Switch to sys_bind to support more platforms

bpf/sockaddr.h

@@ -83,4 +83,23 @@ static __always_inline u16 get_sockaddr_port(struct sockaddr *addr) {
     return bport;
 }
 
+static __always_inline u16 get_sockaddr_port_user(struct sockaddr *addr) {
+    short unsigned int sa_family;
+
+    bpf_probe_read(&sa_family, sizeof(short unsigned int), &addr->sa_family);
+    u16 bport = 0;
+
+    //bpf_dbg_printk("addr = %llx, sa_family %d", addr, sa_family);
+
+    if (sa_family == AF_INET) {
+        bpf_probe_read(&bport, sizeof(u16), &(((struct sockaddr_in*)addr)->sin_port));
+    } else if (sa_family == AF_INET6) {
+        bpf_probe_read(&bport, sizeof(u16), &(((struct sockaddr_in6*)addr)->sin6_port));
+    }
+
+    bport = bpf_ntohs(bport);
+
+    return bport;
+}
+
 #endif

bpf/watch_helper.c

@@ -21,15 +21,18 @@ struct {
     __uint(max_entries, 1 << 24);
 } watch_events SEC(".maps");
 
-SEC("kprobe/security_socket_bind")
-int kprobe_security_socket_bind(struct pt_regs *ctx) {
-    struct sockaddr *addr = (struct sockaddr *)PT_REGS_PARM2(ctx);
+SEC("kprobe/sys_bind")
+int kprobe_sys_bind(struct pt_regs *ctx) {    
+    // unwrap the args because it's a sys call
+    struct pt_regs * __ctx = (struct pt_regs *)PT_REGS_PARM1(ctx);
+    void *addr;
+    bpf_probe_read(&addr, sizeof(void *), (void *)&PT_REGS_PARM2(__ctx));
 
     if (!addr) {
         return 0;
     }
 
-    u16 port = get_sockaddr_port(addr);
+    u16 port = get_sockaddr_port_user(addr);
 
     if (!port) {
         return 0;

pkg/internal/ebpf/goruntime/goruntime.go

@@ -97,6 +97,10 @@ func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) SocketFilters() []*ebpf.Program {
 	return nil
 }

pkg/internal/ebpf/gosql/gosql.go

@@ -82,6 +82,10 @@ func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) SocketFilters() []*ebpf.Program {
 	return nil
 }

pkg/internal/ebpf/grpc/grpc.go

@@ -186,6 +186,10 @@ func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) SocketFilters() []*ebpf.Program {
 	return nil
 }

pkg/internal/ebpf/httpfltr/httpfltr.go

@@ -247,6 +247,10 @@ func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) SocketFilters() []*ebpf.Program {
 	return []*ebpf.Program{p.bpfObjects.SocketHttpFilter}
 }

pkg/internal/ebpf/httpssl/httpssl.go

@@ -133,6 +133,10 @@ func (p *Tracer) KProbes() map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return map[string]map[string]ebpfcommon.FunctionPrograms{
 		"libssl.so": {

pkg/internal/ebpf/instrumenter.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log/slog"
 	"os"
+	"strings"
 	"syscall"
 	"unsafe"
 
@@ -233,6 +234,35 @@ func attachSocketFilter(filter *ebpf.Program) (int, error) {
 	return -1, err
 }
 
+func (i *instrumenter) tracepoints(p KprobesTracer) error {
+	for sfunc, sprobes := range p.Tracepoints() {
+		slog.Debug("going to add syscall", "function", sfunc, "probes", sprobes)
+
+		if err := i.tracepoint(sfunc, sprobes); err != nil {
+			return fmt.Errorf("instrumenting function %q: %w", sfunc, err)
+		}
+		p.AddCloser(i.closables...)
+	}
+
+	return nil
+}
+
+func (i *instrumenter) tracepoint(funcName string, programs ebpfcommon.FunctionPrograms) error {
+	if programs.Start != nil {
+		if !strings.Contains(funcName, "/") {
+			return fmt.Errorf("invalid tracepoint type, must contain / in the name to separate the type and function name")
+		}
+		parts := strings.Split(funcName, "/")
+		kp, err := link.Tracepoint(parts[0], parts[1], programs.Start, nil)
+		if err != nil {
+			return fmt.Errorf("setting syscall: %w", err)
+		}
+		i.closables = append(i.closables, kp)
+	}
+
+	return nil
+}
+
 func isLittleEndian() bool {
 	var a uint16 = 1
 

pkg/internal/ebpf/nethttp/nethttp.go

@@ -192,6 +192,10 @@ func (p *Tracer) UProbes() map[string]map[string]ebpfcommon.FunctionPrograms {
 	return nil
 }
 
+func (p *Tracer) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Tracer) SocketFilters() []*ebpf.Program {
 	return nil
 }

pkg/internal/ebpf/tracer.go

@@ -41,6 +41,7 @@ type KprobesTracer interface {
 	// KProbes returns a map with the name of the kernel probes that need to be
 	// tapped into. Start matches kprobe, End matches kretprobe
 	KProbes() map[string]ebpfcommon.FunctionPrograms
+	Tracepoints() map[string]ebpfcommon.FunctionPrograms
 }
 
 // Tracer is an individual eBPF program (e.g. the net/http or the grpc tracers)

pkg/internal/ebpf/tracer_linux.go

@@ -124,6 +124,12 @@ func (pt *ProcessTracer) tracers() ([]Tracer, error) {
 			return nil, err
 		}
 
+		//Tracepoints support
+		if err := i.tracepoints(p); err != nil {
+			printVerifierErrorInfo(err)
+			return nil, err
+		}
+
 		//Sock filters support
 		if err := i.sockfilters(p); err != nil {
 			printVerifierErrorInfo(err)
@@ -165,6 +171,11 @@ func RunUtilityTracer(p UtilityTracer, pinPath string) error {
 		return err
 	}
 
+	if err := i.tracepoints(p); err != nil {
+		printVerifierErrorInfo(err)
+		return err
+	}
+
 	go p.Run(context.Background())
 
 	return nil

pkg/internal/ebpf/watcher/watcher.go

@@ -69,15 +69,19 @@ func (p *Watcher) AddCloser(c ...io.Closer) {
 
 func (p *Watcher) KProbes() map[string]ebpfcommon.FunctionPrograms {
 	kprobes := map[string]ebpfcommon.FunctionPrograms{
-		"security_socket_bind": {
+		"sys_bind": {
 			Required: true,
-			Start:    p.bpfObjects.KprobeSecuritySocketBind,
+			Start:    p.bpfObjects.KprobeSysBind,
 		},
 	}
 
 	return kprobes
 }
 
+func (p *Watcher) Tracepoints() map[string]ebpfcommon.FunctionPrograms {
+	return nil
+}
+
 func (p *Watcher) Run(ctx context.Context) {
 	p.events <- Event{Type: Ready}
 	ebpfcommon.ForwardRingbuf[any](