fix: agent - eBPF Remove http2 header offset

deepflowio · Jul 10, 2024 · 3c4acd7 · 3c4acd7
1 parent da672e9
commit 3c4acd7
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 18 deletions.
diff --git a/agent/src/ebpf/kernel/include/protocol_inference.h b/agent/src/ebpf/kernel/include/protocol_inference.h
@@ -463,7 +463,6 @@ static __inline enum message_type parse_http2_headers_frame(const char
 		if (offset >= count)
 			break;
 
-		conn_info->tcpseq_offset = offset;
 		bpf_probe_read_user(buf, sizeof(buf), buf_src + offset);
 		offset += (__bpf_ntohl(*(__u32 *) buf) >> 8) +
 		    HTTPV2_FRAME_PROTO_SZ;

diff --git a/agent/src/ebpf/kernel/include/socket_trace.h b/agent/src/ebpf/kernel/include/socket_trace.h
@@ -193,7 +193,7 @@ struct conn_info_s {
 	__u32 prev_count;	// Prestored data length
 	__u32 syscall_infer_len;
 	__u64 count:40;
-	__u64 tcpseq_offset:24;
+	__u64 unused_bits:24;
 	char prev_buf[EBPF_CACHE_SIZE];
 	char *syscall_infer_addr;
 	void *sk;

diff --git a/agent/src/ebpf/kernel/socket_trace.bpf.c b/agent/src/ebpf/kernel/socket_trace.bpf.c
@@ -1392,22 +1392,6 @@ __data_submit(struct pt_regs *ctx, struct conn_info_s *conn_info,
 		conn_info->prev_count = 0;
 	}
 
-	/*
-	 * Due to differences in the data captured through the `af_packet` and
-	 * `eBPF methods` for HTTP/2, for example:
-	 * - Data captured using the af_packet method:
-	 *   `PING[0], HEADERS[86125]: 200 OK, DATA[86125]`
-	 * - Data captured using the eBPF method:
-	 *   `HEADERS[86125]: 200 OK, DATA[86125]`
-	 *
-	 * Furthermore, both sides are unaware of the differences in the captured data.
-	 * This inconsistency can lead to inconsistent `tcpseq` values, making it chal-
-	 * lenging to correlate the data. To address this issue, it is agreed that both
-	 * methods adjust the `tcpseq` to the starting position of the first `HEADER`.
-	 */
-	if (conn_info->protocol == PROTO_HTTP2)
-		v->tcp_seq += conn_info->tcpseq_offset;
-
 	if (conn_info->prev_count > 0) {
 		// 注意这里没有调整v->syscall_len和v->len我们会在用户层做。
 		bpf_probe_read_kernel(v->extra_data, sizeof(v->extra_data),