ilucky.si 2 лет назад
Родитель
Сommit
f539f97c77
4 измененных файлов с 37 добавлено и 10 удалено
  1. 1 1
      containers/container.go
  2. 1 1
      containers/registry.go
  3. 30 3
      ebpftracer/tls.go
  4. 5 5
      ebpftracer/tracer.go

+ 1 - 1
containers/container.go

@@ -1082,7 +1082,7 @@ func (c *Container) revalidateListens(now time.Time, actualListens map[netaddr.I
 }
 
 func (c *Container) attachTlsUprobes(tracer *ebpftracer.Tracer, pid uint32) {
-	fmt.Println("-----------------attachTlsUprobes------------------------")
+	fmt.Println("attachTlsUprobes......")
 	p := c.processes[pid]
 	if p == nil {
 		return

+ 1 - 1
containers/registry.go

@@ -236,7 +236,7 @@ func (r *Registry) handleEvents(ch <-chan ebpftracer.Event) {
 				}
 
 			case ebpftracer.EventTypeListenOpen: // TODO: 核心逻辑:attachTlsUprobes, , 为什么放在这里???根据事件绑定uprobe???
-				fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid)
+				fmt.Println("ebpftracer.EventTypeConnectionOpen==================", e.Pid) // ebpftracer.EventTypeConnectionOpen================== 362943
 				// fmt.Println("----EventTypeListenOpen----")
 				if c := r.getOrCreateContainer(e.Pid); c != nil {
 					c.onListenOpen(e.Pid, e.SrcAddr, false)

+ 30 - 3
ebpftracer/tls.go

@@ -116,7 +116,31 @@ func (t *Tracer) AttachOpenSslUprobes(pid uint32) []link.Link {
 
 // TODO: 核心方法
 func (t *Tracer) AttachGoTlsUprobes(pid uint32) []link.Link { // TODO: 核心方法
-	fmt.Println("--------------AttachGoTlsUprobes------------pid:", pid)
+
+	fmt.Println("AttachGoTlsUprobes------------pid: ", pid)
+	// TODO: 区分语言
+	return t.AttachGoTlsUprobes4GO(pid)
+}
+
+func (t *Tracer) AttachGoTlsUprobes4Java(pid uint32) []link.Link {
+	fmt.Println("AttachGoTlsUprobes4Java-------pid: ", pid)
+	path := proc.Path(13096, "exe")
+	exe, err := link.OpenExecutable(path)
+	if err != nil {
+		fmt.Println("OpenExecutable error: ", err)
+		return nil
+	}
+	var links []link.Link
+	link, err := exe.Uprobe("", t.uprobes[""], &link.UprobeOptions{Address: "address"})
+	if err != nil {
+		fmt.Println("exe.Uprobe error: ", err)
+		return nil
+	}
+	links = append(links, link)
+	return links
+}
+
+func (t *Tracer) AttachGoTlsUprobes4GO(pid uint32) []link.Link {
 	if t.disableL7Tracing {
 		return nil
 	}
@@ -162,7 +186,10 @@ func (t *Tracer) AttachGoTlsUprobes(pid uint32) []link.Link { // TODO: 核心方
 	}
 	defer ef.Close()
 
-	symbols, err := ef.Symbols() // TODO: 根据进程语言...走不同的逻辑......
+	// TODO: 判断是java进程还是go进程...
+	// var lan := "x"
+
+	symbols, err := ef.Symbols()
 	// fmt.Println("--------------AttachGoTlsUprobes---------------symbols------", symbols)
 	if err != nil {
 		if errors.Is(err, elf.ErrNoSymbols) {
@@ -251,7 +278,7 @@ func (t *Tracer) AttachGoTlsUprobes(pid uint32) []link.Link { // TODO: 核心方
 				break
 			}
 		}
-		fmt.Println("s.Name-----:", s.Name) // TODO: s.Name-----: net/http.serverHandler.ServeHTTP
+		fmt.Println("s.Name-----:", s.Name) // TODO: s.Name-----: runtime.execute | net/http.serverHandler.ServeHTTP
 
 		switch s.Name {
 		case goExecute:

+ 5 - 5
ebpftracer/tracer.go

@@ -246,7 +246,7 @@ func (t *Tracer) ebpf(ch chan<- Event) error {
 	for _, spec := range collectionSpec.Maps {
 		fmt.Println("maps:", spec.Name) // maps: __protocol_filter|l7_request_heap
 	}
-	tracer.MapInit(collectionSpec, opts) // TODO: 暂时忽略
+	tracer.MapInit(collectionSpec, opts) // TODO: 暂时忽略???
 	// TODO 多进程
 	tracer.SetConstants(collectionSpec)                            // TODO: 暂时忽略
 	c, err := ebpf.NewCollectionWithOptions(collectionSpec, *opts) // TODO: 后面t.collection = c....
@@ -257,7 +257,7 @@ func (t *Tracer) ebpf(ch chan<- Event) error {
 		}
 		return fmt.Errorf("failed to load collection: %w", err)
 	}
-	tracer.Offset() // TODO: 作用是什么???????
+	tracer.Offset() // TODO: 暂时忽略???
 
 	t.collection = c
 
@@ -270,7 +270,7 @@ func (t *Tracer) ebpf(ch chan<- Event) error {
 	}
 	//fmt.Println(len(collectionSpec.Programs))
 	//fmt.Println(len(c.Programs))
-	tracer.MapInsert(c)
+	tracer.MapInsert(c) // TODO: 暂时忽略???
 	if !t.disableL7Tracing {
 		perfMaps = append(perfMaps, perfMap{name: "l7_events", typ: perfMapTypeL7Events, perCPUBufferSizePages: 32})
 	}
@@ -308,14 +308,14 @@ func (t *Tracer) ebpf(ch chan<- Event) error {
 		var l link.Link // TODO: Link是什么?Link represents a Program attached to a BPF hook.
 		switch programSpec.Type {
 		case ebpf.TracePoint: // TODO: 默认将所有trace point和kprobe进行attach??? 是不是需要一个大的黑名单...
-			fmt.Println("===========【tracepoint】: ", programSpec.Name, programSpec.SectionName, programSpec.Type)
+			// fmt.Println("===========【tracepoint】: ", programSpec.Name, programSpec.SectionName, programSpec.Type)
 			if strings.Contains(programSpec.SectionName, "prog") {
 				continue
 			}
 			parts := strings.SplitN(programSpec.AttachTo, "/", 2)
 			l, err = link.Tracepoint(parts[0], parts[1], program, nil) // TODO: attaches the given eBPF program to the tracepoint with the given group and name. example: tp, err := Tracepoint("syscalls", "sys_enter_fork", prog, nil)
 		case ebpf.Kprobe:
-			fmt.Println("===========【kprobe】: ", programSpec.Name, programSpec.SectionName, programSpec.Type)
+			// fmt.Println("===========【kprobe】: ", programSpec.Name, programSpec.SectionName, programSpec.Type)
 			if strings.HasPrefix(programSpec.SectionName, "uprobe/") { // TODO: 直接过滤uprobe...
 
 				// fmt.Println("==============uprobe s")