From 3e7d08bf2cc45813b95c3a99f1fffd3f4c7c999d Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Thu, 2 Jun 2022 04:34:36 +0300 Subject: [PATCH] Get the correct len of bytes (saw the second entry) --- tap/tlstapper/bpf/golang_uprobes.c | 4 ++-- tap/tlstapper/tlstapper_bpfeb.o | Bin 126064 -> 126056 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 126064 -> 126056 bytes 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index 3d99600e3..de259f300 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -85,8 +85,8 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { // ctx->rsi is common between golang_crypto_tls_write_uprobe and golang_crypto_tls_read_uprobe b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = false; - b->len = CRYPTO_TLS_READ_LEN; - b->cap = CRYPTO_TLS_READ_LEN; // no cap info + b->len = ctx->rcx; + b->cap = ctx->rcx; // no cap info void* stack_addr = (void*)ctx->rsp; __u64 data_p; diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 0af714819dbfcb0ba790dc622840fc6bd87ca833..0e29b030a20e01a209b12eb01595d014949f1627 100644 GIT binary patch delta 4483 zcmbtXYiv~45uQ1BH#UaA0yciIw%2d-w4tuq;t-Yq387H7Ekv%{qHUofgrs$=R^2A3 z-YS*~3YAt_qywm;MnYgLmx742gr>p~sCC;kvFM*|6*X2Wr7n-+7Ji_LKE65UtaW$Q zREl!sduP6xb7#)^?##LC>0HTFt|Z;T!xuX*zg+UYO6nz|OLt%1Rm(dsZ9a7^z`HWD z&eRW#&w(A|6LM2>BkCrqIvyYjLT`sY3b{rc(68e*A6E?5^SH#Gf;|WMDO_XF--U#o zA*$Xl#T_FGeM&4CVv32PD0B8q_?fEzU=iY5YmIWJbwoAqe4IsOs?XLvQ}bsR`f*?A z4MgGeM++T3gXi7;!avLW=VuFY=Q_bybM$!B&O8QON(nT-^$1Ph~EiUYH3D z2X?J;(Vp@}+e*|h__5Zxf4F}02^aa(zQ~^;YP|B1*Eu;Hc=R0?Z3j_HW9IL}l>;jg zcLA;lEV5V8W4Io1dII(*oSuTdZ7u-DXK~@Bx9lpy`-*U~2&W5iW6Q}xL(91$d^L0U zT>bnzh1OP;`NO$3F3Ipn8;3GWMw(h0u^?C4t;?Z*6;}e+7jTI^Mbx?`^UaY;?