fix(modern_bpf): null destination address in sendmsg syscall

Signed-off-by: Gianmatteo Palmieri <[email protected]>
falcosecurity · Feb 14, 2024 · fee3c50 · fee3c50
1 parent 4a07742
commit fee3c50
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c
@@ -45,7 +45,10 @@ int BPF_PROG(sendmsg_e,
 	 */
 	if(socket_fd >= 0)
 	{
-		auxmap__store_socktuple_param(auxmap, socket_fd, OUTBOUND, NULL);
+		struct sockaddr *usrsockaddr;
+		struct msghdr *msg = (struct msghdr*)msghdr_pointer;
+		BPF_CORE_READ_USER_INTO(&usrsockaddr, msg, msg_name);
+		auxmap__store_socktuple_param(auxmap, socket_fd, OUTBOUND, usrsockaddr);
 	}
 	else
 	{