From 3b332d2a9aa27b13f54b75f2dc46a86db42b94ad Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Wed, 1 Jun 2022 14:34:25 +0300 Subject: [PATCH] Cancel `golang_crypto_tls_read_uprobe` if it's a gzip read --- tap/tlstapper/bpf/golang_uprobes.c | 8 +++++++- tap/tlstapper/tlstapper_bpfeb.o | Bin 126896 -> 127072 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 126896 -> 127072 bytes 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index 2e4b6cf67..bdb0e322f 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -71,6 +71,12 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { SEC("uprobe/golang_crypto_tls_read") static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { + int r14 = ctx->r14; + // Cancel if it's a gzip read + if (r14 == 416) { + return 0; + } + struct golang_read_write *b = NULL; b = bpf_ringbuf_reserve(&golang_read_writes, sizeof(struct golang_read_write), 0); if (!b) { @@ -89,7 +95,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { // Address at ctx->rsp + 0xd8 holds the data __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); if (status < 0) { - bpf_printk("[golang_net_http_read_uprobe] error reading data pointer: %d", status); + bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); return 0; } diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 6f9aa06ae263ca4f264a6fe3323d23934dbb89f9..88dd55a64b43e0415297f9eef9dcdb3bebf1c128 100644 GIT binary patch delta 5633 zcmb7{4{X)d701uH@1cdl`f6KV3#I+>=e1S-wOHDx9i=Klks?p2?y)g_MwB8|yV;C7 zSzZ@OtV+gnkL-3vL+2J-Kx17^9+_RJ4wJ?)^3bVW!lYA#s{AR7W?j<6eb4WAU;Vwe zXttZY-ut=t+o3~(ZL7^nTP^-ZZz=ya{twIw zedDa$KL4!y;n3`1-ox>geT%X4d;0u=5zO*ntPp!h+d2Aj@oOL|xe$N8uaqyx|Jdg* zTJwK+$vs%g-;Y-v^apMKk;LR6+qyA$o1-vOX(#t-Y16=ZPv*BrGCf?s#o9LnIkGI&P@|15)J8Qhz}gA$!= zj^j@qD&aTc2M?9=+wqf!78adCw>gKhvuJO_FM=2@$7db(^H=e};WAY|Exz&a0#%+J z|Iy*usyuJt$-^(_mF;+_-THA=wYAE+x4mO&J(_i7q3pQds<8W4S=CiF1Ivz{%A58Y z(awo@&bzNiZ^!y(H?)GNKr%VS)kJ>n;u_@42^X&-nmgd)8;IsT>Eg9SrE)H*^==_r zAUT)fTZz=do`DU2t=$|gKtD>(CLHzOh!+Xqx(Mf8OkGfcLYTV(g zkj6*wJYu65|C9I_RL+;vorNEYY%Kp#Vk|kOtSB`i$^@g1K`x{^B^`~%5h9zE$U+Vy zGLf;A{CQIC^T3rZUJMR894!z7iLAk8kPSAGqvaG6 zdBJf~9fjyJk^0V(+AYd;IP+)ECAD`UxYNb5VH3GMel0j=k4MSw5QA>l1d+DK#WHS` znf)NC{Y$|8W?Z-&e8j~Pz_7z;Ic3a@zd))RN5huz-9)n|Nj--MxWX~;=aK3GE5jmv zKcu%G338?=BE26uF({Dbu;j>)DCu*!a5|~u`kKW&H)=O!YS5VCl+MU0H5k($k{Y`j z9CES59Cq=|;E0Q5yu)ER#0fd&u8eU<Uc=hF;NzNMINv4xHArQJozxTACSv238m;V(Hz)E1W*erJm9yWOws=-7{}>)B1T2lldm;VY4g-SEqn z!_%NbkBnEC`A_J5OZf-WU^?dseQ7Dz-674t6TOxTtCSbv8Q?K9%Zw`%-5ksrL|bx3 zyo#4&@S^Ns@VZ#3qstsGXr5libvs~{DxOYf7PO=!Hg3OMTw2ckz`Qz)H)zS;bS>G7 zF_)G+Q(i3pB_+@N7AcE!h>O#u&=9xymUixj9`*Zcdld z9#2VG+)unUT}s~OlCtF<~%kv$f=e+_xiS!VJ2VqIeE+gd> z8!3e)En`N?d9UclR`7vns#~NSc9to@5`A(Zk)<-tW*->&WAjp?m*m2ax;O_s?y|>x z#vI#z1M*Fzu5?)PX;7pN;)d7;&*}r$@`h>R>sfsX%`Iq30u3W-`|IN-ERQ1ArFcHV zQ(DwtWJLW%M%0t(QQwSZM2ty^I_WGcE84|GS$Yq#WuXVY#4YY3SBU+D*~Wn0wUX;( z)1?DCf#ynSjuSUXtY#G}NZg3eCwaoiDu|s!61!Q&YSra6PUvXvs^L00kyPqX-h(vu^cXH7-hU&wA1`s)=9Iw^ zmw`AKHT(d+ZSY|Aj5$1GJ8|C}unBYi&xw14O_*egTx?n2wzr79J{M!mYf-IjklKK^ z!Z^e?%}Zhsa#(bH4H0_7X8eLaSBr}zd%vL91-W*ke55XN{EEv3za#~3?zB<)>1m_# z;X$4|Vvqb##p!8dE{iIL<5b!#I6-QOT!t}c8ZL{fmdj(5uvz>XB}$f(3c??>IPq2kOM05jwD6-nZw@7sgnC;+^qV{B{v?oKQz3D2gH{$JesU$1fWyHAoiqw($ z=rJnca;YJ)H!3X(kvg_QKem!MHC+1*m(A1Ux@>_)d_-g;AwtgHZN}=Jh{H%#k54Ysu;CK&SaO+6 ztW)Eou5s*E?t*jK9w1KzE|cprc&c%EyoJW$L*!W^Y&lG(cq<*oW%5*G%o}tu7WXzf zoZ5ib1Tg;qd4e+DL4Nztp_fPAecn!ILf~n=uHLy!X!h3gW<62QbGb<8ujXZQrVkMj z1d$?Xn=0A4dh2Rl&eQc?seY{oSMxsZN;EZaLhM*ciymyo{6@X)4wzKvQ&MH= z<~vc1C63=I^M`d)nAfUorT2&VM#Y7RkuV>f#g&Qf`*~kD&<`2$VV5d*3}tXqST`Nz z!+|a|%`;8R@9fUtKH)_15O3fB#_d01h!XZ?uqB+>`vwjcDNS5vo7sQ1gfqBBIC1<< z{<8`+pp92>s%%A8rEx?!G5D6)A|vJ7G*#{vKW-L36^WOI`Ew4)I`VIWDfdJ&xJ@`Q z_%>&IZ5^&jSrXkRI=Hz{IC1_2&sBjW+W6u~mF=S$JT9DAa+1$@%+_{}p-cWNGiB#Q zI=5yevfktD8LFx>G3zwn#fe8o`C~6mR);^~S|mm66JCvMOiIh3HZI*0BfIwsYqPD<6MePgI%IwaMQj!AV=CsECK&)Hj5EB)$Yo~@UE z%B9)wng@Anq0{*=I@Rikj(y7Y`qs~om+ybdL3I~)^chx4>X1}19g}KYC#CAwzR$6t zdwn|exor~@ysuIx1;@4TJa9Wk?b^~YyT-6xhqUj4j7N0n0?e^x!4^v=?K+};7tuYc rLl?256BqHQ&=)z#Jvxbw84uuyrR)sp!b{L`NQW+A`un6~m)QCb_;ty( delta 5456 zcmb7{4{X!N702H@n*sqwAR$g5A5ScMg?K2bfhb6X~(v# zLW;Yl5|!FDol%ZWY-AgQ1lSfvCL^^|ETCHuYzrN15o<@fQE(x&X~!fwQFY(<`<>xu