Add bind syscall support (#493)

Signed-off-by: sanyangji <songyujie@zju.edu.cn>
KindlingProject · Mar 28, 2023 · f310bd6 · f310bd6
1 parent d489fbe
commit f310bd6
Show file tree

Hide file tree

Showing 6 changed files with 33 additions and 316 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,7 @@
 
 ## Unreleased 
 ### Enhancements
+- Add bind support to get the listening ip and port of a server. ([#493](https://github.com/KindlingProject/kindling/pull/493))
 - Add an option `enable_fetch_replicaset` to control whether to fetch ReplicaSet metadata. The default value is false which aims to release pressure on Kubernetes API server. ([#492](https://github.com/KindlingProject/kindling/pull/492))
 
 ### Bug fixes

diff --git a/collector/pkg/component/receiver/cgoreceiver/cgo_func.h b/collector/pkg/component/receiver/cgoreceiver/cgo_func.h
@@ -59,8 +59,8 @@ struct kindling_event_t_for_go{
             char *directory;
             uint32_t protocol;
             uint8_t role;
-            uint32_t sip;
-            uint32_t dip;
+            uint32_t sip[4];
+            uint32_t dip[4];
             uint32_t sport;
             uint32_t dport;
 

diff --git a/collector/pkg/component/receiver/cgoreceiver/cgoreceiver.go b/collector/pkg/component/receiver/cgoreceiver/cgoreceiver.go
@@ -135,8 +135,12 @@ func convertEvent(cgoEvent *CKindlingEventForGo) *model.KindlingEvent {
 	ev.Ctx.FdInfo.Filename = C.GoString(cgoEvent.context.fdInfo.filename)
 	ev.Ctx.FdInfo.Directory = C.GoString(cgoEvent.context.fdInfo.directory)
 	ev.Ctx.FdInfo.Role = If(cgoEvent.context.fdInfo.role != 0, true, false).(bool)
-	ev.Ctx.FdInfo.Sip = []uint32{uint32(cgoEvent.context.fdInfo.sip)}
-	ev.Ctx.FdInfo.Dip = []uint32{uint32(cgoEvent.context.fdInfo.dip)}
+	ev.Ctx.FdInfo.Sip = make([]uint32, 4)
+	ev.Ctx.FdInfo.Dip = make([]uint32, 4)
+	for i := 0; i < 4; i++ {
+		ev.Ctx.FdInfo.Sip[i] = uint32(cgoEvent.context.fdInfo.sip[i])
+		ev.Ctx.FdInfo.Dip[i] = uint32(cgoEvent.context.fdInfo.dip[i])
+	}
 	ev.Ctx.FdInfo.Sport = uint32(cgoEvent.context.fdInfo.sport)
 	ev.Ctx.FdInfo.Dport = uint32(cgoEvent.context.fdInfo.dport)
 	ev.Ctx.FdInfo.Source = uint64(cgoEvent.context.fdInfo.source)

diff --git a/probe/src/cgo/defination.h b/probe/src/cgo/defination.h
diff --git a/probe/src/cgo/kindling.cpp b/probe/src/cgo/kindling.cpp
@@ -296,14 +296,33 @@ int getEvent(void** pp_kindling_event) {
         break;
       }
       case SCAP_FD_IPV4_SOCK:
-      case SCAP_FD_IPV4_SERVSOCK:
         p_kindling_event->context.fdInfo.protocol = get_protocol(fdInfo->get_l4proto());
         p_kindling_event->context.fdInfo.role = fdInfo->is_role_server();
-        p_kindling_event->context.fdInfo.sip = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_sip;
-        p_kindling_event->context.fdInfo.dip = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_dip;
+        p_kindling_event->context.fdInfo.sip[0] = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_sip;
+        p_kindling_event->context.fdInfo.dip[0] = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_dip;
         p_kindling_event->context.fdInfo.sport = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_sport;
         p_kindling_event->context.fdInfo.dport = fdInfo->m_sockinfo.m_ipv4info.m_fields.m_dport;
         break;
+      case SCAP_FD_IPV4_SERVSOCK:
+        p_kindling_event->context.fdInfo.protocol = get_protocol(fdInfo->get_l4proto());
+        p_kindling_event->context.fdInfo.role = fdInfo->is_role_server();
+        p_kindling_event->context.fdInfo.dip[0] = fdInfo->m_sockinfo.m_ipv4serverinfo.m_ip;
+        p_kindling_event->context.fdInfo.dport = fdInfo->m_sockinfo.m_ipv4serverinfo.m_port;
+        break;
+      case SCAP_FD_IPV6_SOCK:
+        p_kindling_event->context.fdInfo.protocol = get_protocol(fdInfo->get_l4proto());
+        p_kindling_event->context.fdInfo.role = fdInfo->is_role_server();
+        memcpy(p_kindling_event->context.fdInfo.sip, fdInfo->m_sockinfo.m_ipv6info.m_fields.m_sip.m_b, sizeof(fdInfo->m_sockinfo.m_ipv6info.m_fields.m_sip.m_b));
+        memcpy(p_kindling_event->context.fdInfo.dip, fdInfo->m_sockinfo.m_ipv6info.m_fields.m_dip.m_b, sizeof(fdInfo->m_sockinfo.m_ipv6info.m_fields.m_dip.m_b));
+        p_kindling_event->context.fdInfo.sport = fdInfo->m_sockinfo.m_ipv6info.m_fields.m_sport;
+        p_kindling_event->context.fdInfo.dport = fdInfo->m_sockinfo.m_ipv6info.m_fields.m_dport;
+        break;
+      case SCAP_FD_IPV6_SERVSOCK:
+        p_kindling_event->context.fdInfo.protocol = get_protocol(fdInfo->get_l4proto());
+        p_kindling_event->context.fdInfo.role = fdInfo->is_role_server();
+        memcpy(p_kindling_event->context.fdInfo.dip, fdInfo->m_sockinfo.m_ipv6serverinfo.m_ip.m_b, sizeof(fdInfo->m_sockinfo.m_ipv6serverinfo.m_ip.m_b));
+        p_kindling_event->context.fdInfo.dport = fdInfo->m_sockinfo.m_ipv6serverinfo.m_port;
+        break;
       case SCAP_FD_UNIX_SOCK:
         p_kindling_event->context.fdInfo.source = fdInfo->m_sockinfo.m_unixinfo.m_fields.m_source;
         p_kindling_event->context.fdInfo.destination =

diff --git a/probe/src/cgo/kindling.h b/probe/src/cgo/kindling.h
@@ -90,8 +90,8 @@ struct kindling_event_t_for_go {
       char* directory;
       uint32_t protocol;
       uint8_t role;
-      uint32_t sip;
-      uint32_t dip;
+      uint32_t sip[4];
+      uint32_t dip[4];
       uint32_t sport;
       uint32_t dport;
       uint64_t source;