From bdd1a8a170f04f6802fcdf01411041edbe222295 Mon Sep 17 00:00:00 2001 From: CFC4N Date: Sat, 10 Dec 2022 23:06:41 +0800 Subject: [PATCH] support boringssl event on TC model. Signed-off-by: CFC4N --- user/event/event_masterkey.go | 2 +- user/module/probe_openssl.go | 7 ++++--- user/module/probe_openssl_tc.go | 10 +++++++++- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/user/event/event_masterkey.go b/user/event/event_masterkey.go index 2ef9bafe8..3082cf5d1 100644 --- a/user/event/event_masterkey.go +++ b/user/event/event_masterkey.go @@ -194,7 +194,7 @@ func (this *MasterSecretBSSLEvent) String() string { } func (this *MasterSecretBSSLEvent) Clone() IEventStruct { - event := new(MasterSecretEvent) + event := new(MasterSecretBSSLEvent) event.event_type = EventTypeModuleData return event } diff --git a/user/module/probe_openssl.go b/user/module/probe_openssl.go index 1e83d0ec5..b8383fd17 100644 --- a/user/module/probe_openssl.go +++ b/user/module/probe_openssl.go @@ -302,7 +302,7 @@ func (this *MOpenSSLProbe) setupManagersUprobe() error { } this.logger.Printf("%s\tHOOK type:%d, binrayPath:%s\n", this.Name(), this.conf.(*config.OpensslConfig).ElfType, binaryPath) - this.logger.Printf("%s\tlHook masterKey function:%s\n", this.Name(), this.masterHookFunc) + this.logger.Printf("%s\tHook masterKey function:%s\n", this.Name(), this.masterHookFunc) this.bpfManager = &manager.Manager{ Probes: []*manager.Probe{ @@ -616,6 +616,8 @@ func (this *MOpenSSLProbe) saveMasterSecretBSSL(secretEvent *event.MasterSecretB case event.TLS1_2_VERSION: b = bytes.NewBufferString(fmt.Sprintf("%s %02x %02x\n", hkdf.KeyLogLabelTLS12, secretEvent.ClientRandom, secretEvent.Secret)) case event.TLS1_3_VERSION: + fallthrough + default: var length int length = 32 @@ -626,8 +628,7 @@ func (this *MOpenSSLProbe) saveMasterSecretBSSL(secretEvent *event.MasterSecretB b.WriteString(fmt.Sprintf("%s %02x %02x\n", hkdf.KeyLogLabelServerTraffic, secretEvent.ClientRandom, secretEvent.ServerTrafficSecret0[:length])) b.WriteString(fmt.Sprintf("%s %02x %02x\n", hkdf.KeyLogLabelExporterSecret, secretEvent.ClientRandom, secretEvent.ExporterSecret[:length])) - default: - b = bytes.NewBufferString(fmt.Sprintf("%s %02x %02x\n", hkdf.KeyLogLabelTLS12, secretEvent.ClientRandom, secretEvent.Secret)) + //b = bytes.NewBufferString(fmt.Sprintf("%s %02x %02x\n", hkdf.KeyLogLabelTLS12, secretEvent.ClientRandom, secretEvent.Secret)) } v := event.TlsVersion{Version: secretEvent.Version} l, e := this.keylogger.WriteString(b.String()) diff --git a/user/module/probe_openssl_tc.go b/user/module/probe_openssl_tc.go index 09da6b2a8..b32889223 100644 --- a/user/module/probe_openssl_tc.go +++ b/user/module/probe_openssl_tc.go @@ -195,7 +195,15 @@ func (this *MOpenSSLProbe) initDecodeFunTC() error { return errors.New("cant found map:mastersecret_events") } this.eventMaps = append(this.eventMaps, MasterkeyEventsMap) - masterkeyEvent := &event.MasterSecretEvent{} + + var masterkeyEvent event.IEventStruct + + if this.isBoringSSL { + masterkeyEvent = &event.MasterSecretBSSLEvent{} + } else { + masterkeyEvent = &event.MasterSecretEvent{} + } + //masterkeyEvent.SetModule(this) this.eventFuncMaps[MasterkeyEventsMap] = masterkeyEvent return nil