Skip to content

Commit fd5f7c4

Browse files
ekoopsekoops
committed
fix(plugins/container): redefine port binding port and IP as integers
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
1 parent e1a0753 commit fd5f7c4

File tree

7 files changed

+137
-10
lines changed

7 files changed

+137
-10
lines changed

‎plugins/container/CMakeLists.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules")
99
# project metadata
1010
project(
1111
container
12-
VERSION 0.2.4
12+
VERSION 0.2.5
1313
DESCRIPTION "Falco container metadata enrichment Plugin"
1414
LANGUAGES CXX)
1515

‎plugins/container/go-worker/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,4 @@ clean:
1616
.PHONY: test
1717
test:
1818
go clean -testcache
19-
GOEXPERIMENT=loopvar go test -v -cover -race ./...
19+
GOEXPERIMENT=loopvar go test -tags=containers_image_openpgp -v -cover -race ./...

‎plugins/container/go-worker/pkg/container/docker.go‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -139,9 +139,19 @@ func (dc *dockerEngine) ctrToInfo(ctx context.Context, ctr types.ContainerJSON)
139139
}
140140
containerPort := port.Int()
141141
for _, portBinding := range portBindings {
142+
hostIP, err := parsePortBindingHostIP(portBinding.HostIP)
143+
if err != nil {
144+
continue
145+
}
146+
147+
hostPort, err := parsePortBindingHostPort(portBinding.HostPort)
148+
if err != nil {
149+
continue
150+
}
151+
142152
portMappings = append(portMappings, event.PortMapping{
143-
HostIp: portBinding.HostIP,
144-
HostPort: portBinding.HostPort,
153+
HostIP: hostIP,
154+
HostPort: hostPort,
145155
ContainerPort: containerPort,
146156
})
147157
}
@@ -301,9 +311,10 @@ func (dc *dockerEngine) get(ctx context.Context, containerId string) (*event.Eve
301311
if err != nil {
302312
return nil, err
303313
}
314+
304315
return &event.Event{
305-
IsCreate: true,
306316
Info: dc.ctrToInfo(ctx, ctrJson),
317+
IsCreate: true,
307318
}, nil
308319
}
309320

@@ -341,8 +352,8 @@ func (dc *dockerEngine) List(ctx context.Context) ([]event.Event, error) {
341352
}
342353
}
343354
evts[idx] = event.Event{
344-
IsCreate: true,
345355
Info: dc.ctrToInfo(ctx, ctrJson),
356+
IsCreate: true,
346357
}
347358
}
348359
return evts, nil

‎plugins/container/go-worker/pkg/container/engine.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,11 @@ package container
22

33
import (
44
"context"
5+
"encoding/binary"
6+
"fmt"
57
"github.com/falcosecurity/plugins/plugins/container/go-worker/pkg/config"
68
"github.com/falcosecurity/plugins/plugins/container/go-worker/pkg/event"
9+
"net/netip"
710
"net/url"
811
"os"
912
"path/filepath"
@@ -150,3 +153,30 @@ func shortContainerID(id string) string {
150153
}
151154
return id
152155
}
156+
157+
// parsePortBindingHostIP parses the provided address string and returns a numerical representation of it.
158+
// TODO(ekoops): add IPv6 addresses support.
159+
func parsePortBindingHostIP(hostIP string) (uint32, error) {
160+
addr, err := netip.ParseAddr(hostIP)
161+
if err != nil {
162+
return 0, err
163+
}
164+
165+
if addr.Is6() {
166+
// TODO(ekoops): handle IPv6 addresses.
167+
return 0, fmt.Errorf("ipv6 addresses are not supported")
168+
}
169+
170+
ipv4Addr := addr.As4()
171+
return binary.BigEndian.Uint32(ipv4Addr[:]), nil
172+
}
173+
174+
// parsePortBindingHostPort parses the provided port string and returns a numerical representation of it.
175+
func parsePortBindingHostPort(port string) (uint16, error) {
176+
convertedPort, err := strconv.ParseUint(port, 10, 16)
177+
if err != nil {
178+
return 0, err
179+
}
180+
181+
return uint16(convertedPort), nil
182+
}

‎plugins/container/go-worker/pkg/container/engine_test.go‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package container
22