#Ud+ zQyVfDN1CdinrCYl6KJ>GFu-iQvDDabtTBC3`(=W!1j;+_w$M-~6thc}`2gy;PHEvTMRAKr#{ zKIy}8oClkJzyI@Gq0hH+W=WE09^UGLZsNp3%uD$&UOFAJcwt8OwQ)Vau3v;$^*V8~ z9NsbOEiWZLij~l~4>thge30nnrTRB*+-5dj2{VQ<|Bx6@n4>}Py!VLTS_Itg{5Obm zwZNS|ybKt}ig{lA&A>4qo(+smihpMGT0Bs}#P3$Y+;0t`o5Yi|fRh$ie2)0OkA;f; z#M821$3n#qh#$zl({6s=f6U?I#1AF@P?7(#!2?urh149WvN1P7a2v2A&iG{qIqQdJ z$F!S&msAJ~V8_s+?WD@F0q(T^MSDqA0V{|3AEeq*8m7d`<$YoZHI=3M#U*&3efoqI zS0Dz?liFL28F80wKdFRlzt=tVJ5tYA04Iw4NsG&GkQ$Wtm8UEJ{4t+j-rtZ9%ljL) zSe4(}s~u_f1a}(ymNj5p}ez@P~*=Nx_FxSONE5;ULT?1PwJZ;HVf3P zo!s*wRB}J4G>3PCB|3bUs1_?36o?Fhr9=-oDrc~xQm~Y0+EE$4D^#8wn6V3&<2Fw1 zcC?lBE=pGX28V!AMh3q?G%9E9qz}&np7zbh^U`u={wpX$;kwgeDXTYx>nPgAO!%W- zu$s5dvN}#UjS6nohgWk`pV*|9#zBDjT5Uuk46)bkGdT+gxL-uT{UQP$783BZ#1Ud1 z3IP)~u1O#_x8b@|#E}TF+n{$4?I-gexOLnkUY_}BZp|ZRRrmDLE?(O$dVMExOt$VK z)hCI!C}0-}RB&9VaFOaq^@%RtYT`h@i8$sJA(t6m%w_~5JO)O*Ef&|~YxHafaKeX? z$LqH^(n#EoJYKR0A98pj@gT~{8*+FzzRLJ*;9Z~rLvnOk0NQaO)NPZ@XbLwfBC5L!tzo0d18(tnU6A2;llFC_m2uA zb-sKW=aO13{V`>ig8orm(oc>HgC()!qV@$+QOw8twCx~x9x!rCUYt7WF*$Yc%nX)O zCxU+!#E?&jhO&4isZCOKjtg+3wqb#saQ>I{t5H{FjW6l!ks5=RI;;v-5znvrvP@NK@_0E;6EeWu1_z9XtBP3rpU z%=uh*nOT;BdSw@PuQm8>QaN9M~I zowp72I^JBf}3DK8*Ji*kW;h0r?(^yhmPC{7IJph2zDr zqd>|&(EM9{~rh5B^4wv+mJo_3qHWXB=p8?;41fUa144=cGDQ& zQo+m6o3mZlM85#NCENTeQ{@f$F5RHr}S^*pI3M34^s1tOv2A|g61BBdup#B^v1 zVo1kDBy?KDn4S=k(xJavpNI=OEn-4Xh?vx&n-DP_7cr#MB9Ko+LWgb{V_XFC-Qvf~ a_Mx(6Ja<9oZt)sC61olVpLF~-NB#@QhtF03 delta 4401 zcmbtWe@xw16+h>G9|Kxy=?aAh4|x2hEh`i$eU{Qv3lov8*tH9zw#CX~yOIqPXKlbY9f$+U`QTPaSnhAxl9RWY62OLPl!f9#QM2_}xBt+O+oA&RM=^S$?x?|ZQ( z%Wm@hp7Xiq+;i^ze9yV>EyhxB#Zu4K@XMEKr=LlUWD-W^)Zd>uSiq;JT7P=g$4`gT zUo0B>I72K%pOu%A7f}OI?lm7#3iK-IbCBD`0R1Dp*5PT!(}zdqhl%{+`#C%_(9aDJu@y~`7N z4^iOCCkq{T8|&@)0`G;tcVTnupKav5p2+tT6}BR>gSp(hGgsIRyUSeo((~)XnG?Q) zM{Kk&c%rov6<_*P`#dpG)cU%O{3TE12Z>6qf8u@4Px#g>+i3fU%J+pon#dVCgt+(O z31X(#>dlb%SiJ}HPgs2z`nNv=fbnHK_~_+NC*gBR_=O~VB@wIg--j<=EZTZAak|1u z!g)!!COmhslIz1fS;#9;Z~bcMhlng)BBPEdCmS-3>(O3~9t=G{=)t>D z^8fVU78I&{l=%8Kl-isJcMz4X@!