Thanks, I'll take a look. El vie., 12 de agosto de 2016 21:06, Mark Drayton <[email protected]> escribió:
> My guess here is that the probe runs before SSL_read does anything, > meaning the buffer you're trying to read hasn't actually been written to > yet. This isn't the case for SSL_write as the buffer contains the data you > want before the probe runs. I'm not sure why the read buffer would contain > a line of output prior to calling SSL_read, though. > > Maybe try converting the read probe to a uretprobe so you can access the > buffer after libssl has written to it? > > > _____________________________ > From: Adrián López Tejedor via iovisor-dev <[email protected]> > Sent: Friday, August 12, 2016 3:05 pm > Subject: [iovisor-dev] BCC: bpf_probe_read read function arguments > To: <[email protected]> > > > > Hi, > > I'm learning how to use bcc tools and to have a goal I was trying to read > HTTP data before it gets encrypted, so, locally, I can read https traffic > (actually, anything using openssl). > > I have modified some examples found on the web and done this: > https://gist.github.com/adrianlzt/260253376bbcd75265cf47332eda496e > > It works well for outgoing data, showing the request, but incoming data > just shows the first line: > > > % sudo python sniff_openssl.py > TIME(s) COMM PID > WRITE: 0.000000000 curl 27088 4 > GET / HTTP/1.1 > Host: google.es > <https://urldefense.proofpoint.com/v2/url?u=http-3A__google.es&d=CwMFaQ&c=5VD0RTtNlTh3ycd41b3MUw&r=L95dOI586ihsUoED6wcJbA&m=U2fUTd8J1dw8HJrx4h4gCsE9Xs0pyMm59X5sF51WhuY&s=T52CNav0mlnDPcES8IdXZdrj49GsvXaoXlMZfh9kt5s&e=> > User-Agent: curl/7.50.1 > Accept: */* > > > READ: 0.041576303 curl 27088 4 > C=US; O=Google Inc; CN=Google Internet Authority G2 > > > I was trying to uderstant that happens behind bpf_probe_read function, but > it goes deep in the kernel. > Any idea? > > Thanks! > Adrian > > P.S.: my real goal is try to decipher http2 requests, but I think is easy > to begin with http1.1/SSL first. > > >
_______________________________________________ iovisor-dev mailing list [email protected] https://lists.iovisor.org/mailman/listinfo/iovisor-dev
