Commit 1dcdcc1
feat: refactor architecture and enhance TLS probing for eCapture v2.0.0 (#953)
* Implement clean architecture foundation with Phase 3 complete + Phase 4 Plan B approved: All simple probes migrated (Bash, Zsh, MySQL, Postgres) (v2 branch) (#911)
v2 重构里程碑:完成阶段1-3,形成可持续迁移架构并交付阶段4方案规划
阶段1(基础与抽象):建立 internal/ 目录结构;实现核心领域接口(Probe/Event/Configuration/Dispatcher);统一错误码与错误处理;封装 zerolog 日志;实现带校验的 BaseConfig;提供流式 ConfigBuilder(Builder);实现 EventDispatcher(Observer);单元测试齐全并通过。
阶段2(通用探针框架):实现 ProbeFactory(Factory);实现 BaseProbe 通用生命周期与资源管理(含正确清理);加入 perf/ringbuf 事件读取循环;核心功能测试通过并覆盖关键路径。
阶段3(探针迁移落地,100% 完成):按统一架构完成并注册 Bash/Zsh/MySQL/Postgres 探针(config/event/probe/register/tests 全套);包含二进制/函数自动检测、eBPF 事件解码与 SQL 截断等能力;全部测试通过(internal/ 包测试累计至 103 个),整体进度提升至约 45%,为阶段4做准备。
文档与路线图(贯穿交付):补齐架构说明、实现总结、迁移指南与执行策略(含 14 个小 PR 的可审查迁移节奏);新增状态追踪与最终状态总结;提供中文版实施计划与质量保障/并行开发建议。
阶段4(TLS/SSL)技术分析与方案决策:完成 TLS/SSL 探针技术分析与工作量评估;给出 A(完整)/B(简化)/C(暂停) 三方案并推荐 方案B(OpenSSL Text Mode + 占位符);产出方案B总结、三步实施计划与后续增强 PR 路线图;建议在新 PR 中实施,当前 PR 聚焦阶段1-3成果 + 阶段4规划,可合并入 v2 分支。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* feat: Phase 4 TLS probe refactoring - Complete all libraries (OpenSSL, GnuTLS, NSPR, GoTLS) with multi-mode support and factory registration (PR #1-6) (#912)
## PR Merge 描述(总结)
本 PR 完成 **Phase 4 Plan B** 的 TLS 探针与输出体系建设,统一实现多 TLS 库的探针骨架与处理器架构,新增 **text / keylog / pcap(stub)** 三种输出模式,并补齐配置校验、工厂注册与文档说明。
### 主要变更
- **统一 Handler 架构与输出模式**
- 新增 `TextHandler`(文本模式输出)
- 新增 **Keylog 模式**:实现 `KeylogHandler`,支持 **NSS Key Log Format**
- 覆盖 TLS 1.2 `CLIENT_RANDOM` 与 TLS 1.3 多类 secret
- key 去重、并发写入线程安全、Wireshark 可直接解密
- 新增 **Pcap 模式(stub)**:实现 `PcapHandler` 桩代码与基础 PCAPNG 文件写入框架
- 增加 `PacketEvent` 抽象与 pcap 配置项,预留后续 eBPF/TC 集成
- **OpenSSL 探针完善**
- 增加 OpenSSL 配置与事件结构(含 master secret 事件)
- 集成 text/keylog/pcap(stub) 多 handler
- 完成 pcap 模式相关配置校验 TODO(网卡存在且 UP、TC 支持检查)
- **新增三类 TLS 库探针(按 OpenSSL 模式复用实现)**
- **GnuTLS 探针**:支持 3.6/3.7/3.8 版本识别与多模式输出(pcap 为 stub)
- **NSPR/NSS 探针**:支持 NSS 3.x 版本识别与多模式输出(pcap 为 stub)
- **GoTLS 探针**:支持 Go 1.17+ 运行时版本识别与多模式输出(pcap 为 stub)
- 共同能力:配置驱动切换模式、事件二进制编解码(4KB payload)、网卡与 TC 校验、生命周期管理(Initialize/Start/Stop/Close)
- **工厂注册与接口一致性修复**
- 补齐部分探针对 `domain.Probe` 的接口方法(`Events()` / `IsRunning()`,按 Phase 4 约束提供 stub)
- **GnuTLS** 完成 factory 注册;**NSPR/GoTLS** 明确在 Phase 4 延后注册并补充原因与后续步骤文档
### 测试与质量
- 新增/完善大量单测(handler、config 校验、probe 生命周期等),最终 **107 个测试全部通过**
- 多处说明 **race detector clean**
- keylog/pcap handler 覆盖率在对应模块达到较高水平;新增探针由于 stub 属性覆盖率较低但有完整基础测试
### 文档
- 增加 Phase 4 及各 PR(Keylog / Pcap stub)实现总结
- 补充 NSPR/GoTLS 延后 factory 注册的设计决策与升级路径说明
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Complete eCapture v2 Architecture Refactoring (Phases 5-7): E2E Tests, Deprecation, Migration Guide, Complete eBPF Code Migration, and CLI Integration Plan (#913)
## PR Merge 描述(总结)
本 PR 完成 **eCapture v2 架构重构的 Phase 5–7**:补齐端到端测试与文档收尾,对旧模块做弃用标记与迁移指引,并将多个 probe 的 **eBPF 集成从“计划/桩”推进为可用实现**,同时输出下一阶段 CLI 集成方案。
### 主要变更
- **E2E 测试与文档更新**
- 新增简单 probes 的 E2E 测试:`bash` / `zsh` / `mysql` / `postgres`
- 更新相关文档,并新增 **Phase 5 完成总结**文档
- **代码审查问题修复**
- 移除未使用变量
- 强化 **MySQL 认证安全性**相关实现
- **Phase 6:弃用与迁移收尾**
- 为旧模块实现增加 **deprecation 标记**
- 完善文档:迁移指南、成功指标(success metrics)、最终状态说明
- **Phase 7a:清理 TODO,明确实现状态**
- 移除全量 TODO 注释并澄清当前实现/计划边界
- **Phase 7b:完成多探针 eBPF 集成**
- 完成 eBPF 集成:**Bash / Zsh / MySQL / Postgres / NSPR / GoTLS / GnuTLS**
- **Phase 7c:规划下一 PR**
- 输出 **CLI 全面集成计划**,作为后续 PR 的工作拆分与路线图
### 总体结果
- v2 重构(Phase 5–7)闭环:**测试 + 弃用策略 + 迁移指南 + eBPF 集成落地 + 下一阶段 CLI 规划** 一并完成。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Complete migration to internal/probe architecture: CLI commands, eCaptureQ HTTP server, eBPF bytecode directory, and user/ directory deletion (8/8 probes) (#914)
## PR Merge 描述(总结)
本 PR 完成 **Phase 7c:CLI 与 HTTP 服务全面切换到 `internal/probe` 新架构**。实现 8/8 探针 CLI 集成(含 4 个 TLS 探针),统一入口与事件分发机制;按维护者反馈移除向后兼容与 `user/*` 旧体系,迁移 eBPF 字节码目录与注释引用,并将 eCaptureQ HTTP server 同步迁移,最终 **删除 `user/` 目录**,完成整体迁移闭环。
### 主要变更
- **CLI 集成(8/8 探针完成)**
- 先完成 bash/zsh/mysql/postgres 的新架构接入,并形成可复用集成模式与进度文档
- 根据维护者反馈:**移除特性开关 `ECAPTURE_USE_NEW_ARCH` 与所有向后兼容逻辑**,CLI 直接使用新架构
- 完成剩余 TLS 探针 CLI 集成:`gotls` / `nspr` / `gnutls` / `openssl(tls)`,至此 8 个探针全部接入
- **统一 CLI 入口与日志/事件基础设施**
- 在 `root.go` 增加 `runProbe()` 作为新探针统一入口,按既有模式重构命令文件为“仅负责配置 + 调用”
- 引入事件分发/dispatcher 基础设施用于 CLI 集成
- 使用 `zerolog.Logger` 替代 `fmt.Println`,并修复 review 指出的问题(未使用变量、类型错误、适配器接口方法缺失等),确保可在 `CGO_ENABLED=0` 编译通过
- **eBPF 字节码与工程结构迁移**
- 将字节码目录从 `user/bytecode` 迁移为顶层 `bytecode/`,同步更新 Makefile 与各探针路径引用
- **注释/Issue 引用迁移**
- 将原 `user/` 目录下的 issue 相关注释迁移到 `internal/probe` 对应实现处,保持问题上下文可追溯
- **eCaptureQ HTTP Server 迁移到新架构**
- HTTP 服务移除 `user/*` 依赖,改用 `domain.Configuration` 与配置工厂 `config_factory.go`
- 补齐 `gotls/nspr` 配置对 `domain.Configuration` 的接口方法与 `Bytes()` 序列化
- 重新启用 `root.go` 中 HTTP server 启动逻辑,使用新的配置通道
- **彻底移除旧架构**
- 删除 `user/` 目录(config/event/module/bytecode),并清理所有残留引用
- `cli/cmd/root.go` 移除 `runModule()` 旧路径与 `user/*` 导入
- `pkg/event_processor` 曾被删除后按维护者要求 **恢复(完整保留 33 个文件)**,其余迁移/清理保持不变
### 当前状态
- 新架构已成为唯一入口:**CLI(8/8)+ eCaptureQ HTTP server 全量迁移完成**
- `user/` 旧实现与引用已清零,目录结构与字节码路径统一到新布局。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Refactor pkg/event_processor to remove user/event dependency and fix CLI compilation (#915)
Key Changes:
Created local event interface definitions in pkg/event_processor/event.go to replace user/event dependencies
Updated CLI configuration to use internal/config.BaseConfig with CLI-specific extensions
Cleaned up unused dependencies in go.mod (removed jschwinger233/elibpcap, moved golang.org/x/arch to indirect)
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* feat: add ELF path configuration and refactor eBPF filename handling in GoTLS probe
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* Refactor gotls probe to follow standardized architecture pattern (#916)
