Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #22787 to 7.10: system/socket: Add ip_local_out alternative #22870

Merged
merged 2 commits into from
Dec 3, 2020
Merged

Cherry-pick #22787 to 7.10: system/socket: Add ip_local_out alternative #22870

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
254a4f5
system/socket: Add ip_local_out alternative (#22787)
adriansr Dec 2, 2020
40b4823
Changelog entry
adriansr Dec 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
- auditd: Fix an error condition causing a lot of `audit_send_reply` kernel threads being created. {pull}22673[22673]
- system/socket: Fixed start failure when run under config reloader. {issue}20851[20851] {pull}21693[21693]
- system/socket: Fixed startup error with some 5.x kernels. {issue}18755[18755] {pull}22787[22787]

*Filebeat*

Expand Down
21 changes: 15 additions & 6 deletions x-pack/auditbeat/module/system/socket/guess/iplocalout.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,22 @@ import (
"github.com/elastic/beats/v7/x-pack/auditbeat/tracing"
)

// Guess how to get a struct sock* from an ip_local_out() call.
// Guess how to get a struct sock* and an sk_buff* from an ip_local_out() call.
// This function has three forms depending on kernel version:
// - ip_local_out(struct sk_buff *skb) // 2.x//<3.13
// - ip_local_out_sk(struct sock *sk, struct sk_buff *skb) // 3.13..4.3
// - ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb) // 4.4+
//
// what it does is set a probe on tcp_sendmsg (guaranteed to have a *sock)
// and in ip_local_out, which will be called by tcp_sendmsg.
// To make things more complicated, in some 5.x+ kernels, ip_local_out is never
// triggered although it exists, but __ip_local_out always works, so
// this guess expects the template variable IP_LOCAL_OUT to be set to the
// first of these functions that is available for tracing:
// [ "ip_local_out_sk", "__ip_local_out", "ip_local_out" ]
//
// ----
//
// What it guess does is set a probe on tcp_sendmsg (guaranteed to have a *sock)
// and in .IP_LOCAL_OUT, which will be called by tcp_sendmsg.
// It dumps the first param (which can be a struct net* or a struct sk_buff)
// and gets the second param. Either the second param is the sock, or is it
// found at some point in the dumped first param.
Expand Down Expand Up @@ -98,8 +106,8 @@ func (g *guessIPLocalOut) Probes() ([]helper.ProbeDef, error) {
Probe: tracing.Probe{
Name: "ip_local_out_sock_guess",
Address: "{{.IP_LOCAL_OUT}}",
Fetchargs: "arg={{if eq .IP_LOCAL_OUT \"ip_local_out\"}}{{.P2}}{{else}}{{.P1}}{{end}} dump=" +
helper.MakeMemoryDump("{{if eq .IP_LOCAL_OUT \"ip_local_out\"}}{{.P1}}{{else}}{{.P2}}{{end}}", 0, skbuffDumpSize),
Fetchargs: "arg={{if ne .IP_LOCAL_OUT \"ip_local_out_sk\"}}{{.P2}}{{else}}{{.P1}}{{end}} dump=" +
helper.MakeMemoryDump("{{if ne .IP_LOCAL_OUT \"ip_local_out_sk\"}}{{.P1}}{{else}}{{.P2}}{{end}}", 0, skbuffDumpSize),
},
Decoder: helper.NewStructDecoder(func() interface{} { return new(skbuffSockGuess) }),
},
Expand Down Expand Up @@ -149,7 +157,8 @@ func (g *guessIPLocalOut) Extract(ev interface{}) (common.MapStr, bool) {
// No tcp_sendmsg received?
return nil, false
}
isIpLocalOut := g.ctx.Vars["IP_LOCAL_OUT"] == "ip_local_out"
// Special handling for ip_local_out_sk
isIpLocalOut := g.ctx.Vars["IP_LOCAL_OUT"] != "ip_local_out_sk"
if v.Arg == g.sock {
if isIpLocalOut {
return common.MapStr{
Expand Down
2 changes: 1 addition & 1 deletion x-pack/auditbeat/module/system/socket/template.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ var baseTemplateVars = common.MapStr{
// These functions names vary between kernel versions. The first available one
// will be selected during setup.
var functionAlternatives = map[string][]string{
"IP_LOCAL_OUT": {"ip_local_out", "ip_local_out_sk"},
"IP_LOCAL_OUT": {"ip_local_out_sk", "__ip_local_out", "ip_local_out"},
"RECV_UDP_DATAGRAM": {"__skb_recv_udp", "__skb_recv_datagram", "skb_recv_datagram"},
"SYS_EXECVE": syscallAlternatives("execve"),
"SYS_GETTIMEOFDAY": syscallAlternatives("gettimeofday"),
Expand Down