diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index 9026e222e..59a821faa 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -7,6 +7,8 @@ Copyright (C) UP9 Inc. #include "include/headers.h" #include "include/maps.h" #include "include/pids.h" +#include "include/log.h" +#include "include/logger_messages.h" SEC("uprobe/golang_crypto_tls_write") @@ -22,14 +24,14 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { // Address at ctx->rsp + 0x20 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe __u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x20); if (status < 0) { - bpf_printk("[golang_crypto_tls_write_uprobe] error reading key_dial: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL, pid_tgid, status, 0l); return 0; } __u64 key_dial_full = (pid << 32) + key_dial; struct golang_socket *s = bpf_map_lookup_elem(&golang_socket_to_write, &key_dial_full); if (s == NULL) { - bpf_printk("[golang_crypto_tls_write_uprobe] error getting socket"); + log_error(ctx, LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET, pid_tgid, status, 0l); return 0; } @@ -49,7 +51,7 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)ctx->rbx); if (status < 0) { - bpf_printk("[golang_crypto_tls_write_uprobe] error reading data: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_DATA, pid_tgid, status, 0l); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); return 0; } @@ -71,7 +73,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { // Address at ctx->rsp + 0xd8 holds the data __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); if (status < 0) { - bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA_POINTER, pid_tgid, status, 0l); return 0; } @@ -90,7 +92,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)(data_p)); if (status < 0) { - bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA, pid_tgid, status, 0l); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); return 0; } @@ -111,6 +113,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) { __u64 key_socket = (pid << 32) + ctx->r14; struct golang_socket *s = bpf_map_lookup_elem(&golang_dial_to_socket, &key_socket); if (s == NULL) { + log_error(ctx, LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET, pid_tgid, 0l, 0l); return 0; } @@ -124,7 +127,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) { __u64 key_dial_full = (pid << 32) + s->key_dial; __u32 status = bpf_map_update_elem(&golang_socket_to_write, &key_dial_full, &b, BPF_ANY); if (status != 0) { - bpf_printk("[golang_net_socket_uprobe] error updating socket file descriptor: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR, pid_tgid, status, 0l); } return 0; @@ -142,7 +145,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx) // Address at ctx->rsp + 0x250 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe __u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x250); if (status < 0) { - bpf_printk("[golang_net_http_dialconn_uprobe] error reading key_dial: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL, pid_tgid, status, 0l); return 0; } @@ -158,7 +161,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx) __u64 key_socket = (pid << 32) + ctx->r14; status = bpf_map_update_elem(&golang_dial_to_socket, &key_socket, &b, BPF_ANY); if (status != 0) { - bpf_printk("[golang_net_http_dialconn_uprobe] error setting socket: %d", status); + log_error(ctx, LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET, pid_tgid, status, 0l); } return 0; diff --git a/tap/tlstapper/bpf/include/logger_messages.h b/tap/tlstapper/bpf/include/logger_messages.h index 69954f43a..51d70dd59 100644 --- a/tap/tlstapper/bpf/include/logger_messages.h +++ b/tap/tlstapper/bpf/include/logger_messages.h @@ -26,6 +26,15 @@ Copyright (C) UP9 Inc. #define LOG_ERROR_PUTTING_CONNECT_INFO (14) #define LOG_ERROR_GETTING_CONNECT_INFO (15) #define LOG_ERROR_READING_CONNECT_INFO (16) +#define LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL (17) +#define LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET (18) +#define LOG_ERROR_GOLANG_WRITE_READING_DATA (19) +#define LOG_ERROR_GOLANG_READ_READING_DATA_POINTER (20) +#define LOG_ERROR_GOLANG_READ_READING_DATA (21) +#define LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET (22) +#define LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR (23) +#define LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL (24) +#define LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET (25) // Sometimes we have the same error, happening from different locations. // in order to be able to distinct between them in the log, we add an diff --git a/tap/tlstapper/bpf_logger_messages.go b/tap/tlstapper/bpf_logger_messages.go index bfcf84138..3c452193b 100644 --- a/tap/tlstapper/bpf_logger_messages.go +++ b/tap/tlstapper/bpf_logger_messages.go @@ -2,7 +2,7 @@ package tlstapper // Must be synced with logger_messages.h // -var bpfLogMessages = []string { +var bpfLogMessages = []string{ /*0000*/ "[%d] Unable to read bytes count from _ex methods [err: %d]", /*0001*/ "[%d] Unable to read ipv4 address [err: %d]", /*0002*/ "[%d] Unable to read ssl buffer [err: %d]", @@ -20,6 +20,13 @@ var bpfLogMessages = []string { /*0014*/ "[%d] Unable to put connect info [err: %d]", /*0015*/ "[%d] Unable to get connect info", /*0016*/ "[%d] Unable to read connect info [err: %d]", - + /*0017*/ "[%d] Golang write unable to read key_dial [err: %d]", + /*0018*/ "[%d] Golang write unable to get socket [err: %d]", + /*0019*/ "[%d] Golang write unable to read data [err: %d]", + /*0020*/ "[%d] Golang read unable to read data pointer [err: %d]", + /*0021*/ "[%d] Golang read unable to read data [err: %d]", + /*0022*/ "[%d] Golang socket unable to get socket [err: %d]", + /*0023*/ "[%d] Golang socket unable to put file descriptor [err: %d]", + /*0024*/ "[%d] Golang dial unable to read key_dial [err: %d]", + /*0025*/ "[%d] Golang dial unable to put socket [err: %d]", } - diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index bb7e037a6..1a5eaef31 100644 Binary files a/tap/tlstapper/tlstapper_bpfeb.o and b/tap/tlstapper/tlstapper_bpfeb.o differ diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index a8bc1e191..2c2aff6d2 100644 Binary files a/tap/tlstapper/tlstapper_bpfel.o and b/tap/tlstapper/tlstapper_bpfel.o differ