tracer.go 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739
  1. package ebpftracer
  2. import (
  3. "bytes"
  4. debugelf "debug/elf"
  5. "encoding/binary"
  6. "encoding/hex"
  7. "errors"
  8. "fmt"
  9. "os"
  10. "runtime"
  11. "strconv"
  12. "strings"
  13. "time"
  14. "github.com/cilium/ebpf"
  15. "github.com/cilium/ebpf/link"
  16. "github.com/cilium/ebpf/perf"
  17. "github.com/coroot/coroot-node-agent/common"
  18. "github.com/coroot/coroot-node-agent/ebpftracer/l7"
  19. "github.com/coroot/coroot-node-agent/ebpftracer/tracer"
  20. "github.com/coroot/coroot-node-agent/proc"
  21. "github.com/coroot/coroot-node-agent/utils"
  22. "golang.org/x/mod/semver"
  23. "golang.org/x/sys/unix"
  24. "inet.af/netaddr"
  25. "k8s.io/klog/v2"
  26. )
  27. /*
  28. #define TASK_COMM_LEN 16
  29. #define BURST_DATA_BUF_SIZE 8192 // For brust send buffer
  30. #include <linux/types.h>
  31. struct __tuple_t {
  32. __u8 daddr[16];
  33. __u8 rcv_saddr[16];
  34. __u8 addr_len;
  35. __u8 l4_protocol;
  36. __u16 dport;
  37. __u16 num;
  38. };
  39. struct __socket_data {
  40. __u32 pid;
  41. __u32 tgid;
  42. __u64 coroutine_id;
  43. __u8 source;
  44. __u8 comm[TASK_COMM_LEN];
  45. __u64 socket_id;
  46. struct __tuple_t tuple;
  47. __u32 extra_data;
  48. __u32 extra_data_count;
  49. __u32 tcp_seq;
  50. __u64 thread_trace_id;
  51. __u64 timestamp;
  52. __u8 direction: 1;
  53. __u8 msg_type: 7;
  54. __u64 syscall_len;
  55. __u64 data_seq;
  56. __u16 data_type;
  57. __u16 data_len;
  58. char data[BURST_DATA_BUF_SIZE];
  59. } __attribute__((packed));
  60. struct __socket_data_buffer {
  61. __u32 events_num;
  62. __u32 len;
  63. char data[32760];
  64. };
  65. */
  66. import "C"
  67. type SocketData C.struct___socket_data
  68. type SocketDataBuffer C.struct___socket_data_buffer
  69. const MaxPayloadSize = 1024
  70. type EventType uint32
  71. type EventReason uint32
  72. const (
  73. EventTypeProcessStart EventType = 1
  74. EventTypeProcessExit EventType = 2
  75. EventTypeConnectionOpen EventType = 3
  76. EventTypeConnectionClose EventType = 4
  77. EventTypeConnectionError EventType = 5
  78. EventTypeListenOpen EventType = 6
  79. EventTypeListenClose EventType = 7
  80. EventTypeFileOpen EventType = 8
  81. EventTypeTCPRetransmit EventType = 9
  82. EventTypeL7Request EventType = 10
  83. EventTypeFunEnt EventType = 11
  84. EventTypeFunRet EventType = 12
  85. EventReasonNone EventReason = 0
  86. EventReasonOOMKill EventReason = 1
  87. )
  88. type Event struct {
  89. Type EventType
  90. Reason EventReason
  91. Pid uint32
  92. SrcAddr netaddr.IPPort
  93. DstAddr netaddr.IPPort
  94. Fd uint64
  95. Timestamp uint64
  96. L7Request *l7.RequestData
  97. StackEvent *StackEvent
  98. }
  99. type perfMapType uint8
  100. const (
  101. perfMapTypeProcEvents perfMapType = 1
  102. perfMapTypeTCPEvents perfMapType = 2
  103. perfMapTypeFileEvents perfMapType = 3
  104. perfMapTypeL7Events perfMapType = 4
  105. perfMapTypeSocketEvents perfMapType = 5
  106. perfMapTypeEventQueue perfMapType = 6
  107. )
  108. type Tracer struct {
  109. kernelVersion string
  110. disableL7Tracing bool
