diff --git a/tap/tlstapper/bpf/go_uprobes.c b/tap/tlstapper/bpf/go_uprobes.c index bc7a83bcf..be207f56d 100644 --- a/tap/tlstapper/bpf/go_uprobes.c +++ b/tap/tlstapper/bpf/go_uprobes.c @@ -73,12 +73,11 @@ static __always_inline __u32 get_fd_from_tcp_conn(struct pt_regs *ctx) { return fd; } -SEC("uprobe/go_crypto_tls_write") -static int go_crypto_tls_write_uprobe(struct pt_regs *ctx) { +static __always_inline void go_crypto_tls_uprobe(struct pt_regs *ctx, struct bpf_map_def* go_context) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u64 pid = pid_tgid >> 32; if (!should_tap(pid)) { - return 0; + return; } struct ssl_info info = new_ssl_info(); @@ -88,91 +87,58 @@ static int go_crypto_tls_write_uprobe(struct pt_regs *ctx) { info.fd = get_fd_from_tcp_conn(ctx); __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); - long err = bpf_map_update_elem(&go_write_context, &pid_fp, &info, BPF_ANY); + long err = bpf_map_update_elem(go_context, &pid_fp, &info, BPF_ANY); if (err != 0) { log_error(ctx, LOG_ERROR_PUTTING_SSL_CONTEXT, pid_tgid, err, 0l); } - return 0; + return; +} + +static __always_inline void go_crypto_tls_ex_uprobe(struct pt_regs *ctx, struct bpf_map_def* go_context, __u32 flags) { + __u64 pid_tgid = bpf_get_current_pid_tgid(); + __u64 pid = pid_tgid >> 32; + if (!should_tap(pid)) { + return; + } + + __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); + struct ssl_info *info_ptr = bpf_map_lookup_elem(go_context, &pid_fp); + + if (info_ptr == NULL) { + return; + } + + struct ssl_info info; + long err = bpf_probe_read(&info, sizeof(struct ssl_info), info_ptr); + + if (err != 0) { + log_error(ctx, LOG_ERROR_READING_SSL_CONTEXT, pid_tgid, err, ORIGIN_SSL_URETPROBE_CODE); + return; + } + + output_ssl_chunk(ctx, &info, info.buffer_len, pid_tgid, flags); + + return; +} + +SEC("uprobe/go_crypto_tls_write") +void BPF_KPROBE(go_crypto_tls_write) { + go_crypto_tls_uprobe(ctx, &go_write_context); } SEC("uprobe/go_crypto_tls_write_ex") -static int go_crypto_tls_write_ex_uprobe(struct pt_regs *ctx) { - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u64 pid = pid_tgid >> 32; - if (!should_tap(pid)) { - return 0; - } - - __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); - struct ssl_info *info_ptr = bpf_map_lookup_elem(&go_write_context, &pid_fp); - - if (info_ptr == NULL) { - return 0; - } - - struct ssl_info info; - long err = bpf_probe_read(&info, sizeof(struct ssl_info), info_ptr); - - if (err != 0) { - log_error(ctx, LOG_ERROR_READING_SSL_CONTEXT, pid_tgid, err, ORIGIN_SSL_URETPROBE_CODE); - return 0; - } - - output_ssl_chunk(ctx, &info, info.buffer_len, pid_tgid, 0); - - return 0; +void BPF_KPROBE(go_crypto_tls_write_ex) { + go_crypto_tls_ex_uprobe(ctx, &go_write_context, 0); } SEC("uprobe/go_crypto_tls_read") -static int go_crypto_tls_read_uprobe(struct pt_regs *ctx) { - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u64 pid = pid_tgid >> 32; - if (!should_tap(pid)) { - return 0; - } - - struct ssl_info info = new_ssl_info(); - - info.buffer_len = GO_ABI_INTERNAL_PT_REGS_R2(ctx); - info.buffer = (void*)GO_ABI_INTERNAL_PT_REGS_R4(ctx); - info.fd = get_fd_from_tcp_conn(ctx); - - __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); - long err = bpf_map_update_elem(&go_read_context, &pid_fp, &info, BPF_ANY); - - if (err != 0) { - log_error(ctx, LOG_ERROR_PUTTING_SSL_CONTEXT, pid_tgid, err, 0l); - } - - return 0; +void BPF_KPROBE(go_crypto_tls_read) { + go_crypto_tls_uprobe(ctx, &go_read_context); } SEC("uprobe/go_crypto_tls_read_ex") -static int go_crypto_tls_read_ex_uprobe(struct pt_regs *ctx) { - __u64 pid_tgid = bpf_get_current_pid_tgid(); - __u64 pid = pid_tgid >> 32; - if (!should_tap(pid)) { - return 0; - } - - __u64 pid_fp = pid << 32 | GO_ABI_INTERNAL_PT_REGS_GP(ctx); - struct ssl_info *info_ptr = bpf_map_lookup_elem(&go_read_context, &pid_fp); - - if (info_ptr == NULL) { - return 0; - } - - struct ssl_info info; - long err = bpf_probe_read(&info, sizeof(struct ssl_info), info_ptr); - - if (err != 0) { - log_error(ctx, LOG_ERROR_READING_SSL_CONTEXT, pid_tgid, err, ORIGIN_SSL_URETPROBE_CODE); - return 0; - } - - output_ssl_chunk(ctx, &info, info.buffer_len, pid_tgid, FLAGS_IS_READ_BIT); - - return 0; +void BPF_KPROBE(go_crypto_tls_read_ex) { + go_crypto_tls_ex_uprobe(ctx, &go_read_context, FLAGS_IS_READ_BIT); } diff --git a/tap/tlstapper/go_hooks.go b/tap/tlstapper/go_hooks.go index 57881f81f..25cdc89fe 100644 --- a/tap/tlstapper/go_hooks.go +++ b/tap/tlstapper/go_hooks.go @@ -33,7 +33,7 @@ func (s *goHooks) installHooks(bpfObjects *tlsTapperObjects, ex *link.Executable // Symbol points to // [`crypto/tls.(*Conn).Write`](https://github.com/golang/go/blob/go1.17.6/src/crypto/tls/conn.go#L1099) - s.goWriteProbe, err = ex.Uprobe(goWriteSymbol, bpfObjects.GoCryptoTlsWriteUprobe, &link.UprobeOptions{ + s.goWriteProbe, err = ex.Uprobe(goWriteSymbol, bpfObjects.GoCryptoTlsWrite, &link.UprobeOptions{ Offset: offsets.GoWriteOffset.enter, }) @@ -42,7 +42,7 @@ func (s *goHooks) installHooks(bpfObjects *tlsTapperObjects, ex *link.Executable } for _, offset := range offsets.GoWriteOffset.exits { - probe, err := ex.Uprobe(goWriteSymbol, bpfObjects.GoCryptoTlsWriteExUprobe, &link.UprobeOptions{ + probe, err := ex.Uprobe(goWriteSymbol, bpfObjects.GoCryptoTlsWriteEx, &link.UprobeOptions{ Offset: offset, }) @@ -55,7 +55,7 @@ func (s *goHooks) installHooks(bpfObjects *tlsTapperObjects, ex *link.Executable // Symbol points to // [`crypto/tls.(*Conn).Read`](https://github.com/golang/go/blob/go1.17.6/src/crypto/tls/conn.go#L1263) - s.goReadProbe, err = ex.Uprobe(goReadSymbol, bpfObjects.GoCryptoTlsReadUprobe, &link.UprobeOptions{ + s.goReadProbe, err = ex.Uprobe(goReadSymbol, bpfObjects.GoCryptoTlsRead, &link.UprobeOptions{ Offset: offsets.GoReadOffset.enter, }) @@ -64,7 +64,7 @@ func (s *goHooks) installHooks(bpfObjects *tlsTapperObjects, ex *link.Executable } for _, offset := range offsets.GoReadOffset.exits { - probe, err := ex.Uprobe(goReadSymbol, bpfObjects.GoCryptoTlsReadExUprobe, &link.UprobeOptions{ + probe, err := ex.Uprobe(goReadSymbol, bpfObjects.GoCryptoTlsReadEx, &link.UprobeOptions{ Offset: offset, }) diff --git a/tap/tlstapper/tlstapper_bpfeb.go b/tap/tlstapper/tlstapper_bpfeb.go index 69cd9178d..c6b046e97 100644 --- a/tap/tlstapper/tlstapper_bpfeb.go +++ b/tap/tlstapper/tlstapper_bpfeb.go @@ -66,24 +66,24 @@ type tlsTapperSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type tlsTapperProgramSpecs struct { - GoCryptoTlsReadExUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_ex_uprobe"` - GoCryptoTlsReadUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_uprobe"` - GoCryptoTlsWriteExUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_ex_uprobe"` - GoCryptoTlsWriteUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_uprobe"` - SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` - SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` - SslRetRead *ebpf.ProgramSpec `ebpf:"ssl_ret_read"` - SslRetReadEx *ebpf.ProgramSpec `ebpf:"ssl_ret_read_ex"` - SslRetWrite *ebpf.ProgramSpec `ebpf:"ssl_ret_write"` - SslRetWriteEx *ebpf.ProgramSpec `ebpf:"ssl_ret_write_ex"` - SslWrite *ebpf.ProgramSpec `ebpf:"ssl_write"` - SslWriteEx *ebpf.ProgramSpec `ebpf:"ssl_write_ex"` - SysEnterAccept4 *ebpf.ProgramSpec `ebpf:"sys_enter_accept4"` - SysEnterConnect *ebpf.ProgramSpec `ebpf:"sys_enter_connect"` - SysEnterRead *ebpf.ProgramSpec `ebpf:"sys_enter_read"` - SysEnterWrite *ebpf.ProgramSpec `ebpf:"sys_enter_write"` - SysExitAccept4 *ebpf.ProgramSpec `ebpf:"sys_exit_accept4"` - SysExitConnect *ebpf.ProgramSpec `ebpf:"sys_exit_connect"` + GoCryptoTlsRead *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read"` + GoCryptoTlsReadEx *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_ex"` + GoCryptoTlsWrite *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write"` + GoCryptoTlsWriteEx *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_ex"` + SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` + SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` + SslRetRead *ebpf.ProgramSpec `ebpf:"ssl_ret_read"` + SslRetReadEx *ebpf.ProgramSpec `ebpf:"ssl_ret_read_ex"` + SslRetWrite *ebpf.ProgramSpec `ebpf:"ssl_ret_write"` + SslRetWriteEx *ebpf.ProgramSpec `ebpf:"ssl_ret_write_ex"` + SslWrite *ebpf.ProgramSpec `ebpf:"ssl_write"` + SslWriteEx *ebpf.ProgramSpec `ebpf:"ssl_write_ex"` + SysEnterAccept4 *ebpf.ProgramSpec `ebpf:"sys_enter_accept4"` + SysEnterConnect *ebpf.ProgramSpec `ebpf:"sys_enter_connect"` + SysEnterRead *ebpf.ProgramSpec `ebpf:"sys_enter_read"` + SysEnterWrite *ebpf.ProgramSpec `ebpf:"sys_enter_write"` + SysExitAccept4 *ebpf.ProgramSpec `ebpf:"sys_exit_accept4"` + SysExitConnect *ebpf.ProgramSpec `ebpf:"sys_exit_connect"` } // tlsTapperMapSpecs contains maps before they are loaded into the kernel. @@ -155,32 +155,32 @@ func (m *tlsTapperMaps) Close() error { // // It can be passed to loadTlsTapperObjects or ebpf.CollectionSpec.LoadAndAssign. type tlsTapperPrograms struct { - GoCryptoTlsReadExUprobe *ebpf.Program `ebpf:"go_crypto_tls_read_ex_uprobe"` - GoCryptoTlsReadUprobe *ebpf.Program `ebpf:"go_crypto_tls_read_uprobe"` - GoCryptoTlsWriteExUprobe *ebpf.Program `ebpf:"go_crypto_tls_write_ex_uprobe"` - GoCryptoTlsWriteUprobe *ebpf.Program `ebpf:"go_crypto_tls_write_uprobe"` - SslRead *ebpf.Program `ebpf:"ssl_read"` - SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` - SslRetRead *ebpf.Program `ebpf:"ssl_ret_read"` - SslRetReadEx *ebpf.Program `ebpf:"ssl_ret_read_ex"` - SslRetWrite *ebpf.Program `ebpf:"ssl_ret_write"` - SslRetWriteEx *ebpf.Program `ebpf:"ssl_ret_write_ex"` - SslWrite *ebpf.Program `ebpf:"ssl_write"` - SslWriteEx *ebpf.Program `ebpf:"ssl_write_ex"` - SysEnterAccept4 *ebpf.Program `ebpf:"sys_enter_accept4"` - SysEnterConnect *ebpf.Program `ebpf:"sys_enter_connect"` - SysEnterRead *ebpf.Program `ebpf:"sys_enter_read"` - SysEnterWrite *ebpf.Program `ebpf:"sys_enter_write"` - SysExitAccept4 *ebpf.Program `ebpf:"sys_exit_accept4"` - SysExitConnect *ebpf.Program `ebpf:"sys_exit_connect"` + GoCryptoTlsRead *ebpf.Program `ebpf:"go_crypto_tls_read"` + GoCryptoTlsReadEx *ebpf.Program `ebpf:"go_crypto_tls_read_ex"` + GoCryptoTlsWrite *ebpf.Program `ebpf:"go_crypto_tls_write"` + GoCryptoTlsWriteEx *ebpf.Program `ebpf:"go_crypto_tls_write_ex"` + SslRead *ebpf.Program `ebpf:"ssl_read"` + SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` + SslRetRead *ebpf.Program `ebpf:"ssl_ret_read"` + SslRetReadEx *ebpf.Program `ebpf:"ssl_ret_read_ex"` + SslRetWrite *ebpf.Program `ebpf:"ssl_ret_write"` + SslRetWriteEx *ebpf.Program `ebpf:"ssl_ret_write_ex"` + SslWrite *ebpf.Program `ebpf:"ssl_write"` + SslWriteEx *ebpf.Program `ebpf:"ssl_write_ex"` + SysEnterAccept4 *ebpf.Program `ebpf:"sys_enter_accept4"` + SysEnterConnect *ebpf.Program `ebpf:"sys_enter_connect"` + SysEnterRead *ebpf.Program `ebpf:"sys_enter_read"` + SysEnterWrite *ebpf.Program `ebpf:"sys_enter_write"` + SysExitAccept4 *ebpf.Program `ebpf:"sys_exit_accept4"` + SysExitConnect *ebpf.Program `ebpf:"sys_exit_connect"` } func (p *tlsTapperPrograms) Close() error { return _TlsTapperClose( - p.GoCryptoTlsReadExUprobe, - p.GoCryptoTlsReadUprobe, - p.GoCryptoTlsWriteExUprobe, - p.GoCryptoTlsWriteUprobe, + p.GoCryptoTlsRead, + p.GoCryptoTlsReadEx, + p.GoCryptoTlsWrite, + p.GoCryptoTlsWriteEx, p.SslRead, p.SslReadEx, p.SslRetRead, diff --git a/tap/tlstapper/tlstapper_bpfeb.o b/tap/tlstapper/tlstapper_bpfeb.o index 9a213817c..c9f63bac6 100644 Binary files a/tap/tlstapper/tlstapper_bpfeb.o and b/tap/tlstapper/tlstapper_bpfeb.o differ diff --git a/tap/tlstapper/tlstapper_bpfel.go b/tap/tlstapper/tlstapper_bpfel.go index af222bfdf..a149b76f6 100644 --- a/tap/tlstapper/tlstapper_bpfel.go +++ b/tap/tlstapper/tlstapper_bpfel.go @@ -66,24 +66,24 @@ type tlsTapperSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type tlsTapperProgramSpecs struct { - GoCryptoTlsReadExUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_ex_uprobe"` - GoCryptoTlsReadUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_uprobe"` - GoCryptoTlsWriteExUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_ex_uprobe"` - GoCryptoTlsWriteUprobe *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_uprobe"` - SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` - SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` - SslRetRead *ebpf.ProgramSpec `ebpf:"ssl_ret_read"` - SslRetReadEx *ebpf.ProgramSpec `ebpf:"ssl_ret_read_ex"` - SslRetWrite *ebpf.ProgramSpec `ebpf:"ssl_ret_write"` - SslRetWriteEx *ebpf.ProgramSpec `ebpf:"ssl_ret_write_ex"` - SslWrite *ebpf.ProgramSpec `ebpf:"ssl_write"` - SslWriteEx *ebpf.ProgramSpec `ebpf:"ssl_write_ex"` - SysEnterAccept4 *ebpf.ProgramSpec `ebpf:"sys_enter_accept4"` - SysEnterConnect *ebpf.ProgramSpec `ebpf:"sys_enter_connect"` - SysEnterRead *ebpf.ProgramSpec `ebpf:"sys_enter_read"` - SysEnterWrite *ebpf.ProgramSpec `ebpf:"sys_enter_write"` - SysExitAccept4 *ebpf.ProgramSpec `ebpf:"sys_exit_accept4"` - SysExitConnect *ebpf.ProgramSpec `ebpf:"sys_exit_connect"` + GoCryptoTlsRead *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read"` + GoCryptoTlsReadEx *ebpf.ProgramSpec `ebpf:"go_crypto_tls_read_ex"` + GoCryptoTlsWrite *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write"` + GoCryptoTlsWriteEx *ebpf.ProgramSpec `ebpf:"go_crypto_tls_write_ex"` + SslRead *ebpf.ProgramSpec `ebpf:"ssl_read"` + SslReadEx *ebpf.ProgramSpec `ebpf:"ssl_read_ex"` + SslRetRead *ebpf.ProgramSpec `ebpf:"ssl_ret_read"` + SslRetReadEx *ebpf.ProgramSpec `ebpf:"ssl_ret_read_ex"` + SslRetWrite *ebpf.ProgramSpec `ebpf:"ssl_ret_write"` + SslRetWriteEx *ebpf.ProgramSpec `ebpf:"ssl_ret_write_ex"` + SslWrite *ebpf.ProgramSpec `ebpf:"ssl_write"` + SslWriteEx *ebpf.ProgramSpec `ebpf:"ssl_write_ex"` + SysEnterAccept4 *ebpf.ProgramSpec `ebpf:"sys_enter_accept4"` + SysEnterConnect *ebpf.ProgramSpec `ebpf:"sys_enter_connect"` + SysEnterRead *ebpf.ProgramSpec `ebpf:"sys_enter_read"` + SysEnterWrite *ebpf.ProgramSpec `ebpf:"sys_enter_write"` + SysExitAccept4 *ebpf.ProgramSpec `ebpf:"sys_exit_accept4"` + SysExitConnect *ebpf.ProgramSpec `ebpf:"sys_exit_connect"` } // tlsTapperMapSpecs contains maps before they are loaded into the kernel. @@ -155,32 +155,32 @@ func (m *tlsTapperMaps) Close() error { // // It can be passed to loadTlsTapperObjects or ebpf.CollectionSpec.LoadAndAssign. type tlsTapperPrograms struct { - GoCryptoTlsReadExUprobe *ebpf.Program `ebpf:"go_crypto_tls_read_ex_uprobe"` - GoCryptoTlsReadUprobe *ebpf.Program `ebpf:"go_crypto_tls_read_uprobe"` - GoCryptoTlsWriteExUprobe *ebpf.Program `ebpf:"go_crypto_tls_write_ex_uprobe"` - GoCryptoTlsWriteUprobe *ebpf.Program `ebpf:"go_crypto_tls_write_uprobe"` - SslRead *ebpf.Program `ebpf:"ssl_read"` - SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` - SslRetRead *ebpf.Program `ebpf:"ssl_ret_read"` - SslRetReadEx *ebpf.Program `ebpf:"ssl_ret_read_ex"` - SslRetWrite *ebpf.Program `ebpf:"ssl_ret_write"` - SslRetWriteEx *ebpf.Program `ebpf:"ssl_ret_write_ex"` - SslWrite *ebpf.Program `ebpf:"ssl_write"` - SslWriteEx *ebpf.Program `ebpf:"ssl_write_ex"` - SysEnterAccept4 *ebpf.Program `ebpf:"sys_enter_accept4"` - SysEnterConnect *ebpf.Program `ebpf:"sys_enter_connect"` - SysEnterRead *ebpf.Program `ebpf:"sys_enter_read"` - SysEnterWrite *ebpf.Program `ebpf:"sys_enter_write"` - SysExitAccept4 *ebpf.Program `ebpf:"sys_exit_accept4"` - SysExitConnect *ebpf.Program `ebpf:"sys_exit_connect"` + GoCryptoTlsRead *ebpf.Program `ebpf:"go_crypto_tls_read"` + GoCryptoTlsReadEx *ebpf.Program `ebpf:"go_crypto_tls_read_ex"` + GoCryptoTlsWrite *ebpf.Program `ebpf:"go_crypto_tls_write"` + GoCryptoTlsWriteEx *ebpf.Program `ebpf:"go_crypto_tls_write_ex"` + SslRead *ebpf.Program `ebpf:"ssl_read"` + SslReadEx *ebpf.Program `ebpf:"ssl_read_ex"` + SslRetRead *ebpf.Program `ebpf:"ssl_ret_read"` + SslRetReadEx *ebpf.Program `ebpf:"ssl_ret_read_ex"` + SslRetWrite *ebpf.Program `ebpf:"ssl_ret_write"` + SslRetWriteEx *ebpf.Program `ebpf:"ssl_ret_write_ex"` + SslWrite *ebpf.Program `ebpf:"ssl_write"` + SslWriteEx *ebpf.Program `ebpf:"ssl_write_ex"` + SysEnterAccept4 *ebpf.Program `ebpf:"sys_enter_accept4"` + SysEnterConnect *ebpf.Program `ebpf:"sys_enter_connect"` + SysEnterRead *ebpf.Program `ebpf:"sys_enter_read"` + SysEnterWrite *ebpf.Program `ebpf:"sys_enter_write"` + SysExitAccept4 *ebpf.Program `ebpf:"sys_exit_accept4"` + SysExitConnect *ebpf.Program `ebpf:"sys_exit_connect"` } func (p *tlsTapperPrograms) Close() error { return _TlsTapperClose( - p.GoCryptoTlsReadExUprobe, - p.GoCryptoTlsReadUprobe, - p.GoCryptoTlsWriteExUprobe, - p.GoCryptoTlsWriteUprobe, + p.GoCryptoTlsRead, + p.GoCryptoTlsReadEx, + p.GoCryptoTlsWrite, + p.GoCryptoTlsWriteEx, p.SslRead, p.SslReadEx, p.SslRetRead, diff --git a/tap/tlstapper/tlstapper_bpfel.o b/tap/tlstapper/tlstapper_bpfel.o index 6c0b938d8..b9d5a9a2d 100644 Binary files a/tap/tlstapper/tlstapper_bpfel.o and b/tap/tlstapper/tlstapper_bpfel.o differ