Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[system-probe] Add static binary inspection to create lookup tables for crypto/tls.(*Conn).{Read,Write,Close} - copy #12897

Merged
merged 9 commits into from
Aug 1, 2022

Conversation

einat-stern
Copy link
Contributor

@einat-stern einat-stern commented Jul 28, 2022

See this PR for previous discussion

What does this PR do?

This PR builds on the work done in #10039 to add another set of lookup tables that are generated ahead-of-time from a suite of Go versions/architectures-- this time, to contain information about the layout of structs and function arguments/return values that is useful to trace TLS traffic running through the standard library. Doing so requires knowledge about:

  • The position of arguments from each of crypto/tls.(*Conn).Read, crypto/tls.(*Conn).Write, andcrypto/tls.(*Conn).Close
  • The layout of structs needed to extract the socket file descriptor from a crypto/tls.(*Conn) value (there are a handful of around 5 pointer/struct embeds that each need to have offsets)

The rest of the information needed to attach probes is able to be determined at runtime, even if the debug/ELF symbols have been stripped from a binary (as opposed to the above two sets of data), so some of it was excluded from this PR (namely, static interface-table entries and runtime.g pointer location information), and is instead in #10161.

Motivation

Tracing Go HTTPS traffic using eBPF.

Additional Notes

I'm not sure whether the changes I made to generate_tools.go are appropriate.

Possible Drawbacks / Trade-offs

The lookup table generation for the binary-inspected data is only run on minor-version bumps (and the latest beta/RC version), so in the unlikely case that the language introduces changes on a revision-level version bump, those changes won't be detected by this implementation.

Describe how to test/QA your changes

Running inv -e system-probe.generate-lookup-tables should run the loookup table generation logic using go generate .... The output file will be at pkg/network/http/gotls/lookup/luts.go, and should be the same as the one currently in the PR.

Reviewer's Checklist

  • If known, an appropriate milestone has been selected; otherwise the Triage milestone is set.
  • The appropriate team/.. label has been applied, if known.
  • A release note has been added or the changelog/no-changelog label has been applied.
  • Changed code has automated tests for its functionality.
  • Adequate QA/testing plan information is provided if the qa/skip-qa label is not applied.
  • If applicable, docs team has been notified or an issue has been opened on the documentation repo.
  • If applicable, the need-change/operator and need-change/helm labels have been applied.
  • If applicable, the config template has been updated.

@einat-stern einat-stern requested a review from a team as a code owner July 28, 2022 06:52
@einat-stern einat-stern added team/networks [deprecated] qa/skip-qa - use other qa/ labels [DEPRECATED] Please use qa/done or qa/no-code-change to skip creating a QA card changelog/no-changelog labels Jul 28, 2022
@einat-stern einat-stern added this to the 7.39.0 milestone Jul 28, 2022
@einat-stern einat-stern merged commit b7bbf4f into main Aug 1, 2022
@einat-stern einat-stern deleted the einat/go-tls-lookup-table-copy branch August 1, 2022 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
changelog/no-changelog [deprecated] qa/skip-qa - use other qa/ labels [DEPRECATED] Please use qa/done or qa/no-code-change to skip creating a QA card team/networks
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants