tracer.go 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752
  1. package ebpftracer
  2. import (
  3. "bytes"
  4. debugelf "debug/elf"
  5. "encoding/binary"
  6. "encoding/hex"
  7. "errors"
  8. "fmt"
  9. "os"
  10. "strconv"
  11. "strings"
  12. "time"
  13. "github.com/cilium/ebpf"
  14. "github.com/cilium/ebpf/link"
  15. "github.com/cilium/ebpf/perf"
  16. "github.com/coroot/coroot-node-agent/common"
  17. "github.com/coroot/coroot-node-agent/ebpftracer/l7"
  18. "github.com/coroot/coroot-node-agent/ebpftracer/tracer"
  19. "github.com/coroot/coroot-node-agent/proc"
  20. "github.com/coroot/coroot-node-agent/utils"
  21. "golang.org/x/sys/unix"
  22. "inet.af/netaddr"
  23. "k8s.io/klog/v2"
  24. )
  25. /*
  26. #define TASK_COMM_LEN 16
  27. #define BURST_DATA_BUF_SIZE 8192 // For brust send buffer
  28. #include <linux/types.h>
  29. struct __tuple_t {
  30. __u8 daddr[16];
  31. __u8 rcv_saddr[16];
  32. __u8 addr_len;
  33. __u8 l4_protocol;
  34. __u16 dport;
  35. __u16 num;
  36. };
  37. struct __socket_data {
  38. __u32 pid;
  39. __u32 tgid;
  40. __u64 coroutine_id;
  41. __u8 source;
  42. __u8 comm[TASK_COMM_LEN];
  43. __u64 socket_id;
  44. struct __tuple_t tuple;
  45. __u32 extra_data;
  46. __u32 extra_data_count;
  47. __u32 tcp_seq;
  48. __u64 thread_trace_id;
  49. __u64 timestamp;
  50. __u8 direction: 1;
  51. __u8 msg_type: 7;
  52. __u64 syscall_len;
  53. __u64 data_seq;
  54. __u16 data_type;
  55. __u16 data_len;
  56. char data[BURST_DATA_BUF_SIZE];
  57. } __attribute__((packed));
  58. struct __socket_data_buffer {
  59. __u32 events_num;
  60. __u32 len;
  61. char data[32760];
  62. };
  63. */
  64. import "C"
  65. type SocketData C.struct___socket_data
  66. type SocketDataBuffer C.struct___socket_data_buffer
  67. const MaxPayloadSize = 1024
  68. type EventType uint32
  69. type EventReason uint32
  70. const (
  71. EventTypeProcessStart EventType = 1
  72. EventTypeProcessExit EventType = 2
  73. EventTypeConnectionOpen EventType = 3
  74. EventTypeConnectionClose EventType = 4
  75. EventTypeConnectionError EventType = 5
  76. EventTypeListenOpen EventType = 6
  77. EventTypeListenClose EventType = 7
  78. EventTypeFileOpen EventType = 8
  79. EventTypeTCPRetransmit EventType = 9
  80. EventTypeL7Request EventType = 10
  81. EventTypeFunEnt EventType = 11
  82. EventTypeFunRet EventType = 12
  83. EventReasonNone EventReason = 0
  84. EventReasonOOMKill EventReason = 1
  85. )
  86. type Event struct {
  87. Type EventType
  88. Reason EventReason
  89. Pid uint32
  90. SrcAddr netaddr.IPPort
  91. DstAddr netaddr.IPPort
  92. Fd uint64
  93. Timestamp uint64
  94. L7Request *l7.RequestData
  95. StackEvent *StackEvent
  96. }
  97. type perfMapType uint8
  98. const (
  99. perfMapTypeProcEvents perfMapType = 1
  100. perfMapTypeTCPEvents perfMapType = 2
  101. perfMapTypeFileEvents perfMapType = 3
  102. perfMapTypeL7Events perfMapType = 4
  103. perfMapTypeSocketEvents perfMapType = 5
  104. perfMapTypeEventQueue perfMapType = 6
  105. )
  106. type Tracer struct {
  107. kernelVersion string
  108. disableL7Tracing bool
  109. disableE2ETracing bool
  110. disableStackTracing bool
  111. collection *ebpf.Collection
  112. readers map[string]*perf.Reader
  113. links []link.Link
  114. uprobes map[string]*ebpf.Program
  115. Symbols []debugelf.Symbol
  116. Uprobes []tracer.Uprobe
  117. UprobesMap map[string]tracer.Uprobe
  118. }
  119. func NewTracer(kernelVersion string, disableL7Tracing, disableE2ETracing, disableStackTracing bool) *Tracer {
  120. if disableL7Tracing {
  121. klog.Infoln("L7 tracing is disabled")
  122. }
  123. if disableE2ETracing {
  124. klog.Infoln("L7 tracing is disabled")
  125. }
  126. if disableStackTracing {
  127. klog.Infoln("L7 stack is disabled")
  128. }
  129. return &Tracer{
  130. kernelVersion: kernelVersion,
  131. disableL7Tracing: disableL7Tracing,
  132. disableE2ETracing: disableE2ETracing,
  133. disableStackTracing: disableStackTracing,
  134. readers: map[string]*perf.Reader{},
  135. uprobes: map[string]*ebpf.Program{},
  136. }
  137. }
  138. func (t *Tracer) Run(events chan<- Event) error {
  139. if err := t.ebpf(events); err != nil {
  140. return err
  141. }
  142. if err := t.init(events); err != nil {
  143. return err
  144. }
  145. return nil
  146. }
  147. func (t *Tracer) Close() {
  148. for _, p := range t.uprobes {
  149. _ = p.Close()
  150. }
  151. for _, l := range t.links {
  152. _ = l.Close()
  153. }
  154. for _, r := range t.readers {
  155. _ = r.Close()
  156. }
  157. t.collection.Close()
  158. }
  159. func (t *Tracer) init(ch chan<- Event) error {
  160. pids, err := proc.ListPids()
  161. if err != nil {
  162. return fmt.Errorf("failed to list pids: %w", err)
  163. }
  164. for _, pid := range pids {
  165. ch <- Event{Type: EventTypeProcessStart, Pid: pid}
  166. }
  167. fds, sockets := readFds(pids)
  168. for _, fd := range fds {
  169. ch <- Event{Type: EventTypeFileOpen, Pid: fd.pid, Fd: fd.fd}
  170. }
  171. listens := map[uint64]bool{}
  172. for _, s := range sockets {
  173. if s.Listen {
  174. listens[uint64(s.pid)<<32|uint64(s.SAddr.Port())] = true
  175. }
  176. }
  177. for _, s := range sockets {
  178. typ := EventTypeConnectionOpen
  179. if s.Listen {
  180. typ = EventTypeListenOpen
  181. } else if listens[uint64(s.pid)<<32|uint64(s.SAddr.Port())] || s.DAddr.Port() > s.SAddr.Port() { // inbound
  182. continue
  183. }
  184. ch <- Event{
  185. Type: typ,
  186. Pid: s.pid,
  187. Fd: s.fd,
  188. SrcAddr: s.SAddr,
  189. DstAddr: s.DAddr,
  190. }
  191. }
  192. return nil
  193. }
  194. type perfMap struct {
  195. name string
  196. perCPUBufferSizePages int
  197. typ perfMapType
  198. }
  199. func (t *Tracer) ebpf(ch chan<- Event) error {
  200. kv := "v" + common.KernelMajorMinor(t.kernelVersion)
  201. path, prg, err := EbpfCode(kv)
  202. klog.Infof("kv is %s, kernel version: %s path: %s\n", kv, t.kernelVersion, path)
  203. if len(prg) == 0 || err != nil {
  204. return fmt.Errorf("kv is %s, unsupported kernel version: %s path: %s err:<%v>", kv, t.kernelVersion, path, err)
  205. }
  206. _, debugFsErr := os.Stat("/sys/kernel/debug/tracing")
  207. _, traceFsErr := os.Stat("/sys/kernel/tracing")
  208. if debugFsErr != nil && traceFsErr != nil {
  209. return fmt.Errorf("kernel tracing is not available: debugfs or tracefs must be mounted")
  210. }
  211. collectionSpec, err := ebpf.LoadCollectionSpecFromReader(bytes.NewReader(prg))
  212. if err != nil {
  213. return fmt.Errorf("failed to load collection spec: %w", err)
  214. }
  215. _ = unix.Setrlimit(unix.RLIMIT_MEMLOCK, &unix.Rlimit{Cur: unix.RLIM_INFINITY, Max: unix.RLIM_INFINITY})
  216. tracer.PidFilter(collectionSpec)
  217. opts := &ebpf.CollectionOptions{MapReplacements: make(map[string]*ebpf.Map)}
  218. for _, spec := range collectionSpec.Maps {
  219. fmt.Println("maps:", spec.Name)
  220. }
  221. tracer.MapInit(collectionSpec, opts)
  222. // TODO 多进程
  223. // tracer.SetConstants(collectionSpec)
  224. c, err := ebpf.NewCollectionWithOptions(collectionSpec, *opts)
  225. if err != nil {
  226. var verr *ebpf.VerifierError
  227. if errors.As(err, &verr) {
  228. klog.Errorf("----%+v", verr)
  229. }
  230. return fmt.Errorf("failed to load collection: %w", err)
  231. }
  232. tracer.Offset()
  233. t.collection = c
  234. perfMaps := []perfMap{
  235. {name: "proc_events", typ: perfMapTypeProcEvents, perCPUBufferSizePages: 4},
  236. {name: "tcp_listen_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 4},
  237. {name: "tcp_connect_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 8},
  238. {name: "tcp_retransmit_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 4},
  239. {name: "file_events", typ: perfMapTypeFileEvents, perCPUBufferSizePages: 4},
  240. {name: "event_queue", typ: perfMapTypeEventQueue, perCPUBufferSizePages: 32},
  241. }
  242. fmt.Println(len(collectionSpec.Programs))
  243. fmt.Println(len(c.Programs))
  244. tracer.MapInsert(c)
  245. if !t.DisableL7Tracing() {
  246. perfMaps = append(perfMaps, perfMap{name: "l7_events", typ: perfMapTypeL7Events, perCPUBufferSizePages: 32})
  247. }
  248. perfMaps = append(perfMaps, perfMap{name: tracer.MAP_PERF_SOCKET_DATA_NAME, typ: perfMapTypeSocketEvents, perCPUBufferSizePages: 64})
  249. fmt.Println("perfMaps start --")
  250. for _, pm := range perfMaps {
  251. fmt.Println("pm.namepm.name: ", pm.name)
  252. m, ok := t.collection.Maps[pm.name]
  253. if ok {
  254. r, err := perf.NewReader(m, pm.perCPUBufferSizePages*os.Getpagesize())
  255. if err != nil {
  256. t.Close()
  257. return fmt.Errorf("failed to create ebpf reader: %w", err)
  258. }
  259. t.readers[pm.name] = r
  260. // event监听
  261. go runEventsReader(pm.name, r, ch, pm.typ)
  262. }
  263. }
  264. fmt.Println("perfMaps end --")
  265. for _, programSpec := range collectionSpec.Programs {
  266. program := t.collection.Programs[programSpec.Name]
  267. fmt.Println("programSpecprogramSpec:--:", programSpec.Name, programSpec.SectionName, programSpec.Type)
  268. if t.DisableL7Tracing() {
  269. switch programSpec.Name {
  270. case "sys_enter_writev", "sys_enter_write", "sys_enter_sendto", "sys_enter_sendmsg", "sys_enter_sendmmsg":
  271. continue
  272. case "sys_enter_read", "sys_enter_readv", "sys_enter_recvfrom", "sys_enter_recvmsg":
  273. continue
  274. case "sys_exit_read", "sys_exit_readv", "sys_exit_recvfrom", "sys_exit_recvmsg":
  275. continue
  276. }
  277. }
  278. var l link.Link
  279. switch programSpec.Type {
  280. case ebpf.TracePoint:
  281. if strings.Contains(programSpec.SectionName, "prog") {
  282. continue
  283. }
  284. parts := strings.SplitN(programSpec.AttachTo, "/", 2)
  285. l, err = link.Tracepoint(parts[0], parts[1], program, nil)
