summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPaul Buetow <pbuetow@mimecast.com>2018-03-30 11:04:11 +0100
committerPaul Buetow <pbuetow@mimecast.com>2018-03-30 11:04:11 +0100
commitf2c21d78cecc86390b2bc16e111f1424f0f76630 (patch)
tree1f5e5b653e606d9112ae62b8e1723daf33f83fce
parenta812f0b58edd2f74edbdd03e07006dccf3d535d6 (diff)
add capture file version check
-rw-r--r--README.md1
-rw-r--r--ioriot/Makefile2
-rw-r--r--ioriot/src/generate/generate.c20
-rw-r--r--ioriot/src/init/init.c12
-rw-r--r--ioriot/src/meta/meta.c2
-rw-r--r--systemtap/src/ioriot.stp14
-rw-r--r--systemtap/src/javaioriot.stp14
-rw-r--r--systemtap/src/targetedioriot.stp14
8 files changed, 55 insertions, 24 deletions
diff --git a/README.md b/README.md
index 0ab83cd..e7d7f72 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,7 @@ sudo ioriot -c ~/io.capture -m targetedioriot.ko -p PID
The resulting capture log looks like this and can be multiple GB in size:
```sh
+#|capture_version=2|
t=1511381122062;:,i=7764:8093;:,o=open;:,d=162;:,p=///usr/local/mimecast/someapp/somesubdir/vd11-9:1;:,f=0;:,m=438;:,
t=1511381122062;:,i=7764:8093;:,o=fstat;:,d=162;:,s=0;:,
t=1511381122062;:,i=7764:8093;:,o=read;:,d=162;:,b=12;:,
diff --git a/ioriot/Makefile b/ioriot/Makefile
index 24b6fcf..15a2f7d 100644
--- a/ioriot/Makefile
+++ b/ioriot/Makefile
@@ -11,7 +11,7 @@ all: compile
quick: clean ctags compile sudo_install
cshell: compile
gdb -ex='break main; run' --args ./$(NAME)
-test: compile
+gdbtest: compile
gdb -ex=run --args ./$(NAME) -U
compile: $(OBJS)
$(CC) $(STATIC) $(DEBUG) $(LIBS) $(OBJS) -o $(NAME)
diff --git a/ioriot/src/generate/generate.c b/ioriot/src/generate/generate.c
index 53751de..0185c50 100644
--- a/ioriot/src/generate/generate.c
+++ b/ioriot/src/generate/generate.c
@@ -81,8 +81,23 @@ status_e generate_run(options_s *opts)
set_limits_drop_root(opts->user);
+ // Check for correct capture format version
+ meta_s *meta = meta_new(capture_fd);
+ meta_read_start(meta);
+
+ long capture_version = 0;
+ if (meta_read_l(meta, "capture_version", &capture_version)) {
+ Put("Capture version is '%ld'", capture_version);
+ if (capture_version != CAPTURE_VERSION) {
+ Error(".capture file of incompatible version, got %x, expected %x",
+ (int)capture_version, CAPTURE_VERSION);
+ }
+ }
+
+ meta_destroy(meta);
+
// Reserve first few bytes for meta information
- meta_s *meta = meta_new(g->replay_fd);
+ meta = meta_new(g->replay_fd);
meta_reserve(meta);
// The writer will write the .replay file
@@ -108,6 +123,9 @@ status_e generate_run(options_s *opts)
// either the parser or the writer thread!
while ((read = getline(&line, &len, capture_fd)) != -1) {
+ if (line[0] == '#')
+ continue;
+
if (0 > ++g->lineno) {
Error("lineno:%lu Line number overflow", g->lineno);
}
diff --git a/ioriot/src/init/init.c b/ioriot/src/init/init.c
index 3f9d8a0..659d59a 100644
--- a/ioriot/src/init/init.c
+++ b/ioriot/src/init/init.c
@@ -59,12 +59,12 @@ void init_extract_header(init_s *i, off_t *init_offset)
meta_s *m = meta_new(i->replay_fd);
meta_read_start(m);
- long version = 0;
- if (meta_read_l(m, "version", &version)) {
- Put("Replay version is '%ld'", version);
- if (version != REPLAY_VERSION) {
+ long replay_version = 0;
+ if (meta_read_l(m, "replay_version", &replay_version)) {
+ Put("Replay version is '%ld'", replay_version);
+ if (replay_version != REPLAY_VERSION) {
Error(".replay file of incompatible version, got %x, expected %x",
- (int)version, REPLAY_VERSION);
+ (int)replay_version, REPLAY_VERSION);
}
}
@@ -136,7 +136,7 @@ status_e init_run(options_s *opts)
// Process the INIT section of the .replay file line by line.
while ((read = getline(&line, &len, i->replay_fd)) != -1) {
- Debug(line);
+ //Debug(line);
char *tok = strtok_r(line, "|", &saveptr);
for (int ntok = 0; tok; ntok++) {
diff --git a/ioriot/src/meta/meta.c b/ioriot/src/meta/meta.c
index d56c17e..1902ac6 100644
--- a/ioriot/src/meta/meta.c
+++ b/ioriot/src/meta/meta.c
@@ -40,7 +40,7 @@ void meta_destroy(meta_s *m)
void meta_reserve(meta_s *m)
{
- // TODO: Use a hole in the .replay file to reserve space
+ // Improvemend: Use a hole in the .replay file to reserve space
char buf[_MAX_META_LEN];
Mset(&buf, '#', _MAX_META_LEN-1, char);
fprintf(m->replay_fd, "%s\n", buf);
diff --git a/systemtap/src/ioriot.stp b/systemtap/src/ioriot.stp
index 4029ebb..ee77263 100644
--- a/systemtap/src/ioriot.stp
+++ b/systemtap/src/ioriot.stp
@@ -71,6 +71,15 @@ function absolute_path (path) {
return task_dentry_path(tc, pwd_dentry, pwd_mnt) . "/" . path;
}
+# Stop probing after 1h (for safety)
+probe timer.s(3600) {
+ exit();
+}
+
+probe begin {
+ printf("#|capture_version=%d|\n", 2);
+}
+
probe syscall.open.return, syscall.openat.return {
if (execname() != "stapio") {
pathname = user_string(@entry($filename))
@@ -597,9 +606,4 @@ probe syscall.exit_group {
}
}
-# Stop probing after 1h (for safety)
-probe timer.s(3600) {
- exit();
-}
-
# vim: tabstop=4 expandtab shiftwidth=4 softtabstop=4
diff --git a/systemtap/src/javaioriot.stp b/systemtap/src/javaioriot.stp
index 945ecf6..b0e960c 100644
--- a/systemtap/src/javaioriot.stp
+++ b/systemtap/src/javaioriot.stp
@@ -71,6 +71,15 @@ function absolute_path (path) {
return task_dentry_path(tc, pwd_dentry, pwd_mnt) . "/" . path;
}
+# Stop probing after 1h (for safety)
+probe timer.s(3600) {
+ exit();
+}
+
+probe begin {
+ printf("#|capture_version=%d|\n", 2);
+}
+
probe syscall.open.return, syscall.openat.return {
if (execname() == "java") {
pathname = user_string(@entry($filename))
@@ -597,9 +606,4 @@ probe syscall.exit_group {
}
}
-# Stop probing after 1h (for safety)
-probe timer.s(3600) {
- exit();
-}
-
# vim: tabstop=4 expandtab shiftwidth=4 softtabstop=4
diff --git a/systemtap/src/targetedioriot.stp b/systemtap/src/targetedioriot.stp
index ee3ee7a..539b826 100644
--- a/systemtap/src/targetedioriot.stp
+++ b/systemtap/src/targetedioriot.stp
@@ -71,6 +71,15 @@ function absolute_path (path) {
return task_dentry_path(tc, pwd_dentry, pwd_mnt) . "/" . path;
}
+# Stop probing after 1h (for safety)
+probe timer.s(3600) {
+ exit();
+}
+
+probe begin {
+ printf("#|capture_version=%d|\n", 2);
+}
+
probe syscall.open.return, syscall.openat.return {
if (pid() == target()) {
pathname = user_string(@entry($filename))
@@ -597,9 +606,4 @@ probe syscall.exit_group {
}
}
-# Stop probing after 1h (for safety)
-probe timer.s(3600) {
- exit();
-}
-
# vim: tabstop=4 expandtab shiftwidth=4 softtabstop=4