  111. collection *ebpf.Collection
  112. readers map[string]*perf.Reader
  113. links []link.Link
  114. uprobes map[string]*ebpf.Program
  115. Symbols []debugelf.Symbol
  116. Uprobes []tracer.Uprobe
  117. UprobesMap map[string]tracer.Uprobe
  118. }
  119. func NewTracer(kernelVersion string, disableL7Tracing bool) *Tracer {
  120. if disableL7Tracing {
  121. klog.Infoln("L7 tracing is disabled")
  122. }
  123. return &Tracer{
  124. kernelVersion: kernelVersion,
  125. disableL7Tracing: disableL7Tracing,
  126. readers: map[string]*perf.Reader{},
  127. uprobes: map[string]*ebpf.Program{},
  128. }
  129. }
  130. func (t *Tracer) Run(events chan<- Event) error {
  131. if err := t.ebpf(events); err != nil {
  132. return err
  133. }
  134. if err := t.stack(); err != nil {
  135. return err
  136. }
  137. if err := t.init(events); err != nil {
  138. return err
  139. }
  140. return nil
  141. }
  142. func (t *Tracer) Close() {
  143. for _, p := range t.uprobes {
  144. _ = p.Close()
  145. }
  146. for _, l := range t.links {
  147. _ = l.Close()
  148. }
  149. for _, r := range t.readers {
  150. _ = r.Close()
  151. }
  152. t.collection.Close()
  153. }
  154. func (t *Tracer) init(ch chan<- Event) error {
  155. pids, err := proc.ListPids()
  156. if err != nil {
  157. return fmt.Errorf("failed to list pids: %w", err)
  158. }
  159. for _, pid := range pids {
  160. ch <- Event{Type: EventTypeProcessStart, Pid: pid}
  161. }
  162. fds, sockets := readFds(pids)
  163. for _, fd := range fds {
  164. ch <- Event{Type: EventTypeFileOpen, Pid: fd.pid, Fd: fd.fd}
  165. }
  166. listens := map[uint64]bool{}
  167. for _, s := range sockets {
  168. if s.Listen {
  169. listens[uint64(s.pid)<<32|uint64(s.SAddr.Port())] = true
  170. }
  171. }
  172. for _, s := range sockets {
  173. typ := EventTypeConnectionOpen
  174. if s.Listen {
  175. typ = EventTypeListenOpen
  176. } else if listens[uint64(s.pid)<<32|uint64(s.SAddr.Port())] || s.DAddr.Port() > s.SAddr.Port() { // inbound
  177. continue
  178. }
  179. ch <- Event{
  180. Type: typ,
  181. Pid: s.pid,
  182. Fd: s.fd,
  183. SrcAddr: s.SAddr,
  184. DstAddr: s.DAddr,
  185. }
  186. }
  187. return nil
  188. }
  189. type perfMap struct {
  190. name string
  191. perCPUBufferSizePages int
  192. typ perfMapType
  193. }
  194. func (t *Tracer) ebpf(ch chan<- Event) error {
  195. if _, ok := ebpfProg[runtime.GOARCH]; !ok {
  196. return fmt.Errorf("unsupported architecture: %s", runtime.GOARCH)
  197. }
  198. kv := "v" + common.KernelMajorMinor(t.kernelVersion)
  199. var prg []byte
  200. for _, p := range ebpfProg[runtime.GOARCH] {
  201. if semver.Compare(kv, p.v) >= 0 {
  202. prg = p.p
  203. break
  204. }
  205. }
  206. if len(prg) == 0 {
  207. return fmt.Errorf("unsupported kernel version: %s", t.kernelVersion)
  208. }
  209. _, debugFsErr := os.Stat("/sys/kernel/debug/tracing")
  210. _, traceFsErr := os.Stat("/sys/kernel/tracing")
  211. if debugFsErr != nil && traceFsErr != nil {
  212. return fmt.Errorf("kernel tracing is not available: debugfs or tracefs must be mounted")
  213. }
  214. collectionSpec, err := ebpf.LoadCollectionSpecFromReader(bytes.NewReader(prg))
  215. if err != nil {
  216. return fmt.Errorf("failed to load collection spec: %w", err)
  217. }
  218. _ = unix.Setrlimit(unix.RLIMIT_MEMLOCK, &unix.Rlimit{Cur: unix.RLIM_INFINITY, Max: unix.RLIM_INFINITY})
  219. tracer.PidFilter(collectionSpec)
  220. opts := &ebpf.CollectionOptions{MapReplacements: make(map[string]*ebpf.Map)}
  221. for _, spec := range collectionSpec.Maps {
  222. fmt.Println("maps:", spec.Name)
  223. }
  224. tracer.MapInit(collectionSpec, opts)
  225. // TODO 多进程
  226. tracer.SetConstants(collectionSpec)
  227. c, err := ebpf.NewCollectionWithOptions(collectionSpec, *opts)
  228. if err != nil {
  229. var verr *ebpf.VerifierError
  230. if errors.As(err, &verr) {
  231. klog.Errorf("----%+v", verr)
  232. }
  233. return fmt.Errorf("failed to load collection: %w", err)
  234. }
  235. tracer.Offset()
  236. t.collection = c
  237. perfMaps := []perfMap{
  238. {name: "proc_events", typ: perfMapTypeProcEvents, perCPUBufferSizePages: 4},
  239. {name: "tcp_listen_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 4},
  240. {name: "tcp_connect_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 8},
  241. {name: "tcp_retransmit_events", typ: perfMapTypeTCPEvents, perCPUBufferSizePages: 4},
  242. {name: "file_events", typ: perfMapTypeFileEvents, perCPUBufferSizePages: 4},
  243. {name: "event_queue", typ: perfMapTypeEventQueue, perCPUBufferSizePages: 32},
  244. }
  245. fmt.Println(len(collectionSpec.Programs))
  246. fmt.Println(len(c.Programs))
  247. tracer.MapInsert(c)
  248. if !t.disableL7Tracing {
  249. perfMaps = append(perfMaps, perfMap{name: "l7_events", typ: perfMapTypeL7Events, perCPUBufferSizePages: 32})
  250. }
  251. perfMaps = append(perfMaps, perfMap{name: tracer.MAP_PERF_SOCKET_DATA_NAME, typ: perfMapTypeSocketEvents, perCPUBufferSizePages: 64})
  252. fmt.Println("perfMaps start --")
  253. for _, pm := range perfMaps {
  254. fmt.Println("pm.namepm.name: ", pm.name)
  255. m, ok := t.collection.Maps[pm.name]
  256. if ok {
  257. r, err := perf.NewReader(m, pm.perCPUBufferSizePages*os.Getpagesize())
  258. if err != nil {
  259. t.Close()
  260. return fmt.Errorf("failed to create ebpf reader: %w", err)
  261. }
  262. t.readers[pm.name] = r
  263. // event监听
  264. go runEventsReader(pm.name, r, ch, pm.typ)
  265. }
  266. }
  267. fmt.Println("perfMaps end --")
  268. for _, programSpec := range collectionSpec.Programs {
  269. program := t.collection.Programs[programSpec.Name]
  270. fmt.Println("programSpecprogramSpec:--:", programSpec.Name, programSpec.SectionName, programSpec.Type)
  271. if t.disableL7Tracing {
  272. switch programSpec.Name {
  273. case "sys_enter_writev", "sys_enter_write", "sys_enter_sendto", "sys_enter_sendmsg", "sys_enter_sendmmsg":
  274. continue
  275. case "sys_enter_read", "sys_enter_readv", "sys_enter_recvfrom", "sys_enter_recvmsg":
  276. continue
  277. case "sys_exit_read", "sys_exit_readv", "sys_exit_recvfrom", "sys_exit_recvmsg":
  278. continue
  279. }
  280. }
  281. var l link.Link
  282. switch programSpec.Type {
  283. case ebpf.TracePoint:
  284. if strings.Contains(programSpec.SectionName, "prog") {
  285. continue
  286. }
  287. parts := strings.SplitN(programSpec.AttachTo, "/", 2)
  288. l, err = link.Tracepoint(parts[0], parts[1], program, nil)
  289. case ebpf.Kprobe:
  290. if strings.HasPrefix(programSpec.SectionName, "uprobe/") {
  291. fmt.Println("==============uprobe s")
  292. fmt.Println(programSpec.Name, programSpec.SectionName, programSpec.Type)
  293. fmt.Println("==============uprobe e")
  294. t.uprobes[programSpec.Name] = program
  295. continue
  296. }
  297. l, err = link.Kprobe(programSpec.AttachTo, program, nil)
  298. }
  299. if err != nil {
  300. t.Close()
  301. return fmt.Errorf("failed to link program: %w", err)
  302. }
  303. t.links = append(t.links, l)
  304. }
  305. return nil
  306. }
  307. func (t EventType) String() string {
  308. switch t {
  309. case EventTypeProcessStart:
  310. return "process-start"
  311. case EventTypeProcessExit:
  312. return "process-exit"
  313. case EventTypeConnectionOpen:
  314. return "connection-open"
  315. case EventTypeConnectionClose:
  316. return "connection-close"
  317. case EventTypeConnectionError:
  318. return "connection-error"
  319. case EventTypeListenOpen:
  320. return "listen-open"
  321. case EventTypeListenClose:
  322. return "listen-close"
  323. case EventTypeFileOpen:
  324. return "file-open"
  325. case EventTypeTCPRetransmit:
  326. return "tcp-retransmit"
  327. case EventTypeL7Request:
  328. return "l7-request"
  329. }
  330. return "unknown: " + strconv.Itoa(int(t))
  331. }
  332. func (t EventReason) String() string {
  333. switch t {
  334. case EventReasonNone:
  335. return "none"
  336. case EventReasonOOMKill:
  337. return "oom-kill"
  338. }
  339. return "unknown: " + strconv.Itoa(int(t))
  340. }
  341. type procEvent struct {
  342. Type EventType
  343. Pid uint32
  344. Reason uint32
  345. }
  346. type tcpEvent struct {
  347. Fd uint64
  348. Timestamp uint64
  349. Type EventType
  350. Pid uint32
  351. SPort uint16
  352. DPort uint16
  353. SAddr [16]byte
  354. DAddr [16]byte
  355. }
  356. type fileEvent struct {
  357. Type EventType
  358. Pid uint32
  359. Fd uint64
  360. }
  361. // struct l7_event in l7.c
  362. type l7Event struct {
  363. Fd uint64
  364. ConnectionTimestamp uint64
  365. Pid uint32
  366. Status uint32
  367. Duration uint64
  368. Protocol uint8
  369. Method uint8
  370. Padding uint16
  371. StatementId uint32
  372. PayloadSize uint64
  373. TraceId uint64
  374. TraceStart uint32
  375. TraceEnd uint32
  376. EventCount uint32
  377. AssumedAppId utils.HashByte
  378. SpanId utils.HashByte
  379. TraceIdFrom utils.HashByte16
  380. CalledId utils.HashByte
  381. InstanceIdFrom utils.HashByte
  382. AppIdFrom utils.HashByte
  383. SpanIdFrom utils.HashByte
  384. }
  385. type SocketDataBufferddd struct {
  386. EventsNum uint32
  387. Len uint32
  388. Data [32760]byte
  389. }
  390. const (
  391. TASK_COMM_LEN = 16
  392. BURST_DATA_BUF_SIZE = 8192
  393. )
  394. type Tuple struct {
  395. Daddr [16]uint8
  396. RcvSaddr [16]uint8
  397. AddrLen uint8
  398. L4Protocol uint8
  399. Dport uint16
  400. Num uint16
  401. }
  402. type SocketDatadddd struct {
  403. Pid uint32 // 表示线程号 如果'pid == tgid'表示一个进程, 否则是线程
  404. Tgid uint32 // 进程号
  405. CoroutineID uint64
  406. Source uint8
  407. Comm [TASK_COMM_LEN]byte
  408. SocketID uint64
  409. Tuple Tuple
  410. ExtraData uint32
  411. ExtraDataCount uint32
  412. TcpSeq uint32
  413. ThreadTraceID uint64
  414. Timestamp uint64
  415. Direction uint8
  416. MsgType uint8
  417. SyscallLen uint64
  418. DataSeq uint64
  419. DataType uint16
  420. DataLen uint16
  421. Data [BURST_DATA_BUF_SIZE]byte
  422. }
  423. type StackEvent struct {
  424. Pid uint64
  425. TraceId uint64
  426. Goid uint64
  427. Ip uint64
  428. Bp uint64
  429. CallerIp uint64
  430. CallerBp uint64
  431. TimeNsStart uint64
  432. TimeNsEnd uint64
  433. Nid uint64
  434. Fpid uint64
  435. Level uint64
  436. Location byte
  437. }
  438. type StackFunEvent struct {
  439. StackEvent StackEvent
  440. Uprobe *tracer.Uprobe
  441. Level int
  442. Pid int
  443. Nid int
  444. }
  445. func runEventsReader(name string, r *perf.Reader, ch chan<- Event, typ perfMapType) {
  446. for {
  447. rec, err := r.Read()
  448. if err != nil {
  449. if errors.Is(err, perf.ErrClosed) {
  450. break
  451. }
  452. continue
  453. }
  454. if rec.LostSamples > 0 {
  455. klog.Errorln(name, "lost samples:", rec.LostSamples)
  456. continue
  457. }
  458. var event Event
  459. switch typ {
  460. case perfMapTypeSocketEvents:
  461. //fmt.Println("perfMapTypeSocketEvents")
  462. // 假设 rec.RawSample 包含数据,类型为 []byte
  463. //rawData := rec.RawSample
  464. //fmt.Println("perfMapTypeSocketEvents2")
  465. //
  466. //// 创建一个 SocketDataBuffer 结构体实例
  467. //var buffer SocketDataBuffer
  468. //
  469. //// 创建一个字节缓冲区,并将数据填充到其中
  470. //reader := bytes.NewReader(rawData)
  471. //fmt.Println("perfMapTypeSocketEvents3")
  472. //fmt.Println(len(rawData))
  473. //// 使用 binary.Read 函数读取数据并解析为 SocketDataBuffer 结构体实例
  474. //if err := binary.Read(reader, binary.LittleEndian, &buffer); err != nil {
  475. // fmt.Println(reader.Len())
  476. // fmt.Println("Failed to read data:", err)
  477. // continue
  478. //}
  479. //fmt.Println("perfMapTypeSocketEvents4")
  480. //
  481. //// 打印解析后的数据
  482. //fmt.Println("EventsNum:", buffer.EventsNum)
  483. //fmt.Println("Len:", buffer.Len)
  484. //
  485. //// 打印 char data 的内容
  486. //fmt.Printf("Data: %s\n", string(buffer.Data[:buffer.Len])) // 仅打印实际长度的数据
  487. //socketDataBuffer := rec.RawSample
  488. // 解析 __socket_data_buffer
  489. //buf := (*SocketDataBuffer)(unsafe.Pointer(&rec.RawSample[0])) //nolint:gosec
  490. //
  491. //// 获取 char data[32760];
  492. //socketData := (*SocketData)(unsafe.Pointer(&buf.data[0])) //nolint:gosec
  493. //// todo
  494. //fmt.Printf("socketData.DataType:%d \n", (socketData.data_type))
  495. //fmt.Printf("socketData.DataLen:%d \n", (socketData.data_len))
  496. //
  497. //// 解析C结构体中的data字段
  498. //dataSlice := C.GoBytes(unsafe.Pointer(&socketData.data[0]), C.int(socketData.data_len))
  499. //// 打印或处理包含的数据
  500. //fmt.Printf("socketData.Payload:%v \n", string(dataSlice))
  501. /*todo */
  502. //socketData := (*(*[128]byte)(unsafe.Pointer(&eventC.line)))
  503. //dataPtr := unsafe.Pointer(&buf.data[0])
  504. //socketData := (*SocketData)(dataPtr)
  505. //reader2 := bytes.NewBuffer(rec.RawSample)
  506. // 222222
  507. //fmt.Println("socketData.Pid:", socketData.pid)
  508. //fmt.Println("socketData.Tgid:", socketData.tgid)
  509. //fmt.Println("socketData.CoroutineID:", socketData.coroutine_id)
  510. //fmt.Println("socketData.Source:", socketData.source)
  511. //
  512. //fmt.Printf("socketData.Comm: %s \n", socketData.comm)
  513. //fmt.Printf("socketData.SocketID :%v \n", socketData.socket_id)
  514. //fmt.Println("socketData.Tuple:", socketData.Tuple)
  515. //fmt.Println("socketData.ExtraData:", socketData.ExtraData)
  516. //fmt.Println("socketData.ExtraDataCount:", socketData.ExtraDataCount)
  517. //fmt.Println("socketData.TCPSeq:", socketData.TcpSeq)
  518. //fmt.Println("socketData.ThreadTraceID:", socketData.ThreadTraceID)
  519. //fmt.Println("socketData.Timestamp:", socketData.Timestamp)
  520. //fmt.Println("socketData.Direction:", socketData.Direction)
  521. //fmt.Println("socketData.MsgType:", socketData.MsgType)
  522. //fmt.Println("socketData.SyscallLen:", socketData.SyscallLen)
  523. //fmt.Println("socketData.DataSeq:", socketData.DataSeq)
  524. //socketData := &SocketData{}
  525. //reader := bytes.NewBuffer(rec.RawSample)
  526. //if err := binary.Read(reader, binary.LittleEndian, v); err != nil {
  527. // klog.Warningln("failed1 to read msg:", err)
  528. // continue
  529. //}
  530. //
  531. //var data []byte
  532. //payload := reader.Bytes()
  533. //switch {
  534. //case v.Len == 0:
  535. //case v.Len > 32760:
  536. // data = payload[:32760]
  537. //default:
  538. // data = payload[:v.Len]
  539. //}
  540. //////data2 := data[:v.Len]
  541. ////fmt.Println("perfMapTypeSocketEvents")
  542. //fmt.Println(v.EventsNum)
  543. //fmt.Println(v.Len)
  544. //fmt.Println(string(data))
  545. //
  546. //var data2 SocketData
  547. //reader2 := bytes.NewBuffer(data)
  548. //if err := binary.Read(reader2, binary.LittleEndian, data2); err != nil {
  549. // klog.Warningln("failed2 to read msg:", err)
  550. // continue
  551. //}
  552. //
  553. //fmt.Println(data2.Pid)
  554. //fmt.Println(data2.Tgid)
  555. //fmt.Println(string(v.Data))
  556. //continue
  557. case perfMapTypeL7Events:
  558. v := &l7Event{}
  559. reader := bytes.NewBuffer(rec.RawSample)
  560. if err := binary.Read(reader, binary.LittleEndian, v); err != nil {
  561. klog.Warningln("failed to read msg:", err)
  562. continue
  563. }
  564. //fmt.Println("v.TraceIdFrom")
  565. //fmt.Println(v.TraceIdFrom)
  566. //a := hex.EncodeToString(v.TraceIdFrom[:])
  567. //for _, b := range v.AssumedAppId {
  568. // fmt.Printf("v.AssumedAppId- %02\n", b)
  569. //}
  570. //fmt.Println(a)
  571. payload := reader.Bytes()
  572. req := &l7.RequestData{
  573. Protocol: l7.Protocol(v.Protocol),
  574. Status: l7.Status(v.Status),
  575. Duration: time.Duration(v.Duration),
  576. Method: l7.Method(v.Method),
  577. StatementId: v.StatementId,
  578. TraceId: v.TraceId,
  579. TraceStart: v.TraceStart,
  580. TraceEnd: v.TraceEnd,
  581. EventCount: v.EventCount,
  582. AssumedAppId: hex.EncodeToString(v.AssumedAppId[:]),
  583. SpanId: hex.EncodeToString(v.SpanId[:]),
  584. }
  585. if v.TraceEnd == 1 {
  586. req.ParentSpanContext.TraceIdFrom = hex.EncodeToString(v.TraceIdFrom[:])
  587. req.ParentSpanContext.CalledId = hex.EncodeToString(v.CalledId[:])
  588. req.ParentSpanContext.InstanceIdFrom = hex.EncodeToString(v.InstanceIdFrom[:])
  589. req.ParentSpanContext.AppIdFrom = hex.EncodeToString(v.AppIdFrom[:])
  590. req.ParentSpanContext.SpanIdFrom = hex.EncodeToString(v.SpanIdFrom[:])
  591. }
  592. switch {
  593. case v.PayloadSize == 0:
  594. case v.PayloadSize > MaxPayloadSize:
  595. req.Payload = payload[:MaxPayloadSize]
  596. default:
  597. req.Payload = payload[:v.PayloadSize]
  598. }
  599. //fmt.Println("==========")
  600. //fmt.Println("req.Payload:", string(req.Payload))
  601. //fmt.Println("==========")
  602. event = Event{Type: EventTypeL7Request, Pid: v.Pid, Fd: v.Fd, Timestamp: v.ConnectionTimestamp, L7Request: req}
  603. case perfMapTypeFileEvents:
  604. v := &fileEvent{}
  605. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  606. klog.Warningln("failed to read msg:", err)
  607. continue
  608. }
  609. event = Event{Type: v.Type, Pid: v.Pid, Fd: v.Fd}
  610. case perfMapTypeProcEvents:
  611. v := &procEvent{}
  612. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  613. klog.Warningln("failed to read msg:", err)
  614. continue
  615. }
  616. event = Event{Type: v.Type, Reason: EventReason(v.Reason), Pid: v.Pid}
  617. case perfMapTypeTCPEvents:
  618. v := &tcpEvent{}
  619. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  620. klog.Warningln("failed to read msg:", err)
  621. continue
  622. }
  623. event = Event{
  624. Type: v.Type,
  625. Pid: v.Pid,
  626. SrcAddr: ipPort(v.SAddr, v.SPort),
  627. DstAddr: ipPort(v.DAddr, v.DPort),
  628. Fd: v.Fd,
  629. Timestamp: v.Timestamp,
  630. }
  631. case perfMapTypeEventQueue:
  632. v := &StackEvent{}
  633. if err := binary.Read(bytes.NewBuffer(rec.RawSample), binary.LittleEndian, v); err != nil {
  634. klog.Warningln("failed to read msg:", err)
  635. continue
  636. }
  637. event = Event{
  638. Type: EventTypeFunEnt,
  639. StackEvent: v,
  640. }
  641. default:
  642. continue
  643. }
  644. ch <- event
  645. }
  646. }
  647. func ipPort(ip [16]byte, port uint16) netaddr.IPPort {
  648. i, _ := netaddr.FromStdIP(ip[:])
  649. return netaddr.IPPortFrom(i, port)
  650. }
  651. func (t *Tracer) InitKProcInfo(pid uint32, insID utils.ID) error {
  652. info := tracer.EbpfProcInfo{}
  653. info.InstanceId = insID.HashtVal
  654. // 获取内存地址
  655. allocDetails, err := tracer.Allocate(int(pid))
  656. if err == nil && allocDetails != nil {
  657. info.StartAddr = allocDetails.StartAddr
  658. info.EndAddr = allocDetails.EndAddr
  659. }
  660. //klog.Infoln("Major:", major)
  661. //klog.Infoln("Minor:", minor)
  662. //klog.Infoln("Revision:", revision)
  663. //klog.Infoln("goVersion", goVersion)
  664. //klog.Infoln("info.StartAddr", info.StartAddr)
  665. //klog.Infoln("info.EndAddr", info.EndAddr)
  666. _, err = tracer.UpdateProcInfoToMap(t.collection, pid, info)
  667. if err != nil {
  668. klog.Error("failed to update program info", err)
  669. }
  670. return err
  671. }