Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

probe module unload failed. #150

Closed
cfc4n opened this issue Jul 30, 2022 · 0 comments · Fixed by #151
Closed

probe module unload failed. #150

cfc4n opened this issue Jul 30, 2022 · 0 comments · Fixed by #151

Comments

@cfc4n
Copy link
Member

cfc4n commented Jul 30, 2022

TC program unload failed when CTRL+C send,and Close() function called, It does not unload ebpf program from kernel.
and can display it with command bpftool net show. used tc filter del dev eth0 ingress/egress to unload them.
at #148 .

func (this *MOpenSSLProbe) setupManagersTC() error {
	var ifname, binaryPath string

	ifname = this.conf.(*OpensslConfig).Ifname

	switch this.conf.(*OpensslConfig).elfType {
	case ELF_TYPE_BIN:
		binaryPath = this.conf.(*OpensslConfig).Curlpath
	case ELF_TYPE_SO:
		binaryPath = this.conf.(*OpensslConfig).Openssl
	default:
		//如果没找到
		binaryPath = "/lib/x86_64-linux-gnu/libssl.so.1.1"
	}

	this.logger.Printf("%s\tInterface:%s, Pcapng filepath:%s\n", this.Name(), ifname, this.pcapngFilename)

	this.bpfManager = &manager.Manager{
		Probes: []*manager.Probe{
			// customize deleteed TC filter
			// tc filter del dev eth0 ingress
			// tc filter del dev eth0 egress
			{
				Section:          "classifier/egress",
				EbpfFuncName:     "egress_cls_func",
				Ifname:           ifname,
				NetworkDirection: manager.Egress,
			},
			{
				Section:          "classifier/ingress",
				EbpfFuncName:     "ingress_cls_func",
				Ifname:           ifname,
				NetworkDirection: manager.Ingress,
			},
			// --------------------------------------------------

			// openssl masterkey
			{
				Section:          "uprobe/SSL_write_key",
				EbpfFuncName:     "probe_ssl_master_key",
				AttachToFuncName: "SSL_write",
				BinaryPath:       binaryPath,
				UID:              "uprobe_ssl_master_key",
			},
		},

		Maps: []*manager.Map{
			{
				Name: "mastersecret_events",
			},
			{
				Name: "skb_events",
			},
		},
	}

	this.bpfManagerOptions = manager.Options{
		DefaultKProbeMaxActive: 512,

		VerifierOptions: ebpf.CollectionOptions{
			Programs: ebpf.ProgramOptions{
				LogSize: 2097152,
			},
		},

		RLimit: &unix.Rlimit{
			Cur: math.MaxUint64,
			Max: math.MaxUint64,
		},
	}

	if this.conf.EnableGlobalVar() {
		// 填充 RewriteContants 对应map
		this.bpfManagerOptions.ConstantEditors = this.constantEditor()
	}
	return nil
}
@cfc4n cfc4n transferred this issue from gojue/ebpfmanager Aug 1, 2022
cfc4n added a commit that referenced this issue Aug 1, 2022
@cfc4n cfc4n changed the title TC program unload failed. probe module unload failed. Aug 1, 2022
@cfc4n cfc4n linked a pull request Aug 1, 2022 that will close this issue
@cfc4n cfc4n closed this as completed in #151 Aug 1, 2022
cfc4n added a commit that referenced this issue Aug 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant