tls

package
v0.0.0-...-c684d4a Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 2, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Index

Constants

View Source
const (
	EncodingGZip    = "gzip"
	EncodingDeflate = "deflate"
	EncodingZstd    = "zstd"
)
View Source
const (
	HTTP1DelimiterLen = 4
	CRLFLen           = 2
)
View Source
const (
	HTTP2FrameHeaderLen = 9
	HTTP2FrameMaxCode   = 0x9
	HTTP2FlagsMask      = 0x1 | 0x4 | 0x8 | 0x20
)
View Source
const (
	// SSL
	SSLMaxEventSize = 64 * 1024            // 64 KiB
	SSLMaxDataSize  = 64 * SSLMaxEventSize // 4 MiB
	SSLRwRead       = 4
	SSLRwWrite      = 2

	// HTTP
	ChunkedEncodingValue = "chunked"
	StreamEndChunkLength = uint64(len("0")) + 2*CRLFLen // "0\r\n\r\n"

	// Postgres
	PostgresStartupMessageMaxLength = 4096
)
View Source
const PostgresProtoRequest string = "Postgres"

Variables

View Source
var (
	// HTTP
	CRLF                = []byte("\r\n")
	HTTP1Delimiter      = []byte("\r\n\r\n")
	HTTP1ChunkEnd       = []byte("0\r\n\r\n")
	HTTP1ResponsePrefix = []byte("HTTP/")
	HTTP1RequestMethods = [][]byte{
		[]byte("GET"),
		[]byte("POST"),
		[]byte("PUT"),
		[]byte("DELETE"),
		[]byte("HEAD"),
		[]byte("OPTIONS"),
		[]byte("PATCH"),
		[]byte("TRACE"),
		[]byte("CONNECT"),
	}
	HTTP2Preface    = []byte("PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n")
	HTTP2PrefaceLen = len(HTTP2Preface)
	HeaderAPIKeys   = []string{
		"Authorization",
		"X-API-Key",
		"X-Auth-Token",
		"X-Access-Token",
		"X-Session-Token",
		"Cookie",
	}
	HeaderTokenSecret = []byte("tensorchord-watchu-sslsniff-mask-secret-c0ffee")
)

Functions

This section is empty.

Types

type BoringSSLProbe

type BoringSSLProbe struct {
	// contains filtered or unexported fields
}

func NewBoringSSLProbe

func NewBoringSSLProbe(path string) (*BoringSSLProbe, error)

func (*BoringSSLProbe) Close

func (bp *BoringSSLProbe) Close() error

func (*BoringSSLProbe) ReadBuffer

func (bp *BoringSSLProbe) ReadBuffer(record *ringbuf.Record) error

type EventInfo

type EventInfo struct {
	TimestampNs uint64
	DataLen     uint64
	Comm        [16]int8
}

type HTTP1Parser

type HTTP1Parser struct{}

func (*HTTP1Parser) ParseRequest

func (h1 *HTTP1Parser) ParseRequest(record *SSLRecord) (*ParsedRequest, int, error)

HTTP/1 parsing assumes a single in-flight request/response pair per TLS connection. HTTP/1.1 pipelining is intentionally unsupported.

func (*HTTP1Parser) ParseResponse

func (h1 *HTTP1Parser) ParseResponse(record *SSLRecord) (*ParsedResponse, int, error)

HTTP/1 parsing assumes a single in-flight request/response pair per TLS connection. HTTP/1.1 pipelining is intentionally unsupported.

type HTTP2ParsedMessage

type HTTP2ParsedMessage struct {
	StreamID uint32
	Headers  []hpack.HeaderField
	Body     []byte
	Canceled bool
}

type HTTP2Parser

type HTTP2Parser struct{}

func (*HTTP2Parser) ParseRequest

func (h2 *HTTP2Parser) ParseRequest(record *SSLRecord) (*ParsedRequest, int, error)

func (*HTTP2Parser) ParseResponse

func (h2 *HTTP2Parser) ParseResponse(record *SSLRecord) (*ParsedResponse, int, error)

type HTTP2State

type HTTP2State struct {
	PrefaceConsumed bool
	Decoder         *hpack.Decoder // HPACK dynamic tables are scoped to one HTTP/2 connection direction.
	HeaderStreamID  uint32
	HeaderBlockBuf  []byte
	Streams         map[uint32]*HTTP2StreamState
}

type HTTP2StreamState

type HTTP2StreamState struct {
	HeadersReady bool
	Ended        bool
	Headers      []hpack.HeaderField
	Body         bytes.Buffer
}

type OpenSSLProbe

type OpenSSLProbe struct {
	// contains filtered or unexported fields
}

func NewOpenSSLProbe

func NewOpenSSLProbe(sslPath string) (*OpenSSLProbe, error)

func (*OpenSSLProbe) Close

func (op *OpenSSLProbe) Close() error

func (*OpenSSLProbe) ReadBuffer

func (op *OpenSSLProbe) ReadBuffer(record *ringbuf.Record) error

type ParsedRequest

type ParsedRequest struct {
	StreamID uint32
	Request  *http.Request
}

type ParsedResponse

type ParsedResponse struct {
	StreamID      uint32
	Response      *http.Response
	DiscardStream bool
}

type PostgresParser

type PostgresParser struct{}

func (*PostgresParser) ParseRequest

func (pp *PostgresParser) ParseRequest(record *SSLRecord) (*ParsedRequest, int, error)

func (*PostgresParser) ParseResponse

func (pp *PostgresParser) ParseResponse(record *SSLRecord) (*ParsedResponse, int, error)

type ProtocolParser

type ProtocolParser interface {
	ParseRequest(record *SSLRecord) (*ParsedRequest, int, error)
	ParseResponse(record *SSLRecord) (*ParsedResponse, int, error)
}

type ProtocolType

type ProtocolType int
const (
	ProtocolHTTP1 ProtocolType = iota
	ProtocolHTTP2
	ProtocolPostgres
	ProtocolUnknown
)

type SSLKey

type SSLKey struct {
	PidTgid  uint64
	UidGid   uint64
	SSLPtr   uint64
	CgroupID uint64
}

type SSLRecord

type SSLRecord struct {
	Info        []*EventInfo
	Stream      []uint8
	LastResp    *http.Response
	EndOfStream bool
	HTTP2       *HTTP2State
	LastTouched time.Time
}

func (*SSLRecord) Append

func (r *SSLRecord) Append(data []uint8, info *EventInfo)

type SSLStore

type SSLStore struct {
	Request  map[SSLKey]*SSLRecord
	Response map[SSLKey]*SSLRecord
	// contains filtered or unexported fields
}

func NewSSLStore

func NewSSLStore() *SSLStore

func (*SSLStore) Add

func (s *SSLStore) Add(event *sslEvent)

func (*SSLStore) Parse

func (s *SSLStore) Parse(ctx context.Context, reqChan chan *export.RawRequest, respChan chan *export.RawResponse, postgresChan chan *export.RawPostgres)

type SessionScope

type SessionScope struct {
	Conn     SSLKey
	StreamID uint32
}

type TLSPlaintextProbe

type TLSPlaintextProbe interface {
	ReadBuffer(*ringbuf.Record) error
	Close() error
}

type TLSProbe

type TLSProbe struct {
	// contains filtered or unexported fields
}

func NewTLSProbe

func NewTLSProbe(procProbe *execve.ProcExecProbe, sslPath *string, exporter *export.Exporter) *TLSProbe

func (*TLSProbe) Close

func (sp *TLSProbe) Close()

func (*TLSProbe) Start

func (sp *TLSProbe) Start(ctx context.Context)

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL