github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-06-23 06:48:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add log_error calls

Browse Source
This commit is contained in:
M. Mert Yildiran 2022-06-02 08:58:56 +03:00
parent f0f357af8c
commit a69eb38663
No known key found for this signature in database
GPG Key ID: D42ADB236521BF7A
5 changed files with 30 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
tap/tlstapper/bpf/golang_uprobes.c
View File

@ -7,6 +7,8 @@ Copyright (C) UP9 Inc.
#include "include/headers.h" #include "include/headers.h"
#include "include/maps.h" #include "include/maps.h"
#include "include/pids.h" #include "include/pids.h"
#include "include/log.h"
#include "include/logger_messages.h"
SEC("uprobe/golang_crypto_tls_write") SEC("uprobe/golang_crypto_tls_write")
@ -22,14 +24,14 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) {
// Address at ctx->rsp + 0x20 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe // Address at ctx->rsp + 0x20 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe
__u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x20); __u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x20);
if (status < 0) { if (status < 0) {
bpf_printk("[golang_crypto_tls_write_uprobe] error reading key_dial: %d", status); log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL, pid_tgid, status, 0l);
return 0; return 0;
} }
__u64 key_dial_full = (pid << 32) + key_dial; __u64 key_dial_full = (pid << 32) + key_dial;
struct golang_socket *s = bpf_map_lookup_elem(&golang_socket_to_write, &key_dial_full); struct golang_socket *s = bpf_map_lookup_elem(&golang_socket_to_write, &key_dial_full);
if (s == NULL) { if (s == NULL) {
bpf_printk("[golang_crypto_tls_write_uprobe] error getting socket"); log_error(ctx, LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET, pid_tgid, status, 0l);
return 0; return 0;
} }
@ -49,7 +51,7 @@ static __always_inline int golang_crypto_tls_write_uprobe(struct pt_regs *ctx) {
status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)ctx->rbx); status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)ctx->rbx);
if (status < 0) { if (status < 0) {
bpf_printk("[golang_crypto_tls_write_uprobe] error reading data: %d", status); log_error(ctx, LOG_ERROR_GOLANG_WRITE_READING_DATA, pid_tgid, status, 0l);
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
return 0; return 0;
} }
@ -71,7 +73,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
// Address at ctx->rsp + 0xd8 holds the data // Address at ctx->rsp + 0xd8 holds the data
__u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8);
if (status < 0) { if (status < 0) {
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data pointer: %d", status); log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA_POINTER, pid_tgid, status, 0l);
return 0; return 0;
} }
@ -90,7 +92,7 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) {
status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)(data_p)); status = bpf_probe_read(&b->data, CHUNK_SIZE, (void*)(data_p));
if (status < 0) { if (status < 0) {
bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); log_error(ctx, LOG_ERROR_GOLANG_READ_READING_DATA, pid_tgid, status, 0l);
bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP);
return 0; return 0;
} }
@ -111,6 +113,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) {
__u64 key_socket = (pid << 32) + ctx->r14; __u64 key_socket = (pid << 32) + ctx->r14;
struct golang_socket *s = bpf_map_lookup_elem(&golang_dial_to_socket, &key_socket); struct golang_socket *s = bpf_map_lookup_elem(&golang_dial_to_socket, &key_socket);
if (s == NULL) { if (s == NULL) {
log_error(ctx, LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET, pid_tgid, 0l, 0l);
return 0; return 0;
} }
@ -124,7 +127,7 @@ static __always_inline int golang_net_socket_uprobe(struct pt_regs *ctx) {
__u64 key_dial_full = (pid << 32) + s->key_dial; __u64 key_dial_full = (pid << 32) + s->key_dial;
__u32 status = bpf_map_update_elem(&golang_socket_to_write, &key_dial_full, &b, BPF_ANY); __u32 status = bpf_map_update_elem(&golang_socket_to_write, &key_dial_full, &b, BPF_ANY);
if (status != 0) { if (status != 0) {
bpf_printk("[golang_net_socket_uprobe] error updating socket file descriptor: %d", status); log_error(ctx, LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR, pid_tgid, status, 0l);
} }
return 0; return 0;
@ -142,7 +145,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx)
// Address at ctx->rsp + 0x250 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe // Address at ctx->rsp + 0x250 is common between golang_crypto_tls_write_uprobe and golang_net_http_dialconn_uprobe
__u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x250); __u32 status = bpf_probe_read(&key_dial, sizeof(key_dial), stack_addr + 0x250);
if (status < 0) { if (status < 0) {
bpf_printk("[golang_net_http_dialconn_uprobe] error reading key_dial: %d", status); log_error(ctx, LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL, pid_tgid, status, 0l);
return 0; return 0;
} }
@ -158,7 +161,7 @@ static __always_inline int golang_net_http_dialconn_uprobe(struct pt_regs *ctx)
__u64 key_socket = (pid << 32) + ctx->r14; __u64 key_socket = (pid << 32) + ctx->r14;
status = bpf_map_update_elem(&golang_dial_to_socket, &key_socket, &b, BPF_ANY); status = bpf_map_update_elem(&golang_dial_to_socket, &key_socket, &b, BPF_ANY);
if (status != 0) { if (status != 0) {
bpf_printk("[golang_net_http_dialconn_uprobe] error setting socket: %d", status); log_error(ctx, LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET, pid_tgid, status, 0l);
} }
return 0; return 0;

