netlink_packet_audit/
status.rs

1// SPDX-License-Identifier: MIT
2
3use byteorder::{ByteOrder, NativeEndian};
4
5use netlink_packet_utils::{
6    traits::{Emitable, Parseable},
7    DecodeError,
8};
9
10use crate::Field;
11
12const MASK: Field = 0..4;
13const ENABLED: Field = 4..8;
14const FAILURE: Field = 8..12;
15const PID: Field = 12..16;
16const RATE_LIMITING: Field = 16..20;
17const BACKLOG_LIMIT: Field = 20..24;
18const LOST: Field = 24..28;
19const BACKLOG: Field = 28..32;
20const FEATURE_BITMAP: Field = 32..36;
21const BACKLOG_WAIT_TIME: Field = 36..40;
22pub const STATUS_MESSAGE_LEN: usize = BACKLOG_WAIT_TIME.end;
23
24#[derive(Debug, PartialEq, Eq, Clone, Default)]
25#[non_exhaustive]
26pub struct StatusMessage {
27    /// Bit mask for valid entries
28    pub mask: u32,
29    pub enabled: u32,
30    /// Failure-to-log action
31    pub failure: u32,
32    /// PID of auditd process
33    pub pid: u32,
34    /// Message rate limit (per second)
35    pub rate_limiting: u32,
36    /// Waiting messages limit
37    pub backlog_limit: u32,
38    /// Messages lost
39    pub lost: u32,
40    /// Messages waiting in queue
41    pub backlog: u32,
42    /// bitmap of kernel audit features
43    pub feature_bitmap: u32,
44    /// Message queue wait timeout
45    pub backlog_wait_time: u32,
46}
47
48impl StatusMessage {
49    pub fn new() -> Self {
50        Default::default()
51    }
52}
53
54#[derive(Debug, PartialEq, Eq, Clone)]
55#[non_exhaustive]
56pub struct StatusMessageBuffer<T> {
57    buffer: T,
58}
59
60impl<T: AsRef<[u8]>> StatusMessageBuffer<T> {
61    pub fn new(buffer: T) -> StatusMessageBuffer<T> {
62        StatusMessageBuffer { buffer }
63    }
64
65    pub fn new_checked(
66        buffer: T,
67    ) -> Result<StatusMessageBuffer<T>, DecodeError> {
68        let buf = Self::new(buffer);
69        buf.check_buffer_length()?;
70        Ok(buf)
71    }
72
73    fn check_buffer_length(&self) -> Result<(), DecodeError> {
74        let len = self.buffer.as_ref().len();
75        if len < STATUS_MESSAGE_LEN {
76            return Err(format!(
77                "invalid StatusMessageBuffer buffer: length is {len} \
78                instead of {STATUS_MESSAGE_LEN}"
79            )
80            .into());
81        }
82        Ok(())
83    }
84
85    pub fn into_inner(self) -> T {
86        self.buffer
87    }
88
89    pub fn mask(&self) -> u32 {
90        NativeEndian::read_u32(&self.buffer.as_ref()[MASK])
91    }
92
93    pub fn enabled(&self) -> u32 {
94        NativeEndian::read_u32(&self.buffer.as_ref()[ENABLED])
95    }
96
97    pub fn failure(&self) -> u32 {
98        NativeEndian::read_u32(&self.buffer.as_ref()[FAILURE])
99    }
100
101    pub fn pid(&self) -> u32 {
102        NativeEndian::read_u32(&self.buffer.as_ref()[PID])
103    }
104
105    pub fn rate_limiting(&self) -> u32 {
106        NativeEndian::read_u32(&self.buffer.as_ref()[RATE_LIMITING])
107    }
108
109    pub fn backlog_limit(&self) -> u32 {
110        NativeEndian::read_u32(&self.buffer.as_ref()[BACKLOG_LIMIT])
111    }
112
113    pub fn lost(&self) -> u32 {
114        NativeEndian::read_u32(&self.buffer.as_ref()[LOST])
115    }
116
117    pub fn backlog(&self) -> u32 {
118        NativeEndian::read_u32(&self.buffer.as_ref()[BACKLOG])
119    }
120
121    pub fn feature_bitmap(&self) -> u32 {
