fix(modern_bpf): recvmsg filler sending empty addres for udp connections

Signed-off-by: Gianmatteo Palmieri <mail@gian.im>
falcosecurity · Mar 29, 2024 · 0d0b953 · 0d0b953
1 parent 026ffe1
commit 0d0b953
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 14 deletions.
diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c
@@ -93,7 +93,7 @@ int BPF_PROG(recvmsg_x,
 
 		/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
 		uint32_t socket_fd = (uint32_t)args[0];
-		auxmap__store_socktuple_param(auxmap, socket_fd, INBOUND, NULL);
+		auxmap__store_socktuple_param(auxmap, socket_fd, INBOUND, msghhdr.msg_name);
 
 		/* Parameter 5: msg_control (type: PT_BYTEBUF) */
 		if (msghhdr.msg_control != NULL)

diff --git a/test/drivers/test_suites/syscall_exit_suite/recvmsg_x.cpp b/test/drivers/test_suites/syscall_exit_suite/recvmsg_x.cpp
@@ -373,19 +373,7 @@ TEST(SyscallExit, recvmsgX_udp_connection_snaplen)
 	evt_test->assert_bytebuf_param(3, FULL_MESSAGE, DEFAULT_SNAPLEN);
 
 	/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
-	if(evt_test->is_modern_bpf_engine())
-	{
-		/* we are not able to get the sorce ip + port because right now
-		 * we don't use the userspace struct.
-		 */
-		evt_test->assert_tuple_inet_param(4, PPM_AF_INET, IPV4_EMPTY, IPV4_SERVER, IPV4_PORT_EMPTY_STRING, IPV4_PORT_SERVER_STRING);
-		evt_test->assert_num_params_pushed(5);
-		GTEST_SKIP() << "[RECVMSG_X]: we are not able to get the sorce ip + port because right now we don't use the userspace struct." << std::endl;
-	}
-	else
-	{
-		evt_test->assert_tuple_inet_param(4, PPM_AF_INET, IPV4_CLIENT, IPV4_SERVER, IPV4_PORT_CLIENT_STRING, IPV4_PORT_SERVER_STRING);
-	}
+	evt_test->assert_tuple_inet_param(4, PPM_AF_INET, IPV4_CLIENT, IPV4_SERVER, IPV4_PORT_CLIENT_STRING, IPV4_PORT_SERVER_STRING);
 
 	/* Parameter 5: msg_control (type: PT_BYTEBUF) */
 	evt_test->assert_empty_param(5);