Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix wrong reported program type and missing traces #552

Merged
merged 4 commits into from
Jan 17, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion bpf/http_sock.c
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,7 @@ int BPF_KPROBE(kprobe_tcp_recvmsg, struct sock *sk, struct msghdr *msg, size_t l
return 0;
}

bpf_printk("=== tcp_recvmsg id=%d sock=%llx ===", id, sk);
bpf_dbg_printk("=== tcp_recvmsg id=%d sock=%llx ===", id, sk);

// Important: We must work here to remember the iovec pointer, since the msghdr structure
// can get modified in non-reversible way if the incoming packet is large and broken down in parts.
Expand Down
10 changes: 7 additions & 3 deletions bpf/http_sock.h
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,8 @@ struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__type(key, pid_connection_info_t);
__type(value, http_info_t);
__uint(max_entries, MAX_CONCURRENT_REQUESTS);
__uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
__uint(pinning, LIBBPF_PIN_BY_NAME);
} ongoing_http SEC(".maps");

// http_info_t became too big to be declared as a variable in the stack.
Expand Down Expand Up @@ -154,7 +155,7 @@ static __always_inline http_info_t* empty_http_info() {

static __always_inline void finish_http(http_info_t *info) {
if (info->start_monotime_ns != 0 && info->status != 0 && info->pid.host_pid != 0) {
http_info_t *trace = bpf_ringbuf_reserve(&events, sizeof(http_info_t), 0);
http_info_t *trace = bpf_ringbuf_reserve(&events, sizeof(http_info_t), 0);
if (trace) {
bpf_dbg_printk("Sending trace %lx", info);

Expand All @@ -165,6 +166,8 @@ static __always_inline void finish_http(http_info_t *info) {
u64 pid_tid = bpf_get_current_pid_tgid();
bpf_map_delete_elem(&server_traces, &pid_tid);

// bpf_dbg_printk("Terminating trace for pid=%d", pid_from_pid_tgid(pid_tid));
// dbg_print_http_connection_info(&info->conn_info); // commented out since GitHub CI doesn't like this call
pid_connection_info_t pid_conn = {
.conn = info->conn_info,
.pid = pid_from_pid_tgid(pid_tid)
Expand Down Expand Up @@ -271,7 +274,8 @@ static __always_inline void handle_buf_with_connection(pid_connection_info_t *pi

http_info_t *info = get_or_set_http_info(in, pid_conn, packet_type);
if (!info) {
bpf_printk("No info?");
bpf_dbg_printk("No info, pid =%d?", pid_conn->pid);
//dbg_print_http_connection_info(&pid_conn->conn); // commented out since GitHub CI doesn't like this call
return;
}

Expand Down
4 changes: 2 additions & 2 deletions bpf/http_ssl.h
Original file line number Diff line number Diff line change
Expand Up @@ -138,8 +138,8 @@ static __always_inline void handle_ssl_buf(u64 id, ssl_args_t *args, int bytes_l
.pid = pid_from_pid_tgid(id)
};

bpf_printk("conn pid %d", pid_conn.pid);
dbg_print_http_connection_info(&pid_conn.conn);
// bpf_dbg_printk("conn pid %d", pid_conn.pid);
// dbg_print_http_connection_info(&pid_conn.conn);

handle_buf_with_connection(&pid_conn, (void *)args->buf, bytes_len, 1);
} else {
Expand Down
5 changes: 3 additions & 2 deletions bpf/trace_common.h
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@ struct {
__uint(type, BPF_MAP_TYPE_LRU_HASH);
__type(key, u64); // key: pid_tid
__type(value, tp_info_pid_t); // value: traceparent info
__uint(max_entries, MAX_CONCURRENT_REQUESTS);
__uint(max_entries, MAX_CONCURRENT_SHARED_REQUESTS);
__uint(pinning, LIBBPF_PIN_BY_NAME);
} server_traces SEC(".maps");

struct {
Expand Down Expand Up @@ -130,7 +131,7 @@ static __always_inline u8 correlated_requests(tp_info_pid_t *tp, tp_info_pid_t *
// We check for correlated requests which are in order, but from different PIDs
// Same PID means that we had client port reuse, which might falsely match prior
// transaction if it happened during the same epoch.
if ((tp->tp.ts > existing_tp->tp.ts) && (tp->pid != existing_tp->pid)) {
if ((tp->tp.ts >= existing_tp->tp.ts) && (tp->pid != existing_tp->pid)) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These could be the same if the requests are too quick to happen one after another.

return current_epoch(tp->tp.ts) == current_epoch(existing_tp->tp.ts);
}

Expand Down
1 change: 1 addition & 0 deletions pkg/internal/discover/attacher.go
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,7 @@ func (ta *TraceAttacher) getTracer(ie *Instrumentable) (*ebpf.ProcessTracer, boo
"pid", ie.FileInfo.Pid,
"child", ie.ChildPids,
"exec", ie.FileInfo.CmdExePath)
ie.FileInfo.Service.SDKLanguage = ie.Type
// allowing the tracer to forward traces from the new PID and its children processes
monitorPIDs(tracer, ie)
if tracer.Type == ebpf.Generic {
Expand Down
Binary file modified pkg/internal/ebpf/httpfltr/bpf_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_debug_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_debug_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_tp_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_tp_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_tp_debug_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpfltr/bpf_tp_debug_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_debug_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_debug_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_tp_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_tp_bpfel_x86.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_tp_debug_bpfel_arm64.o
Binary file not shown.
Binary file modified pkg/internal/ebpf/httpssl/bpf_tp_debug_bpfel_x86.o
Binary file not shown.
3 changes: 2 additions & 1 deletion pkg/internal/export/debug/debug.go
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ func PrinterNode(_ PrintEnabled) (node.TerminalFunc[[]request.Span], error) {
for spans := range input {
for i := range spans {
t := spans[i].Timings()
fmt.Printf("%s (%s[%s]) %v %s %s [%s]->[%s:%d] size:%dB svc=[%s] traceparent=[%s]\n",
fmt.Printf("%s (%s[%s]) %v %s %s [%s]->[%s:%d] size:%dB svc=[%s %s] traceparent=[%s]\n",
t.Start.Format("2006-01-02 15:04:05.12345"),
t.End.Sub(t.RequestStart),
t.End.Sub(t.Start),
Expand All @@ -33,6 +33,7 @@ func PrinterNode(_ PrintEnabled) (node.TerminalFunc[[]request.Span], error) {
spans[i].HostPort,
spans[i].ContentLength,
&spans[i].ServiceID,
spans[i].ServiceID.SDKLanguage.String(),
traceparent(&spans[i]),
)
}
Expand Down