Error getting data from BPF_MAP_TYPE_PERF_EVENT_ARRAY

[YJesus]

Describe the bug
I have take this example https://github.com/cilium/ebpf/tree/f055084d26cfa4c8f2b922dae0014933b570aed2/examples/fentry and change few things.

My .c file:

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include <errno.h>

#define AF_INET 2
#define TASK_COMM_LEN 16

char __license[] SEC("license") = "Dual MIT/GPL";

struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
} events SEC(".maps");

struct event {

uint32_t daddr;
uint16_t dport;
char comm[16];

};
struct event *unused attribute((unused));

SEC("fentry/tcp_v4_connect")
int BPF_PROG(tcp_v4_connect, struct sock * sk, struct sockaddr * uaddr, int addr_len,int retval) {

if (sk->__sk_common.skc_family != AF_INET) {
	return 0;
}

struct event event;


__builtin_memset(&event, 0, sizeof(event));



struct sockaddr_in *ipv4 = (struct sockaddr_in *)uaddr->sa_data;


event.daddr = ipv4->sin_addr.s_addr;
event.dport = ipv4->sin_port;
bpf_get_current_comm(&event.comm, TASK_COMM_LEN);

 bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));

return 0;

}

my go file:

package main

import (
"log"
"os"
"os/signal"
"syscall"
"bytes"
"encoding/binary"
"errors"

"github.com/cilium/ebpf/link"
"github.com/cilium/ebpf/rlimit"
"github.com/cilium/ebpf/perf"
"fmt"
"net"

)

type bpfEvent struct {

Daddr uint32
Dport uint16
Comm [16]byte

}

func main() {
stopper := make(chan os.Signal, 1)
signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)

// Allow the current process to lock memory for eBPF resources.
if err := rlimit.RemoveMemlock(); err != nil {
    log.Fatal(err)
}

// Load pre-compiled programs and maps into the kernel.
objs := bpfObjects{}
if err := loadBpfObjects(&objs, nil); err != nil {
    log.Fatalf("loading objects: %s", err)
}
defer objs.Close()

//SEC("tracepoint/syscalls/sys_enter_execve")
// attach to xxx

link, err := link.AttachTracing(link.TracingOptions{
Program: objs.bpfPrograms.TcpV4Connect,
})

if err != nil {
	log.Fatal(err)
}
defer link.Close()

log.Printf("Successfully started! Please run \"sudo cat /sys/kernel/debug/tracing/trace_pipe\" to see output of the BPF programs\n")

rd, err := perf.NewReader(objs.Events, os.Getpagesize())
if err != nil {
	log.Fatalf("creating perf event reader: %s", err)
}
defer rd.Close()

go func() {
	// Wait for a signal and close the perf reader,
	// which will interrupt rd.Read() and make the program exit.
	<-stopper
	log.Println("Received signal, exiting program..")

	if err := rd.Close(); err != nil {
		log.Fatalf("closing perf event reader: %s", err)
	}
}()

log.Printf("Listening for events..")

var event bpfEvent

for {
	record, err := rd.Read()
	if err != nil {
		if errors.Is(err, perf.ErrClosed) {
			return
		}
		log.Printf("reading from perf event reader: %s", err)
		continue
	}

	if record.LostSamples != 0 {
		log.Printf("perf event ring buffer full, dropped %d samples", record.LostSamples)
		continue
	}

	// Parse the perf event entry into a bpfEvent structure.
	if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.BigEndian, &event); err != nil {
		log.Printf("parsing perf event: %s", err)
		continue
	}

	
	fmt.Printf("Dest Port %d\n", event.Dport)
	
	ipfixed := intToIP(event.Daddr)
	
	fmt.Printf("Dest IP %s\n", ipfixed)
	
	
	comando := string(event.Comm[:bytes.IndexByte(event.Comm[:], 0)])
	
	fmt.Printf("command %s\n", comando)
	
	
}
<-stopper
log.Println("Received signal, exiting program..")

}

func intToIP(ipNum uint32) net.IP {
ip := make(net.IP, 4)
binary.BigEndian.PutUint32(ip, ipNum)
return ip
}

As you can see both structs in map and go are equal types:

type bpfEvent struct {

Daddr uint32
Dport uint16
Comm [16]byte

}

VS

struct event {

uint32_t daddr;
uint16_t dport;
char comm[16];

};

But the data that I get isn't reliable

To Reproduce

$ telnet www.google.com 443
Trying 216.58.212.164...
Connected to www.google.com.
Escape character is '^]'.

--> the program prints:

Dest Port 55354
Dest IP 212.164.0.0
command telnet

Dest IP is cutted and Port isn't correct.

go version
uname -a
cat /etc/issue

Expected behavior
A clear and concise description of what you expected to happen.

[lmb]

Hi @YJesus, I've converted your issue to a discussion since this is unlikely to be a bug. Your markup is messed up and it's not possible to read your code, maybe something to fix.

P.S.: Showing which changes you made to the example might also help.

[YJesus]

You are right, my mistake for the bad paste :(

I attach the code
test.c.txt
main.go.txt

[YJesus]

Meh, again my mistake

struct sockaddr_in *ipv4 = (struct sockaddr_in *)uaddr->sa_data;

Must be:

struct sockaddr_in *ipv4 = (struct sockaddr_in *)uaddr;

shame on me !!