33
import (
4+
"encoding/binary"
45
"github.com/docker/docker/client"
56
"github.com/stretchr/testify/assert"
67
"testing"
@@ -65,3 +66,77 @@ func TestCountCPUSet(t *testing.T) {
6566
})
6667
}
6768
}
69+
70+
func TestParsePortBindingHostIP(t *testing.T) {
71+
tCases := map[string]struct {
72+
hostIP string
73+
parsedHostIP uint32
74+
successExpected bool
75+
}{
76+
"127.0.0.1": {
77+
hostIP: "127.0.0.1",
78+
parsedHostIP: binary.BigEndian.Uint32([]byte{127, 0, 0, 1}),
79+
successExpected: true,
80+
},
81+
"Wrong literal": {
82+
hostIP: "Wrong literal",
83+
parsedHostIP: 0,
84+
successExpected: false,
85+
},
86+
"IPv6 address": {
87+
hostIP: "fe80::1",
88+
parsedHostIP: 0,
89+
successExpected: false,
90+
},
91+
}
92+
93+
for name, tc := range tCases {
94+
t.Run(name, func(t *testing.T) {
95+
if !tc.successExpected {
96+
_, err := parsePortBindingHostIP(tc.hostIP)
97+
assert.Error(t, err)
98+
} else {
99+
parsedHostIP, err := parsePortBindingHostIP(tc.hostIP)
100+
assert.NoError(t, err)
101+
assert.Equal(t, tc.parsedHostIP, parsedHostIP)
102+
}
103+
})
104+
}
105+
}
106+
107+
func TestParsePortBindingHostPort(t *testing.T) {
108+
tCases := map[string]struct {
109+
hostPort string
110+
parsedHostPort uint16
111+
successExpected bool
112+
}{
113+
"1000": {
114+
hostPort: "1000",
115+
parsedHostPort: 1000,
116+
successExpected: true,
117+
},
118+
"Wrong literal": {
119+
hostPort: "Wrong literal",
120+
parsedHostPort: 0,
121+
successExpected: false,
122+
},
123+
"Out of range port": {
124+
hostPort: "65536",
125+
parsedHostPort: 0,
126+
successExpected: false,
127+
},
128+
}
129+
130+
for name, tc := range tCases {
131+
t.Run(name, func(t *testing.T) {
132+
if !tc.successExpected {
133+
_, err := parsePortBindingHostPort(tc.hostPort)
134+
assert.Error(t, err)
135+
} else {
136+
parsedHostPort, err := parsePortBindingHostPort(tc.hostPort)
137+
assert.NoError(t, err)
138+
assert.Equal(t, tc.parsedHostPort, parsedHostPort)
139+
}
140+
})
141+
}
142+
}

‎plugins/container/go-worker/pkg/container/podman.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,9 +80,19 @@ func (pc *podmanEngine) ctrToInfo(ctr *define.InspectContainerData) event.Info {
8080
continue
8181
}
8282
for _, portBinding := range portBindings {
83+
hostIP, err := parsePortBindingHostIP(portBinding.HostIP)
84+
if err != nil {
85+
continue
86+
}
87+
88+
hostPort, err := parsePortBindingHostPort(portBinding.HostPort)
89+
if err != nil {
90+
continue
91+
}
92+
8393
portMappings = append(portMappings, event.PortMapping{
84-
HostIp: portBinding.HostIP,
85-
HostPort: portBinding.HostPort,
94+
HostIP: hostIP,
95+
HostPort: hostPort,
8696
ContainerPort: containerPort,
8797
})
8898
}
@@ -192,6 +202,7 @@ func (pc *podmanEngine) get(_ context.Context, containerId string) (*event.Event
192202
if err != nil {
193203
return nil, err
194204
}
205+
195206
return &event.Event{
196207
Info: pc.ctrToInfo(ctrInfo),
197208
IsCreate: true,

‎plugins/container/go-worker/pkg/event/event.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ package event
33
import "encoding/json"
44

55
type PortMapping struct {
6-
HostIp string `json:"HostIp"`
7-
HostPort string `json:"HostPort"`
6+
HostIP uint32 `json:"HostIp"`
7+
HostPort uint16 `json:"HostPort"`
88
ContainerPort int `json:"ContainerPort"`
99
}
1010

0 commit comments

Comments
 (0)