Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEM] [Auditbeat] system/socket: Fix UDP flows #13470

Merged
merged 3 commits into from
Sep 4, 2019

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented Sep 3, 2019

This fixes a few problems with UDP:

  • IPv6/UDP unconnected support was missing.
  • Lost packets in UDP due to using zero-destination address.

Added more tests.

Relates #13058

This fixes a few problems with UDP:
- IPv6/UDP unconnected support.
- Lost packets in UDP due to using zero-destination address.
- Added more tests
@adriansr adriansr requested a review from a team as a code owner September 3, 2019 10:09
@adriansr adriansr added Auditbeat review Team:SIEM x-pack Issues and pull requests for X-Pack features. labels Sep 3, 2019
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem

@adriansr adriansr added the needs_backport PR is waiting to be backported to other branches. label Sep 3, 2019
Not available in Windows CI workers
@@ -321,7 +321,7 @@ var installKProbes = []helper.ProbeDef{
Probe: tracing.Probe{
Name: "udp_sendmsg_in",
Address: "udp_sendmsg",
Fetchargs: "sock={{.UDP_SENDMSG_SOCK}} size={{.UDP_SENDMSG_LEN}} laddr=+{{.INET_SOCK_LADDR}}({{.UDP_SENDMSG_SOCK}}):u32 lport=+{{.INET_SOCK_LPORT}}({{.UDP_SENDMSG_SOCK}}):u16 raddr=+{{.SOCKADDR_IN_ADDR}}(+0({{.UDP_SENDMSG_MSG}})):u32 rport=+{{.SOCKADDR_IN_PORT}}(+0({{.UDP_SENDMSG_MSG}})):u16",
Fetchargs: "sock={{.UDP_SENDMSG_SOCK}} size={{.UDP_SENDMSG_LEN}} laddr=+{{.INET_SOCK_LADDR}}({{.UDP_SENDMSG_SOCK}}):u32 lport=+{{.INET_SOCK_LPORT}}({{.UDP_SENDMSG_SOCK}}):u16 raddr=+{{.SOCKADDR_IN_ADDR}}(+0({{.UDP_SENDMSG_MSG}})):u32 rport=+{{.SOCKADDR_IN_PORT}}(+0({{.UDP_SENDMSG_MSG}})):u16 altraddr=+{{.INET_SOCK_RADDR}}({{.UDP_SENDMSG_SOCK}}):u32 altrport=+{{.INET_SOCK_RPORT}}({{.UDP_SENDMSG_SOCK}}):u16",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In what cases are the alt addrs needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sometimes, for connected sockets, the alt addresses are zero and the non-alt are populated.

@adriansr adriansr merged commit f0e2e20 into elastic:master Sep 4, 2019
adriansr added a commit to adriansr/beats that referenced this pull request Sep 5, 2019
This fixes a few problems with UDP:
- IPv6/UDP unconnected support.
- Lost packets in UDP due to using zero-destination address.
- Added more tests

(cherry picked from commit f0e2e20)
@adriansr adriansr added v7.4.0 and removed needs_backport PR is waiting to be backported to other branches. labels Sep 5, 2019
adriansr added a commit that referenced this pull request Sep 5, 2019
This fixes a few problems with UDP:
- IPv6/UDP unconnected support.
- Lost packets in UDP due to using zero-destination address.
- Added more tests

(cherry picked from commit f0e2e20)
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
…tic#13513)

This fixes a few problems with UDP:
- IPv6/UDP unconnected support.
- Lost packets in UDP due to using zero-destination address.
- Added more tests

(cherry picked from commit 7dd2735)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Auditbeat review v7.4.0 x-pack Issues and pull requests for X-Pack features.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants