Verify already started protocol handlers (#832)

Author: grcevski

bpf/common/connection_info.h

@@ -18,6 +18,7 @@ enum protocol_type : u8 {
     k_protocol_type_unknown = 0,
     k_protocol_type_mysql = 1,
     k_protocol_type_postgres = 2,
+    k_protocol_type_http = 3,
 };
 
 // Struct to keep information on the connections in flight

bpf/generictracer/k_tracer.c

@@ -1129,7 +1129,8 @@ int obi_handle_buf_with_args(void *ctx) {
 
     if (is_http(args->small_buf, MIN_HTTP_SIZE, &args->packet_type)) {
         bpf_tail_call(ctx, &jump_table, k_tail_protocol_http);
-    } else if (is_http2_or_grpc(args->small_buf, MIN_HTTP2_SIZE)) {
+    } else if (is_http2_or_grpc(args->small_buf, MIN_HTTP2_SIZE) &&
+               (args->protocol_type != k_protocol_type_http)) {
         bpf_dbg_printk("Found HTTP2 or gRPC connection");
         http2_conn_info_data_t data = {
             .id = 0,

bpf/generictracer/k_tracer_defs.h

@@ -30,13 +30,23 @@ typedef struct recv_args {
 } recv_args_t;
 
 static __always_inline enum protocol_type
-protocol_type_for_conn_info(const connection_info_t *info) {
-    const enum protocol_type *cached_protocol_type = bpf_map_lookup_elem(&protocol_cache, info);
+protocol_type_for_conn_info(const pid_connection_info_t *info) {
+    const enum protocol_type *cached_protocol_type =
+        bpf_map_lookup_elem(&protocol_cache, &info->conn);
+    if (!cached_protocol_type) {
+        if (already_tracked_http(info)) {
+            return k_protocol_type_http;
+        }
+    }
     return cached_protocol_type ? *cached_protocol_type : k_protocol_type_unknown;
 }
 
-static __always_inline call_protocol_args_t *make_protocol_args(
-    connection_info_t *info, void *u_buf, int bytes_len, u8 ssl, u8 direction, u16 orig_dport) {
+static __always_inline call_protocol_args_t *make_protocol_args(const pid_connection_info_t *info,
+                                                                void *u_buf,
+                                                                int bytes_len,
+                                                                u8 ssl,
+                                                                u8 direction,
+                                                                u16 orig_dport) {
     call_protocol_args_t *args = protocol_args();
     if (!args) {
         return 0;
@@ -60,7 +70,7 @@ static __always_inline void handle_buf_with_connection(void *ctx,
                                                        u8 direction,
                                                        u16 orig_dport) {
     call_protocol_args_t *args =
-        make_protocol_args(&pid_conn->conn, u_buf, bytes_len, ssl, direction, orig_dport);
+        make_protocol_args(pid_conn, u_buf, bytes_len, ssl, direction, orig_dport);
     if (!args) {
         return;
     }

bpf/generictracer/protocol_http.h

@@ -46,6 +46,11 @@ static __always_inline u32 trace_type_from_meta(http_connection_metadata_t *meta
     return TRACE_TYPE_SERVER;
 }
 
+static __always_inline u8 already_tracked_http(const pid_connection_info_t *p_conn) {
+    http_info_t *http_info = bpf_map_lookup_elem(&ongoing_http, p_conn);
+    return (http_info && !(http_info->delayed || http_info->submitted));
+}
+
 static __always_inline void
 http_get_or_create_trace_info(http_connection_metadata_t *meta,
                               u32 pid,
@@ -485,6 +490,8 @@ static __always_inline int http_send_large_buffer(http_info_t *req,
 
     req->has_large_buffers = true;
 
+    bpf_dbg_printk("sending large buffer, size=%d", bytes_len);
+
     bpf_ringbuf_output(&events, large_buf, total_size & k_large_buf_max_size_mask, get_flags());
     return 0;
 }

bpf/generictracer/protocol_http2.h

@@ -39,6 +39,11 @@ static __always_inline u8 http2_flag_new(u8 flags) {
     return flags & http2_conn_flag_new;
 }
 
+static __always_inline u8 already_tracked_http2(const pid_connection_info_t *p_conn) {
+    http2_conn_info_data_t *http2_info = bpf_map_lookup_elem(&ongoing_http2_connections, p_conn);
+    return http2_info != 0;
+}
+
 static __always_inline http2_grpc_request_t *empty_http2_info() {
     int zero = 0;
     http2_grpc_request_t *value = bpf_map_lookup_elem(&http2_info_mem, &zero);

bpf/generictracer/protocol_tcp.h

@@ -43,6 +43,11 @@ static __always_inline void init_new_trace(tp_info_t *tp) {
 #endif
 }
 
+static __always_inline u8 already_tracked_tcp(const pid_connection_info_t *p_conn) {
+    tcp_req_t *tcp_info = bpf_map_lookup_elem(&ongoing_tcp_req, p_conn);
+    return tcp_info != 0;
+}
+
 static __always_inline void set_tcp_trace_info(
     u32 type, connection_info_t *conn, tp_info_t *tp, u32 pid, u8 ssl, u16 orig_dport) {
     tp_info_pid_t *tp_p = tp_buf();
@@ -131,6 +136,8 @@ static __always_inline int tcp_send_large_buffer(tcp_req_t *req,
             ret = postgres_send_large_buffer(req, u_buf, bytes_len, packet_type, direction, action);
         }
         break;
+    case k_protocol_type_http:
+        break;
     case k_protocol_type_unknown:
         break;
     }

bpf/tpinjector/tpinjector.c

@@ -16,9 +16,9 @@
 #include <common/trace_util.h>
 #include <common/tracing.h>
 
-#include <generictracer/types/http2_conn_info_data.h>
-#include <generictracer/maps/ongoing_tcp_req.h>
-#include <generictracer/maps/ongoing_http2_connections.h>
+#include <generictracer/protocol_http.h>
+#include <generictracer/protocol_tcp.h>
+#include <generictracer/protocol_http2.h>
 
 #include <logger/bpf_dbg.h>
 
@@ -171,22 +171,8 @@ static __always_inline u8 is_tracked_go_request(const tp_info_pid_t *tp) {
 }
 
 static __always_inline u8 already_tracked(const pid_connection_info_t *p_conn) {
-    http_info_t *http_info = bpf_map_lookup_elem(&ongoing_http, p_conn);
-    if (http_info && !(http_info->delayed || http_info->submitted)) {
-        return 1;
-    }
-
-    tcp_req_t *tcp_info = bpf_map_lookup_elem(&ongoing_tcp_req, p_conn);
-    if (tcp_info) {
-        return 1;
-    }
-
-    http2_conn_info_data_t *http2_info = bpf_map_lookup_elem(&ongoing_http2_connections, p_conn);
-    if (http2_info) {
-        return 1;
-    }
-
-    return 0;
+    return already_tracked_http(p_conn) || already_tracked_tcp(p_conn) ||
+           already_tracked_http2(p_conn);
 }
 
 // This code is copied from the kprobe on tcp_sendmsg and it's called from