One Hat Cyber Team

Your IP: 216.73.216.144
Server IP: 157.245.143.252
Server: Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software: nginx/1.26.0
PHP Version: 8.3.11
Buat File | Buat Folder

Edit File: sslsnoop.bt

#!/usr/bin/env bpftrace
/*
 * sslsnoop	Trace SSL/TLS handshake for OpenSSL.
 * 		For Linux, uses bpftrace and eBPF.
 *
 * sslsnoop shows handshake latency and retval. This is useful for SSL/TLS
 * performance analysis.
 *
 * Copyright (c) 2021 Tao Xu.
 * Licensed under the Apache License, Version 2.0 (the "License")
 *
 * 15-Dec-2021	Tao Xu	created this.
 */

config = { missing_probes = "ignore" }

BEGIN
{
	printf("Tracing SSL/TLS handshake... Hit Ctrl-C to end.\n");
	printf("%-10s %-8s %-8s %7s %5s %s\n", "TIME(us)", "TID",
	       "COMM", "LAT(us)", "RET", "FUNC");
}

uprobe:libssl:SSL_read,
uprobe:libssl:SSL_write,
uprobe:libssl:SSL_do_handshake
{
	@start_ssl[tid] = nsecs;
	@func_ssl[tid] = func; // store for uretprobe
}

uretprobe:libssl:SSL_read,
uretprobe:libssl:SSL_write,
uretprobe:libssl:SSL_do_handshake
/@start_ssl[tid] != 0/
{
	printf("%-10u %-8d %-8s %7u %5d %s\n", elapsed/1000, tid, comm,
	       (nsecs - @start_ssl[tid])/1000, retval, @func_ssl[tid]);
	delete(@start_ssl[tid]); delete(@func_ssl[tid]);
}

// need debug symbol for ossl local functions
uprobe:libcrypto:rsa_ossl_public_encrypt,
uprobe:libcrypto:rsa_ossl_public_decrypt,
uprobe:libcrypto:rsa_ossl_private_encrypt,
uprobe:libcrypto:rsa_ossl_private_decrypt,
uprobe:libcrypto:RSA_sign,
uprobe:libcrypto:RSA_verify,
uprobe:libcrypto:ossl_ecdsa_sign,
uprobe:libcrypto:ossl_ecdsa_verify,
uprobe:libcrypto:ossl_ecdh_compute_key
{
	@start_crypto[tid] = nsecs;
	@func_crypto[tid] = func; // store for uretprobe
}

uretprobe:libcrypto:rsa_ossl_public_encrypt,
uretprobe:libcrypto:rsa_ossl_public_decrypt,
uretprobe:libcrypto:rsa_ossl_private_encrypt,
uretprobe:libcrypto:rsa_ossl_private_decrypt,
uretprobe:libcrypto:RSA_sign,
uretprobe:libcrypto:RSA_verify,
uretprobe:libcrypto:ossl_ecdsa_sign,
uretprobe:libcrypto:ossl_ecdsa_verify,
uretprobe:libcrypto:ossl_ecdh_compute_key
/@start_crypto[tid] != 0/
{
	printf("%-10u %-8d %-8s %7u %5d %s\n", elapsed/1000, tid, comm,
	       (nsecs - @start_crypto[tid])/1000, retval, @func_crypto[tid]);
	delete(@start_crypto[tid]); delete(@func_crypto[tid]);
}