElseIf(const BoolExpr& cond, const ResultExpr& then_result) const {
|
| return Elser(
|
| Cons<Clause>::Make(std::make_pair(cond, then_result), clause_list_));
|
| }
|
|
|
| -ResultExpr Elser::Else(ResultExpr else_result) const {
|
| +ResultExpr Elser::Else(const ResultExpr& else_result) const {
|
| // We finally have the default result expression for this
|
| // if/then/else sequence. Also, we've already accumulated all
|
| // if/then pairs into a list of reverse order (i.e., lower priority
|
| @@ -269,8 +299,7 @@ ErrorCode SandboxBPFDSLPolicy::InvalidSyscall(SandboxBPF* sb) const {
|
| return InvalidSyscall()->Compile(sb);
|
| }
|
|
|
| -ResultExpr SandboxBPFDSLPolicy::Trap(::sandbox::Trap::TrapFnc trap_func,
|
| - void* aux) {
|
| +ResultExpr SandboxBPFDSLPolicy::Trap(Trap::TrapFnc trap_func, void* aux) {
|
| return bpf_dsl::Trap(trap_func, aux);
|
| }
|
|
|
|
|