From c8a7f769805dc53f746ed75b7a4ff9f4296d0b61 Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Thu, 9 Jun 2022 07:24:55 +0300 Subject: [PATCH] Update the comments --- tap/tlstapper/bpf/go_uprobes.c | 31 +++++++++++++++++++------------ tap/tlstapper/tlstapper_bpfeb.o | Bin 155784 -> 155800 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 156600 -> 156616 bytes 3 files changed, 19 insertions(+), 12 deletions(-) diff --git a/tap/tlstapper/bpf/go_uprobes.c b/tap/tlstapper/bpf/go_uprobes.c index be207f56d..5710b3f16 100644 --- a/tap/tlstapper/bpf/go_uprobes.c +++ b/tap/tlstapper/bpf/go_uprobes.c @@ -8,23 +8,28 @@ Copyright (C) UP9 Inc. README -Go does not follow any platform ABI like x86-64 ABI. -Before 1.17, Go followed stack-based Plan9 (Bell Labs) calling convention. -After 1.17, Go switched to an internal register-based calling convention. (Go internal ABI) -The probes in this file supports Go 1.17+ +Go does not follow any platform ABI like x86-64 System V ABI. +Before 1.17, Go followed stack-based Plan9 (Bell Labs) calling convention. (ABI0) +After 1.17, Go switched to an internal register-based calling convention. (ABIInternal) +For now, the probes in this file supports only ABIInternal (Go 1.17+) `uretprobe` in Linux kernel uses trampoline pattern to jump to original return address of the probed function. A Goroutine's stack size is 2Kb while a C thread is 2MB on Linux. -If stack size exceeds 2Kb, Go runtime reallocates the stack. That causes the -return address to become wrong in case of `uretprobe` and probed Go program crashes. +If stack size exceeds 2Kb, Go runtime relocates the stack. That causes the +return address to become incorrect in case of `uretprobe` and probed Go program crashes. Therefore `uretprobe` CAN'T BE USED for a Go program. `_ex_uprobe` suffixed probes suppose to be `uretprobe`(s) are actually `uprobe`(s) -because of the non-standard ABI of Go. Therefore we probe `ret` mnemonics under the symbol +because of the non-standard ABI of Go. Therefore we probe all `ret` mnemonics under the symbol by automatically finding them through reading the ELF binary and disassembling the