mirror of
https://github.com/kubeshark/kubeshark.git
synced 2025-08-06 11:05:08 +00:00
52c9251c00
* Determine the Go ABI and get `goid` offset from DWARF
* Add `ABI` enum and morph the function according to the detected ABI
* Pass `goid` offset to an eBPF map to retrieve it in eBPF context
* Add `vmlinux.h` and implement `get_goid_from_thread_local_storage`
* Fix BPF verifier errors
* Update the comments
* Add `go_abi_0.h` and implement `ABI0` specific reads for `arm64`
* Upgrade `github.com/cilium/ebpf` to `v0.9.0`
* Add a comment
* Add macros for x86 specific parts
* Update `x86.o`
* Fix the map key type
* Add `user_pt_regs`
* Update arm64 object file
* Fix the version detection logic
* Add `getGStructOffset` method
* Define `goid_offsets`, `goid_offsets_map` structs and pass the offsets correctly
* Fix the `net.TCPConn` and buffer addresses for `ABI0`
* Remove comment
* Fix the issues for arm64 build
* Update x86.o
* Revert "Fix the issues for arm64 build"
This reverts commit 48b041b1b6.
* Revert `user_pt_regs`
* Add `vmlinux` directory
* Fix the `build.sh` and `Dockerfile`
* Add vmlinux_arm64.h
* Disable `get_goid_from_thread_local_storage` on ARM64 with a macro
* Update x86.o
* Update arm64.o
* x86
* arm64
* Fix the cross-compilation issue from x86 to arm64
* Fix the same thing for x86
* Use `BPF_CORE_READ` macro instead of `bpf_ringbuf_reserve` to support kernel versions older than 5.8
Also;
Add legacy version of thread_struct: thread_struct___v46
Build an additional object file for the kernel versions older than or equal to 4.6 and load them accordingly.
Add github.com/moby/moby
* Make #define directives more definitive
* Select the x86 and arm64 versions of `vmlinux.h` using macros
* Put `goid` offsets into the map before installing `uprobe`(s)
* arm64
* #run_acceptance_tests
* Remove a forgotten `fmt.Printf`
* Log the detected Linux kernel version
106 lines
3.0 KiB
C
106 lines
3.0 KiB
C
/*
|
|
Note: This file is licenced differently from the rest of the project
|
|
SPDX-License-Identifier: GPL-2.0
|
|
Copyright (C) UP9 Inc.
|
|
*/
|
|
|
|
#ifndef __MAPS__
|
|
#define __MAPS__
|
|
|
|
#define FLAGS_IS_CLIENT_BIT (1 << 0)
|
|
#define FLAGS_IS_READ_BIT (1 << 1)
|
|
|
|
#define CHUNK_SIZE (1 << 12)
|
|
#define MAX_CHUNKS_PER_OPERATION (8)
|
|
|
|
// One minute in nano seconds. Chosen by gut feeling.
|
|
#define SSL_INFO_MAX_TTL_NANO (1000000000l * 60l)
|
|
|
|
#define MAX_ENTRIES_HASH (1 << 12) // 4096
|
|
#define MAX_ENTRIES_PERF_OUTPUT (1 << 10) // 1024
|
|
#define MAX_ENTRIES_LRU_HASH (1 << 14) // 16384
|
|
|
|
// The same struct can be found in chunk.go
|
|
//
|
|
// Be careful when editing, alignment and padding should be exactly the same in go/c.
|
|
//
|
|
struct tls_chunk {
|
|
__u32 pid;
|
|
__u32 tgid;
|
|
__u32 len;
|
|
__u32 start;
|
|
__u32 recorded;
|
|
__u32 fd;
|
|
__u32 flags;
|
|
__u8 address[16];
|
|
__u8 data[CHUNK_SIZE]; // Must be N^2
|
|
};
|
|
|
|
struct ssl_info {
|
|
void* buffer;
|
|
__u32 buffer_len;
|
|
__u32 fd;
|
|
__u64 created_at_nano;
|
|
|
|
// for ssl_write and ssl_read must be zero
|
|
// for ssl_write_ex and ssl_read_ex save the *written/*readbytes pointer.
|
|
//
|
|
size_t *count_ptr;
|
|
};
|
|
|
|
struct fd_info {
|
|
__u8 ipv4_addr[16]; // struct sockaddr (linux-src/include/linux/socket.h)
|
|
__u8 flags;
|
|
};
|
|
|
|
struct goid_offsets {
|
|
__u64 g_addr_offset;
|
|
__u64 goid_offset;
|
|
};
|
|
|
|
const struct goid_offsets *unused __attribute__((unused));
|
|
|
|
// Heap-like area for eBPF programs - stack size limited to 512 bytes, we must use maps for bigger (chunk) objects.
|
|
//
|
|
struct {
|
|
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
|
|
__uint(max_entries, 1);
|
|
__type(key, int);
|
|
__type(value, struct tls_chunk);
|
|
} heap SEC(".maps");
|
|
|
|
|
|
#define BPF_MAP(_name, _type, _key_type, _value_type, _max_entries) \
|
|
struct bpf_map_def SEC("maps") _name = { \
|
|
.type = _type, \
|
|
.key_size = sizeof(_key_type), \
|
|
.value_size = sizeof(_value_type), \
|
|
.max_entries = _max_entries, \
|
|
};
|
|
|
|
#define BPF_HASH(_name, _key_type, _value_type) \
|
|
BPF_MAP(_name, BPF_MAP_TYPE_HASH, _key_type, _value_type, MAX_ENTRIES_HASH)
|
|
|
|
#define BPF_PERF_OUTPUT(_name) \
|
|
BPF_MAP(_name, BPF_MAP_TYPE_PERF_EVENT_ARRAY, int, __u32, MAX_ENTRIES_PERF_OUTPUT)
|
|
|
|
#define BPF_LRU_HASH(_name, _key_type, _value_type) \
|
|
BPF_MAP(_name, BPF_MAP_TYPE_LRU_HASH, _key_type, _value_type, MAX_ENTRIES_LRU_HASH)
|
|
|
|
// Generic
|
|
BPF_HASH(pids_map, __u32, __u32);
|
|
BPF_LRU_HASH(file_descriptor_to_ipv4, __u64, struct fd_info);
|
|
BPF_PERF_OUTPUT(chunks_buffer);
|
|
BPF_PERF_OUTPUT(log_buffer);
|
|
|
|
// OpenSSL specific
|
|
BPF_LRU_HASH(openssl_write_context, __u64, struct ssl_info);
|
|
BPF_LRU_HASH(openssl_read_context, __u64, struct ssl_info);
|
|
|
|
// Go specific
|
|
BPF_HASH(goid_offsets_map, __u32, struct goid_offsets);
|
|
BPF_LRU_HASH(go_write_context, __u64, struct ssl_info);
|
|
BPF_LRU_HASH(go_read_context, __u64, struct ssl_info);
|
|
|
|
#endif /* __MAPS__ */
|