Skip to content

Commit 1c630ed

Browse files
ekoopsekoops
committed
feat: add SOCKETPAIR_E params to SOCKETPAIR_X
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
1 parent 186e522 commit 1c630ed

File tree

13 files changed

+398
-61
lines changed

13 files changed

+398
-61
lines changed

‎driver/SCHEMA_VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.11.0
1+
3.12.0

‎driver/bpf/fillers.h‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1214,45 +1214,60 @@ FILLER(sys_connect_x, true) {
12141214
}
12151215

12161216
FILLER(sys_socketpair_x, true) {
1217-
struct unix_sock *us = NULL;
1218-
struct sock *speer = NULL;
1217+
/* Parameter 1: res (type: PT_ERRNO) */
1218+
long retval = bpf_syscall_get_retval(data->ctx);
1219+
int res = bpf_push_s64_to_ring(data, retval);
1220+
CHECK_RES(res);
1221+
12191222
/* In case of failure we send invalid fd (-1) */
12201223
int fds[2] = {-1, -1};
1221-
unsigned long val;
1222-
long retval;
1223-
int res;
1224-
1225-
/* ret */
1226-
retval = bpf_syscall_get_retval(data->ctx);
1227-
res = bpf_push_s64_to_ring(data, retval);
1228-
CHECK_RES(res);
1224+
struct unix_sock *us = NULL;
1225+
struct sock *speer = NULL;
12291226

12301227
if(retval == 0) {
1231-
val = bpf_syscall_get_argument(data, 3);
1232-
if(bpf_probe_read_user(fds, 2 * sizeof(int), (void *)val))
1228+
void *val = (void *)bpf_syscall_get_argument(data, 3);
1229+
if(bpf_probe_read_user(fds, 2 * sizeof(int), val)) {
12331230
return PPM_FAILURE_INVALID_USER_MEMORY;
1231+
}
12341232

12351233
struct socket *sock = bpf_sockfd_lookup(data, fds[0]);
1236-
12371234
if(sock) {
12381235
us = (struct unix_sock *)_READ(sock->sk);
12391236
speer = _READ(us->peer);
12401237
}
12411238
}
1242-
/* fd1 */
1239+
/* Parameter 2: fd1 (type: PT_FD) */
12431240
res = bpf_push_s64_to_ring(data, (int64_t)fds[0]);
12441241
CHECK_RES(res);
12451242

1246-
/* fd2 */
1243+
/* Parameter 3: fd2 (type: PT_FD) */
12471244
res = bpf_push_s64_to_ring(data, (int64_t)fds[1]);
12481245
CHECK_RES(res);
12491246

1250-
/* source */
1247+
/* Parameter 4: source (type: PT_UINT64) */
12511248
res = bpf_push_u64_to_ring(data, (unsigned long)us);
12521249
CHECK_RES(res);
12531250

1254-
/* peer */
1255-
return bpf_push_u64_to_ring(data, (unsigned long)speer);
1251+
/* Parameter 5: peer (type: PT_UINT64) */
1252+
bpf_push_u64_to_ring(data, (unsigned long)speer);
1253+
CHECK_RES(res);
1254+
1255+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
1256+
/* why to send 32 bits if we need only 8 bits? */
1257+
uint8_t domain = (uint8_t)bpf_syscall_get_argument(data, 0);
1258+
res = bpf_push_u32_to_ring(data, domain);
1259+
CHECK_RES(res);
1260+
1261+
/* Parameter 7: type (type: PT_UINT32) */
1262+
/* this should be an int, not an uint32 */
1263+
uint32_t type = (uint32_t)bpf_syscall_get_argument(data, 1);
1264+
res = bpf_push_u32_to_ring(data, type);
1265+
CHECK_RES(res);
1266+
1267+
/* Parameter 8: proto (type: PT_UINT32) */
1268+
/* this should be an int, not an uint32 */
1269+
uint32_t proto = (uint32_t)bpf_syscall_get_argument(data, 2);
1270+
return bpf_push_u32_to_ring(data, proto);
12561271
}
12571272

12581273
// TODO bpf_val_to_ring_dyn?

