diff --git a/pkg/eventparser/parser.go b/pkg/eventparser/parser.go index d1c92eb..127a49c 100644 --- a/pkg/eventparser/parser.go +++ b/pkg/eventparser/parser.go @@ -349,7 +349,16 @@ func (bs *ByteStream) parseSocketAddress() (any, error) { return fmt.Sprintf("%+v", addr), nil } default: - return nil, nil + { + type unknownAddr struct { + Family string + } + + var addr unknownAddr + addr.Family = socketFamilyNames[int32(family)] + + return fmt.Sprintf("%+v", addr), nil + } } } diff --git a/pkg/eventparser/parser_test.go b/pkg/eventparser/parser_test.go index a8f4548..5b74ef2 100644 --- a/pkg/eventparser/parser_test.go +++ b/pkg/eventparser/parser_test.go @@ -4,6 +4,7 @@ package eventparser import ( + "fmt" "reflect" "testing" ) @@ -440,7 +441,7 @@ func TestByteStream_parseSocketAddress(t *testing.T) { position: 0, nparams: 2, }, - want: nil, + want: fmt.Sprintf("%+v", struct{ Family string }{Family: "AF_UNSPEC"}), wantErr: false, }, { diff --git a/tarian/c/utils/shared/writer.h b/tarian/c/utils/shared/writer.h index 0476780..4f0f5e2 100644 --- a/tarian/c/utils/shared/writer.h +++ b/tarian/c/utils/shared/writer.h @@ -247,6 +247,9 @@ stain void write_sockaddr(uint8_t *buf, uint64_t *pos, unsigned long data_ptr, u write_str(buf, pos, start_reading_point, MAX_UNIX_SOCKET_PATH, KERNEL); break; } + default: { + write_u8(buf, pos, socket_family); + } } } diff --git a/tarian/tarian_x86_bpfel.o b/tarian/tarian_x86_bpfel.o index 6568f98..2fe33b9 100644 Binary files a/tarian/tarian_x86_bpfel.o and b/tarian/tarian_x86_bpfel.o differ