1 #!/usr/sbin/dtrace -s 2 /* 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 /* 30 #pragma D option flowindent 31 */ 32 33 /* 34 *** vscan kernel pseudo driver *** 35 */ 36 37 /* 38 * vscan_svc.c 39 */ 40 sdt:vscan::vscan-req-counts 41 { 42 printf("%s reql: %d, node: %d, taskq: %d", 43 stringof(arg0), 44 ((vscan_svc_counts_t *)arg1)->vsc_reql, 45 ((vscan_svc_counts_t *)arg1)->vsc_node, 46 ((vscan_svc_counts_t *)arg1)->vsc_tq); 47 } 48 49 sdt:vscan::vscan-svc-state-violation 50 { 51 printf("%d %s", arg0, 52 arg0 == 0 ? "UNCONFIG" : 53 arg0 == 1 ? "IDLE" : 54 arg0 == 2 ? "ENABLED" : 55 arg0 == 3 ? "DISABLED" : "UNKNOWN"); 56 } 57 58 sdt:vscan::vscan-scan-timeout 59 { 60 printf("idx: %d, seqnum: %d - %s", 61 ((vscan_req_t *)arg0)->vsr_idx, 62 ((vscan_req_t *)arg0)->vsr_seqnum, 63 stringof(((vscan_req_t *)arg0)->vsr_vp->v_path)); 64 } 65 66 sdt:vscan::vscan-scan-file 67 { 68 printf("%s (%s)", stringof(arg0), arg1 ? "async" : "sync"); 69 } 70 71 sdt:vscan::vscan-exempt-filesize 72 { 73 printf("%s EXEMPT (%s)", stringof(arg0), arg1 ? "DENY" : "ALLOW"); 74 } 75 76 sdt:vscan::vscan-type-match 77 { 78 printf("ext: %s matched: %s", stringof(arg0), stringof(arg1)); 79 } 80 81 sdt:vscan::vscan-exempt-filetype 82 { 83 printf("%s EXEMPT", stringof(arg0)); 84 } 85 86 sdt:vscan::vscan-getattr 87 { 88 printf("%s, m: %d, q: %d, scanstamp: %s", 89 stringof(((vscan_svc_node_t *)arg0)->vsn_req->vsr_vp->v_path), 90 ((vscan_svc_node_t *)arg0)->vsn_modified, 91 ((vscan_svc_node_t *)arg0)->vsn_quarantined, 92 stringof(((vscan_svc_node_t *)arg0)->vsn_scanstamp)); 93 } 94 95 sdt:vscan::vscan-setattr 96 { 97 /* XAT_AV_QUARANTINED */ 98 printf("%s", (arg1 & 0x400) == 0 ? "" : 99 ((vscan_svc_node_t *)arg0)->vsn_quarantined ? "q: 1, " : "q: 0, "); 100 101 /* XAT_AV_MODIFIED */ 102 printf("%s", (arg1 & 0x800) == 0 ? "" : 103 ((vscan_svc_node_t *)arg0)->vsn_modified ? "m: 1, " : "m: 0, "); 104 105 /* XAT_AV_SCANSTAMP */ 106 printf("%s", (arg1 & 0x1000) == 0 ? "" : "scanstamp: "); 107 printf("%s", (arg1 & 0x1000) == 0 ? "" : 108 stringof(((vscan_svc_node_t *)arg0)->vsn_scanstamp)); 109 } 110 111 112 sdt:vscan::vscan-mtime-changed 113 { 114 printf("%s", 115 stringof(((vscan_svc_node_t *)arg0)->vsn_req->vsr_vp->v_path)); 116 } 117 118 119 sdt:vscan::vscan-result 120 { 121 printf("idx: %d, seqnum: %d, VS_STATUS_%s - VS_ACCESS_%s", 122 arg0, arg1, 123 arg2 == 0 ? "UNDEFINED" : 124 arg2 == 1 ? "NO_SCAN" : 125 arg2 == 2 ? "ERROR" : 126 arg2 == 3 ? "CLEAN" : 127 arg2 == 4 ? "INFECTED" : 128 arg2 == 5 ? "SCANNING" : "XXX unknown", 129 arg3 == 0 ? "UNDEFINED" : 130 arg3 == 1 ? "ALLOW" : "DENY"); 131 } 132 133 /* insert request into request list */ 134 