eBPF tracer: fix the connection timestamp lookup

coroot · Nov 30, 2022 · 97a7eec · 97a7eec
1 parent f4a8338
commit 97a7eec
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/ebpftracer/ebpf.go b/ebpftracer/ebpf.go
diff --git a/ebpftracer/ebpf/l7/l7.c b/ebpftracer/ebpf/l7/l7.c
@@ -214,7 +214,10 @@ int trace_exit_read(struct trace_event_raw_sys_exit_rw__stub* ctx) {
         return 0;
     }
     e.duration = bpf_ktime_get_ns() - ns;
-    __u64 *timestamp = bpf_map_lookup_elem(&connection_timestamps, &k);
+    struct sk_info sk = {};
+    sk.pid = k.pid;
+    sk.fd = k.fd;
+    __u64 *timestamp = bpf_map_lookup_elem(&connection_timestamps, &sk);
     if (timestamp) {
         e.connection_timestamp = *timestamp;
     }