stirling support for boringcrypto as used by the 'boringcrypto' version of Golang #597
Assignees
Labels
area/datacollector
Issues related to Stirling (datacollector)
kind/feature
New feature or request
priority/important-longterm
Important over the long term, but may not be staffed and/or may need multiple releases to complete.
triage/accepted
Indicates an issue or PR is ready to be actively worked on.
Comments
zasgar
added
kind/feature
|
@kay-ge while working on #692, I realized that our existing Go TLS tracing already covers Go applications using boringcrypto (as long as DWARF debug information is available). Can you confirm if your boringcrypto applications had missing traffic or was it because our documentation only states Go TLS and OpenSSL support? I was able to update Pixie's go tls tracing tests to use binaries opted into Test output |
vihangm
pushed a commit
that referenced
this issue
Jun 8, 2023
Summary: Upgrade go 1.19 and go 1.20 to latest bugfix release This is in preparation for adding another go sdk so we can test boringcrypto applications (#1449). Relevant Issues: #597 Type of change: /kind cleanup Test Plan: Existing test coverage --------- Signed-off-by: Dom Del Nano <ddelnano@pixielabs.ai>
vihangm
pushed a commit
that referenced
this issue
Jun 8, 2023
…1449) Summary: Refactor Go SDK label templating to support future boringcrypto SDK This PR adds the scaffolding needed to add a boringcrypto go SDK. This SDK will be used in a future change to add TLS tracing tests for binaries using boringcrypto, which addresses #597. It wasn't known that boringcrypto was supported at the time, but we should still validate that it is functional. `rules_go` does not support go SDKs that use the same version with different `GOEXPERIMENT`s enabled (will be following up to create a GitHub issue on the project). This is an issue because boringcrypto is enabled by setting `GOEXPERIMENT=boringcrypto` as mentioned [here](https://go.googlesource.com/go/+/refs/heads/dev.boringcrypto/README.boringcrypto.md). Until `rules_go` supports this, the proposed plan is to maintain a previous patch version of our latest supported version of go as the "boringcrypto go SDK". The description below should explain the process: ``` # rules_go doesn't support using multiple SDKs with the same version and differing # GOEXPERIMENTs. Until this is addressed, go_sdk_boringcrypto is meant to be 1 bug fix # version behind our latest go release. In the event our primary toolchain is upgraded # to the first release of a new major version (i.e. 1.20.0) an rc suffixed build should # be used for go_sdk_boringcrypto (1.20rcX) until the first minor release is available (1.20.1). ``` Relevant Issues: #597 #692 Type of change: /kind test-infra Test Plan: Existing tests pass and verified this supports the boringcrypto tests on a branch with the full set of changes --------- Signed-off-by: Dom Del Nano <ddelnano@pixielabs.ai>
This was referenced Jun 8, 2023
vihangm
pushed a commit
that referenced
this issue
Jun 12, 2023
Summary: Add Go TLS tracing tests for binaries built with boringcrypto I will follow up with updating the docs.px.dev encryption library section of the [data source docs](https://docs.px.dev/about-pixie/data-sources/#encryption-libraries) to list boringcrypto as a supported TLS library. Relevant Issues: Fixes #597 Type of change: /kind test-infra Test Plan: New test coverage verifies boringcrypto TLS tracing is functional and verified that binaries used have boringcrypto enabled with `goversion -crypto` <details> <summary>goversion test output</summary> ``` # Build the boringcrypto binaries used the trace bpf tests ddelnano@vigenere:~/code/pixie (ddelnano/add-go-boringcrypto-tls-tracing-tests) $ bazel query //... | grep boringcrypto | grep binary | xargs -I{} bazel build {} Loading: 0 packages loaded Loading: 501 packages loaded INFO: Invocation ID: ebe2161e-6317-42d8-8c23-e83173c5ab64 INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/ebe2161e-6317-42d8-8c23-e83173c5ab64 INFO: Analyzed target //src/stirling/testing/demo_apps/go_grpc_tls_pl/client:golang_boringcrypto_grpc_tls_client_binary (0 packages loaded, 0 targets configured). INFO: Found 1 target... Target //src/stirling/testing/demo_apps/go_grpc_tls_pl/client:golang_boringcrypto_grpc_tls_client_binary up-to-date: bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/client/golang_boringcrypto_grpc_tls_client_binary INFO: Elapsed time: 1.118s, Critical Path: 0.11s INFO: 1 process: 1 internal. INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/ebe2161e-6317-42d8-8c23-e83173c5ab64 