wip

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
falcosecurity · Jul 13, 2023 · b5d277b · b5d277b
1 parent 5daacdc
commit b5d277b
Showing 1 changed file with 8 additions and 6 deletions.
diff --git a/driver/modern_bpf/helpers/extract/extract_from_kernel.h b/driver/modern_bpf/helpers/extract/extract_from_kernel.h
@@ -160,19 +160,21 @@ static __always_inline void extract__network_args(void *argv, int num, struct pt
 	bool is_32bit_syscall = extract__32bit_syscall();
 #ifdef __NR_socketcall
 	if(id == __NR_socketcall)
+	{
+		unsigned long args_pointer = extract__syscall_argument(regs, 1);
 #elif defined(__TARGET_ARCH_x86)
 	if(is_32bit_syscall && id == __NR_ia32_socketcall)
+	{
+		u32 args_pointer = extract__syscall_argument(regs, 1);
 #else
 	if (false)
-#endif
 	{
-		size_t size = sizeof(unsigned long);
-		if (extract__32bit_syscall())
+#endif
+		for (int i = 0; i < num; i++)
 		{
-			size = sizeof(u32);
+			unsigned long *dst = ((unsigned long *)argv) + i;
+			bpf_probe_read_user(dst, sizeof(args_pointer), (void *)(args_pointer + i));
 		}
-		unsigned long args_pointer = extract__syscall_argument(regs, 1);
-		bpf_probe_read_user(argv, num * size, (void*)args_pointer);
 		return;
 	}
 	for (int i = 0; i < num; i++)