From 5ee5bbbc120d9b11a10ab873ff2ff5710ae04124 Mon Sep 17 00:00:00 2001 From: Jiping Yin Date: Mon, 1 Jul 2024 12:12:28 +0800 Subject: [PATCH] fix: agent - eBPF Ensure the Sofa protocol can reassemble The system call behavior of sofarpc protocol is to first receive 64 bytes when receiving, and then receive the following content. We make sure that this type of data is reassembled. --- .../ebpf/kernel/include/protocol_inference.h | 17 +++++++++++++++++ .../ebpf/kernel/include/socket_trace_common.h | 8 +++++++- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/agent/src/ebpf/kernel/include/protocol_inference.h b/agent/src/ebpf/kernel/include/protocol_inference.h index 38fc589558e..64c734b3585 100644 --- a/agent/src/ebpf/kernel/include/protocol_inference.h +++ b/agent/src/ebpf/kernel/include/protocol_inference.h @@ -1072,6 +1072,23 @@ static __inline enum message_type infer_sofarpc_message(const char *buf, if (is_infer_socket_valid(conn_info->socket_info_ptr)) { if (conn_info->socket_info_ptr->l7_proto != PROTO_SOFARPC) return MSG_UNKNOWN; + /* + * The system call behavior of sofarpc protocol is to first receive + * 64 bytes when receiving, and then receive the following content. + * We make sure that this type of data is reassembled. + */ + if (conn_info->socket_info_ptr->allow_reassembly && + (conn_info->direction == T_INGRESS)) { + if (conn_info->prev_direction == conn_info->direction && + conn_info->socket_info_ptr->force_reasm) + return MSG_UNKNOWN; + + if (count == 64) + conn_info->socket_info_ptr->force_reasm = true; + else + conn_info->socket_info_ptr->force_reasm = false; + } + goto out; } // code for remoting command (Heartbeat, RpcRequest, RpcResponse) diff --git a/agent/src/ebpf/kernel/include/socket_trace_common.h b/agent/src/ebpf/kernel/include/socket_trace_common.h index 4f694a16916..b4807364365 100644 --- a/agent/src/ebpf/kernel/include/socket_trace_common.h +++ b/agent/src/ebpf/kernel/include/socket_trace_common.h @@ -126,7 +126,13 @@ struct socket_info_s { __u16 allow_reassembly: 1; __u16 finish_reasm: 1; // Has the reassembly been completed? __u16 udp_pre_set_addr: 1; // Is the socket address pre-set during the system call phase in the UDP protocol? - __u16 unused_bits: 13; + /* + * Indicate that the current and next data must be pushed in + * the form of data reorganization. + * Currently only protocol inference is available on sofarpc. + */ + __u16 force_reasm: 1; + __u16 unused_bits: 12; __u32 reasm_bytes; // The amount of data bytes that have been reassembled. /*