(FPshqb@Jj7Z0bOnd~!$fPr*ZMGV4|YhS7QdpK zD!GUk^kImt3&aCiu+A83);8jE$V^cWE(VUpvHnFRSFV$T=HS7QBw3gB2NLZLajXDy zwRT$YW?)<`uAAU8;O02i+p4gaE&3qD&=B$M^{@^bYxWO_Z%Gon^Xy*|FUeldCfUa< zzDB%^mZtF}`?ST^No7>SKI6fa!1k<G&61)ydgj;6C2zXyuGVS|3F^ zu+16&ht~W-;y@y;T$V^HhZ1S!W)H3T*Yx{a_)rQ`L2atx#)CpYJMn=;Lis=~f4r63)5WwC`4nLxnpBm!loAZ}B@HWH}dPN5L|i(5zSlv@XDR`VNK424|aGYkG$Tw^jlr8D=J8e@z|IbeDjO=gX^5GP$;*!YV z6+X!+aOTp;&0ljPr$nKbMXG1`hDw=%ULFZt6@40dMI_@IuU09u&?_T>C~x+;ajGI6 zf8a)y0$O=v+MVp_L}7|^34Vmc~fOsDQ;@o zDp7q^P-3^0YW1kLuG-W{O=4V^QW5D0O@*VN##Y*dxKeehqQ+{Z-~tI&iPT6%rN7y? z&-d;m|50V7eY3xrd9yRKGyC2`x?nzCFjC9ozgvIt+5GQ(vyX_*ef;bLVSeyj=czZm z{(~jp5EV8i&%78KoW9FOTQt!Rs}*FllqiqLTZ{E1)@??93F~64qnJ-%3O|9F2LJP* zQ<(2L`b_i>tTBA;c+A^t_F)~x#7O??rSLb^;Df=uwBttK+Irsrg zi0OM>rnh4~vikos{Sx$@@P3>8{>vK&Q{af@9WKjXz`Aq|kq3#BSeHs%J#?JJ$?LEa z5c;S^vZ;{1T?L zLjtoc`Q${1JCe^$)bRG?nTe`ZyP=6NmP1H~^XOJB3x2*_^Shvt&zjuj@RG& zt;6wiofoI>%v=39(f(w??C%GkM4w6yWHe#Uqf;H+3|zD-gFAq4+NF*a(KgH(yFfMG ziD#!>R2p~TIa!f;e=qQyeR^8HA9u#~zZ`pjSE^sHltj&TQ zPBS$aw&0Dx?Jism9Cfhjsf91Bz5z1$#g*{RHdB zVmWNYr-!Kd)N#Dc4=ZJp6v*HiWNFnAi*Q=nmi9SjQJ=wohJ57{mM&B=;>hDht}}YV zT0A{R?!>G!4EdN#zZ!Vl#um-0-VN~M8ulp~vdHI->4z2t4c=CY7)LBZdbOYb0_8DF zSMX-olF^82?!pvjeFnd0;a)sK6m(%9FwALvuSep;Wg;cfsQ$Boe|c2w2tOa!;ANu+ zqDLA}k$)F6{0z~8!Ow{P2>|#d@~Q&tizGx0-k1mZ80j+;`J3wYMt&sEUVf#HI}XY+ zjQ%Tr1z$q*mf&T;^DZoMAEFZdM#z1y!K%S}mrFzq20x{4)R|qLQa$zDaZKKFMgl$y z*11HW(*5pShCU~noSjQAXXg?)E0=|KcjcxM?4?rKgKfgAIXjirh}ZvJE>fN7rrmUsymfO5RAbs>dI!bON-jwz#We- znaTmy7iWdZ^9@|0#bE%Hhm@sYU6w<3SvuGUEU6T%%W?zGuv0Th^AC4zN9y+(xe7ih-c!YbIr z_vMQa>loG#%UahEypk`(4j7jq{C;5B&1bL<{F9u(fwKa?l@<6Nv7`GD{L97;h#pR$ zr?5{XVi%F<>wd%q`6;vn--Nuej+4Jhw`kvQu2Hqke0Ph;8p;tg3Q9^va2(j`f-QFv z_QRIJlS(!7o;*>VR9Bk0Lm!QCh@$8!5$TLfF?AVy6;?Mt#uRg53wXfb$_Q?V0j78k z9x`|bMHjHqlJVH*58Bn{9>)d1FVnQL~lR