bpf_dsl: support arbitrary (arg & mask) == val expressions

sandbox/linux/bpf_dsl/bpf_dsl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 
 #include <stdint.h>
 
-#include <limits>
 #include <utility>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "sandbox/linux/bpf_dsl/cons.h"
 #include "sandbox/linux/seccomp-bpf/sandbox_bpf_policy.h"
 #include "sandbox/linux/seccomp-bpf/trap.h"
 #include "sandbox/sandbox_export.h"
 
 namespace sandbox {
@@ skipping 34 matching lines @@
 //        }
 //
 //       private:
 //        DISALLOW_COPY_AND_ASSIGN(SillyPolicy);
 //      };
 //
 // More generally, the DSL currently supports the following grammar:
 //
 //   result = Allow() | Error(errno) | Trap(trap_func, arg)
 //          | If(bool, result)[.ElseIf(bool, result)].Else(result)
-//   bool   = arg == val | (arg & mask) == mask | (arg & mask) == 0
+//   bool   = arg == val | (arg & mask) == val
 //          | !bool | bool && bool | bool || bool
 //
 // The semantics of each function and operator are intended to be
 // intuitive, but are described in more detail below.
 //
 // (Credit to Sean Parent's "Inheritance is the Base Class of Evil"
 // talk at Going Native 2013 for promoting value semantics via shared
 // pointers to immutable state.)
 
 namespace sandbox {
@@ skipping 52 matching lines @@
 // Trap specifies a result that the system call should be handled by
 // trapping back into userspace and invoking |trap_func|, passing
 // |aux| as the second parameter.
 SANDBOX_EXPORT ResultExpr Trap(Trap::TrapFnc trap_func, void* aux);
 
 template <typename T>
 class SANDBOX_EXPORT Arg {
  public:
   // Initializes the Arg to represent the |num|th system call
   // argument (indexed from 0), which is of type |T|.
-  explicit Arg(int num)
-      : num_(num), mask_(std::numeric_limits<uint64_t>::max()) {}
+  explicit Arg(int num);
 
   Arg(const Arg& arg) : num_(arg.num_), mask_(arg.mask_) {}
 
   // Returns an Arg representing the current argument, but after
   // bitwise-and'ing it with |rhs|.
   friend Arg operator&(const Arg& lhs, uint64_t rhs) {
     return Arg(lhs.num_, lhs.mask_ & rhs);
   }
 
   // Returns a boolean expression comparing whether the system call
@@ skipping 54 matching lines @@
 // templates.
 namespace internal {
 
 // Returns a boolean expression that represents whether system call
 // argument |num| of size |size| is equal to |val|, when masked
 // according to |mask|.  Users should use the Arg template class below
 // instead of using this API directly.
 SANDBOX_EXPORT BoolExpr
     ArgEq(int num, size_t size, uint64_t mask, uint64_t val);
 
+// Returns the default mask for a system call argument of the specified size.
+SANDBOX_EXPORT uint64_t DefaultMask(size_t size);
+
 // Internal interface implemented by BoolExpr implementations.
 class SANDBOX_EXPORT BoolExprImpl : public base::RefCounted<BoolExprImpl> {
  public:
   BoolExprImpl() {}
   virtual ErrorCode Compile(SandboxBPF* sb,
                             ErrorCode true_ec,
                             ErrorCode false_ec) const = 0;
 
  protected:
   virtual ~BoolExprImpl() {}
@@ skipping 12 matching lines @@
  protected:
   virtual ~ResultExprImpl() {}
 
  private:
   friend class base::RefCounted<ResultExprImpl>;
   DISALLOW_COPY_AND_ASSIGN(ResultExprImpl);
 };
 
 }  // namespace internal
 
+template <typename T>
+Arg<T>::Arg(int num)
+    : num_(num), mask_(internal::DefaultMask(sizeof(T))) {
+}
+
 // Definition requires ArgEq to have been declared.  Moved out-of-line
 // to minimize how much internal clutter users have to ignore while
 // reading the header documentation.
 //
 // Additionally, we use this helper member function to avoid linker errors
 // caused by defining operator== out-of-line.  For a more detailed explanation,
 // see http://www.parashift.com/c++-faq-lite/template-friends.html.
 template <typename T>
 BoolExpr Arg<T>::EqualTo(T val) const {
   return internal::ArgEq(num_, sizeof(T), mask_, static_cast<uint64_t>(val));
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_