fbt:vscan:vscan_svc_reql_insert:entry 135 { 136 printf("%s", stringof(args[0]->v_path)); 137 } 138 fbt:vscan:vscan_svc_reql_insert:return 139 /args[1] != 0/ 140 { 141 printf("seqnum %d %s", args[1]->vsr_seqnum, 142 stringof(args[1]->vsr_vp->v_path)); 143 } 144 fbt:vscan:vscan_svc_reql_insert:return 145 /args[1] == 0/ 146 { 147 printf("request list full"); 148 } 149 /* insert request into scan table */ 150 fbt:vscan:vscan_svc_insert_req:entry 151 { 152 printf("seqnum: %d - %s", 153 args[0]->vsr_seqnum, stringof(args[0]->vsr_vp->v_path)); 154 } 155 fbt:vscan:vscan_svc_insert_req:return 156 { 157 printf("idx: %d", args[1]); 158 } 159 /* remove request from request list and scan table and delete it*/ 160 fbt:vscan:vscan_svc_delete_req:entry 161 { 162 printf("idx: %d, seqnum: %d - %s", 163 args[0]->vsr_idx, args[0]->vsr_seqnum, 164 stringof(args[0]->vsr_vp->v_path)); 165 } 166 167 fbt:vscan:vscan_svc_delete_req:return, 168 fbt:vscan:vscan_svc_reql_handler:entry, 169 fbt:vscan:vscan_svc_reql_handler:return 170 { 171 } 172 173 fbt:vscan:vscan_svc_taskq_callback:entry, 174 fbt:vscan:vscan_svc_do_scan:entry 175 { 176 printf("idx: %d, seqnum: %d - %s", 177 ((vscan_req_t *)(args[0]))->vsr_idx, 178 ((vscan_req_t *)(args[0]))->vsr_seqnum, 179 stringof(((vscan_req_t *)(args[0]))->vsr_vp->v_path)); 180 } 181 fbt:vscan:vscan_svc_scan_complete:entry 182 { 183 printf("idx: %d, seqnum: %d, state: %s - %s", 184 args[0]->vsr_idx, args[0]->vsr_seqnum, 185 args[0]->vsr_state == 0 ? "INIT" : 186 args[0]->vsr_state == 1 ? "QUEUED" : 187 args[0]->vsr_state == 2 ? "IN_PROGRESS" : 188 args[0]->vsr_state == 3 ? "SCANNING" : 189 args[0]->vsr_state == 4 ? "ASYNC_COMPLETE" : 190 args[0]->vsr_state == 5 ? "COMPLETE" : "UNKNOWN", 191 stringof(args[0]->vsr_vp->v_path)); 192 } 193 194 fbt:vscan:vscan_svc_taskq_callback:return, 195 fbt:vscan:vscan_svc_do_scan:return, 196 fbt:vscan:vscan_svc_scan_complete:return 197 { 198 } 199 200 sdt:vscan::vscan-abort 201 { 202 printf("idx: %d, seqnum: %d - %s", 203 ((vscan_req_t *)(arg0))->vsr_idx, 204 ((vscan_req_t *)(arg0))->vsr_seqnum, 205 stringof(((vscan_req_t *)(arg0))->vsr_vp->v_path)); 206 } 207 208 fbt:vscan:vscan_svc_enable:entry, 209 fbt:vscan:vscan_svc_enable:return, 210 fbt:vscan:vscan_svc_disable:entry, 211 fbt:vscan:vscan_svc_disable:return, 212 fbt:vscan:vscan_svc_configure:entry, 213 fbt:vscan:vscan_svc_configure:return 214 { 215 } 216 217 /* 218 * vscan_door.c 219 */ 220 fbt:vscan:vscan_door_open:entry, 221 fbt:vscan:vscan_door_open:return, 222 fbt:vscan:vscan_door_close:entry, 223 fbt:vscan:vscan_door_close:return 224 { 225 } 226 227 fbt:vscan:vscan_door_scan_file:entry 228 { 229 printf("idx: %d, seqnum: %d - %s", 230 