Initial implementation for user space uprobe for Open SSL #819
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
msherif1234
force-pushed
the
dev_ssl
branch
20 times, most recently
from
f5957da to
b833299
Compare
msherif1234
force-pushed
the
dev_ssl
branch
3 times, most recently
from
94c8a6a to
00fd511
Compare
jotak
reviewed
Nov 3, 2025
bpf/configs.h
Outdated
| volatile const u8 network_events_monitoring_groupid = 0; | ||
| volatile const u8 enable_pkt_translation_tracking = 0; | ||
| volatile const u8 enable_ipsec = 0; | ||
| volatile const u8 enable_ssl = 0; |
Member
There was a problem hiding this comment.
maybe more specific "enable_openssl" to leave space for other implementations and also to remove any ambiguity as I'll also add something like "enable_tls_tracker" ?
Member
|
@msherif1234 since there is no correlation with flows, I wonder if it's really something we want to send to FLP, or if just having something build-in (in the agent) to extract HTTP info and produce prometheus metrics, would be good enough? The other use-case is to use specifically with the CLI/pcap |
Contributor
Author
maybe for starter we can go with metrics maybe we can discuss this or collaborate together here I did rename the config |
github-actions
bot
removed
the
ok-to-test
Contributor
Author
|
/ok-to-test |
openshift-ci
bot
added
the
ok-to-test
|
New images: These will expire after two weeks. To deploy this build, run from the operator repo, assuming the operator is running: USER=netobserv VERSION=486fe96 make set-agent-image |
github-actions
bot
removed
the
ok-to-test
Contributor
|
Hey @msherif1234, I took the opportunity to improve the script when testing on openshift: Deploy the agents and collectors using: Run your test SSL script (improved): That seems to work fine 👌 Let me know if you see any issues in the results or if you want me to run something else. Thanks ! |
Contributor
Author
Thanks @jpinsonneau were able to check the dash board metrics ? if so can pls include some pic here ? |
Contributor
Oh I don't have it here as I only deployed the agent + collector. Let me deploy netobserv and check 😉 |
Contributor
Author
Thank you!!, also if u have a min pls run |
Contributor
|
@msherif1234 I capture some events and those are reported to the metrics. However, I only see openssl_type="0". Is it expected ? |
Contributor
Author
were u running the test script during this collection or those was just default flows ? |
Contributor
yes that's with the test script running multiple times |
Contributor
Author
|
this is are the expected types so means its SSL connection type |
jotak
reviewed
Dec 2, 2025
scripts/generators.Dockerfile
Outdated
| @@ -1,4 +1,4 @@ | |||
| FROM fedora:42 | |||
| FROM fedora:40 | |||
Contributor
Author
There was a problem hiding this comment.
so I can build on Mac, for some reason I can't run 42 , will try again and share the error I got
- LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 36)
- LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 26)
- LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 28)
docker run --privileged --rm -v /Users/mmahmoud/go/src/netobserv-ebpf-agent:/src ebpf-generator:latest
WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested
/bin/sh: line 1: which: command not found
basename: missing operand
Try 'basename --help' for more information.
basename: missing operand
Try 'basename --help' for more information.
### Checking if prerequisites are met, and installing missing dependencies
github.com/cilium/ebpf/asm: /go/pkg/tool/linux_amd64/compile: signal: segmentation fault
### Generating BPF Go bindings
pkg/ebpf/gen.go:4: running "bpf2go": exec: "bpf2go": executable file not found in $PATH
make: *** [Makefile:135: gen-bpf] Error 1
make: *** [docker-generate] Error 2
I will revert this and I keep it locally
jotak
reviewed
Dec 2, 2025
| # Build the manager binary | ||
| FROM docker.io/library/golang:1.24 as builder | ||
|
|
||
| ARG TARGETARCH |
Member
There was a problem hiding this comment.
this must not be removed, it's used in the line below:
RUN CGO_ENABLED=0 GOARCH=$TARGETARCH go build
Contributor
Author
There was a problem hiding this comment.
hmm that I don't remember why will revert as well and if needed I will keep it locally
Member
There was a problem hiding this comment.
maybe when running from mac you need to pass explicitly MULTIARCH_TARGETS=arm64
Member
There was a problem hiding this comment.
perhaps that's also what make you have different bytecode than the CI (and hence get it rejected)
Contributor
Author
There was a problem hiding this comment.
I don't think that option is there for make docker-generate
….8.0-crc0 (#590) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: Mohamed S. Mahmoud <[email protected]>
Signed-off-by: Mohamed S. Mahmoud <[email protected]>
Signed-off-by: Mohamed S. Mahmoud <[email protected]>
scratch pad Signed-off-by: Mohamed S. Mahmoud <[email protected]>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@msherif1234: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds support to probe/uretprobe to track openSSL write function call to read the packets before being encrypted and generate events using ringbuffer to userspace
I was able to bring up ebpf agent with SSL_enable on kind cluster
Dependencies
n/a
Checklist
If you are not familiar with our processes or don't know what to answer in the list below, let us know in a comment: the maintainers will take care of that.
To run a perfscale test, comment with:
/test ebpf-node-density-heavy-25nodes