From fa0e9f8fa95681404f2cf0619157f4f20aef9433 Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Thu, 2 Jun 2022 04:18:54 +0300 Subject: [PATCH] Read constant 4KiB --- tap/tlstapper/bpf/golang_uprobes.c | 7 ++++--- tap/tlstapper/tlstapper_bpfeb.o | Bin 126056 -> 126064 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 126056 -> 126064 bytes 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index e9519c7ef..eb2d3845e 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -9,7 +9,8 @@ Copyright (C) UP9 Inc. #include "include/headers.h" #include "include/maps.h" -#define BUFFER_SIZE_READ_WRITE (1 << 19) // 512 KiB +#define BUFFER_SIZE_READ_WRITE (1 << 19) // 512 KiB +#define CRYPTO_TLS_READ_LEN (1 << 12) // constant 4KiB is observed struct golang_read_write { @@ -84,8 +85,8 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_crypto_tls_read_uprobe b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = false; - b->len = ctx->rcx; - b->cap = ctx->rcx; // no cap info + b->len = CRYPTO_TLS_READ_LEN; + b->cap = CRYPTO_TLS_READ_LEN; // no cap info void* stack_addr = (void*)ctx->rsp; __u64 data_p; diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 7d31caf6d50726ea1085dfe4e3cbcdb8620b7897..d7792447b49742811fc9cf2b5f1f0f0b435b0985 100644 GIT binary patch delta 5233 zcmbtX4Qy1$5uSN>4hBqpU>pCP@iRVy2@W>YF;|S?D0b=)CtN6r9H8KU)0$#|t2Wg& zqPinNs;f}d)uBF%Hm%$IU?{4LpgK!|)DPXwQ>)p`p*0{<~e2b7uOv z)-pbHrsX#my!>o@_ABMl&vHab^ksQj@*-*=D!S+;%7R=C`7-*|qJaD#ZSMK7xxW%AKPiXea+=<6H&$KFSO3RgXJx67|##6JU>FT`1dp9x6Xh#!r4KLhWZ;qvTpPc9Vky_h`Q%b=iZ44^S%od7QhUi0kay$hz$3Dxe2i#G zXZ$-S3%M))W6atgKYg;Y_H;q@qmf4Xop5?Br^HNO=pc-e*9 zh$`o~aG2;!;k!MLu8d$%3Og4p<|c>^27qw^DSQ>=Ed;hT_F=rw84hsyhCaEQI?V7M zqCuEYj|(pYhHr7>6a7-)mpN3cx4=(yD-YO^Fkkej3kyD!zJX{` z^jPW)Mm)2ZqCfl)m5SFA`6S|ACD8!x~2mu9KBh1A`G` zAXuu=kf`*ij}(WHbeq)n3;iesEPxFc3!fn?U&_#MvG8Xo4d7I|gJY{29INXrpH?Vm zLR#VdWYr7G){c=4R!