[CWS] Add the protocol field to BindNode (DataDog#31428)

kkpan11 · Nov 26, 2024 · e75539a · e75539a
1 parent d03c3af
commit e75539a
Show file tree

Hide file tree

Showing 8 changed files with 26 additions and 13 deletions.
diff --git a/go.mod b/go.mod
@@ -642,7 +642,7 @@ require (
 
 require (
 	github.com/DATA-DOG/go-sqlmock v1.5.2
-	github.com/DataDog/agent-payload/v5 v5.0.135
+	github.com/DataDog/agent-payload/v5 v5.0.137
 	github.com/DataDog/datadog-agent/comp/api/api/def v0.56.0-rc.3
 	github.com/DataDog/datadog-agent/comp/core/config v0.59.0
 	github.com/DataDog/datadog-agent/comp/core/flare/types v0.59.0

diff --git a/go.sum b/go.sum
diff --git a/pkg/security/secl/schemas/activity_dump.schema.json b/pkg/security/secl/schemas/activity_dump.schema.json
@@ -291,11 +291,15 @@
                                             },
                                             "ip": {
                                                 "type": "string"
+                                            },
+                                            "protocol": {
+                                                "type": "integer"
                                             }
                                         },
                                         "required": [
                                             "port",
-                                            "ip"
+                                            "ip",
+                                            "protocol"
                                         ]
                                     }
                                 }

diff --git a/pkg/security/secl/schemas/activity_dump_proto.schema.json b/pkg/security/secl/schemas/activity_dump_proto.schema.json
@@ -275,11 +275,15 @@
                                             },
                                             "ip": {
                                                 "type": "string"
+                                            },
+                                            "protocol": {
+                                                "type": "integer"
                                             }
                                         },
                                         "required": [
                                             "port",
-                                            "ip"
+                                            "ip",
+                                            "protocol"
                                         ]
                                     }
                                 }

diff --git a/pkg/security/security_profile/activity_tree/activity_tree_proto_dec_v1.go b/pkg/security/security_profile/activity_tree/activity_tree_proto_dec_v1.go
@@ -331,6 +331,7 @@ func protoDecodeProtoSocket(sn *adproto.SocketNode) *SocketNode {
 			MatchedRules: make([]*model.MatchedRule, 0, len(bindNode.MatchedRules)),
 			Port:         uint16(bindNode.Port),
 			IP:           bindNode.Ip,
+			Protocol:     uint16(bindNode.Protocol),
 			ImageTags:    bindNode.ImageTags,
 		}
 

diff --git a/pkg/security/security_profile/activity_tree/activity_tree_proto_enc_v1.go b/pkg/security/security_profile/activity_tree/activity_tree_proto_enc_v1.go
@@ -303,6 +303,7 @@ func socketNodeToProto(sn *SocketNode) *adproto.SocketNode {
 			MatchedRules: make([]*adproto.MatchedRule, 0, len(bn.MatchedRules)),
 			Port:         uint32(bn.Port),
 			Ip:           bn.IP,
+			Protocol:     uint32(bn.Protocol),
 			ImageTags:    bn.ImageTags,
 		}
 

