Welcome to ecapture Discussions!

[cfc4n]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[cfc4n]

Does eCapture need a decoder for event payload?
Anyone else?

[vincentmli]

this may not be specific to ecapture, but to ehid in general, like make it work like project similar to cilium tetragon? security tracing and enforcement in k8s or non-k8s environment?

[cfc4n]

yep, It is just a demo. but there are many more project in open source. like tracee , datadog-agent , Facol , Tetragon , etc ...

[vincentmli]

I like the simple and easy way of deploying and configuration of Tetragon and the team behind Tetragon, has not played with other open source project.

[cfc4n]

eh... I wrote a article about tetragon at Tetragon进程阻断原理, if you can read Chinese.

[vincentmli]

俺是土生土长的中国人 ：-）英文交流只是方便所有人交流。不让不懂中文的产生距离感。

谢谢您的文章，大概读了一下，很有帮助，会再精读一遍加深了解，Tetragone 那篇文章也很有意思。本人觉得公平竞争很好呀，就是不要太酸就行

[cfc4n]

好的。赞同英文交流是为了方便所有人。 另外，我英语很差，还请理解哈。

[langgithub]

@cfc4n 请教个问题？
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
__uint(key_size, sizeof(u32));
__uint(value_size, sizeof(u32));
__uint(max_entries, 10240);
} skb_events SEC(".maps");

struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__type(key, u32);
__type(value, struct skb_data_event_t);
__uint(max_entries, 1);
} skb_data_buffer_heap SEC(".maps");

用bpf_perf_event_output(skb, &skb_events, flags, &event, pkt_size);
向用户态输出数据没有看到数据包 ，只输出了event这个结构体。为啥在 event_openssl_tc.go 读取数据

func (te *TcSkbEvent) Decode(payload []byte) (err error) {
buf := bytes.NewBuffer(payload)
if err = binary.Read(buf, binary.LittleEndian, &te.Ts); err != nil {
return
}
if err = binary.Read(buf, binary.LittleEndian, &te.Pid); err != nil {
return
}
if err = binary.Read(buf, binary.LittleEndian, &te.Comm); err != nil {
return
}
//if err = binary.Read(buf, binary.LittleEndian, &te.Cmdline); err != nil {
// return
//}
//TODO
te.Cmdline[0] = 91 //ascii 91
if err = binary.Read(buf, binary.LittleEndian, &te.Len); err != nil {
return
}
if err = binary.Read(buf, binary.LittleEndian, &te.Ifindex); err != nil {
return
}
tmpData := make([]byte, te.Len)
if err = binary.Read(buf, binary.LittleEndian, &tmpData); err != nil {
return
}
te.payload = tmpData
return nil
}
能够读取到tmpData，不应该是到Ifindex就读完了么？

[cfc4n]

see #450 for more detail.