feat(gotls): add fd extraction from tls.Conn for connection tuple sup…

[skylar2826]

…port

Add pad[3]+fd to go_tls_event struct and extract_fd_from_tls_conn() in BPF to walk tls.Conn->netFD->Sysfd. Align Go-side inner struct, add Tuple/Sock to GoTLSEvent, and parse real IP:port in Base() replacing the hardcoded 127.0.0.1.

bpftool prog tracelog:

[skylar2826]

我的梳理&测试：[ecapture]go1.20 tls fd抽取

[Copilot]

Pull request overview

This PR enhances GoTLS plaintext capture events by extracting the underlying socket FD from *tls.Conn in the eBPF probe, extending the Go/C event struct layouts to carry that FD, and attempting to populate source/destination tuple information on the Go side.

Changes:

• Extend go_tls_event (BPF) / inner (Go) with explicit padding + fd to keep struct layouts aligned.
• Add eBPF logic to walk tls.Conn -> net.Conn -> netFD -> poll.FD.Sysfd and emit the extracted FD.
• Add Tuple/Sock fields to GoTLSEvent, update UUID composition, and parse tuple into Base().

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
user/event/event_gotls.go	Adds fd + tuple/sock fields, updates UUID, and parses tuple into Base() fields.
kern/gotls_kern.c	Adds fd to the perf event struct and introduces BPF-side FD extraction from tls.Conn.

Comments suppressed due to low confidence (1)

user/event/event_gotls.go:74

• These comments say GoTLS events do not have Src/Dst IP/port, but this function now derives them from ge.Tuple. Please update the comments to avoid misleading readers (and to reflect when/if Tuple is expected to be populated).

		SrcIP:     "127.0.0.1", // GoTLS events do not have SrcIP
		SrcPort:   0,           // GoTLS events do not have SrcPort
		DstIP:     "127.0.0.1", // GoTLS events do not have DstIP
		DstPort:   0,           // GoTLS events do not have DstPort

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[skylar2826]

这个失败的测试不是我的代码导致的

[cfc4n]

LGTM, Thanks.