## PR Merge 描述(提炼总结)
本 PR 以 **GoTLS 探针**为样板,完成从旧实现向新 `internal/probe` 架构的深度重构与对齐(对标 bash probe 模式),补齐工厂注册、eBPF manager 装配、事件解码与输出文件处理;同时按维护者反馈逐轮修正 **符号解析、探针地址配置、模式互斥、keylog/pcapng 行为**,并沉淀为可复用的重构指南/Playbook。另将通用 **PCAPNG 写入能力**下沉到共享 handlers 目录,供后续探针复用。
### 关键改动
- **GoTLS probe 架构对齐(follow bash pattern)**
- `Config` 继承 `BaseConfig`,`NewProbe` 初始化 `BaseProbe`
- 完整实现 `Initialize/Start`(含 eBPF manager 创建、options 组装、日志与类型断言)
- 实现 `EventDecoder`:`Decode()` / `GetDecoder()`
- `TLSDataEvent` / `MasterSecretEvent` 对齐并实现 `domain.Event`
- 测试迁移并保持通过(含 race)
- **按维护者反馈的关键修复/增强**
- 回滚误改的 `kern/` 目录格式化变更
- CLI 配置与类型修正(移除不必要 cast、补齐 `config.IConfig` 适配器方法)
- 完成 `register.go` 工厂注册(对标 bash pattern)
- **多 read uretprobe 支持**:引入 `ReadTlsAddrs[]` 与 `GoTlsWriteAddr`,支持多 offset 挂载与回退逻辑
- **Go 符号表解析重写**:使用 `debug/gosym` + `debug/buildinfo` 解析 `gopclntab`,并新增覆盖 Go binary/非 Go binary/非法路径的单测
- **probe 地址配置修正**:统一使用 `UAddress`(绝对地址)替代 `UprobeOffset`
- **补齐 keylog 与 pcap/TC 支持**
- 新增 `GoTlsMasterSecretAddr`,定位 `crypto/tls.(*Config).writeKeyLog`
- pcap 模式加入 TC probes(ingress/egress)及所需 maps,并增加 ifname 校验
- **模式逻辑严格互斥并对齐历史行为**
- TEXT:仅 TLS 明文抓取相关 probes + events map
- KEYLOG:仅 `writeKeyLog`(产出密钥)+ mastersecret map,不加载明文 probes
- PCAP(含 pcapng):TC 抓包 + `writeKeyLog` 产钥;密钥可写入 PCAPNG DSB 或可选 keylog 文件
- 规范化 `-m pcap/pcapng`:内部统一视为 `pcap`
- **输出能力补齐**
- 实现 master secret 写入 **NSS SSLKEYLOGFILE** 格式(Wireshark 可用),覆盖 keylog 与 pcap 模式
- 引入 `PcapWriter`(基于定制 gopacket fork 的 `pcapgo.NgWriter`)实现标准 PCAPNG 写入与 **DSB(Decryption Secrets Block)** 写钥
- `PcapWriter` 下沉至 `internal/probe/base/handlers/` 供 openssl/gnutls 等后续复用
- 按反馈完善 Flush/Close、接口名标识为 `"eCapture(旁观者)"`,并修复相关语法/签名问题
- **文档沉淀**
- 增加 GoTLS 重构总结
- 增加可复用的重构指南与更完整的 **Probe Refactoring Playbook**(流程、迭代记录、坑位与检查清单、测试策略、成功指标)
### 结果
- GoTLS 探针在新架构下实现更一致的生命周期、解码与输出能力,keylog/pcapng 行为与历史实现对齐
- 通用 PCAPNG 写入与 DSB 写钥能力完成抽象复用
- 全套测试通过(含 race detector,文中阶段性为 20 tests)。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Refactor OpenSSL probe to follow standardized architecture pattern (#917)
## PR Merge 描述(提炼总结)
本 PR 完成 **OpenSSL 探针**按统一新架构(PROBE_REFACTORING_PLAYBOOK)重构并收尾:补齐 eBPF manager 装配、模式化挂载(text/keylog/pcap)、事件结构与解码、keylog/pcap 输出与生命周期管理;同时落地 **PCAP 模式的 TC 抓包实现**,并根据维护者/Copilot 反馈修复 keylog 重复、模式归一化、UUID 冲突与关闭卡顿可观测性等问题。相关模块测试均通过。
### 关键变更
- **OpenSSL probe 标准化重构完成**
- 完整 eBPF manager setup,按 **text / keylog / pcap** 模式选择性挂载 probes
- 事件 map 接入:`tls_events`、`mastersecret_events`
- `MasterSecretEvent` 与内核结构对齐;完善 TLS 数据与 master secret 的解码逻辑
- 实现 `writeMasterSecretToFile`,按 **NSS `SSLKEYLOGFILE`** 格式输出(含 TLS 1.3 全 secret 类型支持)
- 完整生命周期(`Initialize/Start/Close`)、错误处理与日志;gofmt/go vet 与注释/文档同步
- **PCAP 模式补齐:TC(Traffic Control)抓包落地**
- 新增 ingress/egress TC classifier probes
- 增加 TC 相关 maps:`skb_events`、`skb_data_buffer_heap`、`network_map`
- pcap 模式强制校验 `Ifname`
- PCAP 模式现可同时采集 **网络包 + TLS 密钥**(用于解密)
- **问题修复与一致性改进**
- TLS 1.2 master key **零值过滤**,避免写入无效 keylog
- 关闭/退出改进:初始化日志打印关键文件路径;`Close()` 增加 debug 分步日志,便于定位 Ctrl+C 卡顿
- `ClientRandom` 日志显示由 16B 改为完整 **32B**,与规范/SSLKEYLOGFILE 一致
- 移除会导致重复的 handshake traffic secret 标签(避免同值重复 entry)
- 模式归一化:`key` 统一映射为 `keylog`
- **UUID 冲突修复**:改为基于完整 32B ClientRandom 的 **FNV-1a hash** 生成,提高连接唯一性
### 结果
- OpenSSL 探针重构完整闭环(按 Playbook 全阶段完成)
- PCAP 模式具备 TC 抓包与密钥输出能力
- openssl/gotls/handlers 相关测试全部通过。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* refactor(nspr): Complete probe refactoring to standardized architecture (#918)
## PR Merge 描述(提炼总结)
本 PR 完成 **NSPR/NSS 探针**按统一新架构的重构落地,并根据 review 反馈进一步收敛为 **仅支持 text 模式** 的精简实现;同时完善单元测试与工厂注册,修正命令命名与配置字段使用,确保接口一致性与可维护性。
### 主要变更
- **NSPR 探针标准化重构**
- `Config` 继承 `config.BaseConfig`,`Probe` 内嵌 `base.BaseProbe`
- 完整实现 `domain.Probe`(`Initialize/Start/Stop/Close`)与 `domain.EventDecoder`(`Decode/GetDecoder`)
- 事件结构实现 `domain.Event`
- 增加 probe/config/events 的单元测试
- 通过 `ProbeTypeNSPR` 完成 factory 注册
- 统一使用 `errors` 包进行错误处理(对齐 bash probe 模式)
- **按代码审查反馈修正与简化**
- CLI 命令文件 `cli/cmd/nspr.go` 重命名为 `nss.go`(nss 为主名,nspr 为别名)
- PID 字段统一使用 `BaseConfig.Pid`(移除 `PID` 引用)
- **移除 keylog/pcap 支持**:删除相关配置字段与校验逻辑、handler 初始化与文件关闭路径;探针仅保留 text 输出
- 测试同步删除 keylog/pcap 覆盖,并清理无用 import
### 结果
- NSPR/NSS 探针已完全对齐新架构与接口规范,功能范围明确(text-only),测试全部通过。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Add comprehensive E2E test suite with 72+ scenarios covering all modules (#919)
## PR Merge 描述(提炼总结)
本 PR 大幅增强端到端(E2E)测试覆盖与测试文档体系,新增 TLS/GoTLS/Bash/MySQL 的高级场景与边界用例测试,并完善 Makefile 测试入口;同时修复 MySQL 高级测试脚本语法问题,并改进 MySQL 探针配置:当未显式指定二进制路径时可基于 PID 自动探测 `mysqld/mariadbd` 路径,提升 CLI 易用性并修复 E2E 失败。
### 主要变更
- **新增/扩展高级 E2E 测试**
- TLS text 模式:HTTP/1.1、HTTP/2、PID/UID 过滤、并发、截断、debug、hex 等
- TLS pcap 模式:端口/主机过滤、网卡选择、并发、tshark 兼容性
- TLS keylog 模式:TLS 1.2/1.3、并发、格式校验、tcpdump 集成
- GoTLS:text/pcap/keylog,全链路 client-server、静态二进制、debug
- Bash:管道/重定向/后台/子 shell/长命令/特殊字符等复杂行为
- 边界与错误处理:非法参数、信号处理、权限等
- **测试入口与文档体系完善**
- Makefile 新增测试目标:`e2e-advanced`、`e2e-basic` 及各模块高级测试入口(含 `e2e-mysql-advanced`)
- 新增 `test/e2e/README.md`:覆盖套件说明、用法、排障、贡献指南(统计 70+ 场景)
- 新增 `QUICK_REFERENCE.md`:常用测试命令速查
- 新增 `IMPLEMENTATION_STATUS.md`:任务完成度/实现状态跟踪(记录 72+ 场景、9 个新文件等)
- **修复与改进**
- 修复 `mysql_advanced_test.sh` heredoc 用法错误(避免 here-document 解析失败)
- **MySQL 探针增强**:未提供 `--mysqld` 路径时,基于 `--pid` 从 `/proc/<pid>/exe` 自动探测,并校验目标确为 `mysqld/mariadbd`,失败时给出明确错误信息。
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* docs: add comprehensive documentation for eCapture project and update compilation references
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* feat: enhance release workflow with pre-release detection and Docker tagging
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* refactor: rename documentation files and update capture mode handling in configuration (#923)
文档与配置
重命名文档文件
更新配置中 capture 模式处理逻辑
TextHandler 优化
移除 TLSDataEvent 接口,简化文本处理
精简事件格式化输出
移除 encoder 参数,更新相关测试
代码与测试
移除未使用的 probe imports,改进错误处理
提高测试中的错误处理清晰度,完善格式化
测试中增加返回控制以改善执行流
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* refactor the event dispatcher setup and probe initialization process (#924)
* refactor: streamline event dispatcher and enhance configuration handling
* refactor: remove event dispatcher from probe initialization
* refactor: enhance configuration handling and streamline dispatcher initialization
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* feat: implement logger writer and enhance output handling in various components (#925)
* feat: implement logger writer and enhance output handling in various components
* feat: add pcap filter injection and instruction patcher preparation for eBPF programs
* refactor: remove unused logger and dispatcher initialization in base probe tests
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* refactor: rename Chinese documentation files and update links in README (#927)
* refactor: rename Chinese documentation files and update links in README
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* feat: implement buffered pcapng packet writing with interface metadata and improved closure handling (#928)
* feat: improve keylog deduplication, filter zero secrets, and enhance handler closure logic
- Deduplicate keylog entries by client_random and label instead of full line to prevent duplicate writes for the same connection
- Filter out all-zero master secrets and secrets to avoid writing incomplete handshake data
- Ensure keylog entries are flushed after writing
- Update handler closure logic to avoid double-closing writers in OpenSSL probe
- Add tests for keylog deduplication and zero-secret filtering
- Refactor pcap handler to close both NgWriter and underlying file writer
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* refactor: migrate build tag from androidgki to ecap_android (#930)
* refactor: migrate build tag from androidgki to ecap_android
Replace all build tags from 'androidgki' to 'ecap_android' for better
namespace isolation and semantic clarity.
Changes:
- Update TARGET_TAG in variables.mk
- Replace //go:build androidgki with //go:build ecap_android (3 files)
- Replace //go:build !androidgki with //go:build !ecap_android (13 files)
- Update version string handling in upgrade logic
- Add migration documentation and verification scripts
* refactor: update android_e2e.yml for improved tool installation and build process; enhance error handling in check_dsb.go
* refactor: streamline tool installation and build process in android_e2e.yml; enhance ARM64 support
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* feat: Optimize GoTLS event handling, enhance OpenSSL configuration (including Android support), and add configuration validation (#936)
* feat: enhance OpenSSL configuration with Android support and validation checks
* feat: enhance GoTLS event handling and configuration validation
