fix(ebpf): relax MySQL split header length check

When MySQL packet header is read separately, prev_count == 4 means the
4-byte MySQL header has already been cached and the current buffer starts
from the payload.

The packet payload length in the MySQL header does not necessarily equal
the current syscall read/write length. Requiring len == count may cause
valid split packets to skip MySQL inference.

Remove this strict check and always parse seq from the cached header and
command bytes from the current payload buffer in the prev_count == 4 path.
The later full packet length validation is still kept for initial protocol
confirmation.

Author: yinjiping

agent/src/ebpf/kernel/include/protocol_inference.h

@@ -768,13 +768,11 @@ static __inline enum message_type infer_mysql_message(const char *buf,
 
 	if (conn_info->prev_count == 4) {
 		len = *(__u32 *) conn_info->prev_buf & 0x00ffffff;
-		if (len == count) {
-			seq = conn_info->prev_buf[3];
-			count += 4;
-			com = buf[0];
-			point_1 = buf[2];
-			point_2 = buf[4];
-		}
+		seq = conn_info->prev_buf[3];
+		count += 4;
+		com = buf[0];
+		point_1 = buf[2];
+		point_2 = buf[4];
 	}
 
 	if (count < 5 || len == 0)