17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5602ca9eaScth * Common Development and Distribution License (the "License").
6602ca9eaScth * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22602ca9eaScth * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
24*8efd981eSKeith M Wesolowski *
25*8efd981eSKeith M Wesolowski * Copyright 2024 Oxide Computer Co.
267c478bd9Sstevel@tonic-gate */
277c478bd9Sstevel@tonic-gate
287c478bd9Sstevel@tonic-gate #include <sys/fm/protocol.h>
297c478bd9Sstevel@tonic-gate
307c478bd9Sstevel@tonic-gate #include <strings.h>
317c478bd9Sstevel@tonic-gate #include <libgen.h>
32602ca9eaScth #include <regex.h>
33602ca9eaScth #include <libnvpair.h>
347c478bd9Sstevel@tonic-gate
357c478bd9Sstevel@tonic-gate #include <fmd_log_impl.h>
367c478bd9Sstevel@tonic-gate #include <fmd_log.h>
377c478bd9Sstevel@tonic-gate
387c478bd9Sstevel@tonic-gate /*ARGSUSED*/
397c478bd9Sstevel@tonic-gate int
fmd_log_filter_class(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)407c478bd9Sstevel@tonic-gate fmd_log_filter_class(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
417c478bd9Sstevel@tonic-gate {
421db96d3bSCheng Sean Ye nvlist_t **nva;
431db96d3bSCheng Sean Ye uint32_t i, size;
441db96d3bSCheng Sean Ye char *class;
451db96d3bSCheng Sean Ye
461db96d3bSCheng Sean Ye if (gmatch(rp->rec_class, arg))
471db96d3bSCheng Sean Ye return (1);
481db96d3bSCheng Sean Ye
491db96d3bSCheng Sean Ye /* return false if the record doesn't contain valid fault list */
501db96d3bSCheng Sean Ye if (! gmatch(rp->rec_class, FM_LIST_EVENT ".*") ||
511db96d3bSCheng Sean Ye nvlist_lookup_uint32(rp->rec_nvl, FM_SUSPECT_FAULT_SZ,
521db96d3bSCheng Sean Ye &size) != 0 || size == 0 ||
531db96d3bSCheng Sean Ye nvlist_lookup_nvlist_array(rp->rec_nvl, FM_SUSPECT_FAULT_LIST,
541db96d3bSCheng Sean Ye &nva, &size) != 0)
551db96d3bSCheng Sean Ye return (0);
561db96d3bSCheng Sean Ye
571db96d3bSCheng Sean Ye /* return true if any fault in the list matches */
581db96d3bSCheng Sean Ye for (i = 0; i < size; i++) {
591db96d3bSCheng Sean Ye if (nvlist_lookup_string(nva[i], FM_CLASS, &class) == 0 &&
601db96d3bSCheng Sean Ye gmatch(class, arg))
611db96d3bSCheng Sean Ye return (1);
621db96d3bSCheng Sean Ye }
631db96d3bSCheng Sean Ye
641db96d3bSCheng Sean Ye return (0);
657c478bd9Sstevel@tonic-gate }
667c478bd9Sstevel@tonic-gate
677c478bd9Sstevel@tonic-gate /*ARGSUSED*/
687c478bd9Sstevel@tonic-gate int
fmd_log_filter_uuid(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)697c478bd9Sstevel@tonic-gate fmd_log_filter_uuid(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
707c478bd9Sstevel@tonic-gate {
717c478bd9Sstevel@tonic-gate char *uuid;
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /*
747c478bd9Sstevel@tonic-gate * Note: the uuid filter matches *any* member whose name is 'uuid'.
757c478bd9Sstevel@tonic-gate * This permits us to match not only a list.suspect uuid but any
767c478bd9Sstevel@tonic-gate * other event that decides to embed uuids, too, using the same name.
777c478bd9Sstevel@tonic-gate */
787c478bd9Sstevel@tonic-gate return (nvlist_lookup_string(rp->rec_nvl,
797c478bd9Sstevel@tonic-gate "uuid", &uuid) == 0 && strcmp(uuid, arg) == 0);
807c478bd9Sstevel@tonic-gate }
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate /*ARGSUSED*/
837c478bd9Sstevel@tonic-gate int
fmd_log_filter_before(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)847c478bd9Sstevel@tonic-gate fmd_log_filter_before(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
857c478bd9Sstevel@tonic-gate {
867c478bd9Sstevel@tonic-gate uint64_t sec = ((struct timeval *)arg)->tv_sec;
877c478bd9Sstevel@tonic-gate uint64_t nsec = ((struct timeval *)arg)->tv_usec * (NANOSEC / MICROSEC);
887c478bd9Sstevel@tonic-gate return (rp->rec_sec == sec ? rp->rec_nsec <= nsec : rp->rec_sec <= sec);
897c478bd9Sstevel@tonic-gate }
907c478bd9Sstevel@tonic-gate
917c478bd9Sstevel@tonic-gate /*ARGSUSED*/
927c478bd9Sstevel@tonic-gate int
fmd_log_filter_after(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)937c478bd9Sstevel@tonic-gate fmd_log_filter_after(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
947c478bd9Sstevel@tonic-gate {
957c478bd9Sstevel@tonic-gate uint64_t sec = ((struct timeval *)arg)->tv_sec;
967c478bd9Sstevel@tonic-gate uint64_t nsec = ((struct timeval *)arg)->tv_usec * (NANOSEC / MICROSEC);
977c478bd9Sstevel@tonic-gate return (rp->rec_sec == sec ? rp->rec_nsec >= nsec : rp->rec_sec >= sec);
987c478bd9Sstevel@tonic-gate }
99602ca9eaScth
100602ca9eaScth /*ARGSUSED*/
101602ca9eaScth int
fmd_log_filter_nv(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)102602ca9eaScth fmd_log_filter_nv(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
103602ca9eaScth {
104*8efd981eSKeith M Wesolowski /*
105*8efd981eSKeith M Wesolowski * The nvarg_next member was added compatibly with the introduction of
106*8efd981eSKeith M Wesolowski * ABI version 3. Older consumers pass a smaller structure that does
107*8efd981eSKeith M Wesolowski * not contain this member, so we treat it as if it were always NULL.
