From e453947b12f2cd2e2a26fcf383e4ae69525a9fe3 Mon Sep 17 00:00:00 2001 From: "M. Mert Yildiran" Date: Tue, 31 May 2022 15:23:11 +0300 Subject: [PATCH] Fix the read data address one more time --- tap/tlstapper/bpf/golang_uprobes.c | 13 +++++++++++-- tap/tlstapper/tlstapper_bpfeb.o | Bin 125440 -> 125616 bytes tap/tlstapper/tlstapper_bpfel.o | Bin 125440 -> 125616 bytes 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/tap/tlstapper/bpf/golang_uprobes.c b/tap/tlstapper/bpf/golang_uprobes.c index be3b4adee..f47d98127 100644 --- a/tap/tlstapper/bpf/golang_uprobes.c +++ b/tap/tlstapper/bpf/golang_uprobes.c @@ -81,8 +81,17 @@ static __always_inline int golang_crypto_tls_read_uprobe(struct pt_regs *ctx) { b->conn_addr = ctx->rsi; // go.itab.*net.TCPConn,net.Conn address b->is_request = false; - // Address at ctx->rbx & 0xfffffff000 holds the data - __u32 status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(ctx->rbx & 0xfffffff000)); + void* stack_addr = (void*)ctx->rsp; + __u64 data_p; + // Address at ctx->rsp + 0xd8 holds the data + __u32 status = bpf_probe_read(&data_p, sizeof(data_p), stack_addr + 0xd8); + if (status < 0) { + bpf_printk("[golang_net_http_read_uprobe] error reading data pointer: %d", status); + bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); + return 0; + } + + status = bpf_probe_read_str(&b->data, sizeof(b->data), (void*)(data_p)); if (status < 0) { bpf_printk("[golang_crypto_tls_read_uprobe] error reading data: %d", status); bpf_ringbuf_discard(b, BPF_RB_FORCE_WAKEUP); diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 71f39d94ca491477b80390472a3cc0f001e6527c..22a3176859ec19870c9437ccd7c5764d94d48ba0 100644 GIT binary patch delta 5136 zcmbtX4RBOf6+Y*^hlHP&Kob&3ATJ~f0TKu_l0X!;mY-0frb;XdZ8nln{v0wuhrr-u zm0+V2$2iN(MW-X{U->EH!~tj1iX}7D83e@?=nQpm*tQTh%4kH?DAf3!ckjlxJK{{I zcX+wyyXW5X^SyKKKEhW=cfU2dYd#PDw0z?M&Wap5P`ThRVT>-9zjW>FRBxuynMA|G z!$UFG!x;zlva@%|@X!x$9+<|rPu+^1bNKzp@gEnotsSq`kIQ6fc@a_WB8O-cUNM zysadf_A^+vv6PE{58-Xv1?WBAB2WM5u}Jq(r~Z<$w#sMiDWbx{4;AN_W7Ag_RvOc5 ze5OA|G~<~M9BBBM^T>8%?bAfXXCvP}meY0-b|>L+v2xYOLCha9atP};j2wnM@F)Pr z(|AB&@!eD$aMEyg8ZJx4p9xf_E(BJl;V-1&FQwu3H2j^&-s7|Qdy((s@6pJwju!=9 zMX09c1Lq)r5l;xum+@@GvzaJxDKhcIEWR39e4>bd7kTzX4!?Wqg%eiRf|8j{jk_Bg zT1wqrTlO{Y*i@q7Y~bCE8@DwyHZ|>Z=ep&sO;xk2$#vaG!|TB@X4C9yHU0`uJ$2>v z#Kci2iMGZgy?w8>Wle@xsXiGCi6-yHoWvEVyjOg<8lBYT!^=?rn|ydVs#ac5@_Y^I zPAWHvYf&tcX%g4bseisX=d(OX6$kjcZ4+X|b;Zz!i6)>d9&04tAax9%f+yS{u9A3h zS&itkfR7p6P27qYsN07Fz`Z^!uc%MsNo~Z36v26<Z9N6ZfLysYRkES#n-Dji%`hhk@*;h_9DoL$}`G;aR{vKCG%| zaef;Ji-Uf4jpl9Qn+TN+E7^m@31G`$VRs1ZdL<^W4MW(Oe26SZK!(OB11m$=$~5|Z zva;3yyBb6CMq85p$+AHVRv7~~$SRfB6Vy0o30dW{f$Mx&I9cbzD}X~jEc#ZBv-Xh{ zl-JvlqHp^z$+AJ-_hH`w$sp>(^1cnHkn}ij41R;G;Jd{Qsnq$NwKHr`{pXPoo;tR4O^>qcU%ia?5m*5W{67RPx$XDtT=xm7YFHW!^V&)233%O+G5~F00IW#>-{Z zGVh^Oato;ReiI5c(fOUgKS6m2ga^S=l^ur45p1XwELGWMsLbzFr3?5-TXI>bJg?2< z{{c6@v?;38b0att81*A~8WKJ!*FfBdCjg^rNA}}9LY+Fq%*VM}-bixTLG4R!_+C(9*JxbuBJpPQlpXS6c(GdyK1SD~qXyr{5B4X3yNTK)*@EPT9^VFW5ZBmUMf}pEzzL1VK2LmXDzHh@ zeGWhPf=!xahBUU=_x8I)PNok-=eYRl_6OjU7>8j0q-?0uSa>{*44rjGe?f&S&`7ZD zUQqE0uKeU`_$=0b#bV(Ovf#~MHda<@*;rZdAoq^!M}1iNsbyoD#ma}{WZ4wHVtx}7 z`WTwWs*vU}On6xQ8Ya*@mV9gBZF+7zjOLM_Byo$&+WMH>FgP=U<%V&I7I}FXhtfSB zzDU+`sW`&~n6YXRAcwSmMy~2vq$>s=KW7+3Bs zz-NOhBy$6)s5ggHT;@hsx&7D{R-t~tjX@RlW~jZnMY*@3MlLc%RrEG?HIa&Yb4a-f zUZ##DI72<3;7Y66RnY`5RnrG}jJloRD)B$S%f@u;z_$j~<^d2lsG32&D)K(nOX2 zfZ7SPSPE6IZ0fNhB%CI}jztouAf1~)>j>J?mZ%4%iiPsyXn@#MX`B?Av?0*%+nFE;~@M(#p$A^!W& zvlKO~jH+-&4t`N;(O%=OIW&(qxw{Spi>kkDwecCNxn~ZQ@JjdNLj}cCuHAN8X=iZ! zSU5792<5xWJ7;07ZE4QF3|7dN7`Yu54dl31)Dof zPYZfpod7_&5C51|@mdz2&f<5n_*y1M>@1#;#bpy{uHRu~LDqoPS^SXu(-&v(X7`u) z-R@p^v3&d!m~ZrtJmuzf2f59i**${~xc7CJ7yUd}hc8Yxc%F!$Or-nBkGrjW_glwj zgeo^a-ZW?N_a1HvPY*|%HtQ0NMrY2fBln|&h3@Z;=N_s0_4&LJJBhaTxPddTHBWjM zYl*BWGp=*T^1 z@3^0H)#DL_(EvsE#6AE?7^T63Ee< zn;^a@;slKSW#XY#;IL-2ywWUpr?-F%kOgba0`HNPQvj~l9JI(9HxnH5vBccqV>woh zJ{EhEW;{JBBu}$7!`^&LWEmijx7{~EBIxk(Sg_F)EnQBT1;0U780js?TmqW>ELjzz zq){aJJVX>8(sn3m)iR>-l53t`tFR6Hk{5(0rLgrj(WddR2VhGx7WJ-fu|flB!U1iETMla;0c|?OUa7fg zw(7cr9~^<9Xy(k~x^>cglISS1osAcd$AAaSEMvD2fOsjw|1q@XdpWr;1m76HPfkrx3OG-ufDrNAX6V_B>@oeKjlUt65QB&y0Gx ziTb)koz%;E>&uUca@t7Za2Sl;i(8~3SIYR$G*4?#@jJOrHjQQy%>~l@8F9VDnqK7{ z;*}QItb*7%Cb64UO7c|wd>uNP@%daQPb6LJdhJUt_&!Ksuhd*}FYy+nl-=lKc(HdF z-iy~Qyx2`y+-kUscn^-T-C_6y@zZyMdx)AP*pl>sUf%$5kkTB^#mf};sy(22%y)>p zioqt#@N~Rfg-w`bisZGd?~M=RGb!L>*qksv$o(5|DviTs#D`@-Ota{C6cIWN#=gI8 z0rCh-hxe<-1zfX6zHTbCTUoHQhAcSqpBgJa^VC@Ra3Hsij7P3mq0Ccba>WY4Z~D}f zK1SAT$%O$u4Y^}gOYRsUJQlx3h|pQQU@#sJ({tl7az|cB;ucr4wMZ@)%o%36V8TRS z@!~KJC3!q{$yz1{&Ikcvtku{cHyV3N)z;_(R+>_+Xqw!z8nA~lc{wk|KZ>kYww0_F z0ka+4DAt}VmG)$*v@cU7lUvq4pGvZ#SNe?`ymos_(PLCXZdrXY-l$Y|O$8R}+(I*k zrsP)ne6sp|xmAu?DI7{)Zdn5ox>=?CW!1M(hmL08tGCT9do`p;=T`ZLWL?K6g&os- z^%$$#jhc}fc0h9Hl;IO(hb4DRY{T}H&yHQn(f4u-xnox%cYJ5xu12mng?d88B(i4< zhc%NaPE<2;$F7FWsr4}ycUEdnZy=p2;bmmkioJ<~-b2O_vE@zYwCD*HQPo(dlLyVd zI_~6TV#^}lUc{+H|2qEDBatSkT1LZVU27J%3nxy$&Z{_rXUh0YNtXxE$l!o*V$pG) z!V!ePCP`&{1478)2I0icU-2KU2*T$`dR3wa>$5l}oY?k;jIBg_`mM1W#E+lF&-BFl zll(W1$U5>FZc3x9A_&DcGa}e?>(q zrmMJAJt`?xzY4sMszb%3YE^NmdR0=Y->bkyUNYuQ9m~A8NVUAn1#0_64v%?WcWzCZ z&R5V0M@dZJunJs4Rj*=~c(IyriE~ujC0@vlDv1tjeV+@J*nfKeHuGuDOn)K4U`A)K*+ zhYue{HOAZ++JkDKzV!CM!}goIAB^L-+po8tHWD94NA&iOSotb90){@1a;D%4%58&Ef*o{Nk)lFKhf<{Zh+?1m1G zHWI_^d3vB2sMp)K9!W@<;hS7jy}i1!VXAjq{mZpm>U<{Vfwxz0*i>0vQ?u2Z?=5Jo z3FH+suh$!?{4kiPl=6zj@C)42e&NGgqY{qRGu9J1+4(^zEyeUEEj1H$J5rv!OJz3d zduIAcF2=LjOd81x@T@aKUGic)ubSa0xdhMUSuuO7z`M*ikn&Q-+CTp!?`b|-WaaQ5 zg`zn4q*BhpkUoiiH9khm)^paZ_$tQI0-PPN$x|Rdq__?GiyJv>vvCf%!^R`Por*&U zvxNPe^_d)EcX4vw${9H&9fMS8Bh$g`D3_m3V!4qv&U{M#GUVe=a8_XBd~m?VlfXe6 z4+EDfMuQ?=o6LuX4#QSP2WJf!p|yIG8B6?#vqr@OkY`_vIf*zOyw@h51#Y%6$t|am z{xWc@L#~{d%T}Z^HuZAMi^RF$<7xu&u*;$-mwQ4X^iz5`^TKho*-PNWn{bTce&Rl` zX3C|52e^zf>_Zlsx1TN=LmPCkj0CsFaCXxPkgrV9m{&0xDxtwQ&d6VMZ*S z*=)w_J~3)KV%8dVVfc(v`!iJ251BDca^hrgmy!>~U6pneH=&J3g8Lowli^&N?}L64 zVy-~3bixT4!!D_?Lp)xy-1cj2H1?ol0h^kFx=2(fnqSG?N$0O*f0x=sr%Pf5faL z1QO*Naq0y87({Z?_lH=Xy%bgyFBd0gs-rI#Nwavdd?RWrEQmeQEa{34&Po)&3aisM za#m$y4cwsk6y&Z3Tz(GTtGEa9QBAna6n_E!>VDi^I_?Hq&{8;VQ_!H$qj;GYpPe@m z_lmzUlrhgC98>Z0kb7EjOvToL-1uCPebVTl)_FJbmON)sbcBJ zW1N*MJ}Y+3Mk0~zv*OBZUbuRB7Je0}b!m7Dm?fKcC9w<}Tz$zHw%84h3!8D8{J=Yt z1;bX@ya%&sxH0>b8JRq@apBlF8El1(Or8MJUj+d1NU&S6{K9+%+p_Ucu$SZS4eirf z5MM9JA7>%ra08YrmY%_lSEV>(qIiD}U*V#;=(`H}idcG;Yx0-nLTr`_>HKseI$?*O znjC%t$N6cW-A_x&41H@{7`FT*?c>pTdBM}V^7wtQqmJJz=FL?J)+=70`@a%wl|GnYIf$HL_wl<&#V@f7 zY$cow&t#pQQF56;UY&I*w&Yg6kX(Zt@oy%WOdy{gmjIsGI?GV;yb=p~rs_xt^Q~C! zD^M&G2>JmVyTK)jtqoZDBJ(Gpvql3yhz9)>)LB?f*eI?PsRY_6<`wg|d0+HeG2fEO z2cl1v@juo28_KLr;LX9iVFx$cIlB4-zKHw#o{7zwh&clec0X&AM^B#MW4OPdJT{h% zIY9@P+By2*BtNbBed}U#=$a2WxWvxU&pK$1*ZQl7sX3Ta;NYO0qgPJz8{8kLimfvl zb4nasZs+J{zvH^$Z>WjQ$;F(ogPZLf9e44c8)&x2Yy2jb$&B8 zCl7Oa9Nh2V?-&pDf9ntQ-A35Bum4BCpr6-2)i3JbHC{EEjJ?Jl<9o({{)+L1epm0; zKiB`M|3km0|4sk9{#X59I@`8wbLH0B?Ug&W)^D$^tZj^bzmxx9Bp(o2J-m>Yh>9M* zfQLnk*<3=Sx%UarH9ns=i;8OyW{4KExkSwwk$D|Wzo?+*xM-oKRa~N`Q)J#ib4^sB zNxju-9&}_u?7&R?_68p#I&Scc)O+;Jp|Z(ragf@oO3_WNw_135p%xYuy`;8590Y1r8$>s?4I6~#wt2wY za)}l+8mkfA7}ct3gr^VER#DMMOV)~mK&`4)bki`FzQY$Jw$1G>HrCQA^5Os7cVG7H&Xnn$ zx$oZJJ?DO$^Uis9xA(7OTF#HzRY;Yu6>Zr@e#_ccno%gYq!At?ckXbXAK#cD#G#wp zZe`N14&CTF=AqwPZ@!X6nbyTuQqymz3K1uSho}0}gec`%C`DG{zSO+=7?}g=M_uSh zvHVi>QG8{1+;3Iyn=!KG6R;|}C*@^L{X850pgXI%1e(0@N^G`0*WN4zeT<2FP`Owb=Y9ZnkM38Z??vVD zI@JAoyaoN&&__x93Ld=9>oI&f!p%zILS#Vk^%yquc)iGii7`AihG)m{iWuHtGm)_5 zfhn}v`t5-Ndfd8rASdA|h@4mRoR!#Dx`2f>{#E(UkII0f9Nxfu}=*Fa)G z^G7%sHIZN&k=m;8x}SnY8wnp8=6|40dY&pop&nR-Fr3^;BIM#?aG8s9!Idr^*C}u0 zQ%3Vv%uU-vqCv~vOBN!&i$tU5e#morNwl~)72M|HS>RnRX1U`8p1%~_6(iS9DG>Ke z6k=K*iC(S1TmW{w#5}G~zFvUCE=51(2#EkZ#h!Qx9N$l(P;(#iaj;>_l}FE$iV~bd z6`r>iQ6q*T9t~qG_c96CuGT#W`SKC$qZtjC=24HcLJAZd535(=Ge$jZ;QbYiH#lU} zg3PJlS{E+?*SVPGjhfXP%``^6Y|n2tM%~N`#Zc&UO~?gzxp*Ad@hXN@Ie{m8;Hx-L zVgPP(dotG$KFxa}kB1v!qtaKNtSK{8g3Zv2b)*ULOH?+)hlcs@STmtsC|5e{1G5^l z2VeP#-xexXJLF46^kTC!?8WeaRzsu8Af7D0ggUticcbPeEaPnj;Cw948G~&*g^CR3 z;yB2=go+I2Y3V}D+$%&G^ea5bQ`AJPS4Bd;^+j43r<7z|F_k~W-KU}NKP<$cUY~g^ zc-X}($2(X1cR=ntg8ekB{g1;;&3{Xm9mTZ9%WI?mNiogc!hNT-z#eAhXE=esTW&Wu zf!Ww7H+$@e<$3IOADEY9R&E||e-dmrZ+3>g82&6bAI3J5Gb!55xv*KAt=tSB1~e-( zEA0g2^>1g$p9i&>=-&>~+|@j;+=)+Llsmyu?gTsTT#X+QzO{BD^L({WJ_JX`NoytGknGK{q`q|pkt8f8)A62ws2QEa_7BNt`1!*&!9V-M}LA@2?!((5atVD z1IfwXA7*8H4OY?Ym-A<7)BSSiEGk!TL?1;|;?3|Z<%)h1Rhn03A*&uCQRiX<+@N_o zK&qe=P^dsq2Yp7p_3vpO3tn=tpbXsEk)EeU_aFm~(cl+tf zyo^dO3_E^O>*Fz~x7mwrvil-_Qt8zn@zeFGGI0*gRmVpE0rXXZ&B}qfgT`orHGz#G z`-10vmHES1N1K089-X5T?4V4Td$$BzVU8x)HLN=BCVuzm_+|EjorF{2nQV#^TCNf( zV2VM_j@-!?mK%^G{_O-)2~=oCB|t`rDbjR2PeABqOf!)X_FHk>7t*W}2>N9%_JON3 zI|p#`MdeSKDH=WaK{V>8N>jAx2_dCfK`Hm-IK zA;eU8w=IS{-5fsi2Hi)&k%uC4axh1HEt-?v9G-uaCQz`fHlo8aC9H!=DPFW0BxjDSt&iC8!l7Y#J&8*KpA+{Zq?J4_d<^CPhuGg z$oO~BRLW&&jIK4Z{au``PM&1!Un|GHM+=OW^|G4Vq4lzz+pao!3N6ka|30g2l-2LE zc%y9Rc4VVGg_e?K{IJ?$85*NylWZSmtxfV2THg5zZ&@#^ukdiaY)8vmV>mvv8LtZ^ VS^BTSlQ`d1DF1LkwqK?E{{tq;@7VwV