fix(ebpf): accept4 save remote address/port

djoreilly · djoreilly · commit adcbcc176c88 · 2025-06-19T16:27:03.000+01:00
security_socket_accept had the local address/port for remote_addr.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -1650,7 +1650,7 @@ int syscall__accept4(void *ctx)
 
     save_to_submit_buf(&p.event->args_buf, (void *) &sockfd, sizeof(u32), 0);
     save_sockaddr_to_buf(&p.event->args_buf, old_sock, true, 1);
-    save_sockaddr_to_buf(&p.event->args_buf, new_sock, true, 2);
+    save_sockaddr_to_buf(&p.event->args_buf, new_sock, false, 2);
 
     return events_perf_submit(&p, 0);
 }

Original file line number	Diff line number	Diff line change
`@@ -1650,7 +1650,7 @@ int syscall__accept4(void *ctx)`
`1650`	`1650`
`1651`	`1651`	`save_to_submit_buf(&p.event->args_buf, (void *) &sockfd, sizeof(u32), 0);`
`1652`	`1652`	`save_sockaddr_to_buf(&p.event->args_buf, old_sock, true, 1);`
`1653`		`- save_sockaddr_to_buf(&p.event->args_buf, new_sock, true, 2);`
	`1653`	`+ save_sockaddr_to_buf(&p.event->args_buf, new_sock, false, 2);`
`1654`	`1654`
`1655`	`1655`	`return events_perf_submit(&p, 0);`
`1656`	`1656`	`}`