‎driver/event_table.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -298,20 +298,23 @@ const struct ppm_event_info g_event_info[] = {
298298
[PPME_SOCKET_GETPEERNAME_X] = {"getpeername", EC_NET | EC_SYSCALL, EF_NONE, 0},
299299
[PPME_SOCKET_SOCKETPAIR_E] = {"socketpair",
300300
EC_IPC | EC_SYSCALL,
301-
EF_CREATES_FD | EF_MODIFIES_STATE,
301+
EF_CREATES_FD | EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
302302
3,
303303
{{"domain", PT_ENUMFLAGS32, PF_DEC, socket_families},
304304
{"type", PT_UINT32, PF_DEC},
305305
{"proto", PT_UINT32, PF_DEC}}},
306306
[PPME_SOCKET_SOCKETPAIR_X] = {"socketpair",
307307
EC_IPC | EC_SYSCALL,
308-
EF_CREATES_FD | EF_MODIFIES_STATE,
309-
5,
308+
EF_CREATES_FD | EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
309+
8,
310310
{{"res", PT_ERRNO, PF_DEC},
311311
{"fd1", PT_FD, PF_DEC},
312312
{"fd2", PT_FD, PF_DEC},
313313
{"source", PT_UINT64, PF_HEX},
314-
{"peer", PT_UINT64, PF_HEX}}},
314+
{"peer", PT_UINT64, PF_HEX},
315+
{"domain", PT_ENUMFLAGS32, PF_DEC, socket_families},
316+
{"type", PT_UINT32, PF_DEC},
317+
{"proto", PT_UINT32, PF_DEC}}},
315318
[PPME_SOCKET_SETSOCKOPT_E] = {"setsockopt", EC_NET | EC_SYSCALL, EF_NONE, 0},
316319
[PPME_SOCKET_SETSOCKOPT_X] =
317320
{"setsockopt",

‎driver/modern_bpf/definitions/events_dimensions.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
#define GETPEERNAME_E_SIZE HEADER_LEN
4343
#define GETPEERNAME_X_SIZE HEADER_LEN
4444
#define SOCKETPAIR_E_SIZE HEADER_LEN + sizeof(uint32_t) * 3 + PARAM_LEN * 3
45-
#define SOCKETPAIR_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(uint64_t) * 2 + PARAM_LEN * 5
45+
#define SOCKETPAIR_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(uint32_t) * 3 + sizeof(uint64_t) * 2 + PARAM_LEN * 8
4646
#define SETSOCKOPT_E_SIZE HEADER_LEN
4747
#define GETSOCKOPT_E_SIZE HEADER_LEN
4848
#define SENDMMSG_E_SIZE HEADER_LEN

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socketpair.bpf.c‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -28,17 +28,17 @@ int BPF_PROG(socketpair_e, struct pt_regs *regs, long id) {
2828
/*=============================== COLLECT PARAMETERS ===========================*/
2929

3030
/* Parameter 1: domain (type: PT_ENUMFLAGS32) */
31-
/* why to send 32 bits if we need only 8 bits? */
31+
/* Why to send 32 bits if we need only 8 bits? */
3232
uint8_t domain = (uint8_t)args[0];
3333
ringbuf__store_u32(&ringbuf, (uint32_t)socket_family_to_scap(domain));
3434

3535
/* Parameter 2: type (type: PT_UINT32) */
36-
/* this should be an int, not a uint32 */
36+
/* This should be an int, not an uint32. */
3737
uint32_t type = (uint32_t)args[1];
3838
ringbuf__store_u32(&ringbuf, type);
3939

4040
/* Parameter 3: proto (type: PT_UINT32) */
41-
/* this should be an int, not a uint32 */
41+
/* This should be an int, not an uint32. */
4242
uint32_t proto = (uint32_t)args[2];
4343
ringbuf__store_u32(&ringbuf, proto);
4444

@@ -55,6 +55,12 @@ int BPF_PROG(socketpair_e, struct pt_regs *regs, long id) {
5555

5656
SEC("tp_btf/sys_exit")
5757
int BPF_PROG(socketpair_x, struct pt_regs *regs, long ret) {
58+
/* We need to keep this at the beginning of the program because otherwise we alter the state of
59+
* the ebpf registers causing a verifier issue.
60+
*/
61+
unsigned long args[4] = {0};
62+
extract__network_args(args, 4, regs);
63+
5864
struct ringbuf_struct ringbuf;
5965
if(!ringbuf__reserve_space(&ringbuf, SOCKETPAIR_X_SIZE, PPME_SOCKET_SOCKETPAIR_X)) {
6066
return 0;
@@ -68,18 +74,13 @@ int BPF_PROG(socketpair_x, struct pt_regs *regs, long ret) {
6874
ringbuf__store_s64(&ringbuf, ret);
6975

7076
int32_t fds[2] = {-1, -1};
71-
unsigned long source = 0;
72-
unsigned long peer = 0;
73-
unsigned long fds_pointer = 0;
77+
uint64_t source = 0;
78+
uint64_t peer = 0;
7479

7580
/* In case of success we have 0. */
7681
if(ret == 0) {
77-
/* Collect parameters at the beginning to manage socketcalls */
78-
unsigned long args[4] = {0};
79-
extract__network_args(args, 4, regs);
80-
8182
/* Get new sockets. */
82-
fds_pointer = args[3];
83+
void *fds_pointer = (void *)args[3];
8384
bpf_probe_read_user((void *)fds, 2 * sizeof(int32_t), (void *)fds_pointer);
8485

8586
/* Get source and peer. */
@@ -104,6 +105,21 @@ int BPF_PROG(socketpair_x, struct pt_regs *regs, long ret) {
104105
/* Parameter 5: peer (type: PT_UINT64) */
105106
ringbuf__store_u64(&ringbuf, peer);
106107

108+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
109+
/* Why to send 32 bits if we need only 8 bits? */
110+
uint8_t domain = (uint8_t)args[0];
111+
ringbuf__store_u32(&ringbuf, (uint32_t)socket_family_to_scap(domain));
112+
113+
/* Parameter 7: type (type: PT_UINT32) */
114+
/* This should be an int, not an uint32. */
115+
uint32_t type = (uint32_t)args[1];
116+
ringbuf__store_u32(&ringbuf, type);
117+
118+
/* Parameter 8: proto (type: PT_UINT32) */
119+
/* This should be an int, not an uint32. */
120+
uint32_t proto = (uint32_t)args[2];
121+
ringbuf__store_u32(&ringbuf, proto);
122+
107123
/*=============================== COLLECT PARAMETERS ===========================*/
108124

109125
ringbuf__submit_event(&ringbuf);

‎driver/ppm_fillers.c‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1815,20 +1815,14 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) {
18151815
struct unix_sock *us;
18161816
struct sock *speer;
18171817

1818-
/*
1819-
* retval
1820-
*/
1818+
/* Parameter 1: res (type: PT_ERRNO) */
18211819
retval = (int64_t)syscall_get_return_value(current, args->regs);
18221820
res = val_to_ring(args, retval, 0, false, 0);
18231821
CHECK_RES(res);
18241822

1825-
/*
1826-
* If the call was successful, copy the FDs
1827-
*/
1823+
/* In case of success we have 0. */
18281824
if(likely(retval == 0)) {
1829-
/*
1830-
* fds
1831-
*/
1825+
/* Get new sockets file descriptors. */
18321826
syscall_get_arguments_deprecated(args, 3, 1, &val);
18331827
#ifdef CONFIG_COMPAT
18341828
if(!args->compat) {
@@ -1842,13 +1836,15 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) {
18421836
}
18431837
#endif
18441838

1839+
/* Parameter 2: fd1 (type: PT_FD) */
18451840
res = val_to_ring(args, (int64_t)fds[0], 0, false, 0);
18461841
CHECK_RES(res);
18471842

1843+
/* Parameter 3: fd2 (type: PT_FD) */
18481844
res = val_to_ring(args, (int64_t)fds[1], 0, false, 0);
18491845
CHECK_RES(res);
18501846

1851-
/* get socket source and peer address */
1847+
/* Get socket source and peer address. */
18521848
sock = sockfd_lookup(fds[0], &err);
18531849
if(likely(sock != NULL)) {
18541850
us = unix_sk(sock->sk);
@@ -1883,6 +1879,21 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) {
18831879
CHECK_RES(res);
18841880
}
18851881

1882+
/* Parameter 2: domain (type: PT_ENUMFLAGS32) */
1883+
syscall_get_arguments_deprecated(args, 0, 1, &val);
1884+
res = val_to_ring(args, val, 0, true, 0);
1885+
CHECK_RES(res);
1886+
1887+
/* Parameter 3: type (type: PT_UINT32) */
1888+
syscall_get_arguments_deprecated(args, 1, 1, &val);
1889+
res = val_to_ring(args, val, 0, true, 0);
1890+
CHECK_RES(res);
1891+
1892+
/* Parameter 4: proto (type: PT_UINT32) */
1893+
syscall_get_arguments_deprecated(args, 2, 1, &val);
1894+
res = val_to_ring(args, val, 0, true, 0);
1895+
CHECK_RES(res);
1896+
18861897
return add_sentinel(args);
18871898
}
18881899

‎test/drivers/test_suites/syscall_exit_suite/socketcall_x.cpp‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1325,26 +1325,35 @@ TEST(SyscallExit, socketcall_socketpairX_success) {
13251325

13261326
/*=============================== ASSERT PARAMETERS ===========================*/
13271327

1328-
/* Parameter 1: res (type: PT_ERRNO)*/
1328+
/* Parameter 1: res (type: PT_ERRNO) */
13291329
evt_test->assert_numeric_param(1, (int64_t)0);
13301330

1331-
/* Parameter 2: fd1 (type: PT_FD)*/
1331+
/* Parameter 2: fd1 (type: PT_FD) */
13321332
evt_test->assert_numeric_param(2, (int64_t)fd[0]);
13331333

1334-
/* Parameter 3: fd2 (type: PT_FD)*/
1334+
/* Parameter 3: fd2 (type: PT_FD) */
13351335
evt_test->assert_numeric_param(3, (int64_t)fd[1]);
13361336

1337-
/* Parameter 4: source (type: PT_UINT64)*/
1337+
/* Parameter 4: source (type: PT_UINT64) */
13381338
/* Here we have a kernel pointer, we don't know the exact value. */
13391339
evt_test->assert_numeric_param(4, (uint64_t)0, NOT_EQUAL);
13401340

1341-
/* Parameter 5: peer (type: PT_UINT64)*/
1341+
/* Parameter 5: peer (type: PT_UINT64) */
13421342
/* Here we have a kernel pointer, we don't know the exact value. */
13431343
evt_test->assert_numeric_param(5, (uint64_t)0, NOT_EQUAL);
13441344

1345+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
1346+
evt_test->assert_numeric_param(6, (uint32_t)PPM_AF_LOCAL);
1347+
1348+
/* Parameter 7: type (type: PT_UINT32) */
1349+
evt_test->assert_numeric_param(7, (uint32_t)type);
1350+
1351+
/* Parameter 8: proto (type: PT_UINT32) */
1352+
evt_test->assert_numeric_param(8, (uint32_t)protocol);
1353+
13451354
/*=============================== ASSERT PARAMETERS ===========================*/
13461355

1347-
evt_test->assert_num_params_pushed(5);
1356+
evt_test->assert_num_params_pushed(8);
13481357
}
13491358

13501359
TEST(SyscallExit, socketcall_socketpairX_failure) {
@@ -1400,9 +1409,18 @@ TEST(SyscallExit, socketcall_socketpairX_failure) {
14001409
/* Parameter 5: peer (type: PT_UINT64) */
14011410
evt_test->assert_numeric_param(5, (uint64_t)0);
14021411

