github/kubeshark
1
0
Fork 0
mirror of https://github.com/kubeshark/kubeshark.git synced 2025-08-04 18:21:32 +00:00
Code Issues Packages Projects Releases Wiki Activity
feat/add-nginx
kubeshark/tap/tlstapper/bpf-builder
History
M. Mert Yıldıran 52c9251c00
Add ABI0 support to Go crypto/tls eBPF tracer (#1169) 
* Determine the Go ABI and get `goid` offset from DWARF

* Add `ABI` enum and morph the function according to the detected ABI

* Pass `goid` offset to an eBPF map to retrieve it in eBPF context

* Add `vmlinux.h` and implement `get_goid_from_thread_local_storage`

* Fix BPF verifier errors

* Update the comments

* Add `go_abi_0.h` and implement `ABI0` specific reads for `arm64`

* Upgrade `github.com/cilium/ebpf` to `v0.9.0`

* Add a comment

* Add macros for x86 specific parts

* Update `x86.o`

* Fix the map key type

* Add `user_pt_regs`

* Update arm64 object file

* Fix the version detection logic

* Add `getGStructOffset` method

* Define `goid_offsets`, `goid_offsets_map` structs and pass the offsets correctly

* Fix the `net.TCPConn` and buffer addresses for `ABI0`

* Remove comment

* Fix the issues for arm64 build

* Update x86.o

* Revert "Fix the issues for arm64 build"

This reverts commit 48b041b1b6.

* Revert `user_pt_regs`

* Add `vmlinux` directory

* Fix the `build.sh` and `Dockerfile`

* Add vmlinux_arm64.h

* Disable `get_goid_from_thread_local_storage` on ARM64 with a macro

* Update x86.o

* Update arm64.o

* x86

* arm64

* Fix the cross-compilation issue from x86 to arm64

* Fix the same thing for x86

* Use `BPF_CORE_READ` macro instead of `bpf_ringbuf_reserve` to support kernel versions older than 5.8

Also;
Add legacy version of thread_struct: thread_struct___v46
Build an additional object file for the kernel versions older than or equal to 4.6 and load them accordingly.
Add github.com/moby/moby

* Make #define directives more definitive

* Select the x86 and arm64 versions of `vmlinux.h` using macros

* Put `goid` offsets into the map before installing `uprobe`(s)

* arm64

* #run_acceptance_tests

* Remove a forgotten `fmt.Printf`

* Log the detected Linux kernel version
2022-07-05 14:35:30 +03:00
..
build.sh Add ABI0 support to Go crypto/tls eBPF tracer (#1169) 2022-07-05 14:35:30 +03:00
Dockerfile Add Go crypto/tls eBPF tracer for TLS connections (#1120) 2022-06-12 14:14:41 +03:00
README.md Add tls tapper (#683) 2022-02-16 15:34:51 +02:00

README.md

Bpf builder

Currently we push the ebpf *.o files to source control, the motivation for it is to avoid the need for everyone to compile it in their PC.

This directory helps those who do want to build the .o files, it also serve as a documentation for the process of compiling the ebpf code.

How to run ebpf-builder

From you shell, go to this directory and run ./build.sh

Once the docker finished successfully, make sure to commit the four relevant files.

tlstapper_bpfeb.go tlstapper_bpfel.go tlstapper_bpfeb.o tlstapper_bpfel.o