diff --git a/userspace/libsinsp/container.cpp b/userspace/libsinsp/container.cpp index 635064cbb9..072c34a151 100644 --- a/userspace/libsinsp/container.cpp +++ b/userspace/libsinsp/container.cpp @@ -261,7 +261,7 @@ std::string sinsp_container_manager::container_to_json(const sinsp_container_inf return Json::FastWriter().write(obj); } -bool sinsp_container_manager::container_to_sinsp_event(const std::string& json, sinsp_evt* evt, std::shared_ptr tinfo) +bool sinsp_container_manager::container_to_sinsp_event(const std::string& json, sinsp_evt* evt, std::shared_ptr tinfo, char *scap_err) { size_t totlen = sizeof(scap_evt) + sizeof(uint32_t) + json.length() + 1; @@ -274,17 +274,12 @@ bool sinsp_container_manager::container_to_sinsp_event(const std::string& json, evt->set_inspector(m_inspector); scap_evt* scapevt = evt->get_scap_evt(); - scapevt->ts = (uint64_t) - 1; + scapevt->ts = UINT64_MAX; scapevt->tid = -1; - scapevt->len = (uint32_t)totlen; - scapevt->type = PPME_CONTAINER_JSON_2_E; - scapevt->nparams = 1; - - uint32_t* lens = (uint32_t*)((char *)scapevt + sizeof(ppm_evt_hdr)); - char* valptr = (char*)lens + sizeof(uint32_t); - - *lens = (uint32_t)json.length() + 1; - memcpy(valptr, json.c_str(), *lens); + if (scap_event_encode_params(scap_sized_buffer{scapevt, totlen}, nullptr, scap_err, PPME_CONTAINER_JSON_2_E, 1, json.c_str()) != SCAP_SUCCESS) + { + return false; + } evt->init(); evt->set_tinfo_ref(tinfo); @@ -364,7 +359,9 @@ void sinsp_container_manager::notify_new_container(const sinsp_container_info& c std::unique_ptr evt(new sinsp_evt()); - if(container_to_sinsp_event(container_to_json(container_info), evt.get(), container_info.get_tinfo(m_inspector))) + char scap_err[SCAP_LASTERR_SIZE]; + + if(container_to_sinsp_event(container_to_json(container_info), evt.get(), container_info.get_tinfo(m_inspector), scap_err)) { libsinsp_logger()->format(sinsp_logger::SEV_DEBUG, "notify_new_container (%s): created CONTAINER_JSON event, queuing to inspector", @@ -376,8 +373,9 @@ void sinsp_container_manager::notify_new_container(const sinsp_container_info& c else { libsinsp_logger()->format(sinsp_logger::SEV_ERROR, - "notify_new_container (%s): could not create CONTAINER_JSON event, dropping", - container_info.m_id.c_str()); + "notify_new_container (%s): could not create CONTAINER_JSON event: %s, dropping", + container_info.m_id.c_str(), + scap_err); } } @@ -389,14 +387,22 @@ bool sinsp_container_manager::async_allowed() const void sinsp_container_manager::dump_containers(sinsp_dumper& dumper) { + char scap_err[SCAP_LASTERR_SIZE]; for(const auto& it : (*m_containers.lock())) { sinsp_evt evt; - if(container_to_sinsp_event(container_to_json(*it.second), &evt, it.second->get_tinfo(m_inspector))) + if(container_to_sinsp_event(container_to_json(*it.second), &evt, it.second->get_tinfo(m_inspector), scap_err)) { evt.get_scap_evt()->ts = m_inspector->get_new_ts(); dumper.dump(&evt); } + else + { + libsinsp_logger()->format(sinsp_logger::SEV_ERROR, + "dump_containers (%s): could not create CONTAINER_JSON event: %s, dropping", + scap_err, + it.second->m_id.c_str()); + } } } diff --git a/userspace/libsinsp/container.h b/userspace/libsinsp/container.h index 18faef5e0d..2bc3fb2344 100644 --- a/userspace/libsinsp/container.h +++ b/userspace/libsinsp/container.h @@ -235,7 +235,7 @@ class sinsp_container_manager : private: - bool container_to_sinsp_event(const std::string& json, sinsp_evt* evt, std::shared_ptr tinfo); + bool container_to_sinsp_event(const std::string& json, sinsp_evt* evt, std::shared_ptr tinfo, char* scap_err); std::string get_docker_env(const Json::Value &env_vars, const std::string &mti); std::list> m_container_engines; diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index 638e85b22e..bc4d2e7979 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -3037,8 +3037,10 @@ void sinsp_parser::parse_bind_exit(sinsp_evt *evt) // if(family == PPM_AF_INET) { - uint32_t ip = *(uint32_t *)(packed_data + 1); - uint16_t port = *(uint16_t *)(packed_data + 5); + uint32_t ip; + uint16_t port; + memcpy(&ip, packed_data + 1, sizeof(ip)); + memcpy(&port, packed_data + 5, sizeof(port)); if(port > 0) { evt->get_fd_info()->m_type = SCAP_FD_IPV4_SERVSOCK; @@ -3846,10 +3848,10 @@ bool sinsp_parser::set_ipv6_addresses_and_ports(sinsp_fdinfo* fdinfo, uint8_t* p uint16_t tsport, tdport; memcpy((uint8_t *) tsip.m_b, packed_data + 1, sizeof(tsip.m_b)); - tsport = *(uint16_t *)(packed_data + 17); + memcpy(&tsport, packed_data + 17, sizeof(tsport)); memcpy((uint8_t *) tdip.m_b, packed_data + 19, sizeof(tdip.m_b)); - tdport = *(uint16_t *)(packed_data + 35); + memcpy(&tdport, packed_data + 35, sizeof(tdport)); if(fdinfo->m_type == SCAP_FD_IPV6_SOCK) {