feat!: drop sendto enter evts gen, testing and parsing code

As the `sendto` exit events contain all the information needed, drop
`sendto` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `sendto` enter evts gen and parsing

Signed-off-by: Leonardo Di Giovanna <[email protected]>

Author: ekoops

driver/bpf/fillers.h

@@ -1682,56 +1682,6 @@ FILLER(sys_send_x, true) {
 	return bpf_val_to_ring_len(data, 0, tuple_size);
 }
 
-FILLER(sys_sendto_e, true) {
-	/* Parameter 1: fd (type: PT_FD) */
-	int64_t fd = (int64_t)(int32_t)bpf_syscall_get_argument(data, 0);
-	int res = bpf_push_s64_to_ring(data, fd);
-	CHECK_RES(res);
-
-	/* Parameter 2: size (type: PT_UINT32) */
-	uint32_t size = (uint32_t)bpf_syscall_get_argument(data, 2);
-	res = bpf_push_u32_to_ring(data, size);
-	CHECK_RES(res);
-
-	/* Get the address */
-	struct sockaddr __user *usrsockaddr =
-	        (struct sockaddr __user *)bpf_syscall_get_argument(data, 4);
-
-	/* Get the address len */
-	unsigned long usrsockaddr_len = bpf_syscall_get_argument(data, 5);
-
-	struct sockaddr *ksockaddr = (struct sockaddr *)data->tmp_scratch;
-	bool use_sockaddr_user_data = false;
-	bool push_socktuple = true;
-	if(usrsockaddr != NULL && usrsockaddr_len != 0) {
-		/* Copy the address into kernel memory */
-		res = bpf_addr_to_kernel(usrsockaddr, usrsockaddr_len, ksockaddr);
-		if(likely(res >= 0)) {
-			/* Convert the fd into socket endpoint information */
-			use_sockaddr_user_data = true;
-		} else {
-			/* Do not send any socket endpoint information */
-			push_socktuple = false;
-		}
-	}
-
-	uint32_t socktuple_size = 0;
-	if(push_socktuple) {
-		/* Convert the fd into socket endpoint information */
-		socktuple_size = bpf_fd_to_socktuple(data,
-		                                     fd,
-		                                     ksockaddr,
-		                                     usrsockaddr_len,
-		                                     use_sockaddr_user_data,
-		                                     false,
-		                                     data->tmp_scratch + sizeof(struct sockaddr_storage));
-	}
-
-	/* Parameter 3: tuple (type: PT_SOCKTUPLE) */
-	data->curarg_already_on_frame = true;
-	return bpf_val_to_ring_len(data, 0, socktuple_size);
-}
-
 FILLER(sys_sendto_x, true) {
 	/* Parameter 1: res (type: PT_ERRNO) */
 	long retval = bpf_syscall_get_retval(data->ctx);

driver/fillers_table.c

@@ -47,7 +47,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
         [PPME_SOCKET_LISTEN_X] = {FILLER_REF(sys_listen_x)},
         [PPME_SOCKET_SEND_E] = {FILLER_REF(sys_send_e)},
         [PPME_SOCKET_SEND_X] = {FILLER_REF(sys_send_x)},
-        [PPME_SOCKET_SENDTO_E] = {FILLER_REF(sys_sendto_e)},
+        [PPME_SOCKET_SENDTO_E] = {FILLER_DISABLED},
         [PPME_SOCKET_SENDTO_X] = {FILLER_REF(sys_sendto_x)},
         [PPME_SOCKET_RECV_E] = {FILLER_DISABLED},
         [PPME_SOCKET_RECV_X] = {FILLER_REF(sys_recv_x)},

