From 9f6188a4cb892fe0a1b9430a2ee23d5eb71a165d Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Thu, 2 Jun 2022 01:10:02 +0300 Subject: [PATCH] Set `len` and `cap` in `golang_net_http_gzipreader_read_uprobe` as well --- tap/tlstapper/bpf/golang_uprobes.c | 2 ++ tap/tlstapper/tlstapper_bpfeb.o | Bin 130744 -> 131064 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 130744 -> 131064 bytes 3 files changed, 2 insertions(+) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index 7e189f861..11bf989b6 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -162,6 +162,8 @@ static __always_inline int golang_net_http_gzipreader_read_uprobe(struct pt_regs b->conn_addr = s->conn_addr; b->is_request = false; b->is_gzip_chunk = true; + b->len = ctx->rax; + b->cap = ctx->rax; // no cap info __u64 data_p; // Address at ctx->rsp + 0x8 holds the data diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 17a9b9e909c078139b0c7889dd0b642c08cda315..21af51d7f8b4e335bd5374a0c89c13b6a963cab4 100644 GIT binary patch delta 5680 zcmb7`4{X)d701uLzX!C1N{h6wEiHX5rMy;POzEGM7G6adR+t_Bp(<_G5pL_D_ zBJ7@f^5)c5Gk9C8d;L=%riPe)@S7{$?w-dN-L==~vi4FA_a1K79NMgRBYGrg#^WJ9 zF1G!QW^ixwK1yNvNZyrhEigTYVjk>p*ZP& z^~K=)OaGIZ?Jv%~eLF+T5ZXP9mT%tF8mbFzelWIZ`OZ!5vq!Vtz+1uoDSy~DYswL#9VzZZ z?;US@9ya)yaa&517l-t?5_NE+kL!^5i+x;ARD|lzWZ%5?4Mg*~{5<{!(SkWX zUQg72_|%8DwS_Q~E0_F`yQiXU0jElz=lVzfUrp4G!7)&{y9Ct~QLGX%U~E z6EkW!IGto;2#gDi_h)WvEW<$T^MS?%;C3HR2jf=b1(OZ8nckp|Dw@Y2O@T0CCP3)TiIxsY?DnsJ!(X@ z8qRu?h4lMP6HO6*)6n{{{lG+dH=2?eYfV-H0y10mhc1{g!p&wy=canZk^J?NOIK^4v1T{xb%9Wi4Cc|++bs^sJcTVynYGqGhwaG zWljSlkbb>{Cz`RvYv@b6J6k&fYkU!DeIL;=HCpRg(-^4}Rrj&hYfihFjjW|1IHKP` zzStJ7x9=Bg6|oe7#Mp`ebiUY%8Js`*6dc-n*&ISHW_(F#3x7-^KQXkTBr&w2Ix(~& z;tOrz3H8rq;?AjT3;lJqqULrTgeDTVCI(g9niy2A_ktR_hQ!9ipo%TNpoUu2=~`uVb)w~Ud zT3sHxQbZMfFiZ@bUD zeiCa?wZiU$IEY4$gSXFF_0xLMVD>qyPGcYad|*j8Ct~a&9AXgRaMl_%EUU6%Kgc=~#9AGIY;81PMC1EZGDkT`&=*BLjQ z_FWR)d0^{k$z>8<%+^t|jZ2*mpy!A1{hZ-r=mMc?Yrvi`5H>tNk3k zz#*#A6Fh?`Cc|4v-oQy`LxIr9wK$-NTK&uFiB&eqN?%qd(f4XhHsKWdqrV=fLE{4~ zh>&b&um{2&BX=joX?Ieb_9Voq!3*CWUz~VH-A1gLM@bG8VZ_D>H6{mn{)E*Z$9L8?)?W-57^?sJeu-_Ne zoU<0;@oFxN@94|Z!Hwp8nz6qVHH?~aGPtIWS>BINQm!fM@1%azr^k6w61L{f;F}dS z<*Ny2DQYN?V-5Zt->l3b!(>}viDA@~vlO~OwU6n4Z~*U{?|T@MAF$ zkL?uyx~l@)i&8Vj|96Cw80SsUY2k{({ff-Z_}WLrFZ!9A7xZYk42o z^4i9xByLXP7<2r!cf_l*B7%OIx02}Fc<2cnP2yJOc+Ux5%l;riy><_u!_RyUKl3@t z;|GStd!mBv;AQExEzu-qJAQpTbG+wW@rhH>f&M~oB~f!{5_c!@0CW7*X)#?^457d1 z^R@SlCh_@1-iE1SQ9OTCoN(YSxBJI2wAl1DPbBh=lqAlHkN-`?GsK|kx+tndqZ+v= zR){W@a|z)R ztKi2FJJbdi4=82CFpKZ0;3ryaFhUtIY((&~(Xn_?DIMMe5X=@_Rt zFFH}vDV?Ts>1_T`C!JcG(IBz0eax7)@khtB+A+l+WRz+YT2osU98?sPe$U;#;l4Yg z)9%cDXFq#(_w1fMXYWmpot(b+i|IW})RB%SYTECcbLX|xODOls578NaOu3KV_bsk) zKe}(-j2_c?MUUHj{}Eo`?!4!m<(;N&UMJ0!+8rs66W8Bw+V3o&nA9=}kNK8+Xr|Pz zzngO07rQUum|J*n3CD&O|7c$k$A`Xn69EtuUdEV16bVfWd*$^F^x`Q@d*$1n#<_$7No zXv@cwBr4tK{&jb;Dt*m;A9kw#4?C+KFX5H$wU0*^UGqPgdGPV#boqAc7`V6cd238g zQ=Byi4@%|B_>p=7^#it^gq&vU?P!13);m!@as~k9ay*!)^7Cx2nmNTAybe`GQw@e| zLwsR~FAeeL5dYB4-&2zR>rm^k`}Cf2RrR#{FA;xn^9Rpru9E#&&sY5u^&9ZC6IC6t z^(~NB;*ma`Xg_J|eUK7=H{ux~TI{%Y4OZ|B_g8}p3uezY{)39Hl^+zic5!s*?ZNlv zyG<`d-S7V?*L~>eX+tfe)jag%pYNG-S{Ko_QFr-)7t*q9ale#hM1`f0KGz{|h5~#6 zVpx*a*RLWEMO@QHBZ@h37825+I>DCG~bew8v zJssR_7&TLHDR~19ky?+%(4gVG_eizP0FM}s)|1)<=6=KZ7n4c}k6ZpFsqMlOhA}dY z2Mv?9!xN;sBvB3!}D_U1JAG!`WzP2(ZLLGQj%HT3(Qj{eql`oI=W|a0*V2oI;1; zIh)Ce!%5U>hkis(3{Lb)~!MRRiuW zTt!Yhq2!ox$Rua8crVXzA-0^7%(3p5u2PEqRPs8APm*@PyX5p-q~EIL!gQh3<$P0i z^0&z8m$U3Jyr7nxL0L?<;TRS>HDl6M?Wn3{*Zpe<1|UIyduG3 z{W)b|!VVC<#Li@ZW%q{zjI@@!M}pHY95cM2hn#V2kXsGQDIAbfXcOK-wBQgq6QN@` zjM=;!@?0}r{5A0VBzL-Z48jVR{^nWWJm`GR0mHDc6Cv6vJFgMeA1>#IZk%eLhW0Vj z4>eQ94HqpW+93`(Z0FfQ)P?@CK^Z?C`d--OgyGZRoIcT4+VNZU@$>kqY0|f7tKQhi zjoG9}XN>Xs*B~av z_mIL8W5eS62AXa?RjgOgmWlFEujh?lJIFUdLjCuWcApfNQF}sdl;%fJUcj{+&tMX{c z!3upz6X(@=O|RlTAUn4cE-WHmtH5?bc!FES6L!Ldmua`jIs)~BP2A|65KMZ-NgBg& z43EGu&RW9@e~NfQ);a9~h8-tm`FY|L>^L1E?zTKh+=cjd`V5yj#JifngZR3UjV$y# z>E``&_xmrromr8 zq|$I%7x92}Xf-UJd=fj1v|0T=efetKTQYgsK0UOW>o2(sM$3$0Xk0ESFD$>b(xWLFAL+mr1RbsI$I+Z`8$DAh#QRc|!kqjg2zY z-$30@H`Rt!cwhOeuo@IuK>4GjItA>4aL=f&kfXXnj@p^+sAk`RI|GiADZMgo?cm#d zZz)==qnsV2Mx_5SqpzqX_1seT!*}X(Wjc%J9xV3~uF-3|9Ur%WgsT`PHGwz{B%GQQ zSNKzYKT^5w=dAB-W^5 zB$ktq#IjqS(oY2RSZ^f9CSKV(e5fL^0*T=)Ln6u7vuwEXa&oGL6Nbr_NR446ma`1H zNJD^eR*|)a{RQ}WguHSZMBiZzAb6Z4b`Swm_I(P7qY5KYrzLop+ zSPMtFGc(!3FBNc4X73HWXI6d>99~cO!6TwS({Ve0xUn{Yx_ngIawXQB#mNxE$y||n z;3eM3wR=&o^hXk1H5%ga5Kjtcs{bZqWuB^2V>h*jI2Gbf;mq(peoED@MSbz9vDdVP zcuR;ogfj!L%Gf08c=!3`I$1}M+e0ktI6L#eIKRQQVn_ZUv1PN^39{G;a<_11;B`Lk z)b^l$jz5xUOJ9fwLp&m!Iq)W*u4>0oUvg^f&66QMmd&^12xsDN^D9oK<{!K#k9&0D zC@;{*Kjt_mbnFve$tm3?Vnp|fSgXfB;T3Avn2vo4Y}0KJGq7PPYEUOW!SJU(#qb=?vM-6kTXdqwo=aS>1G*k>61TQhpu!@B)5uFHKx{x5^FZBqAvxmoW=FTP1f zKlj825jSfs;ugJM#8w?W4somAAYz-=B2s$45z!N%+w=w_v=RG_h<;&oMraYY>-|PV wzw~H>i0xV%vEPX3NnV-zgE70(gl<2{b?V?@-FuQ(Hq)$ diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 0b0701a705c59b26c9faff31b6f9588a99fe5952..12c4375e2f4f414c6fd01f5cc8f857679be62bf0 100644 GIT binary patch delta 5824 zcma)=4Nz6b6~}k)_=Uy#=u9%w(W;G^M2SvJB_lRES|*)RtCd>R{?FdMy!-A(dCjiB~Dahl>Sz05pUO%UPD zaG`&^FFx`76vhG>3vlDM>zIF6-p<$q{r$>NdE=&WBXIIlvMrl{HNWHFXwi^)&}-84w+^Jtt%E6Tcqv4xY0EJ=HvQW#9C0M_+^!2CW^oWyF^goAQyO7UfIoLgfqQxE%Pc^b=8j6pUJ zuJV59CqiGPI4mCS%Qe>E<7PG!f+nAU%>cJpI1JpT7=vt`xY7cJaG3D8#`+WwW2YgN z8au7H4f>FE&?5|FzZ^Lc(x9;$ihmp348c~7jVOWij?1Xx!?+=Qr^Xomk%Mb+7~hJB zD1K-XW3jJkEWx6WfgVAW_CX2Izpk-t#mV6CPDISqHvW!aZ>)3#wZ!puaPwT0L(^x zxgekYn8xTuPmyrKIN9l7*%qD!