search

kubeshark / tracer

The kernel tracer that attaches eBPF probes to containers for capturing TLS traffic
GNU General Public License v3.0
12 stars 6 forks source link

Including an uprobe SSL_get_error #42

Closed zbenamram closed 4 months ago

zbenamram commented 4 months ago

Hello!

Thanks so much for your team's contributions here. There have been some great learnings in this project as I dive more into ebpfs!

I'm curious how this project been aggregating response chunks that have been sniffed from SSL_read/write uprobes.

I've taken a look at https://www.openssl.org/docs/manmaster/man7/ossl-guide-tls-client-block.html and I read that to verify that a response has completed, a 0 value gets returned from the SSL_read_ex function and then a followup call is made to SSL_get_error to verify a response has completed successfully.

I noticed that a 0 value returned by SSL_read_ex does not get handled and is returned early: https://github.com/kubeshark/tracer/blob/master/bpf/openssl_uprobes.c#L104

When aggregating responses to serve in the UI, I'm curious how you are able to tell when a response has completed.

iluxa commented 4 months ago

Hello @zbenamram

The traffic is aggregating by consumer on a higher protocols, for example if consumer is interested in HTTP protocol handling, it expects to receive all traffic based on HTTP length headers

zbenamram commented 4 months ago

Thanks for the reply - thats what I was expecting.