diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index f473e9c54..f28c149dd 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -71,6 +71,15 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) { SEC("uprobe/golang_crypto_tls_read") static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { + void* stack_addr = (void*)ctx->rsp; + __u64 data_p; + // Address at ctx->rsp + 0xd8 holds the data + __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); + if (status < 0) { + bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status); + return 0; + } + struct golang_read_write *b = NULL; b = bpf_ringbuf_reserve(&golang_read_writes, sizeof(struct golang_read_write), 0); if (!b) { @@ -85,16 +94,6 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { b->len = ctx->rcx; b->cap = ctx->rcx; // no cap info - void* stack_addr = (void*)ctx->rsp; - __u64 data_p; - // Address at ctx->rsp + 0xd8 holds the data - __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); - if (status < 0) { - bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status); - bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); - return 0; - } - status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)(data_p)); if (status < 0) { bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index b6f21af74..1d128f91a 100644 Binary files a/tap/tlstapper/tlstapper_bpfeb.o and b/tap/tlstapper/tlstapper_bpfeb.o differ diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 5acf8f057..f7dceb125 100644 Binary files a/tap/tlstapper/tlstapper_bpfel.o and b/tap/tlstapper/tlstapper_bpfel.o differ