Merge pull request #126 from intelops/pre-main

Pre main
intelops · Apr 12, 2024 · 7dcb666 · 7dcb666
2 parents 4fbd9ab + e1703f4
commit 7dcb666
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 2 deletions.
diff --git a/pkg/eventparser/parser.go b/pkg/eventparser/parser.go
@@ -349,7 +349,16 @@ func (bs *ByteStream) parseSocketAddress() (any, error) {
 			return fmt.Sprintf("%+v", addr), nil
 		}
 	default:
-		return nil, nil
+		{
+			type unknownAddr struct {
+				Family string
+			}
+
+			var addr unknownAddr
+			addr.Family = socketFamilyNames[int32(family)]
+
+			return fmt.Sprintf("%+v", addr), nil
+		}
 	}
 }
 

diff --git a/pkg/eventparser/parser_test.go b/pkg/eventparser/parser_test.go
@@ -4,6 +4,7 @@
 package eventparser
 
 import (
+	"fmt"
 	"reflect"
 	"testing"
 )
@@ -440,7 +441,7 @@ func TestByteStream_parseSocketAddress(t *testing.T) {
 				position: 0,
 				nparams:  2,
 			},
-			want:    nil,
+			want:    fmt.Sprintf("%+v", struct{ Family string }{Family: "AF_UNSPEC"}),
 			wantErr: false,
 		},
 		{

diff --git a/tarian/c/utils/shared/writer.h b/tarian/c/utils/shared/writer.h
@@ -247,6 +247,9 @@ stain void write_sockaddr(uint8_t *buf, uint64_t *pos, unsigned long data_ptr, u
       write_str(buf, pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL);
       break;
     }
+    default: {
+      write_u8(buf, pos, socket_family);
+    }
   }
 }
 

diff --git a/tarian/tarian_x86_bpfel.o b/tarian/tarian_x86_bpfel.o
-Original file line number
+Diff line change
@@ Expand Up @@
           write_str(buf, pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL);
           break;
         }
+        default: {
+          write_u8(buf, pos, socket_family);
+        }
       }
     }
@@ Expand Down @@