github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-06-25 07:45:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Cancel golang_crypto_tls_read_uprobe if it's a gzip read

Browse Source
This commit is contained in:
M. Mert Yildiran 2022-06-01 14:34:25 +03:00
parent 9fc8e0eb50
commit 3b332d2a9a
No known key found for this signature in database
GPG Key ID: D42ADB236521BF7A
3 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tap/tlstapper/bpf/golang_uprobes.c
View File

@ -71,6 +71,12 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) {
SEC("uprobe/golang_crypto_tls_read")
static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
int r14 = ctx->r14;
// Cancel if it's a gzip read
if (r14 == 416) {
return 0;
}
struct golang_read_write *b = NULL;
b = bpf_ringbuf_reserve(&golang_read_writes, sizeof(struct golang_read_write), 0);
if (!b) {
@ -89,7 +95,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
// Address at ctx->rsp + 0xd8 holds the data
__u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8);
if (status < 0) {
bpf_printk("[golang_net_http_read_uprobe] error reading data pointer: %d", status);
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status);
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
return 0;
}

BIN
tap/tlstapper/tlstapper_bpfeb.o
View File

Binary file not shown.

BIN
tap/tlstapper/tlstapper_bpfel.o
View File

Binary file not shown.