zORct(oV(B6yLQLX0A4=Z3XwdOL~#sgLSYV_p;p1jSUx7w7H)uQhlDCBQOxyO@N{F$@n^?0WE;m7Qu;KAtH zp1Iihb3Gp4LCkVtEEju7**W^A;TIs9JrMnEPa&U(z6~!q|A&`(y@gy6UDfOHHT_Rs zUhXYy-#pnCXBCmJ-}uVLK18tT_@VgX_#Y*G}_U_T%L%+y6+A(l0 zYg`A>Q-jfse}1jK6cddbnol%il7klzd7gA|4U(bT!CxYp^@4*RBr15!!Ap=NB6xEB zQu^atl^SMzjzb`EE?XA(_aiO?E}D<;A;V0bTawQ!@&Q!f$+a=<~G zv+gEt@PI=OM#_jL)_QLeH|2p_94xugYV4N~2eXLUsm<<~8YA8y+C+@OX5yBm;7&81 z+`w+fxFlqc;XdMy25_H)ec-r*<+z7zo{kLb9tZ!Fusir8;=>RsTQ)HTKNN{1dj+u^ zI8Crwl!}Woe#21eq(iAJM0N?0C6$uE#$?TqS#KZlEeXt02L5kPFw$g;fkYOuCuH@J z%9Y4=I#?o0Dk0+%S&u!A$kYOP2*zzjU@CyXtW1+5Ly^E{l#*%+3Yo}o#wsXhTy6}$ zPHIB|xZ1&U!6xz_oV1ms!cGV-|WSa56k?LOo_S%e=Roatkd&EE% z^qU268fWA*0ygJXks7)i9CWbb23q5bF&<7EPil_S8j;i7nKE8^M`SUO<4uYzED?0u z6Xdu@bV~&^Lxx>K#z6)v_8e%I5Y0^Nxo1g@3Xj?2qS-ANThFp8OhU;!f!_sdx0YtY z>McB1mmdFc$<^U$)(u+1~E-VO9Ju5(Evu?6r9uROpuRax;Iuo>Iw=jf3gT^?F++FI+3lUlH}=mB2|a!WrO% znPtWmA`mY#@p~O@$s}R%auQyY6%3y2_%r%K7CsZz2(RZ0#xq|Bd-_lC}_ zkXQ;}p zP}O>y7TKB?JO}<6GDQ$>ge60F8dYzzQB_znw9}|s@SL7@AMb5Xc8jWm_A&(*@wAq^ zi-fh@2qQ@esbuk|M2F?>k2rWL7zupa9`hMnoWb@7NFqTKLtUtCqr9^!rE$SO-QQu09x)IBZ7`G(qA$wVCefeXe zEWDT4>jj&ra4or9>~Grkg)iWnB$|1lcA{*`rr?D+dQ%NgyH9$K&?(zR_kccGZH5<_bF)URj#?xS9L%}R^1$&D)ksIu zq1+>jcBOogzAl4pqMLHtl;wGvG#B4Di0OrI%7wT83pryq6p*$%tPK!!Rlno5Wa$rbS_Gdf@Q*6`AaGTp|HYq<6^E}W~0 z5l5rFU*Al8EldIj9gNjoVVjYzu1vX5gNDb*<&_I%;=MgS;uyzn|#^P=hKym}g`&0BZx%@KTMjq?nkv1-Q zDY_%Z;YR&NoqeHv8?~>VSL%rL6xgJmhiXK z#GA2OOSqkRSnp^=_Yd`rMl6uf{mZbxNu9kM3%sZ|EXM*t?Op+sYQ00MOnpPDvDnro znLngQ9|5-M=0`FAqAp#D`LF4Ym6+eE&#c7!M!h`2w;%m5$qb)xCJqxib+H0~3Q?TPaW z_ThxN?2c^+r5CjWGe@ z%J_}F!+CY2`~Jx}`r>;E>v|RI&c*(HV)~CRgdZTRj$|VS9!d? z>l)vWI}o@gesn~tY8}4@^T#{8MnORx7zH)=>4;#fjthRJv+KH4*pyXc)T)Pc+^R>q z-iL8O2i}L(mTn!f>Jc4Bw;p&Ow`TkYT&r3z{{t9$b>suC%Xo6k?BA;gG0d4=W0-y( JTNq>Se*v`;sQ&-} diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 409a3b47ed00bd0c0c622c650d4fe70d522522bc..f950a4c182fea2c7aaf8d65d7511ba452570a4ec 100644 GIT binary patch delta 5817 zcma)<3vg7`8OP6eH;KCmfy4w7B7_AJ5*`Z)k`RqTD1p3qEYB|1VjO`aG}WM)f(&-! z$Y_GLpv!nthDyK=1kfREm|1EO;%kOb%LJ4PGYC--gYpQSYGH;c{eS14yL)##I-Z%k z=ls6cIp@3Ix%Y0zg?oB?