exein-io / pulsar

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.
https://pulsar.sh
Other
888 stars 51 forks source link

fix(network-filter): DNS event generation #267

Closed Pierrow7675 closed 4 months ago

Pierrow7675 commented 6 months ago

Pull Request Title

Pulsar IOT was not successfully generating DNS queries/answers information.

Implementation (Optional)

First the amount of data read is now corresponding to the data len - 1 in the packet (excl IP and UDP headers). Review is welcome on this point since that does not work if "len = output->data_len" (i.e. the exact size of the data in the packet) but with "len = output->data_len - 1".

For the data reception, destination address retrieval of the incoming packet is skipped. Actually we do not really care about this adress since it should be an adress of one of the network interface...

I have

banditopazzo commented 5 months ago

before this change the args was NULL there was no output message to userspace. now what happens when args is NULL in userspace? there is a 1:1 mapping with a Rust struct, please check if it receives garbage