args[0]->vsr_idx, args[0]->vsr_seqnum, args[0]->vsr_path); 231 } 232 fbt:vscan:vscan_door_scan_file:return 233 { 234 printf("VS_STATUS_%s", 235 args[1] == 0 ? "UNDEFINED" : 236 args[1] == 1 ? "NO_SCAN" : 237 args[1] == 2 ? "ERROR" : 238 args[1] == 3 ? "CLEAN" : 239 args[1] == 4 ? "INFECTED" : 240 args[1] == 5 ? "SCANNING" : "XXX unknown"); 241 } 242 243 244 /* 245 * vscan_drv.c 246 */ 247 sdt:vscan::vscan-drv-state-violation 248 { 249 printf("%d %s", arg0, 250 arg0 == 0 ? "UNCONFIG" : 251 arg0 == 1 ? "IDLE" : 252 arg0 == 2 ? "CONNECTED" : 253 arg0 == 3 ? "ENABLED" : 254 arg0 == 4 ? "DELAYED_DISABLE" : "UNKNOWN"); 255 } 256 257 sdt:vscan::vscan-minor-node 258 { 259 printf("vscan%d %s", arg0, arg1 != 0 ? "created" : "error"); 260 } 261 262 /* unprivileged vscan driver access attempt */ 263 sdt:vscan::vscan-priv 264 /arg0 != 0/ 265 { 266 printf("vscan driver access attempt by unprivileged process"); 267 } 268 269 /* daemon-driver synchronization */ 270 sdt:vscan::vscan-reconnect 271 { 272 } 273 274 fbt:vscan:vscan_drv_open:entry 275 / *(int *)args[0] == 0/ 276 { 277 printf("vscan daemon attach"); 278 } 279 280 fbt:vscan:vscan_drv_close:entry 281 / (int)args[0] == 0/ 282 { 283 printf("vscan daemon detach"); 284 } 285 286 fbt:vscan:vscan_drv_ioctl:entry 287 / (int)args[0] == 0/ 288 { 289 printf("vscan daemon ioctl %d %s", args[1], 290 args[1] == 1 ? "ENABLE" : 291 args[1] == 2 ? "DISABLE" : 292 args[1] == 3 ? "CONFIG" : 293 args[1] == 4 ? "RESULT" : 294 args[1] == 5 ? "MAX FILES" : "unknown"); 295 } 296 297 fbt:vscan:vscan_drv_delayed_disable:entry, 298 fbt:vscan:vscan_drv_delayed_disable:return, 299 fbt:vscan:vscan_drv_attach:entry, 300 fbt:vscan:vscan_drv_detach:entry 301 { 302 } 303 304 fbt:vscan:vscan_drv_attach:return, 305 fbt:vscan:vscan_drv_detach:return 306 { 307 printf("%s", args[1] ? "DDI_FAILURE" : "DDI_SUCCESS"); 308 } 309 310 fbt:vscan:vscan_drv_in_use:return 311 { 312 printf("%s", args[1] ? "TRUE" : "FALSE"); 313 } 314 315 316 /* file access */ 317 318 /* 319 fbt:vscan:vscan_drv_open:entry 320 / *(int *)args[0] != 0/ 321 { 322 printf("%d", *(int *)args[0]); 323 } 324 325 fbt:vscan:vscan_drv_close:entry, 326 fbt:vscan:vscan_drv_read:entry 327 / (int)args[0] != 0/ 328 { 329 printf("%d", (int)args[0]); 330 } 331 */ 332 333 334 /* 335 *** vscan daemon - vscand *** 336 */ 337 338 pid$target::vs_svc_init:entry 339 { 340 printf("Max concurrent scan requests from kernel: %d", arg1); 341 } 342 343 pid$target::vs_svc_init:return 344 { 345 } 346 347 348 pid$target::vs_door_scan_req:entry, 349 pid$target::vs_svc_scan_file:entry, 350 pid$target::vs_svc_queue_scan_req:entry, 351 pid$target::vs_svc_async_scan:entry, 352 pid$target::vs_eng_scanstamp_current:entry, 