9
tap/tlstapper/bpf/include/logger_messages.h
View File

@ -26,6 +26,15 @@ Copyright (C) UP9 Inc.
#define LOG_ERROR_PUTTING_CONNECT_INFO (14) #define LOG_ERROR_PUTTING_CONNECT_INFO (14)
#define LOG_ERROR_GETTING_CONNECT_INFO (15) #define LOG_ERROR_GETTING_CONNECT_INFO (15)
#define LOG_ERROR_READING_CONNECT_INFO (16) #define LOG_ERROR_READING_CONNECT_INFO (16)
#define LOG_ERROR_GOLANG_WRITE_READING_KEY_DIAL (17)
#define LOG_ERROR_GOLANG_WRITE_GETTING_SOCKET (18)
#define LOG_ERROR_GOLANG_WRITE_READING_DATA (19)
#define LOG_ERROR_GOLANG_READ_READING_DATA_POINTER (20)
#define LOG_ERROR_GOLANG_READ_READING_DATA (21)
#define LOG_ERROR_GOLANG_SOCKET_GETTING_SOCKET (22)
#define LOG_ERROR_GOLANG_SOCKET_PUTTING_FILE_DESCRIPTOR (23)
#define LOG_ERROR_GOLANG_DIAL_READING_KEY_DIAL (24)
#define LOG_ERROR_GOLANG_DIAL_PUTTING_SOCKET (25)
// Sometimes we have the same error, happening from different locations. // Sometimes we have the same error, happening from different locations.
// in order to be able to distinct between them in the log, we add an // in order to be able to distinct between them in the log, we add an

11
tap/tlstapper/bpf_logger_messages.go
View File

@ -20,6 +20,13 @@ var bpfLogMessages = []string {
/*0014*/ "[%d] Unable to put connect info [err: %d]", /*0014*/ "[%d] Unable to put connect info [err: %d]",
/*0015*/ "[%d] Unable to get connect info", /*0015*/ "[%d] Unable to get connect info",
/*0016*/ "[%d] Unable to read connect info [err: %d]", /*0016*/ "[%d] Unable to read connect info [err: %d]",
/*0017*/ "[%d] Golang write unable to read key_dial [err: %d]",
/*0018*/ "[%d] Golang write unable to get socket [err: %d]",
/*0019*/ "[%d] Golang write unable to read data [err: %d]",
/*0020*/ "[%d] Golang read unable to read data pointer [err: %d]",
/*0021*/ "[%d] Golang read unable to read data [err: %d]",
/*0022*/ "[%d] Golang socket unable to get socket [err: %d]",
/*0023*/ "[%d] Golang socket unable to put file descriptor [err: %d]",
/*0024*/ "[%d] Golang dial unable to read key_dial [err: %d]",
/*0025*/ "[%d] Golang dial unable to put socket [err: %d]",
} }

BIN
tap/tlstapper/tlstapper_bpfeb.o
View File

Binary file not shown.

BIN
tap/tlstapper/tlstapper_bpfel.o
View File

Binary file not shown.