}(eX^W#GuadPxjw56&KOn195;LqZII%ih ziCp+EvbyCq?a0taG{$LJhvhg^9H-{@Ykie6kn z=s63Gf20)Lx-D}|ztr*{*;-}Se6+42hD@2`gW5dr3Mhy9RBG}`_ z@3;b*rE;=(r}Ni)`PW^karuOgYCA}}jcHu`JKXWI_etaDAkksiONofzS(PYH#ARFK zEYL6@`f4-(HqlGY_zG^%hIO$*p;`{M1C`*1&sltN*~C(K4)BDYo6^fwE3r!OoP#Vk zr(lWoI$}vGDgAGerOs%rj#Z*iT^$Ga!Zy`BF>MQ8X%w4KUr86QrOj$`N)l4a|V zDgqHfu%u|Op>hTrDg{f5_8BV6{6gigqBG;dWm5Yodj^Fi<%^URy}~|Vq>;kMh)zlQ zkGpU#@TAKg^QGjJ{V>u{xUSP!((0UW9Ync^!J=8tXDfNrY%SwvbdbRTr+XDwZj&*| zr6dSYzo<4M5Sp?*s$!-Qa65y5+ZhB*rxWm?_z_~Jg@94*R|Sxl+3=#biESI$Y|w+` zsuuexZC`E^*TiFEtM3tS<+d}gp4T)e`5VL`*}Cym{xWf^1#CQl3JwbuDNmQ3AJ+3G z?dP)d7W}9qLM+uhAsrEn@CX?3v}$Y@5_h4>JRL5KIG!GZHxu_Djwh0VdkyX(K8(cn z3>f@8zU*HG9>T|5He#m?hFt~{VBFyMiGPV}*E6B&tiw(cB9|sG&S%x#bm`c=YQkpHum z!-*|TToud0EMA;Ac%Juh7L2(vaqBg1+mN@b@d%cN)zwm)P{*&Xo#;a$4LaOcSaKeBbc6zVz zdY*EU(iJ(`*U?3sR_TIHuXO!RQo430djj3C(<)uW>6LEGNlMr6WdB|3q)R%z(oHx? z>870Q8|d1dR_TVFUg;1|x`>l~Qw_FChj=%6-JCA)A?@1(&ge}nanQ-W#p`EZ)1x_W KIDLQPqW=On*z*_w delta 5260 zcmbtXeQZ*O!5?U1W509nb^08w zld4|j`QG0-=bdxz@11ks%XoImSawRPiF?mB54;rkW(Q3tjPF)ZyUaVDCBK==&fR;d zZ8mQ?xBmD=FKnl16B|o@h+2p$k9vuGST|zbk9oN$u)c(!Vq6hiU&AHx zB;;AlU%)kl^%cyJGp5Q93-F5(#(GR77$SeIOnoW%WRe}SK*e|T!)`i$|s*5&yTqB)iD?18KjfBl&M z2Xk{48+kH)_C#sg-|OAF)OdT;z(nw z@wS<$p)UQ8-ipK$_$|R@Ln3>Xbp+P~W*vk4VY5zRz41W+j3;p6p*L)ugm+EC@kuz9 zkLwzao!ARM(i1Y4 z5zQRKoWmiaD%nmBx1v{WyYOlh_%B^}9m-N3LC(Gnh1KuE8&M9UE*vE~x9+!{Pb}RJ zp|ooe9(PfOC>{jHaiZ{5q60I5ZH@hqA9DT@yz@eZOBFriKto(~*%;d#JG z7k1V+z)de&hz5=L8d3jL;9-OB6Ab|K5siznhf9KuzW8;RI&Z*DB0C-8QDb(I=n4|$ zF&CZ&JZ|s@M1QW*C!uVz1P^4a6xfhZEP7P91s_U}v+{=Mk?I6SJj*tC6D4R|3>qf{ zG%g0s2Ja-g+XftV;RayHltaN{|@mx!8f}3(&7;<0fG~z`9 z{0S`pK^zhSBL=@t92RT>6Gm+*i~FNHUx zaajRzY8~R|N=6AlEoEH>(nez%mw?)SP%B*`6biM20AbWK6_aX?Y7B;~r(M-w@f)%_ zq`hL3^l^>xh^?eNb458eoV)*s);A~vsevBX4U&1U3p>v&;8}@^>tuDIF1bLfgsg5M z%WSf8HCcxQ-_?2{>ot(2UI|TbiBYu_SDQ*#ktNu|ciGMvP{PjyMhy8<5$y5eldhbm zsKTvU>ilN`|F|P3m$&(dw!=z~tj1N}!;3)nK5qORAnJlWQc`}W)T4(Hmu-!GprJ?f zjpqJe;0@vYdkMD}NY)BH)5PI+plbMis~EN>mcoU=WBT5lUe0IPLp82Ha9#;Z3|v$1e;K=Ru`|cD%958ys|f+SN0+Y7q2{B zYDeXuX#EPpfo`7ue`uYxnK+P7D+lvw<#0Z&9C6V)>!