Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kern: support openssl 3.2.x , change ssl_st to ssl_connection_st #472

Merged
merged 8 commits into from
Jan 28, 2024
Merged

kern: support openssl 3.2.x , change ssl_st to ssl_connection_st #472

merged 8 commits into from
Jan 28, 2024
+523 −6

Conversation

cfc4n
Copy link
Member

@cfc4n cfc4n commented Jan 27, 2024

feat: #464

add the offset generation script.

@cfc4n
kern: support openssl 3.2.x , change ssl_st to ssl_connection_st, upd…
1362476 
…ate more OFFSETS.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n cfc4n added documentation Improvements or additions to documentation enhancement New feature or request improve labels Jan 27, 2024
@cfc4n
Copy link
Member Author

cfc4n commented Jan 28, 2024

测试 Tests

类库使用deps/openssl目录的源码，

  1. 根目录执行bash utils/openssl_offset_3.2.sh，拉取3.2.0 分支的代码，进入目录，执行./Configure ，再执行make即可，不需要执行make install。
  2. 将当前terminal的动态链接库增加openssl 3.2的目录，命令为export LD_LIBRARY_PATH=/home/cfc4n/project/ecapture/deps/openssl
  3. 借用issue_463目录下的客户端代码进行测试，编译后生成test_tls_client，使用ldd确认ELF文件使用正确的动态链接库版本。
  4. 新开一个Terminal，启动eCapture。
  5. 回到之前编译openssl 3.2的Terminal里，执行test_tls_client。
  6. 在eCapture的终端里，查看捕获结果。

The library uses the source code in the deps/openssl directory.

  1. Execute bash utils/openssl_offset_3.2.sh in the root directory to fetch the code from branch 3.2.0. Enter the directory and execute ./Configure, then execute make, no need to execute make install.
  2. Add openssl 3.2's directory as a dynamic link library for the current terminal, command is export LD_LIBRARY_PATH=/home/cfc4n/project/ecapture/deps/openssl.
  3. Use client code under the directory of issue_463 for testing, compile it to generate test_tls_client, use ldd to confirm that ELF file is using correct version of dynamic link library.
  4. Open a new terminal and start eCapture there.
  5. Return to previous terminal where openssl 3.2 was compiled, execute test_tls_client.
  6. View capture results in eCapture's terminal.

text mode

sudo bin/ecapture tls --libssl=/home/cfc4n/project/ecapture/deps/openssl/libssl.so.3 --ssl_version="openssl 3.2.0"
tls_2024/01/28 13:11:17 ECAPTURE :: ecapture Version : linux_aarch64:0.7.2-20240128-f368e82:[CORE]
tls_2024/01/28 13:11:17 ECAPTURE :: Pid Info : 232993
tls_2024/01/28 13:11:17 ECAPTURE :: Kernel Info : 5.15.131
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	module initialization
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	master key keylogger:
tls_2024/01/28 13:11:17 ECAPTURE ::	Module.Run()
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	Text MODEL
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	OpenSSL/BoringSSL version: openssl 3.2.0
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	HOOK type:2, binrayPath:/home/cfc4n/project/ecapture/deps/openssl/libssl.so.3
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	Hook masterKey function:[SSL_get_wbio SSL_in_before SSL_do_handshake]
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	libPthread:/lib/aarch64-linux-gnu/libc.so.6
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	target all process.
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	target all users.
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	BPF bytecode filename:user/bytecode/openssl_3_2_0_kern.o
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	perfEventReader created. mapSize:4 MB
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	perfEventReader created. mapSize:4 MB
tls_2024/01/28 13:11:17 EBPFProbeOPENSSL	module started successfully.
tls_2024/01/28 13:11:17 ECAPTURE :: 	start 1 modules
tls_2024/01/28 13:13:15 UUID:233406_233406_openssl_client_3_1, Name:HTTPRequest, Type:1, Length:39
tls_2024/01/28 13:13:15
GET / HTTP/1.1
Host: www.cnxct.com


tls_2024/01/28 13:13:15 UUID:233406_233406_openssl_client_3_0, Name:HTTPResponse, Type:3, Length:932
tls_2024/01/28 13:13:15
HTTP/1.1 200 OK
Content-Length: 612
Accept-Ranges: bytes
Connection: keep-alive
Content-Type: text/html
Date: Sun, 28 Jan 2024 13:13:14 GMT
Etag: "65b4d88f-264"
Last-Modified: Sat, 27 Jan 2024 10:18:55 GMT
Server: nginx/1.18.0 (Ubuntu)
Strict-Transport-Security: max-age=63072000; includeSubdomains; preload

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

^Ctls_2024/01/28 13:13:21 EBPFProbeOPENSSL	close.
tls_2024/01/28 13:13:21 EBPFProbeOPENSSL	close

keylog mode

sudo bin/ecapture tls --libssl=/home/cfc4n/project/ecapture/deps/openssl/libssl.so.3 --ssl_version="openssl 3.2.0" -m keylog
tls_2024/01/28 13:13:25 ECAPTURE :: ecapture Version : linux_aarch64:0.7.2-20240128-f368e82:[CORE]
tls_2024/01/28 13:13:25 ECAPTURE :: Pid Info : 233551
tls_2024/01/28 13:13:25 ECAPTURE :: Kernel Info : 5.15.131
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	module initialization
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	master key keylogger: ecapture_openssl_key.og
tls_2024/01/28 13:13:25 ECAPTURE ::	Module.Run()
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	Keylog MODEL
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	OpenSSL/BoringSSL version: openssl 3.2.0
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	HOOK type:2, binrayPath:/home/cfc4n/project/ecapture/deps/openssl/libssl.so.3
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	Hook masterKey function:[SSL_get_wbio SSL_in_before SSL_do_handshake]
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	target all process.
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	target all users.
tls_2024/01/28 13:13:25 EBPFProbeOPENSSL	BPF bytecode filename:user/bytecode/openssl_3_2_0_kern.o
tls_2024/01/28 13:13:26 EBPFProbeOPENSSL	perfEventReader created. mapSize:4 MB
tls_2024/01/28 13:13:26 EBPFProbeOPENSSL	module started successfully.
tls_2024/01/28 13:13:26 ECAPTURE :: 	start 1 modules
tls_2024/01/28 13:13:29 EBPFProbeOPENSSL	TLS1_2_VERSION: save CLIENT_RANDOM 98e7c033008797a9b8c3419841b2a3385be63dfde5f36a957f92f430d9eb2680 to file success, 176 bytes
^Ctls_2024/01/28 13:13:35 EBPFProbeOPENSSL	close.
tls_2024/01/28 13:13:35 EBPFProbeOPENSSL	close

@cfc4n
user: imporve #463, impact on the performance of the tested program
ed1383a 
* When calling `SSL_connect` in the OpenSSL library in a client role or `SSL_accept` in a server role, the execution flow ultimately enters the `state_machine` function in `ssl/statem/statem.c` for TLS handshake.
* Therefore, the optional scope is functions within this `state_machine` function that start with an uppercase `SSL`.
* When using OpenSSL synchronously, a successful TLS handshake returns 1, i.e., `ret = 1`. Thus, after this variable is assigned, the called functions can obtain the desired memory data.
* Under this premise, the only function within the `state_machine` function that meets the requirements is `SSL_get_wbio`.
* Adding an alternate HOOK function, `SSL_in_before`, to the scope.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n
user: add test program
97582fc 
see readme.md for more detail.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n
user: chore
f5f1237 
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n
user: add hook function "SSL_do_handshake" for TLS Server mode.
c1636bc 
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n
user: Added eBPF loader support for OpenSSL 3.2.0.
3013cb3 
Optimized OpenSSL 3.2 offset generation scripts.
SSL_CONNECTION types of ssl_st are not supported at this time.

More info: #472

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n
Merge branch 'master' into support-openssl-3.2.x
b615364
@cfc4n
kern: fix non-void function 'probe_ssl_master_key' should return a va…
07301c8 
…lue.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
cfc4n
cfc4n commented Jan 28, 2024
View reviewed changes
Copy link
Member Author

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reviewed.

@cfc4n cfc4n merged commit 2ae3e78 into master Jan 28, 2024
6 checks passed
@cfc4n cfc4n deleted the support-openssl-3.2.x branch January 28, 2024 13:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
documentation Improvements or additions to documentation enhancement New feature or request improve
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@cfc4n