Skip to content

feat(bpf/openssl): Add SSL pointer to FD cache as fallback #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

jonfriesen
Copy link
Contributor

@jonfriesen jonfriesen commented Apr 24, 2025

Introduces an LRU hash map (ssl_to_fd_map) to cache the mapping between an SSL structure pointer and its associated file descriptor (FD).

Problem:
The get_fd function, when called from SSL uprobe return handlers (uretprobes), sometimes failed to retrieve the FD. This was determined to be a timing issue where the uretprobe could execute before the backing I/O syscall's exit tracepoint had run to update the uprobe_fd_requests map via respond_to_fd_request. This resulted in missed data events for SSL traffic.

Solution:
This change implements a caching layer as a fallback:

  • A new LRU map ssl_to_fd_map stores uintptr_t ssl -> int32_t fd.
  • The map is populated within the SSL_read/write uretprobes after get_fd successfully retrieves an FD (using the existing primary ssl_get_fd or secondary get_fd_from_syscall methods).
  • A new function get_fd_from_cache looks up the SSL pointer in this map.
  • get_fd is modified to attempt get_fd_from_cache as a third resort if the primary and secondary methods fail.
  • The SSL_free uprobe is updated to delete the corresponding entry from ssl_to_fd_map.

Future:
We may want to consider hooking into the the SSL_set_fd, SSL_set_rfd, and SSL_set_wfd to populate the cache by pointer. Though it seems largely unnecessary now.

Introduces an LRU hash map (`ssl_to_fd_map`) to cache the mapping
between an SSL structure pointer and its associated file descriptor (FD).

Problem:
The `get_fd` function, when called from SSL uprobe return handlers
(uretprobes), sometimes failed to retrieve the FD. This was determined
to be a timing issue where the uretprobe could execute before the
backing I/O syscall's exit tracepoint had run to update the
`uprobe_fd_requests` map via `respond_to_fd_request`. This resulted
in missed data events for SSL traffic.

Solution:
This change implements a caching layer as a fallback:
- A new LRU map `ssl_to_fd_map` stores `uintptr_t ssl -> int32_t fd`.
- The map is populated within the `SSL_read`/`write` uretprobes *after*
  `get_fd` successfully retrieves an FD (using the existing primary
  `ssl_get_fd` or secondary `get_fd_from_syscall` methods).
- A new function `get_fd_from_cache` looks up the SSL pointer in this map.
- `get_fd` is modified to attempt `get_fd_from_cache` as a third resort
  if the primary and secondary methods fail.
- The `SSL_free` uprobe is updated to delete the corresponding entry
  from `ssl_to_fd_map`.

Future:
We may want to consider hooking into the the SSL_set_fd, SSL_set_rfd, and
SSL_set_wfd to populate the cache by pointer. Though it seems largely
unnecessary now.
@jonfriesen jonfriesen force-pushed the jon/eng-414-http1-connection-closed-with-unread-data branch from 7c42d70 to f22dc6a Compare April 24, 2025 18:06
@jonfriesen jonfriesen merged commit 1705397 into main Apr 24, 2025
1 check passed
@jonfriesen jonfriesen deleted the jon/eng-414-http1-connection-closed-with-unread-data branch April 24, 2025 18:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants