fix(modern_bpf): address review comments

Signed-off-by: Roberto Scolaro <[email protected]>

driver/modern_bpf/definitions/struct_flavors.h

@@ -72,12 +72,6 @@ struct modern_bpf__kernel_timespec
 	long int tv_nsec;
 };
 
-struct modern_bpf__kernel_timespec_ia32
-{
-	int tv_sec;
-	int tv_nsec;
-};
-
 /* We use this as a fallback for kernels where `struct __kernel_timex_timeval` is not defined. */
 struct modern_bpf__kernel_timex_timeval
 {

driver/modern_bpf/helpers/store/auxmap_store_params.h

@@ -620,24 +620,18 @@ static __always_inline void auxmap__store_sockaddr_param(struct auxiliary_map *a
 		{
 			/* This is an abstract socket address, we need to skip the initial `\0`. */
 			start_reading_point = (unsigned long)sockaddr_un->sun_path + 1;
-			addrlen -= 1;
 		}
 		else
 		{
 			start_reading_point = (unsigned long)sockaddr_un->sun_path;
 		}
 
-		// The addrlen is used has hard limit. So we should use add 1 for the `\0`
-		addrlen -= (FAMILY_SIZE + 1);
-		if(sockaddr_un->sun_path[addrlen-1] != '\0')
-			addrlen += 1;
-
 		/* Pack the sockaddr info:
 		 * - socket family.
 		 * - socket_unix_path (sun_path).
 		 */
 		push__u8(auxmap->data, &auxmap->payload_pos, socket_family_to_scap(socket_family));
-		uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, addrlen, KERNEL);
+		uint16_t written_bytes = push__charbuf(auxmap->data, &auxmap->payload_pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL);
 		final_param_len = FAMILY_SIZE + written_bytes;
 		break;
 	}
@@ -811,7 +805,8 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map *
 		}
 
 		unsigned long start_reading_point;
-		if(path[0] == '\0' && path[1] != '\0')
+		char first_path_byte = *(char *)path;
+		if(first_path_byte == '\0')
 		{
 			/* Please note exceptions in the `sun_path`:
 			 * Taken from: https://man7.org/linux/man-pages/man7/unix.7.html
@@ -824,13 +819,6 @@ static __always_inline void auxmap__store_socktuple_param(struct auxiliary_map *
 			 */
 			start_reading_point = (unsigned long)path + 1;
 		}
-		else if(path[0] == '\0' && path[1] == '\0')
-		{
-			// If no path is retrived from kernel, try to read from userspace.
-			bpf_probe_read_user_str(path, UNIX_PATH_MAX,
-									((struct sockaddr_un *)usrsockaddr)->sun_path);
-			start_reading_point = (unsigned long)path;
-		}
 		else
 		{
 			start_reading_point = (unsigned long)path;

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c

@@ -55,7 +55,7 @@ int BPF_PROG(ppoll_e,
 	}
 	else
 	{
-		struct modern_bpf__kernel_timespec_ia32 ts = {0};
+		struct old_timespec32 ts = {0};
 		bpf_probe_read_user(&ts, sizeof(ts), (void *)ts_pointer);
 		nanosec = ((uint32_t)ts.tv_sec) * SECOND_TO_NS + ts.tv_nsec;
 	}