353 pid$target::vs_icap_scan_file:entry 354 { 355 } 356 357 pid$target::vs_svc_queue_scan_req:return, 358 pid$target::vs_svc_async_scan:return 359 { 360 } 361 362 pid$target::vs_svc_scan_file:return 363 { 364 printf("VS_STATUS_%s", 365 arg1 == 0 ? "UNDEFINED" : 366 arg1 == 1 ? "NO_SCAN" : 367 arg1 == 2 ? "ERROR" : 368 arg1 == 3 ? "CLEAN" : 369 arg1 == 4 ? "INFECTED" : 370 arg1 == 5 ? "SCANNING" : "XXX unknown"); 371 } 372 373 pid$target::vs_eng_scanstamp_current:return 374 { 375 printf("%sCURRENT", arg1 == 0 ? "NOT " : ""); 376 } 377 378 pid$target::vs_icap_scan_file:return 379 { 380 printf("%d VS_RESULT_%s", (int)arg1, 381 (int)arg1 == 0 ? "UNDEFINED" : 382 (int)arg1 == 1 ? "CLEAN" : 383 (int)arg1 == 2 ? "CLEANED" : 384 (int)arg1 == 3 ? "FORBIDDEN" : "(SE)_ERROR"); 385 } 386 387 pid$target::vs_stats_set:entry 388 { 389 printf("%s", (arg0 == 1) ? "CLEAN" : 390 (arg0 == 2) ? "CLEANED" : 391 (arg0 == 3) ? "QUARANTINE" : "ERROR"); 392 } 393 394 pid$target::vs_stats_set:return 395 { 396 } 397 398 /* get engine connection */ 399 pid$target::vs_eng_get:entry, 400 pid$target::vs_eng_connect:entry, 401 pid$target::vs_eng_release:entry, 402 pid$target::vs_eng_release:return 403 { 404 } 405 pid$target::vs_eng_get:return, 406 pid$target::vs_eng_connect:return 407 { 408 printf("%s", arg1 == 0 ? "success" : "error"); 409 } 410 411 /* engine errors */ 412 pid$target::vs_eng_set_error:entry 413 / arg1 == 1 / 414 { 415 printf("scan engine error"); 416 } 417 418 /* configuration */ 419 pid$target::vscand_cfg_init:entry, 420 pid$target::vscand_cfg_fini:entry, 421 pid$target::vscand_cfg_init:return, 422 pid$target::vscand_cfg_fini:return, 423 pid$target::vscand_cfg_handler:entry, 424 pid$target::vscand_cfg_handler:return 425 { 426 } 427 428 pid$target::vscand_dtrace_gen:entry 429 { 430 printf("maxsize: %s action: %s\n", 431 copyinstr(arg0), (arg1 == 1) ? "allow" : "deny"); 432 printf("types: %s\n", copyinstr(arg2)); 433 printf("log: %s\n", copyinstr(arg3)); 434 } 435 pid$target::vscand_dtrace_eng:entry 436 { 437 printf("\n%s %s \nhost: %s \nport: %d \nmax connections: %d\n", 438 copyinstr(arg0), (arg1 == 1) ? "enabled" : "disabled", 439 copyinstr(arg2), arg3, arg4); 440 } 441 442 443 444 /* shutdown */ 445 pid$target::vscand_sig_handler:entry 446 { 447 printf("received signal %d", arg0); 448 } 449 pid$target::vscand_sig_handler:return, 450 pid$target::vscand_fini:entry, 451 pid$target::vscand_fini:return, 452 pid$target::vscand_kernel_disable:entry, 453 pid$target::vscand_kernel_disable:return, 454 pid$target::vscand_kernel_unbind:entry, 455 pid$target::vscand_kernel_unbind:return, 456 pid$target::vscand_kernel_result:entry, 457 