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c

@@ -8,53 +8,6 @@
 
 #include <helpers/interfaces/variable_size_event.h>
 
-/*=============================== ENTER EVENT ===========================*/
-
-SEC("tp_btf/sys_enter")
-int BPF_PROG(sendto_e, struct pt_regs *regs, long id) {
-	struct auxiliary_map *auxmap = auxmap__get();
-	if(!auxmap) {
-		return 0;
-	}
-	auxmap__preload_event_header(auxmap, PPME_SOCKET_SENDTO_E);
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	/* Collect parameters at the beginning to manage socketcalls */
-	unsigned long args[5] = {0};
-	extract__network_args(args, 5, regs);
-
-	/* Parameter 1: fd (type: PT_FD) */
-	int64_t socket_fd = (int32_t)args[0];
-	auxmap__store_s64_param(auxmap, socket_fd);
-
-	/* Parameter 2: size (type: PT_UINT32) */
-	uint32_t size = (uint32_t)args[2];
-	auxmap__store_u32_param(auxmap, size);
-
-	/* Parameter 3: tuple (type: PT_SOCKTUPLE) */
-	/* TODO: Here we don't know if this fd is a socket or not,
-	 *   since we are in the enter event and the syscall could fail.
-	 *   This shouldn't be a problem since if it is not a socket fd
-	 *   the `bpf_probe_read()` call will fail. Probably we have to move it
-	 *   in the exit event.
-	 */
-	struct sockaddr *usrsockaddr = (struct sockaddr *)args[4];
-	/* Notice: the following will push an empty parameter if
-	 * something goes wrong (e.g.: fd not valid) */
-	auxmap__store_socktuple_param(auxmap, socket_fd, OUTBOUND, usrsockaddr);
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	auxmap__finalize_event_header(auxmap);
-
-	auxmap__submit_event(auxmap);
-
-	return 0;
-}
-
-/*=============================== ENTER EVENT ===========================*/
-
 /*=============================== EXIT EVENT ===========================*/
 
 SEC("tp_btf/sys_exit")

driver/ppm_fillers.c

@@ -2353,65 +2353,6 @@ int f_sys_send_x(struct event_filler_arguments *args) {
 	return add_sentinel(args);
 }
 
-int f_sys_sendto_e(struct event_filler_arguments *args) {
-	int res;
-	unsigned long val;
-	int64_t fd;
-	uint32_t size;
-	struct sockaddr __user *usrsockaddr;
-	unsigned long usrsockaddr_len;
-	struct sockaddr_storage address;
-	struct sockaddr *ksockaddr = NULL;
-	unsigned long sockaddr_len = 0;
-	bool use_sockaddr = false;
-	char *targetbuf = args->str_storage;
-	uint16_t tuple_size = 0;
-
-	/* Parameter 1: fd (type: PT_FD) */
-	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	fd = (int64_t)(int32_t)val;
-	res = val_to_ring(args, fd, 0, false, 0);
-	CHECK_RES(res);
-
-	/* Parameter 2: size (type: PT_UINT32) */
-	syscall_get_arguments_deprecated(args, 2, 1, &val);
-	size = (uint32_t)val;
-	res = val_to_ring(args, size, 0, false, 0);
-	CHECK_RES(res);
-
-	/* Get the address */
-	syscall_get_arguments_deprecated(args, 4, 1, &val);
-	usrsockaddr = (struct sockaddr __user *)val;
-
-	/* Get the address len */
-	syscall_get_arguments_deprecated(args, 5, 1, &usrsockaddr_len);
-
-	if(usrsockaddr != NULL && usrsockaddr_len != 0) {
-		/* Copy the address into kernel memory */
-		res = addr_to_kernel(usrsockaddr, usrsockaddr_len, (struct sockaddr *)&address);
-		if(likely(res >= 0)) {
-			ksockaddr = (struct sockaddr *)&address;
-			sockaddr_len = usrsockaddr_len;
-			use_sockaddr = true;
-		}
-	}
-
-	/* Convert the fd into socket endpoint information */
-	tuple_size = fd_to_socktuple((int)fd,
-	                             ksockaddr,
-	                             sockaddr_len,
-	                             use_sockaddr,
-	                             false,
-	                             targetbuf,
-	                             STR_STORAGE_SIZE);
-
-	/* Parameter 3: tuple (type: PT_SOCKTUPLE) */
-	res = val_to_ring(args, (uint64_t)(unsigned long)targetbuf, tuple_size, false, 0);
-	CHECK_RES(res);
-
-	return add_sentinel(args);
-}
-
 int f_sys_sendto_x(struct event_filler_arguments *args) {
 	int res;
 	int64_t retval;

driver/ppm_fillers.h

@@ -40,7 +40,6 @@ or GPL2.txt for full copies of the license.
 	FN(sys_accept_x)                     \
 	FN(sys_send_e)                       \
 	FN(sys_send_x)                       \
-	FN(sys_sendto_e)                     \
 	FN(sys_sendto_x)                     \
 	FN(sys_sendmsg_x)                    \
 	FN(sys_sendmsg_x_2)                  \