Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tls module cannot to capture payload on Aarch64 kernel 4.18 #108

Closed
cfc4n opened this issue Jun 22, 2022 · 2 comments · Fixed by #111
Closed

tls module cannot to capture payload on Aarch64 kernel 4.18 #108

cfc4n opened this issue Jun 22, 2022 · 2 comments · Fixed by #111
Labels
🐞 bug Something isn't working

Comments

@cfc4n
Copy link
Member

cfc4n commented Jun 22, 2022

Describe the bug

[root@VM-0-5-centos ssldump]# bin/ecapture tls
2022/06/22 23:31:13 pid info :4428
2022/06/22 23:31:13 start to run EBPFProbeOPENSSL module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 start to run EBPFProbeGNUTLS module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libssl.so.1.1
2022/06/22 23:31:13 libPthread so Path:/usr/lib64/libpthread.so.0
2022/06/22 23:31:13 start to run EBPFProbeNSPR module
2022/06/22 23:31:13 stat /usr/lib/libnspr4.so: no such file or directory
2022/06/22 23:31:13 start to run EBPFProbeGoSSL module
2022/06/22 23:31:13 go binary not found
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libgnutls.so.30
2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Send 77 bytes to [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1179 bytes from [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1664 bytes from [ADDR_NOT_FOUND], Payload:

To Reproduce
Steps to reproduce the behavior:

  1. ./ecapture tls
  2. open an other shell, type shell curl https://github.com

Expected behavior
payload captured.

Screenshots
image

Linux Server/Android (please complete the following information):

  • OS: Linux VM-0-5-centos 4.18.0-240.10.1.el8_3.aarch64 SMP Mon Jan 18 16:34:39 UTC 2021 aarch64 aarch64 aarch64 GNU/Linux
  • Arch: aarch64
  • Kernel Version: 4.18
  • Version: v0.1.10

ref: iovisor/bcc#2253

@cfc4n cfc4n added the 🐞 bug Something isn't working label Jun 22, 2022
@cfc4n
Copy link
Member Author

cfc4n commented Jun 24, 2022

huzai9527 added a commit to huzai9527/ecapture that referenced this issue Jun 24, 2022
cfc4n added a commit that referenced this issue Jun 24, 2022
fixed :#108 tls module cannot to capture payload on Aarch64 kernel 4.18
@cfc4n cfc4n closed this as completed Jun 24, 2022
@cfc4n cfc4n reopened this Jun 25, 2022
@cfc4n
Copy link
Member Author

cfc4n commented Jun 25, 2022

IP ADDRESS also lost.

image

@cfc4n cfc4n closed this as completed Jun 25, 2022
cfc4n added a commit that referenced this issue Jun 25, 2022
Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
@cfc4n cfc4n linked a pull request Jun 25, 2022 that will close this issue
@cfc4n cfc4n reopened this Jun 25, 2022
cfc4n added a commit that referenced this issue Jun 25, 2022
fixed #108: ip address lost on aarch64 kernel 4.18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant