parse deallocation of stmt

getanteon · Jul 17, 2024 · 6952a17 · 6952a17
1 parent b2968db
commit 6952a17
Show file tree

Hide file tree

Showing 6 changed files with 62 additions and 5 deletions.
diff --git a/aggregator/data.go b/aggregator/data.go
@@ -1411,6 +1411,17 @@ func (a *Aggregator) parseMySQLCommand(d *l7_req.L7Event) (string, error) {
 			return fmt.Sprintf("EXECUTE %d *values*", d.MySqlPrepStmtId), nil
 		}
 		sqlCommand = query
+	} else if d.Method == l7_req.MYSQL_STMT_CLOSE { // deallocated stmt
+		a.mySqlStmtsMu.Lock()
+		// extract statementId from payload
+		stmtId := binary.LittleEndian.Uint32(r)
+		stmtKey := fmt.Sprintf("%d-%d-%d", d.Pid, d.Fd, stmtId)
+		_, ok := a.mySqlStmts[stmtKey]
+		if ok {
+			delete(a.mySqlStmts, stmtKey)
+		}
+		a.mySqlStmtsMu.Unlock()
+		return fmt.Sprintf("CLOSE STMT %d ", stmtId), nil
 	}
 	return sqlCommand, nil
 }

diff --git a/ebpf/c/bpf_bpfeb.o b/ebpf/c/bpf_bpfeb.o
diff --git a/ebpf/c/bpf_bpfel.o b/ebpf/c/bpf_bpfel.o
diff --git a/ebpf/c/l7.c b/ebpf/c/l7.c
@@ -286,6 +286,42 @@ int process_enter_of_syscalls_write_sendto(void* ctx, __u64 fd, __u8 is_tls, cha
             args.write_start_ns = timestamp;
             bpf_map_update_elem(&active_writes, &id, &args, BPF_ANY);
         }else if (is_mysql_query(buf,count,&req->request_type)){
+            if (req->request_type == MYSQL_COM_STMT_CLOSE) { // stmtID will be extracted on userspace
+                struct l7_event *e = bpf_map_lookup_elem(&l7_event_heap, &zero);
+                if (!e) {
+                    return 0;
+                }
+                e->protocol = PROTOCOL_MYSQL;
+                e->method = METHOD_MYSQL_STMT_CLOSE;
+                bpf_probe_read(e->payload, MAX_PAYLOAD_SIZE, buf);
+                if(count > MAX_PAYLOAD_SIZE){
+                    // will not be able to copy all of it
+                    e->payload_size = MAX_PAYLOAD_SIZE;
+                    e->payload_read_complete = 0;
+                }else{
+                    e->payload_size = count;
+                    e->payload_read_complete = 1;
+                }
+
+                struct sock* sk = get_sock(fd);
+                if (sk != NULL) {
+                    __u32 saddr = BPF_CORE_READ(sk,sk_rcv_saddr);
+                    __u16 sport = BPF_CORE_READ(sk,sk_num);
+                    __u32 daddr = BPF_CORE_READ(sk,sk_daddr);
+                    __u16 dport = BPF_CORE_READ(sk,sk_dport);
+
+                    e->saddr = bpf_htonl(saddr);
+                    e->sport = sport;
+                    e->daddr = bpf_htonl(daddr);
+                    e->dport = bpf_htons(dport);
+                }           
+                long r = bpf_perf_event_output(ctx, &l7_events, BPF_F_CURRENT_CPU, e, sizeof(*e));
+                if (r < 0) {
+                    unsigned char log_msg[] = "failed write to l7_events -- res|fd|psize";
+                    log_to_userspace(ctx, WARN, func_name, log_msg, r, e->fd, e->payload_size);        
+                } 
+                return 0;
+            }
             req->protocol = PROTOCOL_MYSQL;
         }else if (is_http2_frame(buf, count)){
             struct l7_event *e = bpf_map_lookup_elem(&l7_event_heap, &zero);

diff --git a/ebpf/c/mysql.c b/ebpf/c/mysql.c
@@ -16,6 +16,11 @@
 #define MYSQL_COM_STMT_EXECUTE 0x17 // COM_STMT_EXECUTE asks the server to execute a prepared statement as identified by statement_id.
 
 
+// https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_com_stmt_close.html
+#define MYSQL_COM_STMT_CLOSE    0x19 // COM_STMT_CLOSE deallocates a prepared statement.
+// No response packet is sent back to the client.
+
+
 #define MYSQL_RESPONSE_OK    0x00
 #define MYSQL_RESPONSE_EOF   0xfe
 #define MYSQL_RESPONSE_ERROR 0xff
@@ -24,6 +29,8 @@
 #define METHOD_MYSQL_TEXT_QUERY 1
 #define METHOD_MYSQL_PREPARE_STMT 2
 #define METHOD_MYSQL_EXEC_STMT 3
+#define METHOD_MYSQL_STMT_CLOSE 4
+
 
 #define MYSQL_STATUS_OK 1
 #define MYSQL_STATUS_FAILED 2
@@ -48,11 +55,10 @@ int is_mysql_query(char *buf, __u64 buf_size, __u8 *request_type) {
         return 1;
     }
 
-    // COM_STMT_CLOSE deallocates a prepared statement.
-    // if (b[4] == MYSQL_COM_STMT_CLOSE) {
-    //     *request_type = MYSQL_COM_STMT_CLOSE;
-    //     return 1;
-    // }
+    if (b[4] == MYSQL_COM_STMT_CLOSE) {
+        *request_type = MYSQL_COM_STMT_CLOSE;
+        return 1;
+    }
 
     if (b[4] == MYSQL_COM_STMT_PREPARE) {
         *request_type = MYSQL_COM_STMT_PREPARE;

diff --git a/ebpf/l7_req/l7.go b/ebpf/l7_req/l7.go
@@ -137,6 +137,7 @@ const (
 	METHOD_MYSQL_TEXT_QUERY
 	METHOD_MYSQL_PREPARE_STMT
 	METHOD_MYSQL_EXEC_STMT
+	METHOD_MYSQL_STMT_CLOSE
 )
 
 // for http, user space
@@ -189,6 +190,7 @@ const (
 	MYSQL_TEXT_QUERY   = "TEXT_QUERY"
 	MYSQL_PREPARE_STMT = "PREPARE_STMT"
 	MYSQL_EXEC_STMT    = "EXEC_STMT"
+	MYSQL_STMT_CLOSE   = "STMT_CLOSE"
 )
 
 // Custom type for the enumeration
@@ -311,6 +313,8 @@ func (e MySQLMethodConversion) String() string {
 		return MYSQL_PREPARE_STMT
 	case METHOD_MYSQL_EXEC_STMT:
 		return MYSQL_EXEC_STMT
+	case METHOD_MYSQL_STMT_CLOSE:
+		return MYSQL_STMT_CLOSE
 	default:
 		return "Unknown"
 	}