Can't run the openssl tracer

[hansbogert]

When following the readme for the openssl-tracer, I get the following:

sudo ./openssl_tracer 1634608
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:41:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP32__
        ^
<command line>:4:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP32__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:42:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP64__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:43:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP16__
        ^
<command line>:3:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP16__ 1
        ^
3 warnings generated.
prog tag mismatch 9f16ca2b9f8b1e01 1
WARNING: cannot get prog tag, ignore saving source with program tag
Attached uprobe to binary /usr/lib/x86_64-linux-gnu/libssl.so.1.1 at symbol SSL_write
prog tag mismatch c4b89df08a974514 1
WARNING: cannot get prog tag, ignore saving source with program tag
Attached uprobe to binary /usr/lib/x86_64-linux-gnu/libssl.so.1.1 at symbol SSL_write
prog tag mismatch 9f16ca2b9f8b1e01 1
WARNING: cannot get prog tag, ignore saving source with program tag
Attached uprobe to binary /usr/lib/x86_64-linux-gnu/libssl.so.1.1 at symbol SSL_read
prog tag mismatch 12c46cd71c0a6c20 1
WARNING: cannot get prog tag, ignore saving source with program tag
Attached uprobe to binary /usr/lib/x86_64-linux-gnu/libssl.so.1.1 at symbol SSL_read
Opened perf buffer tls_events
Successfully deployed BPF probes. Tracing for SSL data. Use Ctrl-C to exit.

I don't see any actual data. (which I assume should present itself at the end of the output.)

[ezxfv]

@hansbogert you should modify the openssl_tracer.cc, SSL_read -> SSL_read_ex, SSL_write -> SSL_write_ex, it's working for me now.
Due to the change of the function signature, the length of writing and reading needs to be obtained from the fourth input parameter (size_t*), and the following is the modified openssl_tracer_bpf_funcs.c.

https://paste.ubuntu.com/p/d2fJ4Tmgp9/

python 3.10
ubuntu 22.04

[PranshuSrivastava]

Hey @edenzhong7 I noticed a weird bug, When I am using SSL_read_ex and SSL_write_ex, the app is working perfectly fine. But it is not able to intercept curl commands. But when I change the commands back to SSL_read and SSL_write, it is able to intercept curl commands and display their pid. Do you have any idea why this may be happening?

[ezxfv]

@PranshuSrivastava You can attach to both SSL_read and SSL_read_ex, python 3.10 switched from SSL_read to SSL_read_ex, but curl should still use SSL_read

[PranshuSrivastava]

@edenzhong7 Oh, now I get it. Also, if I have an api, that for instance, makes an external call to an https website, can i trace it using ebpf? In my experience I am only able to trace it when the app is running on https-localhost. Do you know any way around it?

[ezxfv]

@PranshuSrivastava yes, you can only trace the client, your api here, it's enough to capture yourself request detail, attach to client instead of server