1412+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
1413+
evt_test->assert_numeric_param(6, (uint32_t)PPM_AF_LOCAL);
1414+
1415+
/* Parameter 7: type (type: PT_UINT32) */
1416+
evt_test->assert_numeric_param(7, (uint32_t)type);
1417+
1418+
/* Parameter 8: proto (type: PT_UINT32) */
1419+
evt_test->assert_numeric_param(8, (uint32_t)protocol);
1420+
14031421
/*=============================== ASSERT PARAMETERS ===========================*/
14041422

1405-
evt_test->assert_num_params_pushed(5);
1423+
evt_test->assert_num_params_pushed(8);
14061424
}
14071425

14081426
#endif

‎test/drivers/test_suites/syscall_exit_suite/socketpair_x.cpp‎

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,26 +39,35 @@ TEST(SyscallExit, socketpairX_success) {
3939

4040
/*=============================== ASSERT PARAMETERS ===========================*/
4141

42-
/* Parameter 1: res (type: PT_ERRNO)*/
42+
/* Parameter 1: res (type: PT_ERRNO) */
4343
evt_test->assert_numeric_param(1, (int64_t)0);
4444

45-
/* Parameter 2: fd1 (type: PT_FD)*/
45+
/* Parameter 2: fd1 (type: PT_FD) */
4646
evt_test->assert_numeric_param(2, (int64_t)fd[0]);
4747

48-
/* Parameter 3: fd2 (type: PT_FD)*/
48+
/* Parameter 3: fd2 (type: PT_FD) */
4949
evt_test->assert_numeric_param(3, (int64_t)fd[1]);
5050

51-
/* Parameter 4: source (type: PT_UINT64)*/
51+
/* Parameter 4: source (type: PT_UINT64) */
5252
/* Here we have a kernel pointer, we don't know the exact value. */
5353
evt_test->assert_numeric_param(4, (uint64_t)0, NOT_EQUAL);
5454

55-
/* Parameter 5: peer (type: PT_UINT64)*/
55+
/* Parameter 5: peer (type: PT_UINT64) */
5656
/* Here we have a kernel pointer, we don't know the exact value. */
5757
evt_test->assert_numeric_param(5, (uint64_t)0, NOT_EQUAL);
5858

59+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
60+
evt_test->assert_numeric_param(6, (uint32_t)PPM_AF_LOCAL);
61+
62+
/* Parameter 7: type (type: PT_UINT32) */
63+
evt_test->assert_numeric_param(7, (uint32_t)type);
64+
65+
/* Parameter 8: proto (type: PT_UINT32) */
66+
evt_test->assert_numeric_param(8, (uint32_t)protocol);
67+
5968
/*=============================== ASSERT PARAMETERS ===========================*/
6069

61-
evt_test->assert_num_params_pushed(5);
70+
evt_test->assert_num_params_pushed(8);
6271
}
6372

6473
TEST(SyscallExit, socketpairX_failure) {
@@ -108,9 +117,18 @@ TEST(SyscallExit, socketpairX_failure) {
108117
/* Parameter 5: peer (type: PT_UINT64) */
109118
evt_test->assert_numeric_param(5, (uint64_t)0);
110119

120+
/* Parameter 6: domain (type: PT_ENUMFLAGS32) */
121+
evt_test->assert_numeric_param(6, (uint32_t)PPM_AF_LOCAL);
122+
123+
/* Parameter 7: type (type: PT_UINT32) */
124+
evt_test->assert_numeric_param(7, (uint32_t)type);
125+
126+
/* Parameter 8: proto (type: PT_UINT32) */
127+
evt_test->assert_numeric_param(8, (uint32_t)protocol);
128+
111129
/*=============================== ASSERT PARAMETERS ===========================*/
112130

113-
evt_test->assert_num_params_pushed(5);
131+
evt_test->assert_num_params_pushed(8);
114132
}
115133

116134
#endif

0 commit comments

Comments
 (0)