122        NativeEndian::read_u32(&self.buffer.as_ref()[FEATURE_BITMAP])
123    }
124
125    pub fn backlog_wait_time(&self) -> u32 {
126        NativeEndian::read_u32(&self.buffer.as_ref()[BACKLOG_WAIT_TIME])
127    }
128}
129
130impl<T: AsRef<[u8]> + AsMut<[u8]>> StatusMessageBuffer<T> {
131    pub fn set_mask(&mut self, value: u32) {
132        NativeEndian::write_u32(&mut self.buffer.as_mut()[MASK], value)
133    }
134
135    pub fn set_enabled(&mut self, value: u32) {
136        NativeEndian::write_u32(&mut self.buffer.as_mut()[ENABLED], value)
137    }
138
139    pub fn set_failure(&mut self, value: u32) {
140        NativeEndian::write_u32(&mut self.buffer.as_mut()[FAILURE], value)
141    }
142
143    pub fn set_pid(&mut self, value: u32) {
144        NativeEndian::write_u32(&mut self.buffer.as_mut()[PID], value)
145    }
146
147    pub fn set_rate_limiting(&mut self, value: u32) {
148        NativeEndian::write_u32(&mut self.buffer.as_mut()[RATE_LIMITING], value)
149    }
150
151    pub fn set_backlog_limit(&mut self, value: u32) {
152        NativeEndian::write_u32(&mut self.buffer.as_mut()[BACKLOG_LIMIT], value)
153    }
154
155    pub fn set_lost(&mut self, value: u32) {
156        NativeEndian::write_u32(&mut self.buffer.as_mut()[LOST], value)
157    }
158
159    pub fn set_backlog(&mut self, value: u32) {
160        NativeEndian::write_u32(&mut self.buffer.as_mut()[BACKLOG], value)
161    }
162
163    pub fn set_feature_bitmap(&mut self, value: u32) {
164        NativeEndian::write_u32(
165            &mut self.buffer.as_mut()[FEATURE_BITMAP],
166            value,
167        )
168    }
169
170    pub fn set_backlog_wait_time(&mut self, value: u32) {
171        NativeEndian::write_u32(
172            &mut self.buffer.as_mut()[BACKLOG_WAIT_TIME],
173            value,
174        )
175    }
176}
177
178impl<T: AsRef<[u8]>> Parseable<StatusMessageBuffer<T>> for StatusMessage {
179    fn parse(buf: &StatusMessageBuffer<T>) -> Result<Self, DecodeError> {
180        buf.check_buffer_length()?;
181        Ok(StatusMessage {
182            mask: buf.mask(),
183            enabled: buf.enabled(),
184            failure: buf.failure(),
185            pid: buf.pid(),
186            rate_limiting: buf.rate_limiting(),
187            backlog_limit: buf.backlog_limit(),
188            lost: buf.lost(),
189            backlog: buf.backlog(),
190            feature_bitmap: buf.feature_bitmap(),
191            backlog_wait_time: buf.backlog_wait_time(),
192        })
193    }
194}
195
196impl Emitable for StatusMessage {
197    fn buffer_len(&self) -> usize {
198        STATUS_MESSAGE_LEN
199    }
200
201    fn emit(&self, buffer: &mut [u8]) {
202        let mut buffer = StatusMessageBuffer::new(buffer);
203        buffer.set_mask(self.mask);
204        buffer.set_enabled(self.enabled);
205        buffer.set_failure(self.failure);
206        buffer.set_pid(self.pid);
207        buffer.set_rate_limiting(self.rate_limiting);
208        buffer.set_backlog_limit(self.backlog_limit);
209        buffer.set_lost(self.lost);
210        buffer.set_backlog(self.backlog);
211        buffer.set_feature_bitmap(self.feature_bitmap);
212        buffer.set_backlog_wait_time(self.backlog_wait_time);
213    }
214}
netlink_packet_audit/status.rs

netlink_packet_audit/
status.rs
