cleanup(drivers): move all recvmmsg arguments to the exit event

falcosecurity · Oct 17, 2024 · 56a540f · 56a540f
1 parent 80aedd7
commit 56a540f
Show file tree

Hide file tree

Showing 12 changed files with 162 additions and 132 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -4251,18 +4251,13 @@ FILLER(sys_recvmsg_x_2, true) {
 	return res;
 }
 
-FILLER(sys_recvmmsg_e, true) {
-	/* Parameter 1: fd (type: PT_FD) */
-	int32_t fd = (int32_t)bpf_syscall_get_argument(data, 0);
-	return bpf_push_s64_to_ring(data, (int64_t)fd);
-}
-
 FILLER(sys_recvmmsg_x, true) {
 	const struct iovec *iov;
 	struct mmsghdr mmh;
 	unsigned long iovcnt;
 	unsigned long val;
 	int res;
+	int fd;
 
 	/* Parameter 1: res (type: PT_ERRNO) */
 	long retval = bpf_syscall_get_retval(data->ctx);
@@ -4274,22 +4269,28 @@ FILLER(sys_recvmmsg_x, true) {
 		res = bpf_push_s64_to_ring(data, retval);
 		CHECK_RES(res);
 
-		/* Parameter 2: size (type: PT_UINT32) */
+		/* Parameter 2: fd (type: PT_FD) */
+		res = bpf_push_empty_param(data);
+		CHECK_RES(res);
+
+		/* Parameter 3: size (type: PT_UINT32) */
 		res = bpf_push_u32_to_ring(data, 0);
 		CHECK_RES(res);
 
-		/* Parameter 3: data (type: PT_BYTEBUF) */
+		/* Parameter 4: data (type: PT_BYTEBUF) */
 		res = bpf_push_empty_param(data);
 		CHECK_RES(res);
 
-		/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
+		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
 		res = bpf_push_empty_param(data);
 		CHECK_RES(res);
 
-		/* Parameter 5: msg_control (type: PT_BYTEBUF) */
+		/* Parameter 6: msg_control (type: PT_BYTEBUF) */
 		return bpf_push_empty_param(data);
 	}
 
+	fd = bpf_syscall_get_argument(data, 0);
+
 	/*
 	 * Retrieve the message header
 	 */
@@ -4300,6 +4301,9 @@ FILLER(sys_recvmmsg_x, true) {
 	res = bpf_push_s64_to_ring(data, mmh.msg_len);
 	CHECK_RES(res);
 
+	res = bpf_push_s64_to_ring(data, fd);
+	CHECK_RES(res);
+
 	/*
 	 * data and size
 	 */

diff --git a/driver/event_table.c b/driver/event_table.c
@@ -334,16 +334,13 @@ const struct ppm_event_info g_event_info[] = {
                                     {"data", PT_BYTEBUF, PF_NA},
                                     {"tuple", PT_SOCKTUPLE, PF_NA},
                                     {"msgcontrol", PT_BYTEBUF, PF_NA}}},
-        [PPME_SOCKET_RECVMMSG_E] = {"recvmmsg",
-                                    EC_IO_READ | EC_SYSCALL,
-                                    EF_USES_FD | EF_READS_FROM_FD | EF_MODIFIES_STATE,
-                                    1,
-                                    {{"fd", PT_FD, PF_DEC}}},
+        [PPME_SOCKET_RECVMMSG_E] = {"recvmmsg", EC_IO_READ | EC_SYSCALL, EF_NONE, 0},
         [PPME_SOCKET_RECVMMSG_X] = {"recvmmsg",
                                     EC_IO_READ | EC_SYSCALL,
                                     EF_USES_FD | EF_READS_FROM_FD | EF_MODIFIES_STATE,
-                                    5,
+                                    6,
                                     {{"res", PT_ERRNO, PF_DEC},
+                                     {"fd", PT_FD, PF_DEC},
                                      {"size", PT_UINT32, PF_DEC},
                                      {"data", PT_BYTEBUF, PF_NA},
                                      {"tuple", PT_SOCKTUPLE, PF_NA},

diff --git a/driver/fillers_table.c b/driver/fillers_table.c
@@ -70,7 +70,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
         [PPME_SOCKET_SENDMMSG_X] = {FILLER_REF(sys_sendmmsg_x)},
         [PPME_SOCKET_RECVMSG_E] = {FILLER_REF(sys_recvmsg_e)},
         [PPME_SOCKET_RECVMSG_X] = {FILLER_REF(sys_recvmsg_x)},
-        [PPME_SOCKET_RECVMMSG_E] = {FILLER_REF(sys_recvmmsg_e)},
+        [PPME_SOCKET_RECVMMSG_E] = {FILLER_REF(sys_empty)},
         [PPME_SOCKET_RECVMMSG_X] = {FILLER_REF(sys_recvmmsg_x)},
         [PPME_SYSCALL_CREAT_E] = {FILLER_REF(sys_creat_e)},
         [PPME_SYSCALL_CREAT_X] = {FILLER_REF(sys_creat_x)},

