diff --git a/agent/src/ebpf/kernel/include/protocol_inference.h b/agent/src/ebpf/kernel/include/protocol_inference.h index 38fc589558e..64c734b3585 100644 --- a/agent/src/ebpf/kernel/include/protocol_inference.h +++ b/agent/src/ebpf/kernel/include/protocol_inference.h @@ -1072,6 +1072,23 @@ static __inline enum message_type infer_sofarpc_message(const char *buf, if (is_infer_socket_valid(conn_info->socket_info_ptr)) { if (conn_info->socket_info_ptr->l7_proto != PROTO_SOFARPC) return MSG_UNKNOWN; + /* + * The system call behavior of sofarpc protocol is to first receive + * 64 bytes when receiving, and then receive the following content. + * We make sure that this type of data is reassembled. + */ + if (conn_info->socket_info_ptr->allow_reassembly && + (conn_info->direction == T_INGRESS)) { + if (conn_info->prev_direction == conn_info->direction && + conn_info->socket_info_ptr->force_reasm) + return MSG_UNKNOWN; + + if (count == 64) + conn_info->socket_info_ptr->force_reasm = true; + else + conn_info->socket_info_ptr->force_reasm = false; + } + goto out; } // code for remoting command (Heartbeat, RpcRequest, RpcResponse) diff --git a/agent/src/ebpf/kernel/include/socket_trace_common.h b/agent/src/ebpf/kernel/include/socket_trace_common.h index 4f694a16916..b4807364365 100644 --- a/agent/src/ebpf/kernel/include/socket_trace_common.h +++ b/agent/src/ebpf/kernel/include/socket_trace_common.h @@ -126,7 +126,13 @@ struct socket_info_s { __u16 allow_reassembly: 1; __u16 finish_reasm: 1; // Has the reassembly been completed? __u16 udp_pre_set_addr: 1; // Is the socket address pre-set during the system call phase in the UDP protocol? - __u16 unused_bits: 13; + /* + * Indicate that the current and next data must be pushed in + * the form of data reorganization. + * Currently only protocol inference is available on sofarpc. + */ + __u16 force_reasm: 1; + __u16 unused_bits: 12; __u32 reasm_bytes; // The amount of data bytes that have been reassembled. /*