Replies: 4 comments 6 replies
-
|
plese upload |
Beta Was this translation helpful? Give feedback.
5 replies
-
|
hi！test.py是一个简单的使用requests库发送https请求的例子，在图2中cat出来了： 我对这个问题的理解是：Python在2.7.9及以上版本中引入了标准库ssl，它是完全基于OpenSSL实现，并且提供了Python程序和OpenSSL之间的接口，在上述的LD_DEBUG中也可以看到相关线索，但实验现象表示并没有通过eBPF捕获到HTTPS请求。我目前认为该python程序引用了libssl.so链接库但是并没有调用SSL_write函数。希望得到您对这个具体问题的分享~ |
Beta Was this translation helpful? Give feedback.
-
|
下面的这个截图证实了我的想法，该python程序引用了libssl.so链接库但是并没有调用SSL_write函数，而是其他一些uprobe，如下所示： |
Beta Was this translation helpful? Give feedback.
-
|
wow，我发现了一个有趣的uprobe也被调用了：uprobe:/lib/x86_64-linux-gnu/libssl.so.3:SSL_write_ex，这仿佛可以解决我的需求了！ |
Beta Was this translation helpful? Give feedback.
-
|
你可以手动更改eCapture的hook函数，指定为SSL_write_ex ，或者参考被删除的代码： https://github.com/gojue/ecapture/blob/v0.5.0/user/module/probe_openssl.go#L330-L360 // for SSL_write_ex \ SSL_read_ex
/*
{
Section: "uprobe/SSL_write",
EbpfFuncName: "probe_entry_SSL_write",
AttachToFuncName: "SSL_write_ex",
BinaryPath: binaryPath,
UID: "uprobe_SSL_write_ex",
},
{
Section: "uretprobe/SSL_write",
EbpfFuncName: "probe_ret_SSL_write",
AttachToFuncName: "SSL_write_ex",
BinaryPath: binaryPath,
UID: "uretprobe_SSL_write_ex",
},
{
Section: "uprobe/SSL_read",
EbpfFuncName: "probe_entry_SSL_read",
AttachToFuncName: "SSL_read_ex",
BinaryPath: binaryPath,
UID: "uprobe_SSL_read_ex",
},
{
Section: "uretprobe/SSL_read",
EbpfFuncName: "probe_ret_SSL_read",
AttachToFuncName: "SSL_read_ex",
BinaryPath: binaryPath,
UID: "uretprobe_SSL_read_ex",
},
*/ |
Beta Was this translation helpful? Give feedback.
-
|
nice！谢谢您的分享～ |
Beta Was this translation helpful? Give feedback.
-
|
update下昨晚实现的demo截图，希望能给遇到同样场景或问题的朋友提供解决思路： |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
更新一下在该场景下的一些引申的问题： |
Beta Was this translation helpful? Give feedback.
0 replies
-
简体中文关于回话合并这并不是 不过，你可以在eBPF的函数里，HOOK的地方，针对每个hook事件，取当时的CPU时钟，用户空间程序收到事件后，再进行消息顺序排序。 可以很好的减缓这类问题。但仍无法完美解决。 在eCapture的代码中， 关于SSL结构体访问也不需要完全引入 ecapture/kern/openssl_1_1_1d_kern.c Lines 7 to 44 in fe4a76d EnglishAbout conversation mergingThis is not caused by the However, in eBPF functions where HOOK occurs, you can take the CPU clock at that time for each hook event and sort messages in order after receiving events in user space programs. This can greatly alleviate such problems. But still cannot solve perfectly. In eCapture's code, About SSL structure accessYou don't need to fully introduce ecapture/kern/openssl_1_1_1d_kern.c Lines 7 to 44 in fe4a76d |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
wow，学到了！感谢您的耐心分享！ |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
我在使用LD_DEBUG信息跟踪某发送HTTPS请求的python程序时，输出了该python程序引用到的链接库，如下所示：
所以我使用bpftrace简单地hook了该链接库的SSL_write函数，在执行该python测试程序后并没有捕获到相关信息：
这是一个有趣的现象，同样地我对curl进行了测试，发现curl也同样引用了该链接库，但是不同地是可以捕获到调用信息：
这个测试来源于我在实现自研的进程级别的流量监控程序的过程中，同样我借鉴了ecapture项目的实现思路，但针对上述这个具体的问题，ecapture的结果也不尽如人意，所以想跟大家讨论下~
Beta Was this translation helpful? Give feedback.
All reactions