mirror of
https://github.com/kubeshark/kubeshark.git
synced 2025-06-22 22:39:40 +00:00
Add log_error
calls
This commit is contained in:
parent
f0f357af8c
commit
a69eb38663
@ -7,6 +7,8 @@ Copyright (C) UP9 Inc.
|
||||
#include "include/headers.h"
|
||||
#include "include/maps.h"
|
||||
#include "include/pids.h"
|
||||
#include "include/log.h"
|
||||
#include "include/logger_messages.h"
|
||||
|
||||
|
||||
SEC("uprobe/golang_crypto_tls_write")
|
||||
@ -22,14 +24,14 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) {
|
||||
// Address at ctx->rsp + 0x20 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe
|
||||
__u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x20);
|
||||
if (status < 0) {
|
||||
bpf_printk("[golang_crypto_tls_write_uprobe] error reading key_dial: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL, pid_tgid, status, 0l);
|
||||
return 0;
|
||||
}
|
||||
|
||||
__u64 key_dial_full = (pid << 32) + key_dial;
|
||||
struct golang_socket *s = bpf_map_lookup_elem(&golang_socket_to_write, &key_dial_full);
|
||||
if (s == NULL) {
|
||||
bpf_printk("[golang_crypto_tls_write_uprobe] error getting socket");
|
||||
log_error(ctx, LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET, pid_tgid, status, 0l);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -49,7 +51,7 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) {
|
||||
|
||||
status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)ctx->rbx);
|
||||
if (status < 0) {
|
||||
bpf_printk("[golang_crypto_tls_write_uprobe] error reading data: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_DATA, pid_tgid, status, 0l);
|
||||
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
|
||||
return 0;
|
||||
}
|
||||
@ -71,7 +73,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
|
||||
// Address at ctx->rsp + 0xd8 holds the data
|
||||
__u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8);
|
||||
if (status < 0) {
|
||||
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA_POINTER, pid_tgid, status, 0l);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -90,7 +92,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
|
||||
|
||||
status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)(data_p));
|
||||
if (status < 0) {
|
||||
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA, pid_tgid, status, 0l);
|
||||
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
|
||||
return 0;
|
||||
}
|
||||
@ -111,6 +113,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) {
|
||||
__u64 key_socket = (pid << 32) + ctx->r14;
|
||||
struct golang_socket *s = bpf_map_lookup_elem(&golang_dial_to_socket, &key_socket);
|
||||
if (s == NULL) {
|
||||
log_error(ctx, LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET, pid_tgid, 0l, 0l);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -124,7 +127,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) {
|
||||
__u64 key_dial_full = (pid << 32) + s->key_dial;
|
||||
__u32 status = bpf_map_update_elem(&golang_socket_to_write, &key_dial_full, &b, BPF_ANY);
|
||||
if (status != 0) {
|
||||
bpf_printk("[golang_net_socket_uprobe] error updating socket file descriptor: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR, pid_tgid, status, 0l);
|
||||
}
|
||||
|
||||
return 0;
|
||||
@ -142,7 +145,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx)
|
||||
// Address at ctx->rsp + 0x250 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe
|
||||
__u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x250);
|
||||
if (status < 0) {
|
||||
bpf_printk("[golang_net_http_dialconn_uprobe] error reading key_dial: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL, pid_tgid, status, 0l);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@ -158,7 +161,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx)
|
||||
__u64 key_socket = (pid << 32) + ctx->r14;
|
||||
status = bpf_map_update_elem(&golang_dial_to_socket, &key_socket, &b, BPF_ANY);
|
||||
if (status != 0) {
|
||||
bpf_printk("[golang_net_http_dialconn_uprobe] error setting socket: %d", status);
|
||||
log_error(ctx, LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET, pid_tgid, status, 0l);
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
@ -26,6 +26,15 @@ Copyright (C) UP9 Inc.
|
||||
#define LOG_ERROR_PUTTING_CONNECT_INFO (14)
|
||||
#define LOG_ERROR_GETTING_CONNECT_INFO (15)
|
||||
#define LOG_ERROR_READING_CONNECT_INFO (16)
|
||||
#define LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL (17)
|
||||
#define LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET (18)
|
||||
#define LOG_ERROR_GOLANG_WRITE_READING_DATA (19)
|
||||
#define LOG_ERROR_GOLANG_READ_READING_DATA_POINTER (20)
|
||||
#define LOG_ERROR_GOLANG_READ_READING_DATA (21)
|
||||
#define LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET (22)
|
||||
#define LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR (23)
|
||||
#define LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL (24)
|
||||
#define LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET (25)
|
||||
|
||||
// Sometimes we have the same error, happening from different locations.
|
||||
// in order to be able to distinct between them in the log, we add an
|
||||
|
@ -2,7 +2,7 @@ package tlstapper
|
||||
|
||||
// Must be synced with logger_messages.h
|
||||
//
|
||||
var bpfLogMessages = []string {
|
||||
var bpfLogMessages = []string{
|
||||
/*0000*/ "[%d] Unable to read bytes count from _ex methods [err: %d]",
|
||||
/*0001*/ "[%d] Unable to read ipv4 address [err: %d]",
|
||||
/*0002*/ "[%d] Unable to read ssl buffer [err: %d]",
|
||||
@ -20,6 +20,13 @@ var bpfLogMessages = []string {
|
||||
/*0014*/ "[%d] Unable to put connect info [err: %d]",
|
||||
/*0015*/ "[%d] Unable to get connect info",
|
||||
/*0016*/ "[%d] Unable to read connect info [err: %d]",
|
||||
|
||||
/*0017*/ "[%d] Golang write unable to read key_dial [err: %d]",
|
||||
/*0018*/ "[%d] Golang write unable to get socket [err: %d]",
|
||||
/*0019*/ "[%d] Golang write unable to read data [err: %d]",
|
||||
/*0020*/ "[%d] Golang read unable to read data pointer [err: %d]",
|
||||
/*0021*/ "[%d] Golang read unable to read data [err: %d]",
|
||||
/*0022*/ "[%d] Golang socket unable to get socket [err: %d]",
|
||||
/*0023*/ "[%d] Golang socket unable to put file descriptor [err: %d]",
|
||||
/*0024*/ "[%d] Golang dial unable to read key_dial [err: %d]",
|
||||
/*0025*/ "[%d] Golang dial unable to put socket [err: %d]",
|
||||
}
|
||||
|
||||
|
Binary file not shown.
Binary file not shown.
Loading…
Reference in New Issue
Block a user