z7C~UAdUPALV>43$f|mpP4A%GdJ@(g1{L=R}aD=Hd|1ZbYTSg?Jn#C z?lRbMz-c1gRP7#$d-2C4Int#Q^-#jR@Rmy5W4h`s723)Netaq~_1IR9Bm(r1vpdc) z^^-sFVGhK5GrY=F-bLQRfvLU>uPU``ia)Rd=O4-Ns#7g*2=DBn3~y~}?H}1=1*T&e z-nvxFG*@{8bTq@ONge$YZ?OVh{TW_u>czL&@_rkTKOQB&LRiOsN?m3FZH%EfaE94GX!f zW`xWs|5cEv>J~DlhJ|21Au;8@rkUMBupfwjp&x~daaO&14IYju|8)reuDY*t&Hn&w CaJs+% delta 4599 zcmbtWe@xZa6+h?u9`F!eeO3@;JbefXDwQ8Tl!98QxH+Xlt9A$*GK;Nt#FAxOm~rFL zn$7G-;_}Qcam&V*+EUh-HrPCp%@x*$v94+8nrx5OtR!0~v(C89EuClRng0r^7{X|%0^o?(Sx-OWHO&9jmTSu`3&aUjr?zzufV(ky$4Yr$+MlMD!aYrF<%Sd8Bytm!OGlEQgRfWkBT*lPy%7bkEl z(P+*)Cl7Lt`uYZru8u(7f;~r9A{V-t&KdlQsw?HSJg3@0s^%cg>0=r<(i-fb=>pS~ z3l{;$9jp-6QoT{^O*e6JMQ*bxCb?4tzmLA^O{Ow~??4`mGgZ3qW?;FGL|^13zzr^( z1&mE;If!m;7@^-!TXKo=uQB!747wh`g*VI8XK+8{D{r&T2yyUz;JjOjC|m~4SztPE z^d0%2!INTtk!dJJKBjR$DisRl+166v1eXFkffJks95)6)bi0L77F38EKPO;O8S+K& zY2eHpiz*HNp5T07%a;Egd@i$eO66o5WAb5*YTtlZznz@8NJ(cUw#G)7$H^ zsLgo)2=d$>OBc^lcp&dHa(!NBt)--Kz8`eSH$y(;!X?1NHn!-Fs@sHh7fJd>LI9EBPh(8lvLw#+&NGK46&Ba<51B zhYPM!80wFk_{U$6?}VR@t9jb!f#?>;DDt172hR}6DG5F!`ey;KKEcHq@H>dYHF$Fx zboYm0)H0nfXz$bHzM=yyWy`vp80 ztUbO?Ixj^2Q^;$kNKIE5j}D`8I1PeJi#3k6h34ji9EhmS#0auBUPpWsfa7UWBnpAZaTz^=m zI;@9qPr1Ul3^*yQz)o0$xM_W#g;jT0yRjLAkEu5*jF)3-Qzh3wDPEkG6v|%K_jZvH z76yrSp%cp44J9qa>^Pzu)RdLDkqZt0 zOZp1Fh`#DYqFEPS4ty)+dnrHBA4B&e+2qm@tdk4LhVW--M#dWTk1F1mCBh6mMpfga zkjh2sWHpzx3s+|o)+bNZZn%*q{0qS1*JrQ}!R?d~04IfDF)0N5#g0xV@TZL(5Z#g)tlmkV3Ky#}{Hp5BY6D+Ql3 zxEJyjXYmvn{B7U|FEG92!8<4p9fdKMf(35}ehB&j7xn>%yxVOBX8~nKA-f3Y{vuv)gLPV6VQMqDUDa(vamm`-)x~YR z{lE;qC^2q@eFvEEIwoZgUdI5~BA0CP0VicoAzn)@Pbnbqo$RS!hXN_LXx`Y-1r@fE z3M2sRWREVWS~xQqAb2^j&tQG+?6BW6S(m=efkRB&^gw`hTwxOP40@s*5p+q=X62a8j6nlfs1O*A=Ejk%8}oNjtz0 zH-38Hr)Vq@CS7FXi7;J-y!v%ZicDV>2CG1rYwBg8|AvA;j=v$Z%_bbSH4B68FwEQk z0iypE$g6KyDiY>B+M>glhQ+&AU9)GY>Ry3`tVR3*dF)ULP6u|XQ0HvGLsLest19H7 zxWSIxDI$?ukfSKrC)A#Qc-&vHa6r30`R|IK{#gv8Z^kU_