|auCH#~Rp|IT6#I0Mg1Yx|T zIFC@?l2548=LnrOj#E3IP~PbxH1K)nT9b}~<%VW%{RAqx6I80Nl3Go4;19!pHfh09^>XZ9vEmb5QQR`d${fl)>Zzksg^Y5!3d zE&?8R+2ej`Ic5I?l%a6ltg)2UJHmAs?V=3+;FK)m4O8_R2c?4w4mt;yas4)tNi7Y7 z0QDKR7J)ECK4+JTnMc5#Nd(-PM8Lg#0v;1TLd-oOU_|>>0p!PQc+PQR+Xglp^c+C@ ziTz!Z$8CHrq~FXge?Vn*+gT9e6)m!^X(o=y){Uncyw}?-VB-l?a8#%;o@)A?S3|r( z`N8@c{HRBSSZa78IwBb1Au!@;)3^pNwT>p>m1m+u*gtT_`6{ zkHOoC4?he%fG+^qh@CSSbQws1QG@%4U&FEM8Pm9M7jbVju-T~nE^&`wvr#fbT3!4r zdmA7Beiw$$Yllq$lYqC;V0<_9i$PRlVe&2P(A%zY?P6zJ3vW|QVtu}amv8Dv(4Y=1 zF>CSKK{$8$SY`R;W8t$$9Ytb~GO+^r<&*0lD}d0s@~L}}tVPlvV>%V|j}?-BGF&Ju zfejb4U%&?}?D0HxI|wcUMr?_TQ^$HpP95Acf#uY(@$az+askm$8ZRMhom8FS0^C>| zks!y6{zd1Nu&J`T7o88W&h?qqjx6d%iD(Tj4Dny@BP%JuB!q*;>Y7AU*Ce72iElp*%JE0$S>5(sb!ZckUc^c7FuBPyW&_v!!6Yvaq774aBCNsRv z8l$N^A?Une7shk)wrQM8AlF0oRq}*IA2$I|IGzZ0UkKV+H;>*|#pedV|> z^ZZI~NcsrO)@Ba>jQ6lFj&)tedx2ZoH-vS4X5A29w|s+G2Q#6IvL3*?Art&LPqTbr zi05WP!@SU|{LIVj{57{)J|xPGnG^4^R}Kmpdt#ZM%lw^E>o7TyQJ(2EeZ+R*yGGe* zg!>@mu#@_TSM#VdA`?0Ozha6xQJHKfB~#KFktyQ%$1wFcQJG>+N~R%aM5d(U|C`py zG~lFU8gWKs8g=~FFh!iGOg&CYCd88|=J>BGVN@o>yUwc$ccHRnJU`%Muk&);;=cjy KAD!q8w*L#F3pHo} diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index f1901b01e9c2ae10647fb9cd439d021397593e0d..10eb7b47230b821035c68690a316b1ec202ec7a6 100644 GIT binary patch delta 5360 zcmbuCe@vCv8ONXV-V0phUcCweQjiw`!5@_$0#fk@RBWlBV5c35Q>JLOBTBko%(&c3 zYdW)a3ClG*#w{D$YJ1BXgVE)Zw01Zf$6C|aHR-OcSxMF?v(&K7EuT=RN21JkNd3d7t-r&imf+Xv$|-r#WEfcfRz|IhXNuzv)<8$rJn`r#`p0-r#_o8AP8ZpLGn zY+g*{Lf{amSp&BlHg@3nxA5cR@sNSvW84cp`+l5-Rx`F>yigF^b>*ziolhlk+lRvW zNB#&G?7G=@j972O{LYdux9zR)F%2K=yA|`+(7kY0pre>*0mww}((`)ElhIk;iGEDW zgP4C0bF{hJae*g#ZU!RKc1kZ$g~1YWG<1HjaM8D5iQAY5CGF)4 znj8JZ#k+$>MsxSUqvm>Z)04Z}cC_x>(ejmjPi}5#+}E;sTOFBb`ybwL;OjlJSeRvH z=Fwv&8yq=$=ve5JH_cGr>-iU-`2C9ulDyBLz(OCs_j=%GD0U7cw@UPdS#hoc*IA{< zYN|swt$IW4SXb-)IJ=trWu!