diff --git a/driver/modern_bpf/definitions/events_dimensions.h b/driver/modern_bpf/definitions/events_dimensions.h
@@ -205,7 +205,7 @@
 #define SPLICE_E_SIZE \
 	HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint64_t) + sizeof(uint32_t) + PARAM_LEN * 4
 #define SPLICE_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
-#define RECVMMSG_E_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
+#define RECVMMSG_E_SIZE HEADER_LEN
 #define SENDMMSG_E_SIZE HEADER_LEN
 #define SEMOP_E_SIZE HEADER_LEN + sizeof(int32_t) + PARAM_LEN
 #define SEMOP_X_SIZE                                                                               \

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c
@@ -13,10 +13,6 @@
 
 SEC("tp_btf/sys_enter")
 int BPF_PROG(recvmmsg_e, struct pt_regs *regs, long id) {
-	/* Collect parameters at the beginning to manage socketcalls */
-	unsigned long socket_fd = 0;
-	extract__network_args(&socket_fd, 1, regs);
-
 	struct ringbuf_struct ringbuf;
 	if(!ringbuf__reserve_space(&ringbuf, ctx, RECVMMSG_E_SIZE, PPME_SOCKET_RECVMMSG_E)) {
 		return 0;
@@ -26,8 +22,7 @@ int BPF_PROG(recvmmsg_e, struct pt_regs *regs, long id) {
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 
-	/* Parameter 1: fd (type: PT_FD)*/
-	ringbuf__store_s64(&ringbuf, (int64_t)(int32_t)socket_fd);
+	// Here we have no parameters to collect.
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/
 
@@ -40,7 +35,7 @@ int BPF_PROG(recvmmsg_e, struct pt_regs *regs, long id) {
 
 /*=============================== EXIT EVENT ===========================*/
 
-typedef struct recvmmsg_data_s {
+typedef struct {
 	uint32_t fd;
 	struct mmsghdr *mmh;
 	struct pt_regs *regs;
@@ -68,7 +63,10 @@ static long handle_exit(uint32_t index, void *ctx) {
 	/* Parameter 1: res (type: PT_ERRNO) */
 	auxmap__store_s64_param(auxmap, mmh.msg_len);
 
-	/* Parameter 2: size (type: PT_UINT32) */
+	/* Parameter 2: fd (type: PT_FD) */
+	auxmap__store_s64_param(auxmap, (int64_t)data->fd);
+
+	/* Parameter 3: size (type: PT_UINT32) */
 	auxmap__store_u32_param(auxmap, (uint32_t)mmh.msg_len);
 
 	/* We read the minimum between `snaplen` and what we really
@@ -80,19 +78,19 @@ static long handle_exit(uint32_t index, void *ctx) {
 		snaplen = mmh.msg_len;
 	}
 
-	/* Parameter 3: data (type: PT_BYTEBUF) */
+	/* Parameter 4: data (type: PT_BYTEBUF) */
 	auxmap__store_iovec_data_param(auxmap,
 	                               (unsigned long)mmh.msg_hdr.msg_iov,
 	                               mmh.msg_hdr.msg_iovlen,
 	                               snaplen);
 
-	/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
+	/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
 	auxmap__store_socktuple_param(auxmap,
 	                              data->fd,
 	                              INBOUND,
 	                              (struct sockaddr *)mmh.msg_hdr.msg_name);
 
-	/* Parameter 5: msg_control (type: PT_BYTEBUF) */
+	/* Parameter 6: msg_control (type: PT_BYTEBUF) */
 	if(mmh.msg_hdr.msg_control != NULL) {
 		auxmap__store_bytebuf_param(auxmap,
 		                            (unsigned long)mmh.msg_hdr.msg_control,
@@ -122,16 +120,19 @@ int BPF_PROG(recvmmsg_x, struct pt_regs *regs, long ret) {
 		/* Parameter 1: res (type: PT_ERRNO) */
 		auxmap__store_s64_param(auxmap, ret);
 
-		/* Parameter 2: size (type: PT_UINT32) */
+		/* Parameter 2: fd (type: PT_FD) */
+		auxmap__store_empty_param(auxmap);
+
+		/* Parameter 3: size (type: PT_UINT32) */
 		auxmap__store_u32_param(auxmap, 0);
 
-		/* Parameter 3: data (type: PT_BYTEBUF) */
+		/* Parameter 4: data (type: PT_BYTEBUF) */
 		auxmap__store_empty_param(auxmap);
 
-		/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
+		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
 		auxmap__store_empty_param(auxmap);
 