diff --git a/pkg/security/security_profile/activity_tree/process_node_snapshot.go b/pkg/security/security_profile/activity_tree/process_node_snapshot.go
@@ -287,39 +287,40 @@ func (pn *ProcessNode) snapshotBoundSockets(p *process.Process, stats *Stats, ne
 	for _, s := range sockets {
 		for _, sock := range TCP {
 			if sock.Inode == s {
-				pn.insertSnapshottedSocket(unix.AF_INET, sock.LocalAddr, uint16(sock.LocalPort), stats, newEvent)
+				pn.insertSnapshottedSocket(unix.AF_INET, sock.LocalAddr, unix.IPPROTO_TCP, uint16(sock.LocalPort), stats, newEvent)
 				break
 			}
 		}
 		for _, sock := range UDP {
 			if sock.Inode == s {
-				pn.insertSnapshottedSocket(unix.AF_INET, sock.LocalAddr, uint16(sock.LocalPort), stats, newEvent)
+				pn.insertSnapshottedSocket(unix.AF_INET, sock.LocalAddr, unix.IPPROTO_UDP, uint16(sock.LocalPort), stats, newEvent)
 				break
 			}
 		}
 		for _, sock := range TCP6 {
 			if sock.Inode == s {
-				pn.insertSnapshottedSocket(unix.AF_INET6, sock.LocalAddr, uint16(sock.LocalPort), stats, newEvent)
+				pn.insertSnapshottedSocket(unix.AF_INET6, sock.LocalAddr, unix.IPPROTO_TCP, uint16(sock.LocalPort), stats, newEvent)
 				break
 			}
 		}
 		for _, sock := range UDP6 {
 			if sock.Inode == s {
-				pn.insertSnapshottedSocket(unix.AF_INET6, sock.LocalAddr, uint16(sock.LocalPort), stats, newEvent)
+				pn.insertSnapshottedSocket(unix.AF_INET6, sock.LocalAddr, unix.IPPROTO_UDP, uint16(sock.LocalPort), stats, newEvent)
 				break
 			}
 		}
 		// not necessary found here, can be also another kind of socket (AF_UNIX, AF_NETLINK, etc)
 	}
 }
 
-func (pn *ProcessNode) insertSnapshottedSocket(family uint16, ip net.IP, port uint16, stats *Stats, newEvent func() *model.Event) {
+func (pn *ProcessNode) insertSnapshottedSocket(family uint16, ip net.IP, protocol uint16, port uint16, stats *Stats, newEvent func() *model.Event) {
 	evt := newEvent()
 	evt.Type = uint32(model.BindEventType)
 
 	evt.Bind.SyscallEvent.Retval = 0
 	evt.Bind.AddrFamily = family
 	evt.Bind.Addr.IPNet.IP = ip
+	evt.Bind.Protocol = protocol
 	if family == unix.AF_INET {
 		evt.Bind.Addr.IPNet.Mask = net.CIDRMask(32, 32)
 	} else {

diff --git a/pkg/security/security_profile/activity_tree/socket_node.go b/pkg/security/security_profile/activity_tree/socket_node.go
@@ -21,6 +21,7 @@ type BindNode struct {
 	GenerationType NodeGenerationType
 	Port           uint16
 	IP             string
+	Protocol       uint16
 }
 
 // SocketNode is used to store a Socket node and associated events
@@ -32,10 +33,10 @@ type SocketNode struct {
 
 // Matches returns true if BindNodes matches
 func (bn *BindNode) Matches(toMatch *BindNode) bool {
-	return bn.Port == toMatch.Port && bn.IP == toMatch.IP
+	return bn.Port == toMatch.Port && bn.IP == toMatch.IP && bn.Protocol == toMatch.Protocol
 }
 
-// Matches returns true if BindNodes matches
+// Matches returns true if SocketNodes matches
 func (sn *SocketNode) Matches(toMatch *SocketNode) bool {
 	return sn.Family == toMatch.Family
 }
@@ -81,7 +82,7 @@ func (sn *SocketNode) InsertBindEvent(evt *model.BindEvent, imageTag string, gen
 	evtIP := evt.Addr.IPNet.IP.String()
 
 	for _, n := range sn.Bind {
-		if evt.Addr.Port == n.Port && evtIP == n.IP {
+		if evt.Addr.Port == n.Port && evtIP == n.IP && evt.Protocol == n.Protocol {
 			if !dryRun {
 				n.MatchedRules = model.AppendMatchedRule(n.MatchedRules, rules)
 			}
@@ -100,6 +101,7 @@ func (sn *SocketNode) InsertBindEvent(evt *model.BindEvent, imageTag string, gen
 			GenerationType: generationType,
 			Port:           evt.Addr.Port,
 			IP:             evtIP,
+			Protocol:       evt.Protocol,
 		}
 		if imageTag != "" {
 			node.ImageTags = []string{imageTag}