symbols. -Disassembly related code located in `go_offsets.go` file. -Example: We probe an arbitrary point in a function body (offset +559): -https://github.com/golang/go/blob/go1.17.6/src/crypto/tls/conn.go#L1296 +Disassembly related code located in `go_offsets.go` file and it uses Capstone Engine. +Solution based on: https://github.com/iovisor/bcc/issues/1320#issuecomment-407927542 +*Example* We probe an arbitrary point in a function body (offset +559): +https://github.com/golang/go/blob/go1.17.6/src/crypto/tls/conn.go#L1299 + +We get the file descriptor using the common $rax register that holds the address +of `go.itab.*net.TCPConn,net.Conn` and through a series of dereferencing +using `bpf_probe_read` calls in `go_crypto_tls_get_fd_from_tcp_conn` function. --- @@ -39,6 +44,8 @@ Proposal of Register-based Go calling convention: https://go.googlesource.com/pr Go internal ABI (1.17) specification: https://go.googlesource.com/go/+/refs/heads/dev.regabi/src/cmd/compile/internal-abi.md Go internal ABI (current) specification: https://go.googlesource.com/go/+/refs/heads/master/src/cmd/compile/abi-internal.md A Quick Guide to Go's Assembler: https://go.googlesource.com/go/+/refs/heads/dev.regabi/doc/asm.html +Dissecting Go Binaries: https://www.grant.pizza/blog/dissecting-go-binaries/ +Capstone Engine: https://www.capstone-engine.org/ */ #include "include/headers.h" @@ -51,7 +58,7 @@ A Quick Guide to Go's Assembler: https://go.googlesource.com/go/+/refs/heads/dev #include "include/go_abi_internal.h" #include "include/go_types.h" -static __always_inline __u32 get_fd_from_tcp_conn(struct pt_regs *ctx) { +static __always_inline __u32 go_crypto_tls_get_fd_from_tcp_conn(struct pt_regs *ctx) { struct go_interface conn; long err = bpf_probe_read(&conn, sizeof(conn), (void*)GO_ABI_INTERNAL_PT_REGS_R1(ctx)); if (err != 0) { @@ -84,7 +91,7 @@ static __always_inline void go_crypto_tls_uprobe(struct pt_regs *ctx, struct bpf info.buffer_len = GO_ABI_INTERNAL_PT_REGS_R2(ctx); info.buffer = (void*)GO_ABI_INTERNAL_PT_REGS_R4(ctx); - info.fd = get_fd_from_tcp_conn(ctx); + info.fd = go_crypto_tls_get_fd_from_tcp_conn(ctx); __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); long err = bpf_map_update_elem(go_context, &pid_fp, &info, BPF_ANY); diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index c9f63bac6b1aab7b883371c64d0a5340bf411ceb..2a68d1638b5e6bbb097388b5856162f743c48eae 100644 GIT binary patch delta 4668 zcmeHKZET#y5uVxif^6y#o1A@T$M)UX0Zzmvmy!?D0I}0hk^-$;OymT|b_t0Ni4Q}L zkPw1Rutbnt$<`sQky2t+RJBUdLL5PYT**dJ<+e&1V#i9QSTa%t*Q!6FimEO$f@gO3 zj`t3N+CP;lb)~)CXJ>Y2=h>Nk_YO}K4^0#gtmI2?B?9O8+~}HfHwE~g=^Ym$yd`}Q zzemzPy%4IL4-hRPqBv2-H_)y^MX9JypS=*eVI8`+qK;!^Jz7W^O+|ANeo?-K{@v-~ zsgElzO%FnJkYj!HMxEyP{T~*bld3puk znEvK;=!Tat%Y!V8UFG?Lv1?JAh?X5mKQbLzHSBiVjM40FHxWg`|AF1v=?LGF{uFk< z|8Lp7?P6rtPG@%uQQh0lRuEe_fGRsise2DU(vPD52iI>x+w1yW7@u){jMdFu2Y_-9 zDh{XaFX^)vBh5?lN9(H!aH0U;Re-mqYi5?+vD=+94z&Jpr_pNd)bB5tF;IYio_>1f zrm|nU(d};5X!`g}sPgm@8!Z^5t@48cI_f9Vvoj(7-RM7Ne!Fz>6P-Js+TWdeqBHgA zp3c#C|GKfPM;4O+lyWmsc{|!HZU8>v!?z#`9`oTf2n@Fij1t{ORMqH{--+mW%ZE22 z9-4gkyNHx%YV_d3Z+=v#5Mo3irwkfp&l0y(0AtYLH;7wx`w#fn+@?!fctdk{2;0m` zKO*i%1as7CUtdd{sscs^%4~znfD;b45iRKc7LN2RlwufA)UMqD$BTixoZ3m^AjWy0 z4 zL`4w;!3I)@iM(SvR&Y#jnq%rY2|sA=i+!BI9_fk?M}g;k82gs6%ldIfc)`|k81u8| z9o$Mh83RsOd2kpM3U5sgkJ0t~XH3qXr1mCM=ibvkAz{7$1M)s ztWWRZdlo?z-QpClctE; zsN{!XB}--H>$>?FXXSN0_{>$QdqR{Ne3{5(`kW8r9VAhk)0c+=<{115 z;!UVdSS;~0CR8^fwnSms7QJOZSg_q!(cOkFWBEyVZQe3?!$>jOGsaS$*B=*n{c(ZU z3;AB(<-A@Hug}|M&HD1=ysR!Ijz)oc+3NZPD`GdbV6MSORw)-2QSAF!^Y8+(q|%ZX%*m$0)y1&@OY4~z)~HQR`jD}h^l z7*@P4hX?UAgB34XfcH6k0xuARu{YrGS>jhfu{TWAV+>>!Mtlll;Jn4PmBdHzOz|99 zwF$hx@b>fOocsa2&jdTS$raC$XY`}yscalFxCpou|F!%Z2!!2&dx(#TLX*XaAwCHY z1DlY$ZnH${;*NO{IF3$Sde>1^pO>+IzMb&vZ!hp z&W26oXLy{+W6Uv8HAZT+B+r~(#^6%mjKh~nHH!WfAC}~C%-}Lsx62KKA=!q(a>HPa zwZ;!;P%bKi-y^k2BF-@ZX4JjdAh%d~bcsIQW0^s>xHp$vstq=xDcEU3MUmB_uafE& z044P0UEcHR=XQ@A*C6`>P-^Y@yXo_PgI)%4j3?q&OB$pZ&eaAvf?LP~g6NM{7bb^JjzLpmuLlicO17;QDFP0iI-d-WMXQUKQ85LzQ7{dCgo+e{h(-~N^>so7f3v%H{qD4)e~IA2ce}rx z`F3W0JG0;3_T430c9--t^3dx|fngr(pFezhfWJ=29o`?Db^_LRUR9T+`M_)rrO!GLJncTb@GMMPF?NnUQQJ4 zbGFLi!bUtNiZ7TSz>kb07{BAjarB$rxC8S;Zj8C;zLNmZmg2$YL_aOUKODvBJqIi1 zmLA2TKPy^5k-~Y(uJ6A?|5&{Ap)8lyVCvL6; zM$Q?$i#VolS;4RJB3<3aif7nP4qqJf1wBNNR|_lpiZEuQRp_wyCFRo3@#4N^M6RH0JEU?>_iQ6FwXP z&iXL?mNd-8(I>pXwLHfAx&1D0C4Q+MxXH@PpCBF(-r^3wLZ|Q$Ue4{L#5JNnzlyh- z2oRadIMrW>zj&i7!HLpl$^3bE(8Ov*C#h2f{GXHmeoo$U6F;*^HUxWTjwD}JR_rDf zE83|4PF8lULsm)zf5^({dSvBtId5@jNUQ9^^Au5s0A!_L^%2opoDqa{&tu5sqfgKp~YJfXqiF zm;Nc0TneX-MP;auxTcUwmNfQJ$+1EzIWF=B>wf5Gow~;ciQ(RR@>Fu7kV;MzQfcMm zc9p8-_?93TACn-ikK=nNv5q*cPl#I;@VLc@o!cb#35#o|>CZOW&@pU$fEUV+1fn#p^7>Nr!h5cO#9x9*5s0-Uf=j9YiU!U{0aW zryvGKEUr6|SgydHBdacoy9Vxl-k6hLhWnXd7dE-(Ir5Bt#9WR|00vJ1F2nyUzXO4g zTW}pNAEFSqSa=*jgn?Ek@7KMXERS{l`nyfsviuy_G&c#W5pF+vixLYc7FAxDHmV#J ze8r+_3e(0Fi>iU)T-t=Uk(wjL;Fv)1sAegiF>BV~GT?EChw;%7{RtnI;&II2FjkA? zgu#@!X|S9ySmRuo$QhJ_%HRP~7fZ%DCcunZ1_v3sB9E}%ld{ZU7~GsMF4Ybjk@c_> z$Af0HA0f3_0GJRgEOi&L)D4-RrLBc5T_Ud?A+^=VlB{T&V=3}J?t=B0nXqP1TxwAC z9Sil9y7xg_To`_ap%hnrg47{jan(OdY7ANFD=syTRdU5uzgMs5vY}(x+jY$1@|O9E z3x6TiB<{gp-1=rPR`ndgwL8fxlj3>J%4^>xFCxV==x|OxWO<6N)Qh|MsyDWE^R9y&((zTQh3D(!Dz%t9b!L^iK<&!vtiX_tU5{>y zPD@9O*IDWC-i_!E>7;Zqosll7 pvp2%-n^_%OV`h`mWpqZmEjqgf!iym6P>V~NEmbG?=*`!u(C_n6sdNAU diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index b9d5a9a2d28a5b3da78e91ce87973d8b6a4a88f3..bf73cf26924096284767fc3b85e3a57224fbe038 100644 GIT binary patch delta 4939 zcmeH~e`u9e7{||f@AYzZ&fV*eIj7sb{-9mlvRSq*mU=g|<`2fEo6euJX<|?|bm%nk zu9|2iv2mqSAvwZIH2UF0SBXrKoJHjbZH2=Ah_YWK5wt?I@AJIRyS;nCD1;#BzjU*yib0}`5frfcRn`n$&~<%8d_@GbqeKl#EJk?J;R(hMc88Rnp$5xJec4eN=_ zoQ4@_=DDt!%g`^6{++$8?}BCsL9&nS=w++BKJfTIC~_t8?=hKI1J7guEBWmb@Rbu9Z6hQYJ-SZ z;W!xzPhcjV_88RSqqW-O;uP>9w?6jpj_~i$&&|`S!^H*QE*I1I1s5k$Am|kVZvdO@ z6D}O3RB9st(L{D`1ZOm96>@PD49E44XM>|IP66i&JM&ctzcosYQlVy8ECSxZUh_kh zK5!o%k6muJRD4ZG>J_#Nf`dX_sB4D$AG`^+!*|B6p05)`r$wLs_Im$Y5 zaH*~wUO=HwFApl@@hxB#_gGxvvH1VE{P*JW+?BdcsgR34e?NFS*#93G{(2PN(7x5-=>WhkxUt(VX<86wMU*f4_ z@pX0(?*-`R;8U&`HFYoYN~;&P>ghvR#}sVUxz*Hdf_nIv;$zd{Vc;HF&KbWZybt=p zlQ0|Rkv=bf7G?`yHpjQ>1-!~-6KK@AY&2Vl%Lbo)S1)GM@BqEc+)my}-h-usob1Qp z1SzdXP7i`fjhLN09EX!I8ZJe+zKME8DbwlK&#ZTp15mz|=Z|C7tO@qXN&4*hDYR32 zG4?#%8Wm>K^!?+^fo*zzK>9y#(^CgrTxGwRXpCGs3_QriV8_KP@Rb@|X}@?# zpVwIjqs7Gs&BpEG;)CYY_P=s*z2@(OiMChNYJ4j+p(?}^xtN&ac#j>&4hO;HVq$i2 ziyghT45kT38J zlh68`({pJa@=*Zt3o;KHE{>U@2}(r~HjY^wSuy*aO!wEB@}0VvcU@86x zh%bs0;%~uLnH?v@Ymt`q+*9N@4 zU2K8tg-2;yB;A+Pc z{CL`ocv2UZ(>L@KS(kjc9!w|Tptu=r@i9f?d`y7{#mxlE9XA8%0=W}6uVUVGd@eb0 z!