-		/* Parameter 5: msg_control (type: PT_BYTEBUF) */
+		/* Parameter 6: msg_control (type: PT_BYTEBUF) */
 		auxmap__store_empty_param(auxmap);
 
 		auxmap__finalize_event_header(auxmap);

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c
@@ -35,7 +35,7 @@ int BPF_PROG(sendmmsg_e, struct pt_regs *regs, long id) {
 
 /*=============================== EXIT EVENT ===========================*/
 
-typedef struct sendmmsg_exit_s {
+typedef struct {
 	uint32_t fd;
 	struct mmsghdr *mmh;
 	struct pt_regs *regs;

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -3072,20 +3072,6 @@ int f_sys_recvmsg_x(struct event_filler_arguments *args) {
 	return add_sentinel(args);
 }
 
-int f_sys_recvmmsg_e(struct event_filler_arguments *args) {
-	unsigned long val = 0;
-	int res = 0;
-	int32_t fd = 0;
-
-	/* Parameter 1: fd (type: PT_FD)*/
-	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	fd = (int32_t)val;
-	res = val_to_ring(args, (int64_t)fd, 0, false, 0);
-	CHECK_RES(res);
-
-	return add_sentinel(args);
-}
-
 int f_sys_recvmmsg_x(struct event_filler_arguments *args) {
 	int res;
 	unsigned long val;
@@ -3115,19 +3101,23 @@ int f_sys_recvmmsg_x(struct event_filler_arguments *args) {
 		res = val_to_ring(args, retval, 0, false, 0);
 		CHECK_RES(res);
 
-		/* Parameter 2: size (type: PT_UINT32) */
+		/* Parameter 2: fd (type: PT_FD) */
+		res = push_empty_param(args);
+		CHECK_RES(res);
+
+		/* Parameter 3: size (type: PT_UINT32) */
 		res = val_to_ring(args, 0, 0, false, 0);
 		CHECK_RES(res);
 
-		/* Parameter 3: data (type: PT_BYTEBUF) */
+		/* Parameter 4: data (type: PT_BYTEBUF) */
 		res = push_empty_param(args);
 		CHECK_RES(res);
 
-		/* Parameter 4: tuple (type: PT_SOCKTUPLE) */
+		/* Parameter 5: tuple (type: PT_SOCKTUPLE) */
 		res = push_empty_param(args);
 		CHECK_RES(res);
 
-		/* Parameter 5: msg_control (type: PT_BYTEBUF) */
+		/* Parameter 6: msg_control (type: PT_BYTEBUF) */
 		res = push_empty_param(args);
 		CHECK_RES(res);
 
@@ -3149,6 +3139,12 @@ int f_sys_recvmmsg_x(struct event_filler_arguments *args) {
 		res = val_to_ring(args, mmh.msg_len, 0, false, 0);
 		CHECK_RES(res);
 
+		/* Parameter 2: fd (type: PT_FD)*/
+		syscall_get_arguments_deprecated(args, 0, 1, &val);
+		fd = (int32_t)val;
+		res = val_to_ring(args, (int64_t)fd, 0, false, 0);
+		CHECK_RES(res);
+
 		/*
 		 * data and size
 		 */
@@ -3167,6 +3163,12 @@ int f_sys_recvmmsg_x(struct event_filler_arguments *args) {
 		res = val_to_ring(args, compat_mmh.msg_len, 0, false, 0);
 		CHECK_RES(res);
 
+		/* Parameter 2: fd (type: PT_FD)*/
+		syscall_get_arguments_deprecated(args, 0, 1, &val);
+		fd = (int32_t)val;
+		res = val_to_ring(args, (int64_t)fd, 0, false, 0);
+		CHECK_RES(res);
+
 		/*
 		 * data and size
 		 */

diff --git a/driver/ppm_fillers.h b/driver/ppm_fillers.h
@@ -47,7 +47,6 @@ or GPL2.txt for full copies of the license.
 	FN(sys_recvfrom_x)                   \
 	FN(sys_recvmsg_x)                    \
 	FN(sys_recvmsg_x_2)                  \
-	FN(sys_recvmmsg_e)                   \
 	FN(sys_recvmmsg_x)                   \
 	FN(sys_recvmmsg_x_2)                 \
 	FN(sys_shutdown_e)                   \

diff --git a/test/drivers/test_suites/syscall_enter_suite/recvmmsg_e.cpp b/test/drivers/test_suites/syscall_enter_suite/recvmmsg_e.cpp
@@ -33,11 +33,10 @@ TEST(SyscallEnter, recvmmsgE) {
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/
 
-	/* Parameter 1: fd (type: PT_FD) */
-	evt_test->assert_numeric_param(1, (int64_t)mock_fd);
+	// Here we have no parameters to assert.
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/
 
-	evt_test->assert_num_params_pushed(1);
+	evt_test->assert_num_params_pushed(0);
 }
 #endif