&a-ej*kj=^aJga()I>`z4{2TiX9?ks@x+kNG0HKX z7u9%Y#il#P^P&~@@h%5zg$LS<4*f*8V?0kxeW%jzgFa!lgLNr3_1y+HvyaFi+rfHl z24*64VZqrR2Rp0u#52GbEgS~Ep%{bFR32S`{lvwHj^d_R`1` zMO;4K9$&=IK%dy>i?EE?5nqIdp`X<6U}l6(eHXST(*r-4lTJ98iZCG7S5sN--P^?&h!(?Ew$RXsGHM&#aL76qEQ_EnSueiw>sqoSc~Bjb*+OhK z$`;~3q9?!1{yr5Y~0@ zY7J{O4x_liB`y{4H9_PX^ZY`-@au!wz~wLgREi&3CML@XkT?`fVwte5M#7rx1XD1H zWx}@Mu}Y?VZ8pV05T90NtuT%6Hu9JB#8F@hE^#+{+{&@RF<)JVP;OzS!o z%Lv@EMF8vPFT=MXRL25p^ zgfGmYdF?cu9BD;$NZbq7O5sPbj6^y7D84RUE#b=o$@IGTYYESn&qr;Bc~D!VlELWb z3_l=}r>CRFYB;O1um)~WydL_X2F~zXAni?VRs0j^qjz%FrFakc;nz9C??JP?!8E`R zf@Ct#U@)Zk8aVP-r~}163}q~-8^=^U27OW&j;Yu@kTbyWNA@n*M_Jejb_L`a2IdCb z${-1!w$A;Wl`EEUJi=L};+pAV*&-AcMGNzNi+Jv1^f{caRwj8w1|Z7#!XcKaGtv0k zHQ5RFOPwkBmcwnCQ~iqvVl#D?!fo7ad}B&8qj=)y;}g@uQD8H5WHIGw^36oc5>Eg- zxp8#)&MCmQEF21Uah59|hPfcBN%Aw;K*VBA{`!$a8Jp$!3Rn80V#gAdV@JgRroIBJ z)Z`xtCD)0{cY?U&OvBEh9Iwz#ulGB>m%ZQ7!WlmYLe;i;^s` zeqWT%KtJzy+{4S3|n!FEDF?<-BT zmGC9fqbV4I$FDCte509VcN`wV#_+AKvYI#uY?h%++9(G*t@N_2T=-~IZ0gM_l2rvg zs=_EcSypa*+^MXVWi{Wy5)}U(3nt;S)}`1CYPQAR1^YY;JHe%j%?+4UB&#Y9AA$7$ zALB9e;JaJh5HwTlTdK+m^RP0$LR6LUn#3Li)vtvRg|i;-l`{TGBJcMeuI7g#qC1rl znJ>Vl&%33O|8s3&!V^k?Ap>%^jq_|=YGv=+AM;hbuxE|W#|-%BxA9pU4_Vopb(VaT zuJieD!$+l!Yi!(PW$y>)c&}FI`GL>JO!z3bag~i5tn58-o_ypz>GP2ZAEh>~v~i7< zy>EZUKjnqx)jl7y;G@dM4K{AEviHE}{NIkk)*7FW+3?Y6<8B-GS=sx=7u=y0p55&8 zkp&+^HXgAttF_pBlZW`Hj(Inp^U3DG$Eb~+_5S*Vdhg%9k_!V&uL+G{ljO7>Rh@?@T8=5+3u)AKY8O8F;M8_zsH;Vydi1{z5R#ebXCpu_& zRt(VaoQS!LpigU1-zqvtu<{-R zS0NDXG)un+)eEBH9{ju@I*efegY!p-Dq59Dyw4YC+1EtHeO?sWc+C(mi4bqz;VJ(I Du2^EZ delta 5566 zcma)=e^6D&6~}k)MSLJXpUAK9sTg&La}}RffLfS6B;|CV&lA8O>jah(-|AIra|kEe$U>$y!&p) zOm^J2`#I;_v%6>aEIUp-n0o5oRDXficB60hmVNG5k`FN|dr{+1-2~_tu?Xr#`8UM_$K2=Jt=voa~RXH9EwWVaxl9@$h@e- zImVfutj90HlqS3aB2~0i=oCKs^#`szp3SR_XO5@jJ)8Hn2L9RcEZ=UJ(!li?>_fzz z!cV&k8FQmjxd1u!J*bye--~`ED#@EruPJ#u`Zv%=iCc#s@^i<*F@>a-`lqBpW=J5p z*uhUYc(sF@9sGSG?nJix*AD4Gq4C~{Jnj8L;~JWe3XS;QnJX^C$l8m4puZUtYeK!D z`Yq@;qLNKJ>H}rpiT-P-TTlm4b>n-z`8>+_W$&!C_}OyZ@es4;=m#YNHKqTP-s{Q6 zk~1mBxBnPzyz_o!f9=p*-hc8>K6m7vmlzw`VJy1*kuMGhhT=wL0cuWqh)clz=IJIi zt3W-3Q*GH-gLimByc~QjC&Vkk^*B_P{c7;uyb!O2`!}xK*xIG zxI-}-S^W4V2cvM1x?W?wivO9wSX6^1cZT!}Q^1=v)`evgufldlwQ4M=_*cZcH8!G{ zF`qfWm=g5CAZCxo#udK}hbbMn=kSjlescz6)89sf6qDW!eS+d1aCN7~Jc>>4j3J2f zd(y{2?^XPP4-S_OXspH(fFA{8QSyTiz;WOf#g$0fDM5|3E53<|@==Y^SxQr*(M0pX zY}~Pxw=`A&G3j?gpNU&*evwTu2ZB-?=YqX9p2ozLVxI2%1wKxV&?om%Zi7po+{R|y z7Sl6ynMgF)P1vWT>XX}QK%eB%nYFE!{*W5$81$*RI_p$y>AOsRlKq(s3iQcyU>OXl z526u@xurTgXXAWu(8kkB#px0(rV6%6i?MLEnzFwEvYL9p| zvX?dKlgT5Ksaa<@qB7zJ^tG+}C|(`+GwXmI3JwMR+~*GfwHuim;{cRAcQV{eaF?gv}kp_k*V1XP%e8gd%D=7_l5+ zi|0T;X5(D&xQ(ZQ=|ZB#StV7m9}|cR>a5Pb3zv1)Ah`vp4}+)?$2N@X@{)W^dAo?q z>^fa&O?W1tA-;@li*06d8!UE#F<+_2F=jKiGr0>FGsN|B{>~P%BY7m`bcBelLPv;r zRwfeYRpglBSIK@4027vaJepz=Zja(Q_=_9aiJL(2_Dpem5#Ja|w&*vO@v;rn|2_OB zo@DaMvN#${H;n4(#MKgxmqq&*<%VVqD}euv6%Mkt!Z@@#gPXVYRAn4(E6&!*ozn+HAeZ2ByD zB;-TN?j~$gy3Dgmdg25yomFBtCXw9D*ocke!Q+ap?-LMhvM+*tEY4VwVi|`4{GI1) zsxijB zfpO4)FsxtjcoC3g$HQWoIpr~Jw!0$XQCCJ`RDOq~JZc(6;cylfU@UN(*fdpIkR6SW3J z7D>K<3B)eNQ%|uB&MJ*HDfWnteW{II;2Oo&1gwma8B~gg9{umaWTd=!TdNOR3q;>al|twz*77w*@6kxn zRLfh^kelHpiZF(?2d>ugvuWHP=-bRs#3uTc6`3!@PgmeOyZGl%S9ltg0!=>TMGp2l zxX#Xj!)N(AUU6z;$VUNu3^_RH;4wP~=A9=Wb(=yy3gM&4!L1H%w{zh1Fz?qYYMu@G zm<=Bd4sLO9o1FtaACnL7^C2H|;G@pLO%86gbKr20U*HuD%^@Fi;iJXDZ4U0RbD-xE z|F>S@ZwdLB2Opgd?sf2>odZ`s;ks54+#2#RA3nw$JmFy1Hk*AQ^D4if2a5jAyArrx z{PhdIkb6Ype|Qyd74_5%iv85oi1TQ)a|ea{OJ2zvME#eLHi-SyxWsvCibUcBnix?} zO{>_CM))V74o>h=-X{`o^Q!3I9yP~5vOsLS%}b&i|7P;o4)N357=EP~h8cfRxbMhj zEj3%k0cy61VQRJu_kYp6B-T>1LmZ%{RScVr`z~mwSZg*1%x2hZ-1khK*&IM4_TS^v z#ppdgkM9!h`%v!^Yte|r`;Z^G&*zDH>W!kucMJCeUgi2O!i?e(jSu)jZTvHF-~q3U Q{>G>&UKT4ZP4KM$0e4byQUCw|