mirror of
https://github.com/kubeshark/kubeshark.git
synced 2025-10-21 23:46:45 +00:00
87ef469e25
* initial tls tapper commit * add tls flag to mizu cli * support ssl_read_ex/ssl_write_ex * use hostproc to find libssl * auto discover tls processes * support libssl1.0 * recompile ebpf with old clang/llvm * Update tap/passive_tapper.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * Update tap/tlstapper/tls_poller.go Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> * upgrade ebpf go lib * handling big tls messages * fixing max buffer size in ebpf * remove unused import * fix linter issues * minor pr fixes * compile with old clang * fix cgroup file format * pr fixes + cgroup extract enhance * fix linter * adding indirect ebpf dep to agent go.mod * adding ebpf docker builder * minor pr fixes * add req resp matcher to dissect * rename ssl hooks to ssl hooks structs * move to alpine, use local copy of mizu instead of git, add readme * use global req resp mather for tls Co-authored-by: M. Mert Yıldıran <mehmet@up9.com> Co-authored-by: gadotroee <55343099+gadotroee@users.noreply.github.com>
64 lines
1.8 KiB
C
64 lines
1.8 KiB
C
/*
|
|
Note: This file is licenced differently from the rest of the project
|
|
SPDX-License-Identifier: GPL-2.0
|
|
Copyright (C) UP9 Inc.
|
|
*/
|
|
|
|
#ifndef __MAPS__
|
|
#define __MAPS__
|
|
|
|
#define FLAGS_IS_CLIENT_BIT (1 << 0)
|
|
#define FLAGS_IS_READ_BIT (1 << 1)
|
|
|
|
// The same struct can be found in Chunk.go
|
|
//
|
|
// Be careful when editing, alignment and padding should be exactly the same in go/c.
|
|
//
|
|
struct tlsChunk {
|
|
__u32 pid;
|
|
__u32 tgid;
|
|
__u32 len;
|
|
__u32 recorded;
|
|
__u32 fd;
|
|
__u32 flags;
|
|
__u8 address[16];
|
|
__u8 data[4096]; // Must be N^2
|
|
};
|
|
|
|
struct ssl_info {
|
|
void* buffer;
|
|
__u32 fd;
|
|
|
|
// for ssl_write and ssl_read must be zero
|
|
// for ssl_write_ex and ssl_read_ex save the *written/*readbytes pointer.
|
|
//
|
|
size_t *count_ptr;
|
|
};
|
|
|
|
struct fd_info {
|
|
__u8 ipv4_addr[16]; // struct sockaddr (linux-src/include/linux/socket.h)
|
|
__u8 flags;
|
|
};
|
|
|
|
#define BPF_MAP(_name, _type, _key_type, _value_type, _max_entries) \
|
|
struct bpf_map_def SEC("maps") _name = { \
|
|
.type = _type, \
|
|
.key_size = sizeof(_key_type), \
|
|
.value_size = sizeof(_value_type), \
|
|
.max_entries = _max_entries, \
|
|
};
|
|
|
|
#define BPF_HASH(_name, _key_type, _value_type) \
|
|
BPF_MAP(_name, BPF_MAP_TYPE_HASH, _key_type, _value_type, 4096)
|
|
|
|
#define BPF_PERF_OUTPUT(_name) \
|
|
BPF_MAP(_name, BPF_MAP_TYPE_PERF_EVENT_ARRAY, int, __u32, 1024)
|
|
|
|
BPF_HASH(pids_map, __u32, __u32);
|
|
BPF_HASH(ssl_write_context, __u64, struct ssl_info);
|
|
BPF_HASH(ssl_read_context, __u64, struct ssl_info);
|
|
BPF_HASH(file_descriptor_to_ipv4, __u64, struct fd_info);
|
|
BPF_PERF_OUTPUT(chunks_buffer);
|
|
|
|
#endif /* __MAPS__ */
|