Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[USM] go TLS cleanup debug messages #15246

Merged
merged 4 commits into from
Jan 25, 2023
Merged

[USM] go TLS cleanup debug messages #15246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fddfdfe
scan existance /proc/pid for 10 ms, it's better to do that in the cal…
nplanel Jan 24, 2023
0417d8e
report golang hooking issue only if it's a golang binary
nplanel Jan 24, 2023
d61a9f8
report only once when we unregister binary
nplanel Jan 24, 2023
93fbe86
f
nplanel Jan 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 19 additions & 6 deletions pkg/network/protocols/http/ebpf_gotls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,9 +265,22 @@ func (p *GoTLSProgram) Stop() {

func (p *GoTLSProgram) handleProcessStart(pid pid) {
exePath := filepath.Join(p.procRoot, strconv.FormatUint(uint64(pid), 10), "exe")

binPath, err := os.Readlink(exePath)
if err != nil {
log.Debugf(" could not read binary path for pid %d: %s", pid, err)
// We receive the Exec event, /proc could be slow to update
end := time.Now().Add(10 * time.Millisecond)
for end.After(time.Now()) {
binPath, err = os.Readlink(exePath)
if err == nil {
break
}
time.Sleep(time.Millisecond)
}
}
if err != nil {
// we can't access to the binary path here (pid probably ended already)
// there are not much we can do and we don't want to flood the logs
return
}

Expand Down Expand Up @@ -303,7 +316,10 @@ func (p *GoTLSProgram) hookNewBinary(binID binaryID, binPath string, pid pid, bi
var err error
defer func() {
if err != nil {
log.Debugf("could not hook new binary %q for process %d: %s", binPath, pid, err)
// report hooking issue only if we detect properly a golang binary
if !errors.Is(err, binversion.ErrNotGoExe) {
log.Debugf("could not hook new binary %q for process %d: %s", binPath, pid, err)
}
p.unregisterProcess(pid)
return
}
Expand All @@ -326,9 +342,7 @@ func (p *GoTLSProgram) hookNewBinary(binID binaryID, binPath string, pid pid, bi

inspectionResult, err := bininspect.InspectNewProcessBinary(elfFile, functionsConfig, structFieldsLookupFunctions)
if err != nil {
if !errors.Is(err, binversion.ErrNotGoExe) {
err = fmt.Errorf("error reading exe: %w", err)
}
err = fmt.Errorf("error reading exe: %w", err)
return
}

Expand Down Expand Up @@ -399,7 +413,6 @@ func (p *GoTLSProgram) unregisterProcess(pid pid) {
bin.processCount -= 1

if bin.processCount == 0 {
log.Debugf("no processes left for binID %v", bin.binID)
p.unhookBinary(bin)
delete(p.binaries, binID)
}
Expand Down
19 changes: 10 additions & 9 deletions pkg/process/monitor/process_monitor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,16 +142,17 @@ func (p *ProcessMonitor) evalEXECCallback(c *ProcessCallback, pid uint32) {
return
}

var err error
var proc *process.Process
// We receive the Exec event first and /proc could be slow to update
end := time.Now().Add(10 * time.Millisecond)
for end.After(time.Now()) {
proc, err = process.NewProcess(int32(pid))
if err == nil {
break
proc, err := process.NewProcess(int32(pid))
if err != nil {
// We receive the Exec event first and /proc could be slow to update
end := time.Now().Add(10 * time.Millisecond)
for end.After(time.Now()) {
proc, err = process.NewProcess(int32(pid))
if err == nil {
break
}
time.Sleep(time.Millisecond)
}
time.Sleep(time.Millisecond)
}
if err != nil {
// short living process can hit here (or later proc.Name() parsing)
Expand Down