@7a=TxG(;B+{70$pIze=+-gV&H~O`@A56nU8+9&y;h9V$ zJ*V^UJKv8n#-|20@6I&bg98V4XVTihiQQ>KmkkvnR*0Bf_|{|m0D5j41OMHfmfZ?T zF{lgIc1w#Hc43U>d=NkFfd}_Y%0CJT6ayYo3iV@5N4NRDABmqB5kGKb&j@-maDGqP zQ19>`^I8S1wW_BAliSB*FU#B0vd?4+;lN(fF>l0Pu(o8#N^o5ZY-=Bpe-oCx+6qW? zGv;7WI_js-J8H(LZJ0)q6+yH^Y+WU4Xg1%r@sr#TYViFD`D^A?L9h z*MIc51miedEU(68j4{Ve7!SZ0ZQvsOaGb$WoD*ihGAIfQ6nmq1c@)=0@pDnUC5rb% z@nMsRMBt@;ne<*@_r4rD9yqaYbpAQ0tUGfV;}uwcHLja_T#NB@xK`q7z;!n;YJZLq zn-i$oKgvkR2|Trbh>?=h`O^LaDP!uMY;-@JKgIp9`-#SNo@p2s3pZNbDtE4uKkS~8 zU)VYE=-HImgR6zO6&Ucz-~0=ae$E=V$+#XE9OfxtnHJ_k@CmcdF%sfoT%D+I%YO#A z1+{7MY_KsR%$4AJRG6io2eoMHEdO-sB0r{8ZT=u3&hl-}BEct{d2EUhsktPQY&;0; z);t4xS00Hx&E-g`tCUnG*?$LfISI}t^95W(e55kU{PPsy7io`@Sf>pj5CgzXnol9X z&=n+_ZG10yi{?hyr__>Y)f`07tVR-Tnm0pV)2 zX0@|BB)po{&YXtuX+DL3WvNCewU&K@O`i&VlV-KCJR_7z=4`OvN*xOZLeQ=q)XwG@ zqD!;dna@yliqce#ceaoVXoV4~8I|H%L*zot`aeQHywM2N2=jPwk*QBp23Zi4*c=iX zgB#6LX3VTyi4XZaI=oZd_Q=LjahGPn)PMiwkW+$ zLXP+~3?^(fLIuQ}13si3m=m_jo#U|BT^Ogf8p5q>;SSif9huOag0#8Xz=o|>It+Ev zxjeXW#)6#Q!{LmoTi<1bPN6GZh^mhGUZ2vQEHZpo!^hJOkD*ghjv zTg+)-pSEY71+KO+>(^;kxAayx%cj3SoMv^8VbE%G$O5<7I04+D8J%j!@XHH+8w(hC z2Whfr5^q@Rl--5i72^>7TCZx;o9a*x$w@lcO*}B28Gvf^=$OwTW+I;TD5DTN!HB0A zF~#6|p^EjUY??$nRkDRW7kne!tjL`5Blu6p_jp^WDIHoLVP1B9#No zcY~QqKbxskLi|Ii95f869A-XX*ABCm&r?c_9QQ+$RvX!k_@(z+=2McM=_s0$t$o;&ELt!e4XU)RfuF=BP&k}qW>v4vX1!YM1ap#^RlRO8>-E5J`TQh$!*9vs zAU~$<67kuY)@~Ls>zR|lT)@m8@Q}BJdd*op2;3j#pMMk4>ob@WncALD4;Uhd$wS_hDx5-R|=Em|IFwf=GthW8{sBMEIwtXjJ+p{>1DlW)- zbR2Z5S=)RZ^SDtt*0xk}<&wAsEB5b{jRjP!R^2HNVpzb^et0FK#P}RC7rC(m)Du5_ znAPUJh@!b(W)ZDqHJK5L(H)#G6`nU#s zDn)U#X2(c8EjHrQM{_3lXIt^<*$fOA^lDxW2mZ9_(_9lTL`FNdsrh;6 zGup6C&DMsTIAI*0?cK0Xvau8Fj+ts2SPRJ220IYY`4&ELG^;!wB;nJ1O0Kuhor1jQ`)JuDK>7@?!~8QADW zM0+0k5K*%$8xgM>a$F(JQV}h|`a&xB;bS+)5ju9|h>&mx-$J^ond89LF;qpH8(@5dINf#3iH^hW0mWOI2IXG93nl&ywy))!i)(H921kRq~>W>#|rjE zHgqqvr_-dN zT`pcgf+}5WDcmQ^Wl)n#ws7|c`Pb>RnVN$YB@{I1FOp``QMxVPn@Nw+X*sf#%3hyI zaq`Jh+C|kec^0ju64}C?TheS=Yl!