From fbdbe1a9f19c39b2ee709dfb9ce3365a2e050434 Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Tue, 31 May 2022 00:49:57 +0300 Subject: [PATCH] Change the read symbol from `net/http.(*persistConn).Read` to `crypto/tls.(*Conn).Read` --- tap/tlstapper/bpf/golang_uprobes.c | 13 +++++++------ tap/tlstapper/golang_hooks.go | 6 +++--- tap/tlstapper/golang_offsets.go | 2 +- tap/tlstapper/tlstapper_bpfeb.go | 6 +++--- tap/tlstapper/tlstapper_bpfeb.o | Bin 125344 -> 125400 bytes tap/tlstapper/tlstapper_bpfel.go | 6 +++--- tap/tlstapper/tlstapper_bpfel.o | Bin 125344 -> 125400 bytes 7 files changed, 17 insertions(+), 16 deletions(-) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index 8c979ebc3..079449029 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -51,7 +51,7 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { __u64 pid_tgid = bpf_get_current_pid_tgid(); b->pid = pid_tgid >> 32; b->fd = s->fd; - // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_net_http_read_uprobe + // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_crypto_tls_read_uprobe b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = true; b->len = ctx->rcx; @@ -69,8 +69,8 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { return 0; } -SEC("uprobe/golang_net_http_read") -static __always_inline int golang_net_http_read_uprobe(struct pt_regs *ctx) { +SEC("uprobe/golang_crypto_tls_read") +static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { struct golang_read_write *b = NULL; b = bpf_ringbuf_reserve(&golang_read_writes, sizeof(struct golang_read_write), 0); if (!b) { @@ -79,15 +79,16 @@ static __always_inline int golang_net_http_read_uprobe(struct pt_regs *ctx) { __u64 pid_tgid = bpf_get_current_pid_tgid(); b->pid = pid_tgid >> 32; - // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_net_http_read_uprobe + // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_crypto_tls_read_uprobe b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = false; b->len = ctx->rax; b->cap = ctx->r10; - __u32 status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)ctx->r8); + // Address at ctx->rbx - 0x2bf holds the data + __u32 status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(ctx->rbx - 0x2bf)); if (status < 0) { - bpf_printk("[golang_net_http_read_uprobe] error reading data: %d", status); + bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); return 0; } diff --git a/tap/tlstapper/golang_hooks.go b/tap/tlstapper/golang_hooks.go index 4f4a5537f..4c439e39f 100644 --- a/tap/tlstapper/golang_hooks.go +++ b/tap/tlstapper/golang_hooks.go @@ -62,9 +62,9 @@ func (s *golangHooks) installHooks(bpfObjects *tlsTapperObjects, ex *link.Execut } // Relative offset points to - // [`net/http.(*persistConn).Read+92`](https://github.com/golang/go/blob/fe4de36198794c447fbd9d7cc2d7199a506c76a5/src/net/http/transport.go#L1929) - s.golangReadProbe, err = ex.Uprobe(golangReadSymbol, bpfObjects.GolangNetHttpReadUprobe, &link.UprobeOptions{ - Offset: offsets.GolangReadOffset + 0x5c, + // [`crypto/tls.(*Conn).Read+559`](https://github.com/golang/go/blob/fe4de36198794c447fbd9d7cc2d7199a506c76a5/src/crypto/tls/conn.go#L1306) + s.golangReadProbe, err = ex.Uprobe(golangReadSymbol, bpfObjects.GolangCryptoTlsReadUprobe, &link.UprobeOptions{ + Offset: offsets.GolangReadOffset + 0x22f, }) if err != nil { diff --git a/tap/tlstapper/golang_offsets.go b/tap/tlstapper/golang_offsets.go index 183aa5e48..cf02d1438 100644 --- a/tap/tlstapper/golang_offsets.go +++ b/tap/tlstapper/golang_offsets.go @@ -21,7 +21,7 @@ const ( minimumSupportedGoVersion = "1.17.0" golangVersionSymbol = "runtime.buildVersion.str" golangWriteSymbol = "crypto/tls.(*Conn).Write" - golangReadSymbol = "net/http.(*persistConn).Read" + golangReadSymbol = "crypto/tls.(*Conn).Read" golangSocketSymbol = "net.socket" golangDialSymbol = "net/http.(*Transport).dialConn" ) diff --git a/tap/tlstapper/tlstapper_bpfeb.go b/tap/tlstapper/tlstapper_bpfeb.go index f39bb5e29..bd214cc5e 100644 --- a/tap/tlstapper/tlstapper_bpfeb.go +++ b/tap/tlstapper/tlstapper_bpfeb.go @@ -77,9 +77,9 @@ type tlsTapperSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type tlsTapperProgramSpecs struct { + GolangCryptoTlsReadUprobe *ebpf.ProgramSpec `ebpf:"golang_crypto_tls_read_uprobe"` GolangCryptoTlsWriteUprobe *ebpf.ProgramSpec `ebpf:"golang_crypto_tls_write_uprobe"` GolangNetHttpDialconnUprobe *ebpf.ProgramSpec `ebpf:"golang_net_http_dialconn_uprobe"` - GolangNetHttpReadUprobe *ebpf.ProgramSpec `ebpf:"golang_net_http_read_uprobe"` GolangNetSocketUprobe *ebpf.ProgramSpec `ebpf:"golang_net_socket_uprobe"` SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` @@ -169,9 +169,9 @@ func (m *tlsTapperMaps) Close() error { // // It can be passed to loadTlsTapperObjects or ebpf.CollectionSpec.LoadAndAssign. type tlsTapperPrograms struct { + GolangCryptoTlsReadUprobe *ebpf.Program `ebpf:"golang_crypto_tls_read_uprobe"` GolangCryptoTlsWriteUprobe *ebpf.Program `ebpf:"golang_crypto_tls_write_uprobe"` GolangNetHttpDialconnUprobe *ebpf.Program `ebpf:"golang_net_http_dialconn_uprobe"` - GolangNetHttpReadUprobe *ebpf.Program `ebpf:"golang_net_http_read_uprobe"` GolangNetSocketUprobe *ebpf.Program `ebpf:"golang_net_socket_uprobe"` SslRead *ebpf.Program `ebpf:"ssl_read"` SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` @@ -191,9 +191,9 @@ type tlsTapperPrograms struct { func (p *tlsTapperPrograms) Close() error { return _TlsTapperClose( + p.GolangCryptoTlsReadUprobe, p.GolangCryptoTlsWriteUprobe, p.GolangNetHttpDialconnUprobe, - p.GolangNetHttpReadUprobe, p.GolangNetSocketUprobe, p.SslRead, p.SslReadEx, diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index adddb91cc5accea142a9f4bcbddb8bd2aca0e077..70d3f7719fb646afef971a0802d3738e8710977f 100644 GIT binary patch delta 11725 zcmbta4RBS*b>6-AzJJN$NB;M9+#D6I{`WrAYtN=ddWUnM4Lpqt zzYKm`@gqDZMD-N3SK(IxUx^mDL{nWC#}m{Hel{T>f-=N7A|Kl~eeG2k1F5bKF?xzW z6rwiq`-~yKec#Nr)7kSihUXPROnc>b^E|DH{ye*BXY#+?w_qjZjmG>5!}E1QO#c)- zyTGb1p10}uKp*5SKl$mY`Of{`+WXksD#P3LLZn~(y~g>&{WDj-#-3Ljo^KLj*89Kf zI49pI#OwrnyIF{ajrleGRVzB+m)1TF@ zXJ((9fW9(89-SbcoFIQ-%X5+wIx21+j!yHhIWANAy+`Mn_>YdhP|wRrR0 z^XIpS{B4Em{3A!F9v*t}Zze}}3$dk;Zy)*F>`{c^xdQO-)J*!akOK+Goosnb$U;5jE<>(@oHOJr zA$J=x={aZR)Sv1I#vcrYWYYJAawIVDU#FqW5ONsVp#>(>iZ2Rz3`3D|mLC&x1hT_2 zWvd9|U{_IAxnJcKLjHmTwksPH@@xa-Nui(0okE_c0+bGAZ~^(()XR7_(2_S!6>{yA zQ?4`I`zOMwo)5XrkZD5e4S6Nxc0(q;O5jbxX{5E{gjJG1ov^GZCj(kMl`)cO_EdBV92OKqglX)@ASwOu$%NIo0dBaP0rFb)pmqSnw?^?d*y4yz31 zk!0r$A?_@N9(f#>p`(`z$*zZYFzwnVlKmqK^3jr51-%g;t&3byf5*|L_{bwWIkaw9oPASWS@ zaWB@>W}+xH_#FZ7uvd!meME7B$v}U|AG(yI9P+Cd$d-H2Ly?;cy&#uj1OpEW*`iQO z-fPzc(+RdD$w;O2>{Ln*(T!BflK(T6vgH3sW$mLv*4e3)4R$JJvzO#B?;mTDd$S6rR1Sx3>K;Marela*8iXNv z5@hV3K;AFJK`H}9LoS1iT{~`%{t|rx`DN@sN_A5x(|$Tascyz)gbb#a`=g8G>PW~o zHp$f+z|sa9#;k)k-6!B46j*;Fh-A(B{Ry*vf5NQK+p}KDvp!F=9tqtB{^`N9oc_9y z=`>`XmAeDSjO@>a_A?gx16Rlv8Z_9mVE=&FEkb5!uIy#Tb3(Q{kl737F577C%FAiL zeQ`MT8K?b$#j=G~M3I{bV^Mi8AQf(FD9>yVvIA$zZ8u~@aXVSwC}bz1xLp(EZkF+; z+l6iH_OaY6gL#pvdwmyme7n-LX(k-XmmxEo7eN%nya^Bblcu znCM`W|G++tJJ=*chR#dl`fU!tYYYw2HF!6ZL0c$O9-qeyz4ffW$4@W8L4xn}J$`P9 zTz2DW#B2!TlE+yk!a+21+c@R+wsFc4f$9#~g++08K1LM=ea2;~Fll`K1@qv5bb120 zLpaycj^j)qGtLbdploOT3;z10;SQVig5M9850|qZW0;La5-acnk+<2)g_9$Jhl7&h z?3$3JT@$jj+s+anE@!uqCGr^1D2Ks|cW4$6&JqrnQy_cJ((G6KrsnW)f$aoKhpRp= zoKfR&)vpmw5xdejT+SFxoxRlW^oz~m)WJ4gbFanN4`k7Nc^kN>B}-5hwPL>m~kr;EL!*k2m>P#8bZMP4@)!^#|k z-vplCdLU~+O93!$4T$dHj9UX*q4DtnQT*7~48;(5rpPfc?1*03iW2y$r2A+<=FG^M z!c9L%4czeKzKwmVIykw&UGPY)LxYV^M2AID^f)-iojnT0AE~fE74Bvv(Vh0Vppiu0IpBeaw#=UNh%O*bm zq%Qda9y}7Km5`81C@YLtQD>$kt);??3dQF7xW;Q}mQ0Zx7`CtJRVe0P@}!}lG%_V0 z0>d3@jRD1GXna~+S!2c&Tdncve}K<&0M|%Sig?B&9lAq`{)DRVPK`$o zXgq2R)Vo>Zv9z{NP*&Ja*4&NBs8+9HHJ-?5-1|oZHwQYP@nlikr;N-c&jxs~ z|3u=n?vQHI9isOdcuwOU9W$OmYFOj3XEbismE=bnFU@HC#1AMwJ1T9{iufr5-=p!! zJOeKp_(_eM$F*d+#xH5s_KAIrQ~a`it%!f06@(8NI29)zXqmAz-hPcwGS)stgJ%0l zec+kmPlI86$|S1)OtD`ZinK!U-S$ZXH`drIGjL;|-d8j(yS1O>Pc=R@K8|Na?6_8x zca1AVbiRQbjv_GwAJO*iS&d7YJyXd{Fg)Xmv_f$)`6}T&{|Ym3LU*Vnr%c|vVAxSr zlR|On83XTyvQ>IJ4184ECzoqn#SgU6pKFCxdT9wbfK_^X47>oIDe@W^Wj~@&Kwr{0 zN^d~H{7dM4Pj4uYReBErV7$u6P?7>G+z1e(f1hEzrWHI>>hD+S`v`Z1;GuE&8RoeIV2 z_=d)<(z{CIv9z{NT&?k-@&@?_mY@p70cigziqdgXc$-48mftmSV`)9u1Y*Js>zC?D-3+SLb3KS1E=+7@*V`keyq~_&l;a{PFW)^F1=aRp}a#Y zqO)`dvm|>L47{N2-7^}uN^h0MD~yRHzC4a+MTHqyjw?iE5j>Ok78sscRa&7ay+!cR zPn+i^b?d!e<4y)VQ*s6v9*|XfvFXO~5tV;nse)EmrI%_rJF-ge*EMdH-sKvP zrNJ{L>cFrced)#g6I7vCVcmMSYuvi^4jQVB-c|$P-o+(aWt{m7Zy}rh+(wj5zKJZNOC&92Ev%<#Sq4-LXW@|K2 zy2&WqSY!8sfg1z$?$WqbdVi#G%@P}}(H+XW!83UufZ+j^k0=zE7rH$& zZk66LjaQ_#ed3D--ZftTP+fnc71piyCmOeIy`#Y6_<^j_douuq7fBmZvJx%hVd)L< ztcX%7SYegkQjJ@s_cI1Q95@LckzNC*!7+Kafnonv>0Jdp5$-?Xv?_CyM*0IG-@&X~ z?=Ay3mLN7y=?2eKvK@@Vvqc5t?bNOn)~%O5I=F*%>!tev<4y)VQ}91; z7`ICAw_u=foOYT&8(1O$ z{Vho0Z2=TKyh8@wrSVj+#;sd#)WFYa`ve`!z(3+!x85~M0ep|{;8hv;sK#TfHExyO z(;ByKz27u&ni%gt5kF=qXf{j{I>(#|>(=|I#;ww8Y(}f}eofn#8UC~JgN9-NJX7qy z!Ej)!^gga}tMqmmxDg<}TjS%mUO=&b4e)UOW=)P>VRTpzp2?*O$OD?vuTWgA)@j@- zy+6>nb?g0(#>+cY{((g&8w#2YllSjnIB(={u1Mgrz?Pw$K zX+>obJd^ihFzl!*tx(hnntd{qWvj;Hf2wh(k#WClt*n-3{o<|i%E1L|WyX=U{?>K! zyKzkZ6_|y+& zixU|F-#GZjKS?k6q{MKyi~yQXxxaDGyAOL8+z;K~y2ssD-Pha`gCG1@R=EBz z@xS)`iW9QIZ#ph({H7Cf+2A85WN*T+e-rO}SitX|Um^GAreD|LM16Ju)!- zmRu&Qdy3FC`I(}upS~QS=!=7hDuqGaO@59nhx`IrZi4C}mXBw8-iF1}i(5P~>}TGF zuVFt&O_yJwrmyE6bUSBsTWrJ!ySKy7yaU5FKL^X`vwa=#=}9M3Rkvd{K82%8|yhGuW>#T z_cNy;b@;hc@Vyy!iO_CiqhBD1ZV(FU?)f*^w)z=r`u!X=9e#nD;hxiYcKeyr=tH*} z?z0(Yq(Nq>8SQx&`W8b!=4al8qSeol=CfLJN55Yni1NhF?ilMCgKdYOp$4AEpnp#5 s@4}d&Nl=1>PF3qk)j(j?>5GDT*W=V?w0W&jKNB{r; delta 11405 zcmb7K4Rlr2l|JX*`~F`fK*CE%AP|~p-LIFnHluO zkuGBg*Gl^+H`Cf0r~Cxa87#Jm6`iPz!*pD25FNt|;1jH-R%g($(@bl}`S!j0n&kYQni1nO^b%0j z;|Xd8Kfdt$J##N^NQbJ+2zKZp#6lq|NB%eeC6@of1AA*^y72hkOyx75+3Wb;Ov%sT zn@3eORQUDYnV8G8eVO_z(94CcV(eUijmIx1#FU!~U)onAZ!X-oFH`yC|0BwA^m?iA zA)=i7KSi0{JGE)r2q)zRA?lWJurdsUrab{aP~A#Ah|hvwQ@F1;Gy9Jj=>T%i1rR{X z@I$Y<`^U&#g{OLJ);==^{f9B~t7GJM#>oF=%k`yWN?wXhK0R@G&+*zD$J01?HOFD4C%oaGtdseCy^yUFp=uX`;E6dQmy_IK$k-pE zljW5{wvoQekV)Uo@?Ao%xgK(lALGCnU(svp1wTQ1$S4IxWpvN?Td?=K` zg)|V#)zJ*l=8* zkndBfN<&AJwg@@m@0cO0^TbhCP9he;DJ6e7wtQJQWfwwjHDsDnn<3MoTw}&M|tvAXPh`i* z!8ka7bKwzGfof6l)nK$ia!7Vg39+sON+f4gM&hWPlk9pzY{I^c(#ET}+5ezHKDJ)r zQP>TJcHlx93gwD@LTsa{V?2Q$RFLhkr}2{Pp?iW5u*`tSR1T@*$E zd&NxI@@4c;!lJrc!Rkz=N_s4HE!WW2;qPhV4NDB9KhmvXfIeDsw7Hrfu29 zsjRN>PtTE$KhU8MnLoDwS;t4wNMMEA3`MhC|{t|tH{!e57 zQK}n5nfB8WN_8_%2pLRqec33NL_&5M*i~R@10BPxgO}Tta1RQsyMjp8tUn$z>yO9G z`V)KBSHnFe;}e?oVCXjRPmduE^HU+SS;*%@*+nI7Ap4O}o?7jnyjZr-putu)$(GL( zyGqC$&6T}OeO$=JxMNE8g1O69n!EDyy8m!fIQ6No`zPUrRz#7T3u95$9zZJG#i3j? zQOFHAQ|=l=Mih55%S(jZj3{pV7`c;WywhfWzXH+1th` zgO2JB*<*h=)%LdG!{SsUu-Z1$76@k+9fsksTlKxdnNNp@GZDxXcZBu3gwqUrtY#3V znq(XvdSO#o6l3R)sKTJns7w_mE5s!PsDN~O0(qryuA&{+7RtzsvlIiAYgoVAf8dgE zhfUk<9|y~a%W11n}{zf=M#v!ZC38#qNX&f?V zm{P#rYPSgI{U-mBCV4G+WAQY+ea2yPmm)Rlu+=^#oKI4aTf?yhGQ7KMLK$bpEv3VB zjOB-fo2A1vG)7-E^cXFjh48SQ5H8(PjKkp0$KmlXR$7zVH-tNj<4CmhBP*wv}X9s7=Z6JHmxYH3Y@$Uj%M15mPkj2J z_ybBF283({gbXQ){Vh0!A5thz{!hRon*kw1iW0Yjqi+Zhy*(8r4}vS98#0I%SW$W% zIAo1T4u&l~lk}=!+%fPt4W4njqbN$?`$*w*tydKLD+AB>D;R%*c*9T}(|Gz8@bnr4 zSp#YUz_>M_VU1e@TBva~pkV&7Zx{-5Kr{#rK<{uxi8;})2puzKZuNB}+25$QQu7Q*PApdCHm$ky_1<#bic^C9W46-uuBLIwBnZOlD z;Z`Q-#IU_N(0uHALt&0|hk=`!cwXaXCQ|PMNAV%DCP1lH_)wq@9?9ha9?sv@xQPBH zPy~o)WFkSQfF02nouU}oD11Pn*c0y<_@KtU?HZSjD*wRJU%`V%;w;u3(zspo5ty{Hp;%Tn{kStrk%`=D$lb5P4a6RpKJ^$hLWx9tK!-|Lc!Do zavD!A)wo-s@#w$P{^Jg=k)qTqxM;% zM@d>o9#DKlcZhynkYg^;~pI| z9%$;A#$%6b+^j3f-)g)hr|lE@7Y#+LR>X@2-lg$Kt$~vbQ{+uBJRq}hrCT(9L9?m7iXUjB?`nlrdT9x`gH?LJW#9wgnIe=GWlublcP|*m>6;xCp1(A`?`hT` ztMncOz<9>UP?7>G+z1f+yv8dRgJ+8T2^hAoG?p^`5XD!DB3q+L-lg%$%^Hu<9f0j8 zk7zt{gT|el#*-Im+$z0qGEVWW(tA{Quu3o8^*C^3GkB)x_rNf2mEJ2gZk66kG)|Q_ z%s;RMRVa2upKgkxbet64s!%NBvj%P~O=`Eslf&9RMYkmOlhm2Ziv*oZR-}wnN9hWs z@GkAht2OW;jmI9;xK(;T(s+sCKk*a7dHyBF%;Myf1DAAzXNu4{R=6><$O{^`O7A?4 zTc!6q8XuQ80>t|b#Ub!a@hBJ$Y?a>cYTPQl+YQ|GPdxjf)gTJyAET?1Qj`XG@Q5xn z@HUNmu7UR&_}v<}O7E*0pD?2BV=q&D4qUcDE22|$2eTx5zccUwZSVd<<5uaV8!!7W zHzt<&Gle65xe++>d!@iXTol1GdH)KA9c8i##fJ+1Fe+$yK#s9wsnq}!ULHW6GtH6UOFEJ*si*)|)i&^Xvpo0>?7199g&C6}m&JLwE414E&hJ zW5$wMrT0B;Uy{@I3EHIL1oFZvy@R6)QPQP5MCcszj7y3J{sWDhryxC3<5ubYmd3+N zFRy=`jvNOtZ@sbqHt-SfOkM#D+gqh~n}PSRF`76{hV60d9i>?QjG@Sm;vz~n8P&m9 zW0xwR!uz$ow^rj;>HVq3^{p2!o)7V0{$`1dmg^2>o#2_g{{X{*ty?eMo*B1FZ%X6V zt#^xow~y98RM%f?g>~yap>gZh`x@{#ejuy#QbALAk+dNtC!l3KD7^uU`9~=gtguQi zU4t06O7Beuek|}3JR&;{d`RQo%^EjLZ~98$dA@5oi*<)I{eh5i>(<+0;Dg$p{_$4X zTen`?6YR&j_1>fLd}R>=QR_UeJB|EZ8?;{$wO7A?4o257YTaAyFUV`4E_#A*60N4{>G4R#^3Lf4;18>)O ziq@VTShrrsz>Ul$=vb0H#kX#~U(_8^UErC#iC{QD%Gg}7Yc+0_-m@CFZoLN#91{!k z4=heQnFCn2UOLAL9|q49`8pWJt`6(XMgtR|Yzca+1GurTjbD;V*BK*UF^- zXq((8@Aj`+CFjby{#I(P@pn_>_Pw@Bwycd{edYANvS;NI895KWwr|}L*&-v&;OqK! zKPP|XL>j@@_w5`Y9)ppe>)Za4OgWJp_!)gW|6b1YBFM6A=sWt4vc-uEfWNTMdqsMl zUoj|4W5?YS?rZL=eRBt8xjXuw^8D*h$a??VC*+)Qciz2e?Ok`?rvAHL-w#j7{fWYw z9?!q!H2zurcE9?Jyjw5jp;+MOiJI{M7*EfZzTWEC>94YBu{L)O7pJXVLFt zfAv|Itnu5=%F7dKjT(2I0l3#cMY?u>1UmV!-+WHi2Hy>`u&ifNvgeU7*xWw9;~f5( z^r}$YIOylj$*RcrX&f*tcV$b3KXNV@LG#;kk+Z7kx4#WB=l8!2kGH}w5gM)*{s=+z z?pM$nzxfw1&id`tbol+$^h&|viMpw}YZ>vq_Yrpq6p=8)g~E(|h;!GPcX zE;L!cpEN7A=8g`3grGSFG~hQ6!#L-+Qv=__F!&p7upZ-vCNT&Iw6WCB{Zd|%{CP1D ag;*4(WEVu2W}1?NQ$tnyxn1XE#s2`%-czvv diff --git a/tap/tlstapper/tlstapper_bpfel.go b/tap/tlstapper/tlstapper_bpfel.go index df180fe62..bb330bf43 100644 --- a/tap/tlstapper/tlstapper_bpfel.go +++ b/tap/tlstapper/tlstapper_bpfel.go @@ -77,9 +77,9 @@ type tlsTapperSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type tlsTapperProgramSpecs struct { + GolangCryptoTlsReadUprobe *ebpf.ProgramSpec `ebpf:"golang_crypto_tls_read_uprobe"` GolangCryptoTlsWriteUprobe *ebpf.ProgramSpec `ebpf:"golang_crypto_tls_write_uprobe"` GolangNetHttpDialconnUprobe *ebpf.ProgramSpec `ebpf:"golang_net_http_dialconn_uprobe"` - GolangNetHttpReadUprobe *ebpf.ProgramSpec `ebpf:"golang_net_http_read_uprobe"` GolangNetSocketUprobe *ebpf.ProgramSpec `ebpf:"golang_net_socket_uprobe"` SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` @@ -169,9 +169,9 @@ func (m *tlsTapperMaps) Close() error { // // It can be passed to loadTlsTapperObjects or ebpf.CollectionSpec.LoadAndAssign. type tlsTapperPrograms struct { + GolangCryptoTlsReadUprobe *ebpf.Program `ebpf:"golang_crypto_tls_read_uprobe"` GolangCryptoTlsWriteUprobe *ebpf.Program `ebpf:"golang_crypto_tls_write_uprobe"` GolangNetHttpDialconnUprobe *ebpf.Program `ebpf:"golang_net_http_dialconn_uprobe"` - GolangNetHttpReadUprobe *ebpf.Program `ebpf:"golang_net_http_read_uprobe"` GolangNetSocketUprobe *ebpf.Program `ebpf:"golang_net_socket_uprobe"` SslRead *ebpf.Program `ebpf:"ssl_read"` SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` @@ -191,9 +191,9 @@ type tlsTapperPrograms struct { func (p *tlsTapperPrograms) Close() error { return _TlsTapperClose( + p.GolangCryptoTlsReadUprobe, p.GolangCryptoTlsWriteUprobe, p.GolangNetHttpDialconnUprobe, - p.GolangNetHttpReadUprobe, p.GolangNetSocketUprobe, p.SslRead, p.SslReadEx, diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 357ba0b0c9b8ab25cdb903ff7c578569c8824672..addcbcaf93b9ddfa08f7c0839ce9b0e53fbdaa43 100644 GIT binary patch delta 9380 zcmbuE4|LVVmB(k^%S+w^5)uQ1P$2J_2#FX;kcEU)k|;<3l|)2>iV~|dELw@WZsNZr zh1Gbfm7G{FyGNI#r$TVC5K$Al#wND9S=OToxNWRO5@ADdYnODp6}GPK_uk+9c)!d$ z_MD#n&iTFhedjZCXXeh_-+g&$J(e(dEMaH1Z~F0$OG~!v)RwK=*C%Bwz7qUOmHyvX zUmfb({^3mBbm)hzKZ^?uqzapq-;(rVTK(8mM_nO>eE1fjIF_bVK&d!3G=k^FhJT6Y z6g-#Uz8g2!H{iZ#x>AKGdvH&~v$WSr&BQaVU;#cZcAj+*&n38VwZ!e2wXP8LXgX<$ zQ^%jaEAbJU@fXaY<-t7}>t?|MTVCq1T#Dx--}v(^523xgx-%`G?wMCVh8nhfwa4-` zc)nqlQt)~lFZJvE_HDFr{l?v4Cy~p|KBbnU+zQUNS8%0s`BtHPGkjsz3%=I4cT>hs z`<=ZRTRwmZHoe+0%b&jM@$vh}UpDRQU?X&~V|xvrZ*950J*~7l3kL%#jJw7>m*6=b zH`i~%{fMb=!1LpH#+6io56n_M)AD+IM*S;R?GZ~4TKc4=KezOROL&mzC=p99a1&HmN{wYf|0yQ4Oo8_ug;aL4AHoFdh7ThH{CC%RJ)b-me|5_oD0qOfIS|3B4t z!^gY`zVdK?ipY2M0_c=!QN0kl%!xxhDOH3!*NGm{#rX8kjJ96}{fKi;g_q%TBpl_} z;$W#6hn^hBT${r4a9%n}t$_nRqV6nRUq26ZspVSLqAOQl!}>-o{&V#t=qAHAGOyHX zr${LbrSLJm@Y**DLNY1r>d!K_liFXwYiN=-K_H1 zzF(_q!yZdUWF6FMo6+xrXZA$B#ySnU!NaeBZt`g6uGhHz3TW4BZvR%NeS&ft(64wh zv$5MMar9RL^hDc8&C3X)VEt>@OuSQx8(kfQ=4Pzp{7OwlLdauHz1ezqy;~iR z>VDGO5Vvg&*Ck0n1@6hZR2H*W7#qxxNCL*E-J2an507&R!2f zvq{$CJ6^uat&T_a*LnF#3^Qw{9`EHWtk^7CybKqP^KuE^Duy4U?#s*~kI}4L zT@-aCUYg@v2|do0(5@>l#rK%tt+48KCEkgyEAOS3bImCCQsU)*%9Y!+WQd4yWe&2% zYTRlEMnJ(@4s4TiU|k)AW>>NnSMGEUYz}o?jsxpf$D_K>GdNTA`tA8?F$^32Hi8x<*M$376Lk@7fG?+sFK3}g6aN8+#NuFN4fgj}n zVNRR}uZC&9xV{aV#|j!PtNy*UYUpvR{=&QJ?kYdRFkzeycU2Om zI34HEiu>o%%lW!UCY?*4;qkAy_OEAStvE(}Kv=&5?JI*7@7l{@#pn^*xWFuZgkD~t zi)2U4R8$G($X3J^JzA9+ot1%@s@7_gNBf|+8GS2w{5E7UOE($)D0s>au+LO9z6j%tkoi!w>u!-U81WaIB`g4l}3wau0=jJ`ZZd&$egg(=tVq6 zgR2tXAuq!oOLq1yG5*vH498Kw@yM7pA0lHlrz zdg%z|7MS2VLigZNf-9Jbr4ITo1Xl&LZ^+5)Jb79AD6E*JZ>Qr0X6f50xA0E|*R}o& z!SxobPW%F2c+A;l9S`jWn;gw#zv?qwf+y@(gGRgDjTPoTaGZT7xFmS8{o@Y*jD>zR z-JIo73^?O5KZ3#86W4ip?pf#HLHh!a4nmh1?M}drmGm%Tr@*gj`OoGHek$>+2Gb#s zMUO4fH^(!>^T$hcg?^gyi*#CgC&uElTJBE5l!vH_@tcAtN-FTS*i6lg4+u__x1SeR zQ!nEcf|FD~!ohp}4~;P{4{>FZd^h*v7bx;g;E(XVh%r*cxa)SRV7y3-PmVGE8){@+ zD#j(XFn(8zPmVFZfQA{@<2xE>oUU;rE7eUYR{{^?C@@AKjl0%UDdVI37drl! z-D%+hs$rZdQ%i}N+BRxq{9~C~O3c(gqyffLr1wQJy{kws1>P;aFN*1Xgz_0*Gm)p3 zD#5@{?sb@|7|)m9sgjsn#ASe*8Q&moNsV#KPU>a+mbfLA|F|1>oux6x+hlBnx8;^f ziWCF?QM~3;?KrjG3;WG@zl`luJzj?APpOe{lk~!i${M?dIv96N;%3!D14^t`Q*`{|8-v+(ctyIIfTuv(DU)&RI@ZZ$NxL@4j zSJmSCC|*hfjQ5FK5dBg{@fy;lz?E_w{4vKNp7I$#X?mAPvuN*sp(@4)&DcXS#VDRl z&5TEk@jPi3#apPC@qF<)-jo)8k;WK*Y1UmLKhH&bzeAC$fKPFz#+K}~@LZ~3d{W#2 zgZAe33DJ&cb_XnDI`t?$%^)U!{ITDOUsk&TMEHKWTWc zl~l@jvRQYRg&V1c@yBM}LHt1Cy^c~F;~cXkO;fxOKR43=WB!UIZm|w>2I*zMkDGPZ zx<9EHBO%IXeA-Mc&pPL$RK>Vj)*TlUg2mL#_&;T8aWNsdl6o0GCvJ&TJ!VX|_<+V3 zKO|$v#f0E`iYx~{AVCyRwbs<0qYB1_VmzSAtQh-SYGnL9(|gFm_fZGqsiyZi`Rmi2 z82)&sVaAusmIPu#@Fb;N1MD2&KuicOqEg0f;ucIz%Bb-bRKs|QY)K#{1iz#<#*L=8 zlkTFue@X+4+ht1vYSaqBX{1*Ge{75wSTR;b`Hbg^&jV`E!cR~Y<3E^n7g#a&CN(qu zwM0ok?XqwN^)h~2LNE{$f{SU4@jsfW?XqI*4T_WjPcX*q5Zp}_jGN55cUd9$JT)@@ z)NE+76=S8;!8pOJyWPU~(=g*-n024C@DWN`2^=w7Qfr0aS5(UQjD%o7?X*HLjcR~b zK4#WkZH1sVR)_ElnD;ti<{GvR{tylDXq&_l@d{sb$6a$suLAx^tj4Q@VkO#Q9_2Hx z6+gwt?9uB~#rSUN6)!&~Mf>81GHPbLN1`erCM`Zqy^Qn3ctT8C{0@yV{;uh5r^PK4 zSq(hN^tRLDDym>STlOd+CMJ(iBjX-%OF~RcUQQj1|6bgZ5EGNdG|YIW>`_8YO#XpV zt_7|$z3sHvNu`Wi&DeHYOrjdbzc9w_w77xV7-xvj6JpZh78+puTeEIEExu0rI^Yi^ zY!YJ9VjAT$-YYQ)S}2Ud9b(-F8}hmc|%=Vm8!H zi-i=q9{4K>n*?R2#k;72@q1?7c3OOk8X2dXEwR($=hVUYs4;HGu6M`Ky#<)w| z5{e1IITWb?ZWgy-YEnke<6^2{{H2_=P)rE^mKqt?nBI0;JU|_ccbT#6v=~prjNg;} z4k1Vb_VJ(mU;f8R{a zPK*0VuLb^JcT23S`3&VVt~Kkn)8bQ9#rRjIx1ARAshRQT5+xyJr^WTu%lI9$ZaXdh zgvJ=Bm@To>;(t-(M&N%o#_bSHpbEy{G3&O|;utkDe&1|~odw&e132gJ#OD*_m-OgS zQtC9aqECrar1~sj`A z)o~H%+_yn5u1egwE^0i|`PonO)jDzXrfA*8omal0uh5BkmC?G)&PTiTNnc|2Ez!EH z&U<>eF6{m@8t9VFjX%?VUt+25{~)@{2%y_b$>@We6wgAj#}>mI$C zhL7uF{ZMD*V_mQHENVNUGxS;NJ)sxt>2&^tE)L~AZpNZUhRBk~b(+qjx*=Wc>-ru& zG^FR~+i7@6r-e$MaoRRHZ5K(c?xVtCjM7JST-4HGE?VjQu%4^WQREYttER$FFjjf1 z(?5?&k7KNtsEuI*9cI{UU>x;+0{A*bPGZO(nA$!nJ*gLmHugIfhN$r*8vT&k&`6ii z;gcA1l+L5@1#hM$r|^?UHPxNM6z-t5Q)rV-hgm)7s3tmp3O&lG@IO$rQymx8beM}i zI?qKD6^@`oy3+woMo`&Bhq)M}^UR7IHcEx3QCUWHr%`zewVlRz?R1#c0!LwL+ys6Y vMFC@@V6R-587f2P?sC3VhDo2nN~iZba;f8vf1s)}aK}xiwwD^u=#2jd^6kn* delta 9338 zcma)B4S1B*mA-c-lguOpG6YBn!6YV>0P-^dBqaqC`PEP$MIeC1qy^0?MZ%(GcabD3 zZn3p}5=T9_wwPG{1iPCE-C#vFLF=-v4^5;<>{3j?B5SQO)ZHR>+kMZO`(?h|S$%q+ z=bP_)?|bgK=f3xx?@lH?r<0mbCp8v&de60uFMU`K4d3_h%EX0=+u^Q<-^teBK76qG z)dbxU-nchM_lAG4H)G_945fTZB^1Kw44!9*xl+FiAK#lXMrSJZW%P95^5I!ntyBu0 z(fq~u2!^lkog6Ae4~RiCg^&-=EZnY*`~v@}1N?`#@5|AH!n^lnjC^U-7mfM_SSPBU z@YQ`2u$CM4XN)Nut&|sQ;ot_W1?vi;uN2pc@ap|Jq1CYDXcwTzG|%mL_(|?xKJTgh zIr`P`N0|3w-d{5B_yak0*I>!