• M. Mert Yıldıran's avatar
    Add Go `crypto/tls` eBPF tracer for TLS connections (#1120) · 2ad4838c
    M. Mert Yıldıran authored
    * Run `go generate tls_tapper.go`
    
    * Add `golang_uprobes.c`
    
    * Add Golang hooks and offsets
    
    * Add `golangConnection` struct and implement `pollGolangReadWrite` method
    
    * Upgrade `github.com/cilium/ebpf` version to `v0.8.1`
    
    * Fix the linter error
    
    * Move map related stuff to `maps.h` and run `go generate tls_tapper.go`
    
    * Remove unused parameter
    
    * Add an environment variable to test Golang locally
    
    * Replace `Libssl` occurrences with `Ssllib` for consistency
    
    * Fix exe path finding
    
    * Temporarily disable OpenSSL
    
    * Fix the mixed offsets and dissection preparation
    
    * Change the read symbol from `net/http.(*persistConn).Read` to `crypto/tls.(*Conn).Read`
    
    * Remove `len` and `cap` fields
    
    * Fix the indent
    
    * Fix the read data address
    
    * Make `golang_dial_writes` key `__u64` and include the PID
    
    * Fix the read data address one more time
    
    * Temporarily disable the PCAP capture
    
    * Add a uprobe for `net/http.(*gzipReader).Read` to read chunked HTTP response body
    
    * Cancel `golang_crypto_tls_read_uprobe` if it's a gzip read
    
    * Make hash map names more meaningful
    
    * Pass the connection address from `write` to `gzip` through a common address between `gzip` and `dial`
    
    * Fix the probed line number links
    
    * Add `golangReader` struct and implement its `Read` method
    
    * Have a single counter pair and request response matcher per Golang connection
    
    * Add `MIZU_GLOBAL_GOLANG_PATH` environment variable
    
    * `NULL` terminate the bytes with `unix.ByteSliceToString`
    
    * Temporarily reject the gzip chunks
    
    * Add malformed TODOs
    
    * Revert "`NULL` terminate the bytes with `unix.ByteSliceToString`"
    
    This reverts commit 7ee7ef7e.
    
    * Bring back `len` and `cap` fields
    
    * Set `len` and `cap` in `golang_net_http_gzipreader_read_uprobe` as well
    
    * Remove two `TODO`s
    
    * Fix the `key_gzip` offsets
    
    * Compress if it's gzip chunk (probably wrong!)
    
    * Revert "Compress if it's gzip chunk (probably wrong!)"
    
    This reverts commit 094a7c3d.
    
    * Remove `golang_net_http_gzipreader_read_uprobe`
    
    * Read constant 4KiB
    
    * Use constant read length
    
    * Get the correct len of bytes (saw the second entry)
    
    * Set all buffer sizes to `CHUNK_SIZE`
    
    * Remove a `TODO`
    
    * Revert "Temporarily disable the PCAP capture"
    
    This reverts commit a2da15ef.
    
    * Update `golang_crypto_tls_read_uprobe`
    
    * Set the `reader` field of `tlsStream` to fix a `nil pointer dereference` error
    
    * Don't export any fields of `golangConnection`
    
    * Close the reader when we drop the connection
    
    * Add a tracepoint for `sys_enter_close` to detect socket closes
    
    * Rename `socket` struct to `golang_socket`
    
    * Call `should_tap` in Golang uprobes
    
    * Add `log_error` calls
    
    * Revert "Temporarily disable OpenSSL"
    
    This reverts commit f54d9a45.
    
    * Fix linter
    
    * Revert "Revert "Temporarily disable OpenSSL""
    
    This reverts commit 2433d867.
    
    * Change `golang_read_writes` map type from `BPF_RINGBUF` to `BPF_PERF_OUTPUT`
    
    * Rename `golang_read_write` to `golang_event`
    
    * Define an error
    
    * Add comments
    
    * Revert "Revert "Revert "Temporarily disable OpenSSL"""
    
    This reverts commit e5a1de9c.
    
    * Fix `pollGolang`
    
    * Revert "Revert "Revert "Revert "Temporarily disable OpenSSL""""
    
    This reverts commit 6e1bd5d4.
    
    * Fix `panic: send on closed channel`
    
    * Revert "Revert "Revert "Revert "Revert "Temporarily disable OpenSSL"""""
    
    This reverts commit 57d05846.
    
    * Use `findLibraryByPid`
    
    * Revert "Revert "Revert "Revert "Revert "Revert "Temporarily disable OpenSSL""""""
    
    This reverts commit 46f3d290.
    
    * Revert "Revert "Revert "Revert "Revert "Revert "Revert "Temporarily disable OpenSSL"""""""
    
    This reverts commit 775c833c.
    
    * Log tapping Golang
    
    * Fix `Poll`
    
    * Refactor `golang_net_http_dialconn_uprobe`
    
    * Remove an excess error check
    
    * Fix `can only use path@version syntax with 'go get' and 'go install' in module-aware mode` error in `tap/tlstapper/bpf-builder/build.sh`
    
    * Unify Golang and OpenSSL under a single perf event buffer and `tls_chunk` struct
    
    * Generate `tlsTapperChunkType` type (enum) as well
    
    * Use kernel page size for the `sys_closes` perf buffer
    
    * Fix the linter error
    
    * Fix `MIZU_GLOBAL_GOLANG_PID` environment variable's functionality
    
    * Rely on tracepoints for file descriptor retrieval in Golang implementation
    
    * Remove the unnecessary changes
    
    * Move common functions into `common.c`
    
    * Declare `lookup_ssl_info` function to reduce duplication
    
    * Fix linter
    
    * Add comments and TODOs
    
    * Remove `MIZU_GLOBAL_GOLANG_PATH` environment variable
    
    * Update the object files
    
    * Fix indentation
    
    * Update object files
    
    * Add `go_abi_internal.h`
    
    * Fix `lookup_ssl_info`
    
    * Convert indentation to spaces
    
    * Add header guard comment
    
    * Add more comments
    
    * Find the `ret` instructions using Capstone Engine and `uprobe` the `return` statements
    
    * Implement `get_fd_from_tcp_conn` function
    
    * Separate SSL contexts to OpenSSL and Go
    
    * Move `get_count_bytes` from `common.c` to `openssl_uprobes.c`
    
    * Rename everything contains Golang to Go
    
    * Reduce duplication in `go_uprobes.c`
    
    * Update the comments
    
    * Install Capstone in CI and Docker native builds
    
    * Update `devops/install-capstone.sh`
    
    * Add Capstone to AArch64 cross-compilation target
    
    * Fix some of the issues on ARM64
    
    * Delete the map element in `_ex_urpobe`
    
    * Remove an unsued `LOG_` macro
    
    * Rename `aquynh` to `capstone-engine`
    
    * Add comment
    
    * Revert "Fix some of the issues on ARM64"
    
    This reverts commit 0b3eceddf4c7547f05aa3351ded1e8a2dc7f56e0.
    
    * Revert "Revert "Fix some of the issues on ARM64""
    
    This reverts commit 681534ada128f54191277d9813bc68a8730db515.
    
    * Update object files
    
    * Remove unnecessary return
    
    * Increase timeout
    
    * #run_acceptance_tests
    
    * #run_acceptance_tests
    
    * Fix the `arm64v8` sourced builds
    
    * #run_acceptance_tests
    2ad4838c