&Z`q}hbqF#Bs4B}mKO*umJ%lrz2_*lMLL1px+ zJX=9~WYR2zda;t8rXqQ}lGeUH8~mFp@U7sLD)JMZk#%zsq)C1;7eT(3JLe(D2a@Jf zne3el>v{7rLsKP2-_M6%o~-lITG>zq!DTN5{lR4mI8cu~yAXjI;hg`h9ky_5qTlNCNHGmHfJnvbR#=@dNW zqa%rw7kqUUZT5LOmV~oA8r9qt#XWYGbC1%Sp5~=t7ycq@jpBAY2Zwjzo_N$Zy>`on zPm(VjgV}B8;P2j}6!MfW3)_r=jW3F8?Hv5a`}Bd~DS0&PlLH@b6j$3h`0hvSQ}kHa zCl@~DQS7sG@af_{VMD;0Y0~)*jXPmPE&Hck)Ib#yg!H+K!vby;;4+})Bb+%?H=bcQn^7C{p>t*s4nmTyKCnl!j&rPVw{410q8?I2gQ9WI5x`K(k%jI$I z8Jth|ay?i#s? z`@9-?oO^GLjK7Ay8hZ4+>}xQ0*UIBcTr1aD(3&vR z4K+I0>D18ea2dzy`Y|Set+CMAfSnQvV_~eCSZ(7+CDgBgh{1L`grVC1xqIKfx7*S2 z&b+<%ch0%z-h19T`|ild#NM+Ly9$iff4+Fr><5puJ$T=A<3j$C&z?FNXZ$xc@WOM` zjW5#zZ#*}hmIf|8mocSqiVzcoh$|36)L>kRp4-~M^zMwjZID!h`tkhG)RGW8F-CJ% z;b&K1U3bZxeULzL-F&4`KgL3I8^8B0{*$Bp2R`V|rXL5s>du&wGws`ERX}U*YEj^h zo;^n6cXKx0$zdCO;hmvw)BFx$Tomb~sNtaUUmyjB{R;p!M(8N+wSaC;2@GR#CG(0yn+1p==e znnjNXE*+XV=XX$A69P1u(Y&ww7cVEj`&_uy&8GZeV>@GRr+`GM_+bBurF2Od3~ zZhV}7r2Fs-sYg0b45d!!+$O~7z`DP_#*=h|#dE=1Gb}C#2g3=Bkq`^; zJcPtG=Pv@^iKH`m3HYsW3SlI~GCVa%9aFzT2t({Rvj44ltNrF{T{&5ZcNlU>xX>}z z?12u>R@At6xLS` zpM}G^YgTB?31(zip9X!0wpS<1G{jyT=Yh>guznKQjD$MaTqAOFbuf=1Hgnz~)l}n? z<$}d>BXTkoVy__zAZGoKpr5wh5T!OQ1e+&keJdiwl*FhhQ(d!`05)0FXDB5jA@_~64xKB@D zPTDQA3$fXq7^ig@!i^N*gTD?==tLkif6TlWY=reHq6Z9BxSSo_c-|u%-DjhzjW7fB6 zR&R8~igI|q-wHDu6vE(uZ9*f_~`UqjNM{*Pq(L4lw!bL-% z9+bU`r1u&Yz<*web~b?VyLk8*PIS!g!)G%7laWRdc7owgahyYl8}1ba+|4_|=Sl%qlnYcI@+;87d1-ibr8{Q&gNKf+Gtb3-(uS@6&zbTK0{Is?^3)_sIaQ3pE*#+k8W&RpZ`tw4J*myE{ zEM~q7uYm2R;i8a?yerkL@(g*0w-T=m?v+_{sbK=!-Yd6ZxQ>S^v9Kq;XDo(mZY&=M z^IA^L>e&B|IW{=z*w>4`H=;sts z!1ZoflAXQp=E)7^gDY=B!eAB8@?6}O%k-mCd-=u_fO#_5 zsagH~%*VcLoCtQ4C|3^61yN3l`>}!KT6~=~tI*)S<_Gxfv$CMC4Cp2+(sw}rd3~M&^W+AcOfF6Yrt~^y)1&*l7$eQaA znQ`H_?ZJXsMGjO-n9aDBYF3p6`wAO7!S$NW4VZp0Gil ztkIRVLFO!^HL`6XWm1aVw~$JvWG3+jl2rDaTj4%Iz5_LpOz@!FCo4VlD0PI+cqnAh zA-QKUouJEdQ7zp?ugRxssZNg7Q@p%XOHc1_z+nGvw1X;S!V(V#qkJG`{XjVs{gtemkDUS5)WR$@DYt6}~6N_tw3G-C7RTXL~m zexK*}%QH<>XIxE`*Eds*aYcmgXr@0UlPi?6g&u7x?rXGS%XgjAF+6N%`PvD3rnqaZ zH6;&If-&4{=g@EZX)zT$o2)tcn3Ea91$GW4pQKbO_BLB{W?_ymhFk3%x_y8KjN*&X^P<%JBJp$!gD-#S#xg09B&N!>>MgSLmyIc(?)B~O_7&@ctZh7@HWm9<(*t<#Yx(IBQ z#~8ad%d0>mxLH