Commits on Jan 23, 2020

1. Socket dataset: Workaround for bogus dereference in kernel 5.x (elast… …

   …ic#15771)
   
   This is a tentative workaround for the problems in Auditbeat's
   system/socket dataset when run under 5.x kernels.
   
   On older kernels, we could rely on dereferencing a NULL or invalid
   pointer returning zeroed memory. However, seems that in the tested 5.x
   kernels is not the case. Dereferencing a NULL pointer returns bogus
   memory, which causes some wrong codepaths to be taken in a couple of
   kprobes defined by the dataset.
   
   This so far seems only to affect udp_sendmsg and udpv6_sendmsg, which
   caused it to attribute traffic to bogus IP addresses. In turn this
   caused the test-connected-udp system tests to fail.
   
   (cherry picked from commit 0dab517)

   

   adriansr committed Jan 23, 2020
   Configuration menu

   • View commit details
   • Copy full SHA for e28e15c
   • Browse repository at this point

   Copy the full SHA

   e28e15c View commit details

   Browse the repository at this point in the history