  286. case ebpf.Kprobe:
  287. if strings.HasPrefix(programSpec.SectionName, "uprobe/") {
  288. fmt.Println("==============uprobe s")
  289. fmt.Println(programSpec.Name, programSpec.SectionName, programSpec.Type)
  290. fmt.Println("==============uprobe e")
  291. t.uprobes[programSpec.Name] = program
  292. continue
  293. }
  294. l, err = link.Kprobe(programSpec.AttachTo, program, nil)
  295. }
  296. if err != nil {
  297. t.Close()
  298. return fmt.Errorf("failed to link program: %w", err)
  299. }
  300. t.links = append(t.links, l)
  301. }
  302. return nil
  303. }
  304. func (t EventType) String() string {
  305. switch t {
  306. case EventTypeProcessStart:
  307. return "process-start"
  308. case EventTypeProcessExit:
  309. return "process-exit"
  310. case EventTypeConnectionOpen:
  311. return "connection-open"
  312. case EventTypeConnectionClose:
  313. return "connection-close"
  314. case EventTypeConnectionError:
  315. return "connection-error"
  316. case EventTypeListenOpen:
  317. return "listen-open"
  318. case EventTypeListenClose:
  319. return "listen-close"
  320. case EventTypeFileOpen:
  321. return "file-open"
  322. case EventTypeTCPRetransmit:
  323. return "tcp-retransmit"
  324. case EventTypeL7Request:
  325. return "l7-request"
  326. }
  327. return "unknown: " + strconv.Itoa(int(t))
  328. }
  329. func (t EventReason) String() string {
  330. switch t {
  331. case EventReasonNone:
  332. return "none"
  333. case EventReasonOOMKill:
  334. return "oom-kill"
  335. }
  336. return "unknown: " + strconv.Itoa(int(t))
  337. }
  338. type procEvent struct {
  339. Type EventType
  340. Pid uint32
  341. Reason uint32
  342. }
  343. type tcpEvent struct {
  344. Fd uint64
  345. Timestamp uint64
  346. Type EventType
  347. Pid uint32
  348. SPort uint16
  349. DPort uint16
  350. SAddr [16]byte
  351. DAddr [16]byte
  352. }
  353. type fileEvent struct {
  354. Type EventType
  355. Pid uint32
  356. Fd uint64
  357. }
  358. // struct l7_event in l7.c
  359. type l7Event struct {
  360. Fd uint64
  361. ConnectionTimestamp uint64
  362. Pid uint32
  363. Status uint32
  364. Duration uint64
  365. Protocol uint8
  366. Method uint8
  367. Padding uint16
  368. StatementId uint32
  369. PayloadSize uint64
  370. TraceId uint64
  371. StartAt uint64 // ns
  372. EndtAt uint64 // ns
  373. TraceStart uint32
  374. TraceEnd uint32
  375. EventCount uint32
  376. AssumedAppId utils.HashByte
  377. SpanId utils.HashByte
  378. TraceIdFrom utils.HashByte16
  379. CalledId utils.HashByte
  380. InstanceIdFrom utils.HashByte
  381. AppIdFrom utils.HashByte
  382. SpanIdFrom utils.HashByte
  383. }
  384. type SocketDataBufferddd struct {
  385. EventsNum uint32
  386. Len uint32
  387. Data [32760]byte
  388. }
  389. const (
  390. TASK_COMM_LEN = 16
  391. BURST_DATA_BUF_SIZE = 8192
  392. )
  393. type Tuple struct {
  394. Daddr [16]uint8
  395. RcvSaddr [16]uint8
  396. AddrLen uint8
  397. L4Protocol uint8
  398. Dport uint16
  399. Num uint16
  400. }
  401. type SocketDatadddd struct {
  402. Pid uint32 // 表示线程号 如果'pid == tgid'表示一个进程, 否则是线程
  403. Tgid uint32 // 进程号
  404. CoroutineID uint64
  405. Source uint8
  406. Comm [TASK_COMM_LEN]byte
  407. SocketID uint64
  408. Tuple Tuple
  409. ExtraData uint32
  410. ExtraDataCount uint32
  411. TcpSeq uint32
  412. ThreadTraceID uint64
  413. Timestamp uint64
  414. Direction uint8
  415. MsgType uint8
  416. SyscallLen uint64
  417. DataSeq uint64
  418. DataType uint16
  419. DataLen uint16
  420. Data [BURST_DATA_BUF_SIZE]byte
  421. }
  422. type StackEvent struct {
  423. Pid uint64
  424. TraceId uint64
  425. Goid uint64
  426. Ip uint64
  427. Bp uint64
  428. CallerIp uint64
  429. CallerBp uint64
  430. TimeNsStart uint64
  431. TimeNsEnd uint64
  432. // Nid uint64
  433. // Fpid uint64
  434. // Level uint64
  435. Location byte
  436. }
  437. type StackFunEvent struct {
  438. StackEvent StackEvent
  439. Uprobe *tracer.Uprobe
  440. }
  441. func runEventsReader(name string, r *perf.Reader, ch chan<- Event, typ perfMapType) {
  442. for {
  443. rec, err := r.Read()
  444. if err != nil {
  445. if errors.Is(err, perf.ErrClosed) {
  446. break
  447. }
  448. continue
  449. }
  450. if rec.LostSamples > 0 {
  451. klog.Errorln(name, "lost samples:", rec.LostSamples)
  452. continue
  453. }
  454. var event Event
  455. switch typ {
  456. case perfMapTypeSocketEvents:
  457. //fmt.Println("perfMapTypeSocketEvents")
  458. // 假设 rec.RawSample 包含数据,类型为 []byte
  459. //rawData := rec.RawSample
  460. //fmt.Println("perfMapTypeSocketEvents2")
  461. //
  462. //// 创建一个 SocketDataBuffer 结构体实例
  463. //var buffer SocketDataBuffer
  464. //
  465. //// 创建一个字节缓冲区,并将数据填充到其中
  466. //reader := bytes.NewReader(rawData)
  467. //fmt.Println("perfMapTypeSocketEvents3")
  468. //fmt.Println(len(rawData))
  469. //// 使用 binary.Read 函数读取数据并解析为 SocketDataBuffer 结构体实例
  470. //if err := binary.Read(reader, binary.LittleEndian, &buffer); err != nil {
  471. // fmt.Println(reader.Len())
  472. // fmt.Println("Failed to read data:", err)
  473. // continue
  474. //}
  475. //fmt.Println("perfMapTypeSocketEvents4")
  476. //
  477. //// 打印解析后的数据
  478. //fmt.Println("EventsNum:", buffer.EventsNum)
  479. //fmt.Println("Len:", buffer.Len)
  480. //
  481. //// 打印 char data 的内容
  482. //fmt.Printf("Data: %s\n", string(buffer.Data[:buffer.Len])) // 仅打印实际长度的数据
  483. //socketDataBuffer := rec.RawSample
  484. // 解析 __socket_data_buffer
  485. //buf := (*SocketDataBuffer)(unsafe.Pointer(&rec.RawSample[0])) //nolint:gosec
  486. //
  487. //// 获取 char data[32760];
  488. //socketData := (*SocketData)(unsafe.Pointer(&buf.data[0])) //nolint:gosec
  489. //// todo
  490. //fmt.Printf("socketData.DataType:%d \n", (socketData.data_type))
  491. //fmt.Printf("socketData.DataLen:%d \n", (socketData.data_len))
  492. //
  493. //// 解析C结构体中的data字段
  494. //dataSlice := C.GoBytes(unsafe.Pointer(&socketData.data[0]), C.int(socketData.data_len))
  495. //// 打印或处理包含的数据
  496. //fmt.Printf("socketData.Payload:%v \n", string(dataSlice))
  497. /*todo */
  498. //socketData := (*(*[128]byte)(unsafe.Pointer(&eventC.line)))
  499. //dataPtr := unsafe.Pointer(&buf.data[0])
  500. //socketData := (*SocketData)(dataPtr)
  501. //reader2 := bytes.NewBuffer(rec.RawSample)
  502. // 222222
  503. //fmt.Println("socketData.Pid:", socketData.pid)
  504. //fmt.Println("socketData.Tgid:", socketData.tgid)
  505. //fmt.Println("socketData.CoroutineID:", socketData.coroutine_id)
  506. //fmt.Println("socketData.Source:", socketData.source)
  507. //
  508. //fmt.Printf("socketData.Comm: %s \n", socketData.comm)
  509. //fmt.Printf("socketData.SocketID :%v \n", socketData.socket_id)
  510. //fmt.Println("socketData.Tuple:", socketData.Tuple)
  511. //fmt.Println("socketData.ExtraData:", socketData.ExtraData)
  512. //fmt.Println("socketData.ExtraDataCount:", socketData.ExtraDataCount)
  513. //fmt.Println("socketData.TCPSeq:", socketData.TcpSeq)
  514. //fmt.Println("socketData.ThreadTraceID:", socketData.ThreadTraceID)
  515. //fmt.Println("socketData.Timestamp:", socketData.Timestamp)
  516. //fmt.Println("socketData.Direction:", socketData.Direction)
  517. //fmt.Println("socketData.MsgType:", socketData.MsgType)
  518. //fmt.Println("socketData.SyscallLen:", socketData.SyscallLen)
  519. //fmt.Println("socketData.DataSeq:", socketData.DataSeq)
  520. //socketData := &SocketData{}
  521. //reader := bytes.NewBuffer(rec.RawSample)
  522. //if err := binary.Read(reader, binary.LittleEndian, v); err != nil {
  523. // klog.Warningln("failed1 to read msg:", err)
  524. // continue
  525. //}
  526. //
  527. //var data []byte
  528. //payload := reader.Bytes()
  529. //switch {
  530. //case v.Len == 0:
  531. //case v.Len > 32760:
  532. // data = payload[:32760]
  533. //default:
  534. // data = payload[:v.Len]
  535. //}
  536. //////data2 := data[:v.Len]
  537. ////fmt.Println("perfMapTypeSocketEvents")
  538. //fmt.Println(v.EventsNum)
  539. //fmt.Println(v.Len)
  540. //fmt.Println(string(data))
  541. //
  542. //var data2 SocketData
  543. //reader2 := bytes.NewBuffer(data)
  544. //if err := binary.Read(reader2, binary.LittleEndian, data2); err != nil {
  545. // klog.Warningln("failed2 to read msg:", err)
  546. // continue
  547. //}
  548. //
  549. //fmt.Println(data2.Pid)
  550. //fmt.Println(data2.Tgid)
  551. //fmt.Println(string(v.Data))
  552. //continue
  553. case perfMapTypeL7Events:
  554. v := &l7Event{}
  555. reader := bytes.NewBuffer(rec.RawSample)
  556. if err := binary.Read(reader, binary.LittleEndian, v); err != nil {
  557. klog.Warningln("failed to read msg:", err)
  558. continue
  559. }
  560. //fmt.Println("v.TraceIdFrom")
  561. //fmt.Println(v.TraceIdFrom)
  562. //a := hex.EncodeToString(v.TraceIdFrom[:])
  563. //for _, b := range v.AssumedAppId {
  564. // fmt.Printf("v.AssumedAppId- %02\n", b)
  565. //}
  566. //fmt.Println(a)
  567. payload := reader.Bytes()
  568. req := &l7.RequestData{
  569. Protocol: l7.Protocol(v.Protocol),
  570. Status: l7.Status(v.Status),
  571. Duration: time.Duration(v.Duration),
  572. Method: l7.Method(v.Method),
  573. StatementId: v.StatementId,
  574. TraceId: v.TraceId,
  575. TraceStart: v.TraceStart,
  576. TraceEnd: v.TraceEnd,
  577. EventCount: v.EventCount,
  578. AssumedAppId: hex.EncodeToString(v.AssumedAppId[:]),
  579. SpanId: hex.EncodeToString(v.SpanId[:]),
  580. StartAt: v.StartAt,
  581. EndAt: v.EndtAt,
  582. }
  583. if v.TraceEnd == 1 {
  584. req.ParentSpanContext.TraceIdFrom = hex.EncodeToString(v.TraceIdFrom[:])
  585. req.ParentSpanContext.CalledId = hex.EncodeToString(v.CalledId[:])
  586. req.ParentSpanContext.InstanceIdFrom = hex.EncodeToString(v.InstanceIdFrom[:])
  587. req.ParentSpanContext.AppIdFrom = hex.EncodeToString(v.AppIdFrom[:])
  588. req.ParentSpanContext.SpanIdFrom = hex.EncodeToString(v.SpanIdFrom[:])
  589. }
  590. switch {
  591. case v.PayloadSize == 0:
  592. case v.PayloadSize > MaxPayloadSize:
  593. req.Payload = payload[:MaxPayloadSize]
  594. default:
  595. req.Payload = payload[:v.PayloadSize]
  596. }
  597. //fmt.Println("==========")
  598. //fmt.Println("req.Payload:", string(req.Payload))
  599. //fmt.Println("==========")
  600. event = Event{Type: EventTypeL7Request, Pid: v.Pid, Fd: v.Fd, Timestamp: v.ConnectionTimestamp, L7Request: req}
  601. case perfMapTypeFileEvents:
  602. v := &fileEvent{}
  603. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  604. klog.Warningln("failed to read msg:", err)
  605. continue
  606. }
  607. event = Event{Type: v.Type, Pid: v.Pid, Fd: v.Fd}
  608. case perfMapTypeProcEvents:
  609. v := &procEvent{}
  610. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  611. klog.Warningln("failed to read msg:", err)
  612. continue
  613. }
  614. event = Event{Type: v.Type, Reason: EventReason(v.Reason), Pid: v.Pid}
  615. case perfMapTypeTCPEvents:
  616. v := &tcpEvent{}
  617. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  618. klog.Warningln("failed to read msg:", err)
  619. continue
  620. }
  621. event = Event{
  622. Type: v.Type,
  623. Pid: v.Pid,
  624. SrcAddr: ipPort(v.SAddr, v.SPort),
  625. DstAddr: ipPort(v.DAddr, v.DPort),
  626. Fd: v.Fd,
  627. Timestamp: v.Timestamp,
  628. }
  629. case perfMapTypeEventQueue:
  630. v := &StackEvent{}
  631. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  632. klog.Warningln("failed to read msg:", err)
  633. continue
  634. }
  635. event = Event{
  636. Type: EventTypeFunEnt,
  637. StackEvent: v,
  638. }
  639. default:
  640. continue
  641. }
  642. ch <- event
  643. }
  644. }
  645. func ipPort(ip [16]byte, port uint16) netaddr.IPPort {
  646. i, _ := netaddr.FromStdIP(ip[:])
  647. return netaddr.IPPortFrom(i, port)
  648. }
  649. func (t *Tracer) InitKProcInfo(pid uint32, insID utils.ID, codeType uint16) error {
  650. var err error
  651. info := tracer.EbpfProcInfo{}
  652. info.InstanceId = insID.HashtVal
  653. // 获取内存地址
  654. //allocDetails, err := tracer.Allocate(int(pid))
  655. //if err == nil && allocDetails != nil {
  656. // info.StartAddr = allocDetails.StartAddr
  657. // info.EndAddr = allocDetails.EndAddr
  658. //}
  659. info.CodeType = codeType
  660. //klog.Infoln("Major:", major)
  661. //klog.Infoln("Minor:", minor)
  662. //klog.Infoln("Revision:", revision)
  663. //klog.Infoln("goVersion", goVersion)
  664. //klog.Infoln("info.StartAddr", info.StartAddr)
  665. //klog.Infoln("info.EndAddr", info.EndAddr)
  666. _, err = tracer.UpdateProcInfoToMap(t.collection, pid, info)
  667. if err != nil {
  668. klog.Error("failed to update program info", err)
  669. }
  670. return err
  671. }
  672. // TODO check language
  673. func (t *Tracer) DisableL7Tracing() bool {
  674. return t.disableL7Tracing
  675. }
  676. func (t *Tracer) DisableE2ETracing() bool {
  677. return t.disableE2ETracing
  678. }
  679. func (t *Tracer) DisableStackTracing() bool {
  680. return t.disableStackTracing
  681. }