|
|
@@ -196,19 +196,23 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
|
|
|
if e.Pid == uint32(os.Getpid()) {
|
|
|
continue
|
|
|
}
|
|
|
+ if e.Pid != 362943 { // TODO: TEST_DEBUG........只拦截一个进程.....
|
|
|
+ continue
|
|
|
+ }
|
|
|
+
|
|
|
if !more {
|
|
|
return
|
|
|
}
|
|
|
fmt.Println("--------- <- ch -------------pid = ", e.Pid)
|
|
|
switch e.Type {
|
|
|
- case ebpftracer.EventTypeProcessStart:
|
|
|
+ case ebpftracer.EventTypeProcessStart: // TODO: ??????
|
|
|
fmt.Println("----EventTypeProcessStart----")
|
|
|
c, seen := r.containersByPid[e.Pid]
|
|
|
switch { // possible pids wraparound + missed `process-exit` event
|
|
|
case c == nil && seen: // ignored
|
|
|
delete(r.containersByPid, e.Pid)
|
|
|
case c != nil: // revalidating by cgroup
|
|
|
- cg, err := proc.ReadCgroup(e.Pid)
|
|
|
+ cg, err := proc.ReadCgroup(e.Pid) // TODO: 没有什么权限?
|
|
|
if err != nil || cg.Id != c.cgroup.Id {
|
|
|
delete(r.containersByPid, e.Pid)
|
|
|
c.onProcessExit(e.Pid, false)
|
|
|
@@ -231,9 +235,9 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
|
|
|
c.onFileOpen(e.Pid, e.Fd)
|
|
|
}
|
|
|
|
|
|
- case ebpftracer.EventTypeListenOpen: // TODO: 核心逻辑:attachTlsUprobes, , 为什么放在这里???
|
|
|
- //fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid)
|
|
|
- fmt.Println("----EventTypeListenOpen----")
|
|
|
+ case ebpftracer.EventTypeListenOpen: // TODO: 核心逻辑:attachTlsUprobes, , 为什么放在这里???根据事件绑定uprobe???
|
|
|
+ fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid)
|
|
|
+ // fmt.Println("----EventTypeListenOpen----")
|
|
|
if c := r.getOrCreateContainer(e.Pid); c != nil {
|
|
|
c.onListenOpen(e.Pid, e.SrcAddr, false)
|
|
|
c.attachTlsUprobes(r.tracer, e.Pid)
|
|
|
@@ -246,9 +250,9 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
|
|
|
c.onListenClose(e.Pid, e.SrcAddr)
|
|
|
}
|
|
|
|
|
|
- case ebpftracer.EventTypeConnectionOpen: // TODO: 核心逻辑:attachTlsUprobes, 为什么放在这里???
|
|
|
- fmt.Println("----EventTypeConnectionOpen----")
|
|
|
- //fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid)
|
|
|
+ case ebpftracer.EventTypeConnectionOpen: // TODO: 核心逻辑:attachTlsUprobes, 为什么放在这里??? 根据事件绑定uprobe???
|
|
|
+ // fmt.Println("----EventTypeConnectionOpen----")
|
|
|
+ fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid)
|
|
|
if c := r.getOrCreateContainer(e.Pid); c != nil {
|
|
|
c.onConnectionOpen(e.Pid, e.Fd, e.SrcAddr, e.DstAddr, e.Timestamp, false)
|
|
|
c.attachTlsUprobes(r.tracer, e.Pid)
|
|
|
@@ -279,8 +283,8 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
|
|
|
}
|
|
|
}
|
|
|
case ebpftracer.EventTypeL7Request: // TODO: 核心代码, 处理7层协议请求, 来自tracer.runEventsReader方法......
|
|
|
- fmt.Println("-----EventTypeL7Request------1", e) // TODO: 需要区分是client还是server吗?
|
|
|
- //fmt.Println("e.L7Request Payload:", string(e.L7Request.Payload))
|
|
|
+ // fmt.Println("-----EventTypeL7Request------1", e) // TODO: 需要区分是client还是server吗?
|
|
|
+ fmt.Println("e.L7Request Payload:", string(e.L7Request.Payload))
|
|
|
if e.L7Request == nil {
|
|
|
continue
|
|
|
}
|