pid$target::vscand_kernel_result:return, 458 pid$target::vs_svc_terminate:entry, 459 pid$target::vs_svc_terminate:return, 460 pid$target::vs_eng_fini:entry, 461 pid$target::vs_eng_fini:return, 462 pid$target::vs_eng_close_connections:entry, 463 pid$target::vs_eng_close_connections:return 464 { 465 } 466 467 /* vs_icap.c */ 468 469 /* trace entry and exit (inc status) */ 470 pid$target::vs_icap_option_request:entry, 471 pid$target::vs_icap_send_option_req:entry, 472 pid$target::vs_icap_read_option_resp:entry, 473 pid$target::vs_icap_respmod_request:entry, 474 pid$target::vs_icap_may_preview:entry, 475 pid$target::vs_icap_send_preview:entry, 476 pid$target::vs_icap_send_respmod_hdr:entry, 477 pid$target::vs_icap_read_respmod_resp:entry 478 { 479 } 480 481 pid$target::vs_icap_option_request:return, 482 pid$target::vs_icap_send_option_req:return, 483 pid$target::vs_icap_read_option_resp:return, 484 pid$target::vs_icap_respmod_request:return, 485 pid$target::vs_icap_send_preview:return, 486 pid$target::vs_icap_send_respmod_hdr:return, 487 pid$target::vs_icap_read_respmod_resp:return 488 { 489 printf("%s", (int)arg1 < 0 ? "error" : "success"); 490 } 491 492 pid$target::vs_icap_may_preview:return 493 { 494 printf("TRANSFER %s", arg1 == 1 ? "PREVIEW" : "COMPLETE"); 495 } 496 497 /* trace failures only - these functions return -1 on failure */ 498 pid$target::vs_icap_read_resp_code:return, 499 pid$target::vs_icap_read_hdr:return, 500 pid$target::vs_icap_send_termination:return, 501 pid$target::vs_icap_write:return, 502 pid$target::vs_icap_set_scan_result:return, 503 pid$target::vs_icap_read_encap_hdr:return, 504 pid$target::vs_icap_read_encap_data:return, 505 pid$target::vs_icap_read_resp_body:return, 506 pid$target::vs_icap_read_body_chunk:return, 507 pid$target::vs_icap_read:return, 508 pid$target::vs_icap_readline:return, 509 pid$target::vs_icap_send_chunk:return, 510 pid$target::gethostname:return 511 /(int)arg1 == -1/ 512 { 513 printf("error"); 514 } 515 516 /* trace failures only - these functions return 1 on success */ 517 pid$target::vs_icap_opt_value:return, 518 pid$target::vs_icap_opt_ext:return, 519 pid$target::vs_icap_resp_infection:return, 520 pid$target::vs_icap_resp_virus_id:return, 521 pid$target::vs_icap_resp_violations:return, 522 pid$target::vs_icap_resp_violation_rec:return, 523 pid$target::vs_icap_resp_istag:return, 524 pid$target::vs_icap_resp_encap:return 525 /arg1 != 1/ 526 { 527 printf("error"); 528 } 529 530 pid$target::write:return, 531 pid$target::read:return, 532 pid$target::open:return, 533 pid$target::calloc:return 534 /arg1 <= 0/ 535 { 536 printf("error"); 537 } 538 /* 539 pid$target::recv:return, 540 */ 541