>tH}qQ}=ARva*bEc(Xfx(zV0cz;m`lJx2d9N)Rx#YX zMl`I&cVU(~L^P`T0rMrIGYAnc(}G8t3gxKg-!Na7--VmNEut|kz6!B_jA-1!Y2ZoC zA3(oo9BZJQ*=;UTJ$(W}(9HS;(EByluzr##+reJ2sd+2(f%N-Cr4E4?T&}qb22ImM zwGJ)@H#vANxLxxF*e7KR>e2j9Y+Mux`V8_6?3){JJS`oQa=~wvKs-RTg6g$_3eY-1 zO`6r?Y!TF^xdRTe+61*b*bDB|tRmGe=&*wqfbHkni{E=Y1)gib+R<4SbO}18fA9`C zeUG4i%__gT1)b4+8~Vq41%)-+8ys@zGoT;QT#egrJS}1w!dwiFVto|>7R-fUT(b)0 z5XaBbt5Cinhzk$3rW%Lx5}5PKgMnFXE+BL&^)P+(!o6p$$NvexE~Y>3<5&nv6&GJUC-27TEyV26kw#@dDF= z24*-I)_e#0m0lwjTILe)s6(Fyj%voB+9a;L;aq%~WS~S!Rb)Gfjzf@|VQ@k!gP$;? zX6!0Zp+|}E8OPD)#*V7_IaC?3(5oClsra@22hcY+%D^&_6X1D9qY(?cdQ5waSkym) zeo>bZi@FL*rx8o=&!Jz~ZNw7X*4t56kNKn#%U@fsgIYptumT1HdUNWrgToF^J1I9V z$7Zv$k&CBrV>%!zKriCPG^$IX9Va;aKo> zS%{%sVNflKE9-xYo_7N0q~;TBe-eQG zvA!?`>z*MpHLpm5egMaw=KHXzc!}iLDzP(-e_#vh%S3et3%1~kasDMD)P?fMJO@1P zVAgwZhitzWde0ly!OE;we9JmmnSTv^^(e_3WqL(hP+l&okFbT^g18rE6=MW|U!=|$ zH-h;_6JqREN2~fB$J_%>h_Tl?53CR$WcMn>5YHCk6IdoMS0siQCp%VF%cv07io_7t z;~3KVYx2WYq9ciyx+d3_iMpLURbkzMQ_vB{IpBn_g6**8<>F@cz^e|k3M)=+u2lB7 zU%p+YSJ^L@my5b*SZcR~Q1%G*4N{<$xp_nz&}C-C9_J`emqpg z^5f;=7Xe$I4Edr7R!HCh%ITXOu>g$#Ry5Ha)CTjDT;QpRAm$P$DduBunaerp9b@~9?dEQ z_h*CvoDhQPgb*~dAC*p!-_U+AsAk{tyI99Gt#o30Rk6sGDOfR^`PlVJ5ei1DlP#8M zRbp*5&%Xwp52?jT!+Z{GG{KiM9BuHW`KCNxC7P4i^rn2fO4O-`q&GzMs4rHjh>YNi zLvxmiIy;On3I`kD9?h-LC->mBH-k@U?ty;(Nxa20{|Nl(X+c9Sd~)!Dw!yH&z<|M+ z=D*+vbAOIn(ERiqqMR^pQ}aFOa|Upmnn^d0+qxmPH(~F0um^0q*H{Mj21>Pow*b%m zHN5yWtF*d=Z!FEb<=Pq)7w>(yJX<5yY`ckH6zOGI`~b`!p9$H67pos))~mA!oRB@a zc+o2Ti~@q(&Yrp@D3Fzg`Zi)es-W=Voz#9+L4ob;Q3b`{tU3dj=Yc(%)v>eAdY`dB zb((`sK{aZl_JXJ=#U0pyuMux!%_=l4cpGaD%V%qKiiPDLFpU>kyP^KOG+?XTc)7|# zOoB7QgjaDwn7|2P!t2)&rg)J-Zih)NfJ;=b(~WfshT~yUMK%%-(`D!@-!iz!)KQ^X z`m02B9dGmt82F<2lG3-?h=*;A!J#t@)Qm5WULH&a%d3K$y zsww&TI|Wkr#PN5tO@-$+MX zRvgK@%Ch0TaoN&{@0xHKz8jr!SxF>sR1~^>o`Z2&X=LklvD)ypJsp=Vi~RUq;c`a? z{wxlsiz_nqwpf#T?>)<)Q$7I{ZL;sS*eIst6&|vsxPzfrHt#_JYYQ@dZqYO2^)C8dKgkY Zhmo^r1M*LwVuxWVCZN168zw}_{{YxT@NWPB delta 5383 zcmbuCe{2-T6~|}x&h{O?GY57!x0ghk6j!g^|1UDdhjrn0BO5BvR zu7Y}31yN{`YV{HgR5Ueeei+N8MnpO{NrfX&W0W=_w2Dp@Dppek7fi8Aq#^~Ce&6id zyFE+(qsmBoGoSa~zL|OZ-p<}+B5OR6)mtI^&o7F<{OEU&`UJHfe5XVAopS=*=Uw>n z$+_(h4?$hXr4y=j9X*r!8n8qE%y4GMNdD39Hzdh~H#Y(QTNJ^9{9LaP~1qCc`Ax$0%pI(I&m^kwhupTGYXa6ztH zZO4f9Qy9Nf{MDAd2|hlC5AxlPadGTl{lUo6G9hMzOk52-4q=>$i{xQkYgrz}xD8{p zoGti)C$Vh`@0-FsQ@A&si^Xf{0&#WDh9b75guK1F?kzC1u46 zQ)yp`@v~T57}qy&Q8`3$HN*}M1Z7j~=s>w#6FWChGIt{^v5lEfie2=B=El{2;nskW z7h8QXf5Ed=t2)2cZLTys5A{^7dZDwY$*it64?b^_bpOG<&&LkGTYBMp7f;O2D11(c z&9SU&??w)ygeg4Kmf;#l5!+k`&Y7FyCh$G03NR94HLfdG?rL6--?di0X>P{v;DXfs zZQwEM!D{_xAug=>^9x%dhfvj!v}1R1T%|oi&JVgudzsPcb`rld!K=6-zh8)9=38Lzpb(?X z4~d6_IEg5deH)&s_cHX%zb1z9Rc724!G+fz3(mv9mq4VLFM$Ks@njsF4W4BF6#BXU zfCIytun^UdJC2AllYTbz0p=B?pTH)PjQM>Km@L>t29rWmIM@fSVcrdW^L-&29b5)( zc5n{3gZVt{GxDV9X8t!8E=?)!K>i5roc2$l%Fe~0QYN3h4qcrTA=c~AHA>OUtaGDT zip|VBaDT8(iVg?+z+q+`sjX6UIe0cW(#?V%ILPgg$>h+X+9^ep^~65#G3FTTePNl* z6`j0YQk-P{@1Wm!NQ!=Dd%;5vecmA%5hE<{pc>cr%49MTmw^)weGYh>S%-Fz;%P-t zhjv&Bs_GzYs8M8p3>KGVvdZ*AkdYNykN97MLD64ivaE=gfE(EXaVa?D;B2rRdWdzi zLoe}Q^O4bZWObEXPeu0Y(B~q9qqwU*f)(zEAUKf+R5gA?EgIk4L#2E=!10X{=iaA-H-#pp#1)iCcS&I3EMy427w zP>MD+^5dcB03#2x&XGDJndHv|amKfX)agaCAOaA1AtM=f{hUxoA-?$>^mD^TGVD4k zJB?(<{|Wj>x{PGT+xi~9Uq9xkkxXD)&rvPcd9VZqeU2MS!Tk=-j;fuDvDn*~EawPz z=8VuW?2LJJJ|c9&5O_*D5;{3g8~RA8hCgbxI9{4@(TXWT#Mco~|8DCDu-OBKJFR!S zu*m~B_-ja@zFaJSwTJ9To_PRoR<=W@TLQnN{~@j-93}LGi4T+g5dhXlT#|)(5ebud zNe1+Ncn>mvpdK!fJ2J@h1NF^H*|d#@MK};=y=}d|ZJq%h=euk@a!t=t3wzId*4vfr z^(>dIw=40B>TV^^@}g?5l1=+bYPTrXOsr#xjnZ-KjAigqva|}F>~t*M)+^O!4>&EB zKCAAhh7#iGLfMXKiV9_VC`++p-n0&7qf8HF2=5!#pHlx>%9}i;wpTktxfO3aN9bmN z(?SWhLph06c($L_o~2%GtdUL6O&iK?slQ|vaGdWJ;-MA+kRFtl z#5$D6thBV*1Ex?C>$L2(zD({Gst1eZYY|(X3Hd17ZGzumzm=w>Ck}uqO^Lq^o`VmH zF$d2CPfod?%8cxP3VS~ij$TZ}ItuUMc$Okd3;tT90?Xu+nWV%xjPWxx);WY#(I?wF zIHyMPePEi+!>l*{#gvVM(>DGfZR4%vN7p0dSJ@9b-RzB?!91pEB@x-{dPIiYhZXTX z=xZxw>^F&ez4m+aR7IV9te$i=^Ra0p6r~Dr57=miFJ}-o!x!_QQgyO5gG>k2%{tkn z9}O=^giuwa(h(WK2L|&kc&+Zj2ZVzSa5rllgt<3;M84X2H$l=0^#86ZQcId%&i< z!7{KHP{9T_;Lw8)ip|VAncl`H6?2u^z5*phYp+uA6|&(e`oJ&cX-RwyOy8Pm*@JU3 z05Rz)n>^sO>?y=Ks`XRK268)la*9zFl{jD7k1iveqmvE}fbHzjWkjE-oB_l$!5(J) zUVhvaQxIY`Tbn^ikkJgZ1BGSiDlBQwg6?LI{vv_EyvUq>V)#%L>E>q z)S2oyby0PNx{&gYqw7;G)P>b?>PFNR>Y~c~PfJJLkUCD?Rdt2BG3C95E~Hwh>r=<6 o!+g|*mG`z5wor%p(0M2KA#u@$)F-#G!an7lfbwsuWkQz!54c||ssI20