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* feat: add connection event handling and enhance TLS event structure with additional fields (#938)
* feat: add connection event handling and enhance TLS event structure with additional fields
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* fix: avoid modifying input buffer in PcapKeylogWriter and clean up nil checks in tests
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* Fix E2E test failures: Android arch detection, missing curl fallback, keylog test tolerance (#944)
* Initial plan
* fix: fix failing E2E tests - add missing -i flag for pcap mode and fix grep/URL bugs
- tls_text_advanced_test.sh: Use github.com instead of www.github.com for HTTP/1.1 test (more reliable, avoids redirect issues)
- tls_text_advanced_test.sh: Fix grep -c || echo '0' bug producing '0\n0' (invalid integer) by using || true instead
- tls_pcap_advanced_test.sh: Add -i (network interface) flag to all pcap mode tests - required by ecapture but was missing
- gotls_advanced_test.sh: Add -i (network interface) flag to GoTLS pcap mode test
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* fix: add missing -i flag for pcap mode in tls_e2e_test.sh and android_tls_e2e_test.sh
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* fix: clean up redundant fallback in android pcap test
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* fix: fix Android E2E arch detection and keylog test tolerance
- setup_android_env.sh: detect device arch (x86_64/arm64) for binary validation
- android_tls_e2e_test.sh: use Go client as fallback when curl unavailable
- android_gotls_e2e_test.sh: detect device arch for Go client build
- build_android_tests.sh: detect device arch for Go client compilation
- tls_e2e_test.sh: make keylog test tolerant of environments where
master key capture may not produce output (e.g. SSL_write_ex)
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* fix: address code review issues in E2E test scripts
- Fix variable scope for client_pid in pid filter test
- Use escaped double quotes in adb shell commands
- Make keylog grep pattern more specific
- Fix curl stderr redirection
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Revert non-tag changes, keep ebpfassets/dynamic, minimally fix unit tests (#945)
* Initial plan
* Initial state - identifying test failures
* Fix all failing unit tests with race detector
* Remove accidentally tracked example files from git
* Revert non-ebpfassets/dynamic changes and minimally fix unit tests
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* release v2.0.0
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
* fix: update openssl probe unit tests to use non-existent library path (#949)
* Initial plan
* fix: update failing openssl probe unit tests to use non-existent path
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* Fix Android GoTLS E2E: keylog path, URL flag usage, and CI-accessible target URL (#950)
* Initial plan
* Fix Android e2e CI tests: CGO_ENABLED, setsid background launch, diagnostics
* Fix Android e2e FTL errors: --elfpath for gotls, --bash for bash, robust FTL detection, CI failure tracking
* Fix Android E2E CI: move multi-line test runner to separate script
* Remove bash E2E test from Android test suite, keep only TLS and GoTLS
* Fix gotls keylog mode: pass -k flag with writable device path
* Fix Android E2E: use -url flag, switch TEST_URL to github.com
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
* logger: escape non-printable chars strace-style; fix gofmt lint error (#951)
* Initial plan
* logger: filter control chars in stdout output to fix #931
* logger: escape control chars strace-style instead of stripping them (#931)
* logger: replace interface{} with any to satisfy gofmt rewrite rule in .golangci.yml
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: cfc4n <709947+cfc4n@users.noreply.github.com>
---------
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>1 parent acf3143 commit 1dcdcc1
240 files changed
Lines changed: 27147 additions & 10529 deletions
File tree
- .github
- agents
- workflows
- assets
- builder
- bytecode
- cli
- cmd
- http
- docs
- examples/ecaptureq_client
- internal
- builder
- config
- domain
- errors
- events
- factory
- logger
- output
- encoders
- writers
- probe
- base
- handlers
- bash
- gnutls
- gotls
- mysql
- nspr
- openssl
- postgres
- zsh
- pkg
- event_processor
- proc
- upgrade
- util
- ebpf
- ws
- protobuf
- gen/v1
- test/e2e
- android
- tools
- user
- config
- event
- module
- utils/protobuf_visualizer
Some content is hidden
Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
137 | 137 | | |
138 | 138 | | |
139 | 139 | | |
140 | | - | |
141 | | - | |
142 | | - | |
143 | | - | |
144 | | - | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
| 41 | + | |
| 42 | + | |
| 43 | + | |
| 44 | + | |
| 45 | + | |
| 46 | + | |
| 47 | + | |
| 48 | + | |
| 49 | + | |
| 50 | + | |
| 51 | + | |
| 52 | + | |
| 53 | + | |
| 54 | + | |
| 55 | + | |
| 56 | + | |
| 57 | + | |
| 58 | + | |
| 59 | + | |
| 60 | + | |
| 61 | + | |
| 62 | + | |
| 63 | + | |
| 64 | + | |
| 65 | + | |
| 66 | + | |
| 67 | + | |
| 68 | + | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
| 73 | + | |
| 74 | + | |
| 75 | + | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
| 81 | + | |
| 82 | + | |
| 83 | + | |
| 84 | + | |
| 85 | + | |
| 86 | + | |
| 87 | + | |
| 88 | + | |
| 89 | + | |
| 90 | + | |
| 91 | + | |
| 92 | + | |
| 93 | + | |
| 94 | + | |
| 95 | + | |
| 96 | + | |
| 97 | + | |
| 98 | + | |
| 99 | + | |
| 100 | + | |
| 101 | + | |
| 102 | + | |
| 103 | + | |
| 104 | + | |
| 105 | + | |
| 106 | + | |
| 107 | + | |
| 108 | + | |
| 109 | + | |
| 110 | + | |
| 111 | + | |
| 112 | + | |
| 113 | + | |
| 114 | + | |
| 115 | + | |
| 116 | + | |
| 117 | + | |
| 118 | + | |
| 119 | + | |
| 120 | + | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
| 124 | + | |
| 125 | + | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
| 138 | + | |
| 139 | + | |
| 140 | + | |
| 141 | + | |
| 142 | + | |
| 143 | + | |
| 144 | + | |
| 145 | + | |
| 146 | + | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
| 161 | + | |
| 162 | + | |
| 163 | + | |
| 164 | + | |
| 165 | + | |
| 166 | + | |
| 167 | + | |
| 168 | + | |
| 169 | + | |
| 170 | + | |
| 171 | + | |
| 172 | + | |
| 173 | + | |
| 174 | + | |
| 175 | + | |
| 176 | + | |
| 177 | + | |
| 178 | + | |
| 179 | + | |
| 180 | + | |
| 181 | + | |
| 182 | + | |
| 183 | + | |
| 184 | + | |
| 185 | + | |
| 186 | + | |
| 187 | + | |
| 188 | + | |
| 189 | + | |
| 190 | + | |
| 191 | + | |
| 192 | + | |
| 193 | + | |
| 194 | + | |
| 195 | + | |
| 196 | + | |
| 197 | + | |
| 198 | + | |
| 199 | + | |
| 200 | + | |
| 201 | + | |
| 202 | + | |
| 203 | + | |
| 204 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
13 | 13 | | |
14 | 14 | | |
15 | 15 | | |
16 | | - | |
| 16 | + | |
17 | 17 | | |
18 | 18 | | |
19 | | - | |
| 19 | + | |
20 | 20 | | |
21 | 21 | | |
22 | 22 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2 | 2 | | |
3 | 3 | | |
4 | 4 | | |
5 | | - | |
| 5 | + | |
6 | 6 | | |
7 | 7 | | |
8 | | - | |
| 8 | + | |
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
| 4 | + | |
5 | 5 | | |
6 | | - | |
| 6 | + | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | 1 | | |
2 | 2 | | |
3 | 3 | | |
4 | | - | |
| 4 | + | |
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
17 | 17 | | |
18 | 18 | | |
19 | 19 | | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
| 32 | + | |
| 33 | + | |
| 34 | + | |
| 35 | + | |
| 36 | + | |
| 37 | + | |
20 | 38 | | |
21 | 39 | | |
22 | 40 | | |
| |||
96 | 114 | | |
97 | 115 | | |
98 | 116 | | |
| 117 | + | |
| 118 | + | |
99 | 119 | | |
100 | 120 | | |
101 | 121 | | |
102 | 122 | | |
103 | 123 | | |
104 | 124 | | |
105 | 125 | | |
| 126 | + | |
| 127 | + | |
| 128 | + | |
| 129 | + | |
| 130 | + | |
| 131 | + | |
| 132 | + | |
| 133 | + | |
| 134 | + | |
| 135 | + | |
| 136 | + | |
| 137 | + | |
106 | 138 | | |
107 | 139 | | |
108 | 140 | | |
| |||
114 | 146 | | |
115 | 147 | | |
116 | 148 | | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
| 153 | + | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
| 157 | + | |
| 158 | + | |
| 159 | + | |
| 160 | + | |
| 161 | + | |
| 162 | + | |
117 | 163 | | |
118 | 164 | | |
119 | 165 | | |
| |||
124 | 170 | | |
125 | 171 | | |
126 | 172 | | |
127 | | - | |
128 | | - | |
129 | | - | |
| 173 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
32 | 32 | | |
33 | 33 | | |
34 | 34 | | |
| 35 | + | |
35 | 36 | | |
36 | 37 | | |
37 | 38 | | |
| 39 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
| 52 | + | |
52 | 53 | | |
53 | 54 | | |
54 | 55 | | |
| |||
0 commit comments