fix: use other hooks to probe 5-tuple by Asphaltt · Pull Request #695 · gojue/ecapture

Asphaltt · 2024-12-17T15:13:17Z

Fixes #693

__sys_connect_file and do_accept are not found on v5.4 kernel.

Then, use inet_stream_connect and inet_accept instead, as they are found on v4.19 and v5.4 kernels.

I've test it on v5.4, v5.15 and v6.8 kernels.

@cfc4n can you help to test noncore on v4.19 and v5.4 kernels?

cfc4n · 2024-12-17T16:12:03Z

no problem.
However, I may not be able to verify it until later.

chilli13 · 2024-12-18T02:05:58Z

@Asphaltt run success on kernel 4.19 with noncore , but can not get 4-tuple info when works as client(Actively initiate a connection)

[root@zhm-cd ecapture]# uname -a
Linux zhm-cd 4.19.90-2102.2.0.0062.ctl2.x86_64 #1 SMP Thu Mar 10 03:34:36 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
[root@zhm-cd ecapture]# openssl version
OpenSSL 1.1.1f  31 Mar 2020

work as client -- can not get 4-tuple

AddConn success fd=3252076376 is not right

2024-12-18T09:51:18+08:00 DBG AddConn success fd=3252076376 pid=425754 tuple=192.168.10.41:43182-192.168.10.201:5443
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG GetConn fd=5 pid=425754
2024-12-18T09:51:18+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=425754 tuple=[TUPLE_NOT_FOUND]
2024-12-18T09:51:18+08:00 DBG DestroyConn success fd=3252076376 pid=425754 tuple=192.168.10.41:43182-192.168.10.201:5443
2024/12/18 09:51:19 [http2 response] Dump HTTP2 Frame error: unexpected EOF
2024-12-18T09:51:19+08:00 ??? UUID:425754_425754_curl_5_0_0.0.0.0:0-0.0.0.0:0, Name:HTTP2Response, Type:4, Length:1247

Frame Type	=>	SETTINGS

Frame Type	=>	WINDOW_UPDATE

Frame Type	=>	SETTINGS

Frame Type	=>	HEADERS
header field ":status" = "200"
header field "server" = "nginx"
header field "date" = "Wed, 18 Dec 2024 01:51:18 GMT"
header field "content-type" = "text/html"
header field "content-length" = "10417"

work as server -- ok

2024-12-18T09:51:11+08:00 DBG AddConn success fd=32 pid=143183 tuple=192.168.10.201:47282-192.168.10.41:443
2024-12-18T09:51:11+08:00 DBG GetConn fd=32 pid=143183
2024-12-18T09:51:11+08:00 DBG SSLDataEvent bio_type=1285 fd=32 pid=143183 tuple=192.168.10.201:47282-192.168.10.41:443
2024-12-18T09:51:11+08:00 DBG GetConn fd=32 pid=143183
2024-12-18T09:51:11+08:00 DBG SSLDataEvent bio_type=1285 fd=32 pid=143183 tuple=192.168.10.201:47282-192.168.10.41:443
2024-12-18T09:51:11+08:00 DBG GetConn fd=32 pid=143183
2024-12-18T09:51:11+08:00 DBG SSLDataEvent bio_type=1285 fd=32 pid=143183 tuple=192.168.10.201:47282-192.168.10.41:443
2024-12-18T09:51:11+08:00 DBG DestroyConn success fd=32 pid=143183 tuple=192.168.10.201:47282-192.168.10.41:443
2024-12-18T09:51:12+08:00 ??? UUID:143183_143183_nginx_32_1_192.168.10.201:47282-192.168.10.41:443, Name:HTTPResponse, Type:3, Length:250
HTTP/1.1 200 OK
Content-Length: 14
Accept-Ranges: bytes
Connection: keep-alive
Content-Type: text/plain
Date: Wed, 18 Dec 2024 01:51:11 GMT
Etag: "6757a54f-e"
Last-Modified: Tue, 10 Dec 2024 02:19:59 GMT
Server: nginx/1.21.5

hello world 1

`__sys_connect_file` and `do_accept` are not found on v5.4 kernel. Then, use `inet_stream_connect` and `inet_accept` instead, as they are found on v4.19 and v5.4 kernels. Signed-off-by: Leon Hwang <hffilwlqm@gmail.com>

Asphaltt · 2024-12-18T13:15:22Z

AddConn success fd=3252076376 is not right

Thank you, bro @chilli13

I fixed it just now.

cfc4n · 2024-12-18T14:40:12Z

Test passed on ubuntu 20.04 (kernel 5.4):

sudo bin/ecapture  tls -d -b 2
2024-12-18T22:38:37+08:00 INF AppName="eCapture(旁观者)"
2024-12-18T22:38:37+08:00 INF HomePage=https://ecapture.cc
2024-12-18T22:38:37+08:00 INF Repository=https://github.com/gojue/ecapture
2024-12-18T22:38:37+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-12-18T22:38:37+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-18T22:38:37+08:00 INF Version=linux_amd64:v0.9.0-20241218-2b7b128:x86_64
2024-12-18T22:38:37+08:00 INF Listen=localhost:28256
2024-12-18T22:38:37+08:00 INF eCapture running logs logger=
2024-12-18T22:38:37+08:00 INF the file handler that receives the captured event eventCollector=
2024-12-18T22:38:37+08:00 INF listen=localhost:28256
2024-12-18T22:38:37+08:00 INF https server starting...You can upgrade the configuration file via the HTTP interface.
2024-12-18T22:38:37+08:00 INF Kernel Info=5.4.255 Pid=39517
2024-12-18T22:38:37+08:00 INF BTF bytecode mode: non-CORE. btfMode=2
2024-12-18T22:38:37+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-12-18T22:38:37+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-12-18T22:38:37+08:00 INF Module.Run()
2024-12-18T22:38:37+08:00 INF origin versionKey="openssl 1.1.1f" versionKeyLower="openssl 1.1.1f"
2024-12-18T22:38:37+08:00 INF OpenSSL/BoringSSL version found Android=false library version="openssl 1.1.1f"
2024-12-18T22:38:37+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib/x86_64-linux-gnu/libssl.so.1.1
2024-12-18T22:38:37+08:00 INF target all process.
2024-12-18T22:38:37+08:00 INF target all users.
2024-12-18T22:38:37+08:00 INF setupManagers eBPFProgramType=Text
2024-12-18T22:38:37+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_1_1_1d_kern_noncore.o
2024-12-18T22:38:37+08:00 DBG upgrade check failed: local version is ahead of latest version
2024-12-18T22:38:37+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-18T22:38:37+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-18T22:38:37+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
2024-12-18T22:38:46+08:00 DBG AddConn success fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG GetConn fd=5 pid=39581
2024-12-18T22:38:46+08:00 DBG SSLDataEvent bio_type=1285 fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:46+08:00 DBG DestroyConn success fd=5 pid=39581 tuple=172.19.100.17:48962-76.76.21.21:443
2024-12-18T22:38:47+08:00 ??? UUID:39581_39581_curl_5_1_172.19.100.17:48962-76.76.21.21:443, Name:HTTP2Request, Type:2, Length:305

Frame Type	=>	SETTINGS

Frame Type	=>	WINDOW_UPDATE

Frame Type	=>	HEADERS
header field ":method" = "GET"
header field ":path" = "/"
header field ":scheme" = "https"
header field ":authority" = "ecapture.cc"
header field "user-agent" = "curl/7.68.0"
header field "accept" = "*/*"

Frame Type	=>	SETTINGS

2024/12/18 22:38:47 [http2 response] Dump HTTP2 Frame error: unexpected EOF
2024-12-18T22:38:47+08:00 ??? UUID:39581_39581_curl_5_0_172.19.100.17:48962-76.76.21.21:443, Name:HTTP2Response, Type:4, Length:4278

Frame Type	=>	SETTINGS

Frame Type	=>	WINDOW_UPDATE

Frame Type	=>	SETTINGS

Frame Type	=>	HEADERS
header field ":status" = "200"
header field "accept-ranges" = "bytes"
header field "access-control-allow-origin" = "*"
header field "age" = "238524"
header field "cache-control" = "public, max-age=0, must-revalidate"
header field "content-disposition" = "inline"
header field "content-type" = "text/html; charset=utf-8"
header field "date" = "Wed, 18 Dec 2024 14:38:46 GMT"
header field "etag" = "\"6ec0d02787369e8ea7c44409db9cbe99\""
header field "last-modified" = "Sun, 15 Dec 2024 20:23:22 GMT"
header field "server" = "Vercel"
header field "strict-transport-security" = "max-age=63072000"
header field "x-vercel-cache" = "HIT"
header field "x-vercel-id" = "hkg1::m4dgh-1734532726185-a3d01f468486"
header field "content-length" = "24569"

Frame Type	=>	DATA
<!DOCTYPE html>
<html lang="en-US" dir="ltr">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width,initial-scale=1">
    <title>eCapture - Capture SSL/TLS text content without CA cert using eBPF. | eCapture</title>
    <meta name="description" content="eCapture - Capture SSL/TLS text content without CA certificate using eBPF">
    <meta name="generator" content="VitePress v1.5.0">
    <link rel="preload stylesheet" href="/assets/style.nptfy1Tr.css" as="style">
    <link rel="preload stylesheet" href="/vp-icons.css" as="style">
    
    <script type="module" src="/assets/app.DXOqA-Jf.js"></script>
    <link rel="modulepreload" href="/assets/chunks/theme.BkHHwEhx.js">
    <link rel="modulepreload" href="/assets/chunks/framework.tmAlGBxD.js">
    <link rel="modulepreload" href="/assets/chunks/githubReleases.BcmQgaE5.js">
    <link rel="modulepreload" href="/assets/index.md.CEuvy2gq.lean.js">
    <link rel="icon" href="/logo.svg">
    <link rel="preload" href="/assets/inter-latin.7b37fe23.woff2" as="font" type="font/woff2" crossorigin="anonymous">
    <script>(()=>{const e=(o,r,c=!1)=>{const s=localStorage.getItem(o);(s?s!=="false":c)&&document.documentElement.classList.add(r)};e("vue-docs-prefer-composition","prefer-composition"),e("vue-docs-prefer-sfc","prefer-sfc",!0),window.__VUE_BANNER_ID__="wip",e(`vue-docs-banner-${__VUE_BANNER_ID__}`,"banner-dismissed")})();</script>
    <link rel="shortcut icon" href="https://ecapture.cc/assets/logo-300x300-v2.059cb3f9.svg">
    <script id="check-dark-mode">(()=>{const e=localStorage.getItem("vitepress-theme-appearance")||"auto",a=window.matchMedia("(prefers-color-scheme: dark)").matches;(!e||e==="auto"?a:e==="dark")&&document.documentElement.classList.add("dark")})();</script>
    <script id="check-mac-os">document.documentElement.classList.toggle("mac",/Mac|iPhone|iPod|iPad/i.test(navigator.platform));</script>
  </head>
  <body>
    <div id="app"><div class="VPApp" data-v-ae2f6264><!--[--><span tabindex="-1" data-v-2ee4b9aa></span><a href="#VPContent" class="VPSkipLink visually-hidden" data-v-2ee4b9aa>Skip to content</a><!--]--><!----><!--[--><!--]--><header class="VPNav nav-bar stick" data-v-ae2f6264 data-v-c76f83a6><div class="VPNavBar" data-v-c76f83a6 data-v-9abe73e6><div class="container" data-v-9abe73e6><a class="VPNavBarTitle" href="/" data-v-9abe73e6 data-v-25a4f16b><!--[--><!--[--><!--[--><!--[--><!--[--><img class="logo" src="/assets/logo-300x300-v2.BBmMbtan.svg" alt="eCapture Logo" data-v-b49487b1><span class="text" data-v-b49487b1>eCapture(旁观者)</span><!--]--><!--]--><!--]--><!--]--><!--]--></a><div class="content" data-v-9abe73e6><!----><nav aria-labelledby="main-nav-aria-label" class="VPNavBarMenu menu" data-v-9abe73e6 data-v-44ff399f><span id="main-nav-aria-label" class="visually-hidden" data-v-44ff399f>Main Navigation</span><!--[--><!--[--><a class="vt-link link VPNavBarMenuLink active" href="/" data-v-44ff399f data-v-34040ca2><!--[-->English<!--]--><!----></a><!--]--><!--[--><a class="vt-link link VPNavBarMenuLink" href="/guide/introduction.html" data-v-44ff399f data-v-34040ca2><!--[-->Guide<!--]--><!----></a><!--]--><!--[--><a class="vt-link link VPNavBarMenuLink" href="/develop/compile.html" data-v-44ff399f data-v-34040ca2><!--[-->Develop<!--]--><!----></a><!--]--><!--[--><a class="vt-link link VPNavBarMenuLink" href="/download.html" data-v-44ff399f data-
^C2024-12-18T22:39:02+08:00 INF module close.
2024-12-18T22:39:02+08:00 INF Module closed,message recived from Context
2024-12-18T22:39:03+08:00 INF iModule module close
2024-12-18T22:39:03+08:00 INF bye bye.

cfc4n

LGTM, Thanks.

cfc4n added enhancement New feature or request fix bug fix PR labels Dec 17, 2024

fix: use other hooks to probe 5-tuple

2b7b128

`__sys_connect_file` and `do_accept` are not found on v5.4 kernel. Then, use `inet_stream_connect` and `inet_accept` instead, as they are found on v4.19 and v5.4 kernels. Signed-off-by: Leon Hwang <hffilwlqm@gmail.com>

Asphaltt force-pushed the fix/tuple branch from 62b9b47 to 2b7b128 Compare December 18, 2024 13:13

cfc4n approved these changes Dec 18, 2024

View reviewed changes

cfc4n merged commit f19bf92 into gojue:master Dec 18, 2024

chilli13 mentioned this pull request Jan 23, 2025

how to get ipv6 tuple info for -m text #724

Closed

cfc4n mentioned this pull request Apr 24, 2026

feat: gotls Upload sequence; Fix the issue where disorderly arrival c… #978

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: use other hooks to probe 5-tuple#695

fix: use other hooks to probe 5-tuple#695
cfc4n merged 1 commit into
gojue:masterfrom
Asphaltt:fix/tuple

Asphaltt commented Dec 17, 2024 •

edited

Loading

Uh oh!

cfc4n commented Dec 17, 2024

Uh oh!

chilli13 commented Dec 18, 2024

Uh oh!

Asphaltt commented Dec 18, 2024 •

edited

Loading

Uh oh!

cfc4n commented Dec 18, 2024

Uh oh!

cfc4n left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Asphaltt commented Dec 17, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cfc4n commented Dec 17, 2024

Uh oh!

chilli13 commented Dec 18, 2024

work as client -- can not get 4-tuple

work as server -- ok

Uh oh!

Asphaltt commented Dec 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cfc4n commented Dec 18, 2024

Uh oh!

cfc4n left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Asphaltt commented Dec 17, 2024 •

edited

Loading

Asphaltt commented Dec 18, 2024 •

edited

Loading