aquasecurity / aquasecurity/tracee

`dst_dns` arg for the `net_tcp_connect` event is empty

Open
#4,675 0 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

The `dst_dns` arg for the `net_tcp_connect` event is empty.

The event is logged successfully but the `dst_dns` is empty.

The following is an excerpt from the relevant `net_packet_dns` and `net_tcp_connect` events.

```bash
{"eventName":"net_packet_dns","args":[{"name":"src","type":"const char*","value":"192.168.65.7"},{"name":"dst","type":"const char*","value":"172.17.0.3"},{"name":"src_port","type":"u16","value":53},{"name":"dst_port","type":"u16","value":42923},{"name":"metadata","type":"trace.PacketMetadata","value":{"direction":1}},{"name":"proto_dns","type":"trace.ProtoDNS","value":{"ID":7907,"QR":1,"opCode":"query","AA":0,"TC":0,"RD":1,"RA":1,"Z":0,"responseCode":"no error","QDCount":1,"ANCount":3,"NSCount":0,"ARCount":0,"questions":[{"name":"www.terraform.io","type":"A","class":"IN"}],"answers":[{"name":"www.terraform.io","type":"CNAME","class":"IN","TTL":377,"IP":"","NS":"","CNAME":"cname.vercel-dns.com","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"cname.vercel-dns.com","type":"A","class":"IN","TTL":2019,"IP":"66.33.60.194","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""},{"name":"cname.vercel-dns.com","type":"A","class":"IN","TTL":2019,"IP":"76.76.21.142","NS":"","CNAME":"","PTR":"","TXTs":[],"SOA":{"MName":"","RName":"","serial":0,"refresh":0,"retry":0,"expire":0,"minimum":0},"SRV":{"priority":0,"weight":0,"port":0,"name":""},"MX":{"preference":0,"name":""},"OPT":[],"URI":{"priority":0,"weight":0,"target":""},"TXT":""}],"authorities":[],"additionals":[]}}]}

{"eventName":"net_tcp_connect","args":[{"name":"dst","type":"const char*","value":"66.33.60.194"},{"name":"dst_port","type":"int","value":443},{"name":"dst_dns","type":"const char **","value":[]}]}
```

## Output of `tracee version`:

```
Tracee version: v0.23.0
```

## Output of `uname -a`:

```
Linux ad69fbfc6231 6.10.14-linuxkit #1 SMP Fri Nov 29 17:22:03 UTC 2024 aarch64 GNU/Linux
```

## Additional details

N/A

Contributor guide

Open the contributing guide

Research direction

Reproduce the empty dst_dns value using tracee v0.23.0 on the reported Linux 6.10.14-linuxkit environment, using the net_packet_dns and net_tcp_connect event excerpts as the reference. Done means net_tcp_connect records the destination DNS name instead of an empty value for the shown connection.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.