My guess here is that the probe runs before SSL_read does anything, meaning the buffer you're trying to read hasn't actually been written to yet. This isn't the case for SSL_write as the buffer contains the data you want before the probe runs. I'm not sure why the read buffer would contain a line of output prior to calling SSL_read, though.
Maybe try converting the read probe to a uretprobe so you can access the buffer after libssl has written to it? _____________________________ From: Adrián López Tejedor via iovisor-dev <[email protected]<mailto:[email protected]>> Sent: Friday, August 12, 2016 3:05 pm Subject: [iovisor-dev] BCC: bpf_probe_read read function arguments To: <[email protected]<mailto:[email protected]>> Hi, I'm learning how to use bcc tools and to have a goal I was trying to read HTTP data before it gets encrypted, so, locally, I can read https traffic (actually, anything using openssl). I have modified some examples found on the web and done this: https://gist.github.com/adrianlzt/260253376bbcd75265cf47332eda496e It works well for outgoing data, showing the request, but incoming data just shows the first line: % sudo python sniff_openssl.py TIME(s) COMM PID WRITE: 0.000000000 curl 27088 4 GET / HTTP/1.1 Host: google.es<https://urldefense.proofpoint.com/v2/url?u=http-3A__google.es&d=CwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=L95dOI586ihsUoED6wcJbA&m=U2fUTd8J1dw8HJrx4h4gCsE9Xs0pyMm59X5sF51WhuY&s=T52CNav0mlnDPcES8IdXZdrj49GsvXaoXlMZfh9kt5s&e=> User-Agent: curl/7.50.1 Accept: */* READ: 0.041576303 curl 27088 4 C=US; O=Google Inc; CN=Google Internet Authority G2 I was trying to uderstant that happens behind bpf_probe_read function, but it goes deep in the kernel. Any idea? Thanks! Adrian P.S.: my real goal is try to decipher http2 requests, but I think is easy to begin with http1.1/SSL first.
_______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
