Merge pull request #166 from coroot/protocol_detection_accuracy

ebpf: improve protocol identification accuracy

Author: def

ebpftracer/ebpf.go

@@ -276,12 +276,6 @@ int trace_enter_write(void *ctx, __u64 fd, __u16 is_tls, char *buf, __u64 size,
         return 0;
     } else if (is_cassandra_request(payload, size, &k.stream_id)) {
         req->protocol = PROTOCOL_CASSANDRA;
-    } else if (is_kafka_request(payload, size, &req->request_id)) {
-        req->protocol = PROTOCOL_KAFKA;
-        struct l7_request *prev_req = bpf_map_lookup_elem(&active_l7_requests, &k);
-        if (prev_req && prev_req->protocol == PROTOCOL_KAFKA) {
-            req->ns = prev_req->ns;
-        }
     } else if (looks_like_http2_frame(payload, size, METHOD_HTTP2_CLIENT_FRAMES)) {
         struct l7_event *e = bpf_map_lookup_elem(&l7_event_heap, &zero);
         if (!e) {
@@ -298,6 +292,12 @@ int trace_enter_write(void *ctx, __u64 fd, __u16 is_tls, char *buf, __u64 size,
         req->protocol = PROTOCOL_CLICKHOUSE;
     } else if (is_zk_request(payload, total_size)) {
         req->protocol = PROTOCOL_ZOOKEEPER;
+    }  else if (is_kafka_request(payload, size, &req->request_id)) {
+        req->protocol = PROTOCOL_KAFKA;
+        struct l7_request *prev_req = bpf_map_lookup_elem(&active_l7_requests, &k);
+        if (prev_req && prev_req->protocol == PROTOCOL_KAFKA) {
+            req->ns = prev_req->ns;
+        }
     } else if (is_dubbo2_request(payload, size)) {
         req->protocol = PROTOCOL_DUBBO2;
     } else if (is_dns_request(payload, size, &k.stream_id)) {