>F2P*o1<|>N;Te5uC@yX*(a+DhxT?%^DV`H?aeo!A z`%Hg5o*%$7+TaR&u%GP~Zj9mZ(F4P)Uy5O||2GT2W#LN}{?x*0V|e=5{A0qipC7Bo zhwsMc)bJ0U&rh8P3rGJY;p5L|j9hJcnlbPpT;IgifopB}BaB)X9&s>#q821YDaBf9>G7^wf>(x7<~;Wy_|!Hm|Q<7e3#S6F&6HSijR7KKIH`lfSuT>%`fc zi^r9y@Uzcm9zK5jaL~8yuas&HKiGAs?q!I{dU2bA>z(u%F5=D+F+2@$Ml{2jQ6;#t zvts-$z*mu#j=#CU_eFCIPfBqSp2>~zi)8LiNS8CPh!h?W!8N3nv;wr70U3da;s|ybU?ug<#)qtRU z+qCL223N5-y;F-$!_mi$Itp<2G7G*kJzPEuEDdA;G_3w#cvq4XFLIzHFt0U zaIp)g?5Wct8XGumsWI392bl-7sxf$bno@xmwAy6w%i!~m#gt>50bK9mrvf|5Ieepw zUr+}FM>@x#*=+#6)nMGDb>Nc&PK7+fUSqkUcs+37Bos1u8{;>DJyBkiJqHpQhghYJ zXGgi{P?uxUwxh4$L#?o2nP@Zk@@w?Hu{x`cpNCzG$tc^9=8=~k`+6PxxM3c()Qn}E z0bJ?A^MI>dnE9;+%QhBx`c-qr8`Z`}_Z0??YCNC-xY^|(rGUx{5$p)Okp~xI`EG@7 z^7JcI13oatqplcU6e{&d4NitXZmTnus>Q_-bM7%d2bZbqlnCTtKQNmyPVg! z<|6%pZ%I&U8Lq+Dv4vVaHBpy|BqwP8L|qaS9&gV9!UGQw9@r6nBwp_RJ29PG_;pyi z!E5R5iAMOfbn~Py5`L4GqaqIiam&nBY9=m)bYkHdOB&<#l;*;IU>2Tv5xy~cY%zA4 zExco!2-}lp?1Qk+I1o*B<{75}_Za>u;1Mq<)$77TfUj8N(;zgDKY}Y2DLchr*_dOB zHzH9Cy!5BZy4=UMURpdwm#^kW$w9=#r{o;C=EnVvz&w}VV3FbzOA6otQvA`8f__`5 zcbBst$v5`Bh$3AwovBrz zQjvO`JB(X^J;*bDSuqv`mco_6XXqb_i~wioZFs3;E2ovBFc^y<9XRz2PR~Jc)@W7b z!XDsF2A6|R+=Nrk!aEJ#06w?_=e@z-0lpQ-bgNg@$%Kx;L`fKY zPqI>32e3?oKLDTAjAa_^EXa?_;{~yOF6`4>*bkhWfWIQxzzLwx82EFs?JsDx)L_x^ zh*p&bub}zUP-8rF1?`)rXDmL05d~&m?*0r|;mjM5JUGMB(9OKOz<>uNPqs%+gUoD6 z9@!g79`rlOGb0Z*f#d12@gp@f4abuUrvW?3BQ;cvSA)p_#zTPp2Fq*xD~QX5lYw)! zx>*8sCPWblUYUoKn~THRV3B4K4r_z=(Ds{6itV9Oc#PFpCBA6hs8kt3<;F5h0#@~w zOgk)@fCtF**Z`SgHHLmiCYb;qJ!YO7%#(LCCX>`yM@*)dz!$yd;TlWfxD2N3B0ar? zJN^KJ)E-ZNrIqHR(t4v`3z!!fF2kXbVKexm4?Xl)k)9_WosM(x`1w`0$lG6aZSaut zM|?{%NzFJB*r`Iv*)*>@X?UrsT(9ae*x{WbV%`HDMG>t!sj5QnfU3xv=2e*{$3lIUJJnocoTstWeSF6;+hXs{E2Q$$i!#a^|Q|0?d+tkkRO&45qxY5z=oHDM0V zNhP`>OFfF^B&f)ro!OoHVX7_B8Mpm2zV2{xw>tgi{xg(3^pgZ|Q{McTd<+Z@tg0UhCT23?P!+-(tsn0{J<8LW=FIXs`GYNpqS^C5B0i>Qg| z%i?@Uoby@K$@F){`H(p0Cn>`8Bw1LR{ORGI{_iMn7U-AoHIR?4lWq>rzorVNm!)uj zP?FDWaf%w4o+hJ%3Y#^cKZceh5WVEWr;^g{Wb9W%(H2Bs^`X#AZspe>>{rauGVcdE-*?I)#`%A#-}w($v^Ue(I%a zrt^(zy%zm0H8EXcHne!~z|qf9C(|9WUd)ZZklk%CMVS7vS@*&;H>uQPls5--vl*S{ z{C;DsKB5Yy=b3faSab?CF#V8mzSFAEUr`&=r;IFHhYg&24D~VXHS6xO=npA47xXBz z?p)`m8sp^esf=l#3GE7g1#q{ERLk^xvQr6hCAf}Sm@bihM)+1LzE9mu&yyWXke?3R z&L1Z|4|JDAo*-Wv-1LJKVtScG?u#qILsZT5<1)8Tby+1iotl{bYjN&VJFOD@4s|lU z(Tpy(N-#(frk9w}b_tHBy!oKt71c1eweHubg6Ser%@UA~`lu9SX%&X0&}Qo}viTDMkqUSlmo`OF;j( zk40pZU)eReg8G<#Lgx0z)#PdlE(JYD zA`isXAQLnsS%xDMR1K8S26B5>C6U+HYU3=X>-BYFerPRo7ERrCy+u>FG+nU*Atc;lrFY7rv^~#D^Uw-@gV|uDiEv}696}0btMPKx! zPFWM{8`J(|2lo}OjrD!0{gGF-*OOXW73&+@{^ZYfenRTjb+Nv}_MiW|p6W^MxI5N2 zuHE;h_9jqfmrhIS_MZ0s()(8X6ye)03SGdMPq3Zr zvdA?lKUPug1z0VlHn!Sl!n3|asjU=Yt4AqxQIGY#$X4Ns=Jde#o1^a9>2EIT8Od|` zr%kl3d+GWGeS>c|3_Wb9GbwTr4mv3Gp1#G?yNWiyr)TR@YI_g<*1{|RvtblrxY@vT zT}7eaU{o&E@~xiQ_*P00zBN