From 9758c8173625db81aa4acf9c99386850156ac496 Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Thu, 10 Oct 2019 16:45:24 +0000 Subject: [PATCH] comment: add explanatory comment on handleFdInstall() --- probe/endpoint/ebpf.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/probe/endpoint/ebpf.go b/probe/endpoint/ebpf.go index 744b2cb4c..93230dc60 100644 --- a/probe/endpoint/ebpf.go +++ b/probe/endpoint/ebpf.go @@ -247,6 +247,9 @@ func tupleFromPidFd(pid int, fd int) (tuple fourTuple, netns uint32, ok bool) { return fourTuple{}, 0, false } +// this callback exists to close a hole whereby we don't get a kprobe +// for tcp_accept if accept was called before the probe started. +// It's fairly safe to assume all such connections are incoming, but not 100% func (t *EbpfTracker) handleFdInstall(ev tracer.EventType, pid int, fd int) { if !process.IsProcInAccept("/proc", strconv.Itoa(pid)) { t.tracer.RemoveFdInstallWatcher(uint32(pid))