fix(driver): properly add back fallback to user data when peer socket…

… data is missing. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Andrea Terzolo <[email protected]>
falcosecurity · Jan 14, 2025 · e1baab6 · e1baab6
1 parent 7809820
commit e1baab6
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 2 deletions.
diff --git a/driver/bpf/filler_helpers.h b/driver/bpf/filler_helpers.h
@@ -884,6 +884,7 @@ static __always_inline long bpf_fd_to_socktuple(struct filler_data *data,
 		 */
 		struct unix_sock *us = (struct unix_sock *)sk;
 		struct sock *speer = _READ(us->peer);
+		struct sockaddr_un *usrsockaddr_un;
 		char *us_name = NULL;
 
 		data->buf[data->state->tail_ctx.curoff & SCRATCH_SIZE_HALF] = socket_family_to_scap(family);
@@ -899,6 +900,10 @@ static __always_inline long bpf_fd_to_socktuple(struct filler_data *data,
 			memcpy(&data->buf[(data->state->tail_ctx.curoff + 1 + 8) & SCRATCH_SIZE_HALF], &us, 8);
 			bpf_getsockname(sock, peer_address, 1);
 			us_name = ((struct sockaddr_un *)peer_address)->sun_path;
+			if(us_name[0] == '\0' && us_name[1] == '\0' && usrsockaddr != NULL) {
+				usrsockaddr_un = (struct sockaddr_un *)usrsockaddr;
+				us_name = usrsockaddr_un->sun_path;
+			}
 		}
 
 		int res = unix_socket_path(

diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h
@@ -789,7 +789,15 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map *
 		if(direction == OUTBOUND) {
 			push__u64(auxmap->data, &auxmap->payload_pos, (uint64_t)socket_peer);
 			push__u64(auxmap->data, &auxmap->payload_pos, (uint64_t)socket_local);
-			path = BPF_CORE_READ(socket_peer, addr, name[0].sun_path);  // empty
+			struct sockaddr_un usrsockaddr_un = {};
+			if(socket_peer == NULL && usrsockaddr != NULL) {
+				bpf_probe_read_user(&usrsockaddr_un,
+				                    bpf_core_type_size(struct sockaddr_un),
+				                    (void *)usrsockaddr);
+				path = usrsockaddr_un.sun_path;
+			} else {
+				path = BPF_CORE_READ(socket_peer, addr, name[0].sun_path);  // empty
+			}
 		} else {
 			push__u64(auxmap->data, &auxmap->payload_pos, (uint64_t)socket_local);
 			push__u64(auxmap->data, &auxmap->payload_pos, (uint64_t)socket_peer);

diff --git a/driver/ppm_events.c b/driver/ppm_events.c
@@ -1188,7 +1188,7 @@ uint16_t fd_to_socktuple(int fd,
 		// Note that we check the second byte of `us_name`, see `sock_getname` for more details.
 		// Some times `usrsockaddr` is provided as a NULL pointer, checking `use_userdata` should be
 		// enough but just to be sure we check also `usrsockaddr != NULL`
-		if(us_name && us_name[1] == '\0' && use_userdata && usrsockaddr != NULL) {
+		if((!us_name || (us_name[0] == '\0' && us_name[1] == '\0')) && usrsockaddr != NULL) {
 			usrsockaddr_un = (struct sockaddr_un *)usrsockaddr;
 
 			/*