|5}_>Q4_&AMjNyPwQ~{6j}XoMVtoilW{)0??-S-1o6oOMmiPn1kQpnQ8~Rx#kel`na??P1 zLGHMT=BMJg>GLQ)Q9B0Q!0Cmzy5oi^=2Ww!*A#ODT~4pMiLkW?&KBE_fURE4BFwg5 z#Vo>C%*I_}`xSF)*I%XALSKJ+O_+qw>+A5KL@#jwTqDfE8S<%4VNRc@PhIeg_qfI_ zj4QvS7pG6mhu5O*bWWcczW#J5#e$i6K9wQk>^WSVY~b{Pe!lDeAUH1UY_Lq2v!}?X z>iu|)(NktW#eJ$#6l%?g-QuTOvwF8)a^mQ2{rW|Hhgr7DD%6`z>ndxuK4iM7DKg>J zXlhI)HC?8anmwkQnm!Y*Mblv_sfn3ZYOb1YYHCb)4Vny7NllGur3Pcv#7y`hG`NqN n4AV+Yqv^JV;W|)}sidaSv{KV&x~b_h;kEV{H4Ub9t(Eg9H5aQv delta 4897 zcmeH~Yiv|i5XaBCTh^uR;udIGOCP(Hq$@=&QYd73tORxCVG6WRQMBciqI_sb2oH%{ zp$I`^kR=>6s8lg&L=kNh8XvJH7>XfKjOe0Y+JtB|nxGPe1fu_$JGZ^N35kZp#Ke=F zJ?A$wckVfJXYM`Qb8>js$>Dn<)|DmijjukZyE|5#E6>tDBzK=L)zRcz=SveW z%Dqz!HmefTA0Z#6R8|D@>zGdzb$)?T*_g-BXQ7k41^o`lCt>VHzY}w|hvP|@qxtT^ z&oq0keVE74(US46itB11r!`dBGWxZu@e>KS(xd{tUE9UjQ@RF~%{=D*zb&ph8! zIJCP!@~*EdW&|N2&of+}W0-FqtCRuY3rq5Fugk+6%(F{xW^LK2 z(itImAkX)?JjXGQh5pXk)}%@kb+9B458|r!GJ8FvF@Fj@2c23cTvV4r?e;IDedE@lsJHG!Fq7n2-+nVhrkHspuPl5N$A+;fDxHN4uXTiaV#VJ_R!

>)Eb7p+BdE}-{r z1!X4MHq2i_R}DDM2!D>0_OC*Py4VK}3jYdy{yL@TM77Oa+Mr)ckQ)+vA?_734BS%q zCH-0S;;o9ym$(@B^R_~X>LOkb_8(CE_9gasp+AHJljw`a-~e_Q&jwtMQ(P3?|2*nT zD>GuFo;ZvyDl&66>WVt{2m8EEe6Ah;;B0Wp#iYL^{4DgokNCyJ>*4#Kz_zh3@^{9Z z*r@06UCx-%n{>rmk~*!)V_WsXn??xeW9ANWGer+uO$%}sUQUpb9}2n;OlHI!9I+ST8wI%?*B2Mr??|%eAdjOp*={+=h+s&VHyN`(ab*8{(7dx*&-Kdu`er?T zD46&(rUet67EG`c%mp}$`tZrY8*(U^_=GsY+;6sSkznpOr?=>eC+Ln&OABVR=955J zlr=aNtVdT!9SSBfXY4LJV;%N^DVW3@%sqC-))bmwHt1Iqj@%1*kJufB?U;5ug-K5w z0H;KM23+vA;x7{EiEjm8%D6s&=#u^?bU#w8QkbKS6vG4XvO(0eZbcZ#Hfp}abQw+i zV6L$yI`GVfYicC#0n@#F!o2Ov8QTV@Z5s!RO19^1&m})xsgU=I9}L`_ZCXW2g^(f6 zwm6AUhF4%k*VjTnae`?Zrl;`IYt6x@b#yYRUWCeze4@M{z5ur3c3u#31ZwP~39;Yg zCL{oU^Jqdx`MJn?R18H$RveISt>VJ-ij}&%2_I$`Ti|Bl?a+IXH=8nem+)ce^IEk! zB>V|@_CBqSc~pXL=ooal3@jM*3FnmH41Z9o0pT)mVLP@d`~dMGY*X0TkT1*L5ZTkw zCE#KoIFwaw8#oJyh{0-H;KNy^MwsK+sa3sjhdJFMaqKWf&*gyKDv%;400z-|zSm9|3e4$N9p&;WFu6OVylTVPYYM@Zy}bgq`rt*F_dWnG!e`Ca9kTbc<}|$A zxV+|j2Fq(i8UE~ELj)yziM`-@VNT9~M|BHx`Gh>GH$$It=`HB-Ptq|KF2BMQJchI zp()xaaaw5B?bJ(-pV+AnpVvXNcDYrpSDUuw)+~L%^wSVA;m0tHGtqakR*jTmqp4L;LGLzC&Zh2a&Th-svu Y$+XchVESq3GU1iBj)qmHZKYNI7pAYHB>(^b