108*8efd981eSKeith M Wesolowski */
109*8efd981eSKeith M Wesolowski for (fmd_log_filter_nvarg_t *argt = (fmd_log_filter_nvarg_t *)arg;
110*8efd981eSKeith M Wesolowski argt != NULL; argt = (lp->log_abi < 3) ? NULL : argt->nvarg_next) {
111*8efd981eSKeith M Wesolowski char *name = argt->nvarg_name;
112*8efd981eSKeith M Wesolowski char *value = argt->nvarg_value;
113*8efd981eSKeith M Wesolowski regex_t *value_regex = argt->nvarg_value_regex;
114*8efd981eSKeith M Wesolowski nvpair_t *nvp;
115*8efd981eSKeith M Wesolowski int ai;
116*8efd981eSKeith M Wesolowski
117*8efd981eSKeith M Wesolowski /* see if nvlist has named member */
118*8efd981eSKeith M Wesolowski if (nvlist_lookup_nvpair_embedded_index(rp->rec_nvl, name,
119*8efd981eSKeith M Wesolowski &nvp, &ai, NULL) != 0) {
120*8efd981eSKeith M Wesolowski return (0); /* name filter failure */
121*8efd981eSKeith M Wesolowski }
122*8efd981eSKeith M Wesolowski
123*8efd981eSKeith M Wesolowski /* check value match for matching nvpair */
124*8efd981eSKeith M Wesolowski if ((value != NULL) &&
125*8efd981eSKeith M Wesolowski (nvpair_value_match_regex(nvp, ai,
126*8efd981eSKeith M Wesolowski value, value_regex, NULL) != 1)) {
127*8efd981eSKeith M Wesolowski return (0); /* value filter failure */
128*8efd981eSKeith M Wesolowski }
129*8efd981eSKeith M Wesolowski }
130*8efd981eSKeith M Wesolowski
131*8efd981eSKeith M Wesolowski return (1); /* name/value filter pass */
132*8efd981eSKeith M Wesolowski }
133*8efd981eSKeith M Wesolowski
134*8efd981eSKeith M Wesolowski /*
135*8efd981eSKeith M Wesolowski * This exists because filters are sorted and grouped based on the pointer to
136*8efd981eSKeith M Wesolowski * the filtering function, and we need fmdump to be able to maintain backward
137*8efd981eSKeith M Wesolowski * compatibility. fmdump distinguishes filter classes by the command-line
138*8efd981eSKeith M Wesolowski * option used to describe the filter. As for all library consumers, filters
139*8efd981eSKeith M Wesolowski * with the same evaluation function are considered to have the same class, and
140*8efd981eSKeith M Wesolowski * groups of filters of the SAME class are ORed together (i.e., match-any) while
141*8efd981eSKeith M Wesolowski * distinct classes are ANDed together, so that at least one of every class of
142*8efd981eSKeith M Wesolowski * filter must match in order for the record to pass through. The command-line
143*8efd981eSKeith M Wesolowski * syntax fmdump accepts for multiple name-value filter chains cannot be made
144*8efd981eSKeith M Wesolowski * compatible with the syntax it accepted for single name-value filters,
145*8efd981eSKeith M Wesolowski * requiring that a new command-line option be introduced for multi-name-value
146*8efd981eSKeith M Wesolowski * filter chains. Using a separate function thus allows fmdump to treat
147*8efd981eSKeith M Wesolowski * single-name-value and multi-name-value filters as belonging to different
148*8efd981eSKeith M Wesolowski * classes, maintaining backward compatibility with its existing command-line
149*8efd981eSKeith M Wesolowski * option syntax AND consistency with its documented treatment of filters of
150*8efd981eSKeith M Wesolowski * distinct classes. At the same time, because a single-name-value filter is
151*8efd981eSKeith M Wesolowski * merely a special case of a multi-name-value filter (each entry in the
152*8efd981eSKeith M Wesolowski * argument list is required to match the record in order for the record to pass
153*8efd981eSKeith M Wesolowski * the filter), the actual implementation of the two filter classes is
154*8efd981eSKeith M Wesolowski * identical. A consumer that, unlike fmdump, wants to treat these types of
155*8efd981eSKeith M Wesolowski * filters as belonging to a single class can therefore do so simply by using
156*8efd981eSKeith M Wesolowski * fmd_log_filter_nv() regardless of the number of name-value parameters in the
157*8efd981eSKeith M Wesolowski * argument chain, while those that want the fmdump behaviour should use that
158*8efd981eSKeith M Wesolowski * function only for filters with a single such parameter and this function for
159*8efd981eSKeith M Wesolowski * those with multiple. See fmdump(8).
160*8efd981eSKeith M Wesolowski */
161*8efd981eSKeith M Wesolowski int
fmd_log_filter_nv_multi(fmd_log_t * lp,const fmd_log_record_t * rp,void * arg)162*8efd981eSKeith M Wesolowski fmd_log_filter_nv_multi(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
163*8efd981eSKeith M Wesolowski {
164*8efd981eSKeith M Wesolowski return (fmd_log_filter_nv(lp, rp, arg));
165602ca9eaScth }
166