INFO: Build completed successfully, 1 total action INFO: Invocation ID: bab5d6bb-5e75-48f3-91a7-5c7b7ab7fb25 INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/bab5d6bb-5e75-48f3-91a7-5c7b7ab7fb25 INFO: Analyzed target //src/stirling/testing/demo_apps/go_grpc_tls_pl/server:golang_boringcrypto_grpc_tls_server_binary (2 packages loaded, 6 targets configured). INFO: Found 1 target... Target //src/stirling/testing/demo_apps/go_grpc_tls_pl/server:golang_boringcrypto_grpc_tls_server_binary up-to-date: bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/server/golang_boringcrypto_grpc_tls_server_binary INFO: Elapsed time: 0.932s, Critical Path: 0.04s INFO: 1 process: 1 internal. INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/bab5d6bb-5e75-48f3-91a7-5c7b7ab7fb25 INFO: Build completed successfully, 1 total action INFO: Invocation ID: ff5e37d4-0cdf-4f78-b582-affeef69dcc4 INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/ff5e37d4-0cdf-4f78-b582-affeef69dcc4 INFO: Analyzed target //src/stirling/testing/demo_apps/go_https/client:golang_boringcrypto_client_binary (1 packages loaded, 4 targets configured). INFO: Found 1 target... Target //src/stirling/testing/demo_apps/go_https/client:golang_boringcrypto_client_binary up-to-date: bazel-bin/src/stirling/testing/demo_apps/go_https/client/golang_boringcrypto_client_binary INFO: Elapsed time: 0.503s, Critical Path: 0.06s INFO: 1 process: 1 internal. INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/ff5e37d4-0cdf-4f78-b582-affeef69dcc4 INFO: Build completed successfully, 1 total action INFO: Invocation ID: e1938fea-1793-490b-befd-38f632f95c6c INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/e1938fea-1793-490b-befd-38f632f95c6c INFO: Analyzed target //src/stirling/testing/demo_apps/go_https/server:golang_boringcrypto_server_binary (1 packages loaded, 4 targets configured). INFO: Found 1 target... Target //src/stirling/testing/demo_apps/go_https/server:golang_boringcrypto_server_binary up-to-date: bazel-bin/src/stirling/testing/demo_apps/go_https/server/golang_boringcrypto_server_binary INFO: Elapsed time: 0.421s, Critical Path: 0.05s INFO: 1 process: 1 internal. INFO: Streaming build results to: https://bb.corp.pixielabs.ai/invocation/e1938fea-1793-490b-befd-38f632f95c6c INFO: Build completed successfully, 1 total action # Verify with goversion -crypto that boringcrypto is in use ddelnano@vigenere:~/code/pixie (ddelnano/add-go-boringcrypto-tls-tracing-tests) $ ~/go/bin/goversion -crypto bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/client/golang_boringcrypto_grpc_tls_client_binary bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/client/golang_boringcrypto_grpc_tls_client_binary go1.20.4 X:boringcrypto,nocoverageredesign (boring crypto) ddelnano@vigenere:~/code/pixie (ddelnano/add-go-boringcrypto-tls-tracing-tests) $ ~/go/bin/goversion -crypto bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/server/golang_boringcrypto_grpc_tls_server_binary bazel-bin/src/stirling/testing/demo_apps/go_grpc_tls_pl/server/golang_boringcrypto_grpc_tls_server_binary go1.20.4 X:boringcrypto,nocoverageredesign (boring crypto) ddelnano@vigenere:~/code/pixie (ddelnano/add-go-boringcrypto-tls-tracing-tests) $ ~/go/bin/goversion -crypto bazel-bin/src/stirling/testing/demo_apps/go_https/client/golang_boringcrypto_client_binary bazel-bin/src/stirling/testing/demo_apps/go_https/client/golang_boringcrypto_client_binary go1.20.4 X:boringcrypto,nocoverageredesign (boring crypto) ddelnano@vigenere:~/code/pixie (ddelnano/add-go-boringcrypto-tls-tracing-tests) $ ~/go/bin/goversion -crypto bazel-bin/src/stirling/testing/demo_apps/go_https/server/golang_boringcrypto_server_binary bazel-bin/src/stirling/testing/demo_apps/go_https/server/golang_boringcrypto_server_binary go1.20.4 X:boringcrypto,nocoverageredesign (boring crypto) ``` </details> --------- Signed-off-by: Dom Del Nano <ddelnano@pixielabs.ai>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
It would be great if stirling were able to decode TLS flows from the 'boringcrypto' versions of Golang.
Stirling would need to be modified to have uprobes for this version of Golang: https://go.googlesource.com/go/+/dev.boringcrypto
This version of Golang is used in order to have FIPS compliant Go programs. We at VMware use it extensively.
Alternatives:
Don't use the boringcrypto version of Golang. This is not an option in cases where one wants to claim FIPS compliance for their Go program.
The text was updated successfully, but these errors were encountered: