Repository: gojue/ecapture
File: kern/openssl.h (C/C++)

Code before:
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    // get fd ssl->rbio->num
    ssl_rbio_num_ptr = (u64 *)(ssl_rbio_addr + BIO_ST_NUM);
    ret = bpf_probe_read_user(&ssl_rbio_num_addr, sizeof(ssl_rbio_num_addr),
                              ssl_rbio_num_ptr);
    if (ret) {
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_num_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    // get ssl->bio->method
    ssl_rbio_method_ptr = (u64 *)(ssl_rbio_addr + BIO_ST_METHOD);
    ret = bpf_probe_read_user(&ssl_rbio_method_addr, sizeof(ssl_rbio_method_addr),
                              ssl_rbio_method_ptr);
    if (ret) {
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_method_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    // get ssl->bio->method->type
    u32 bio_type;
    ssl_rbio_method_type_ptr = (u64 *)(ssl_rbio_method_addr + BIO_METHOD_ST_TYPE);
    ret = bpf_probe_read_user(&bio_type, sizeof(bio_type),
                              ssl_rbio_method_type_ptr);
    if (ret) {
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_method_type_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    debug_bpf_printk("openssl uprobe/SSL_read bio_type: %d\n", bio_type);

    u32 fd = (u32)ssl_rbio_num_addr;
    if (fd == 0) {
        u64 ssl_addr = (u64)ssl;
        u64 *fd_ptr = bpf_map_lookup_elem(&ssl_st_fd, &ssl_addr);
        if (fd_ptr) {
            fd = (u64)*fd_ptr;
        } else {
        }
    }

Review comment (suggestion):
If the `method` and `type` of the BIO are not required, then I think it is possible to continue with the following process instead of returning 0.

Code after:
            "(OPENSSL) bpf_probe_read ssl_ver_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    ssl_rbio_ptr = (u64 *)(ssl + SSL_ST_RBIO);
    ret = bpf_probe_read_user(&ssl_rbio_addr, sizeof(ssl_rbio_addr),
                              ssl_rbio_ptr);
    if (ret) {
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_ptr failed, ret: %d\n",
            ret);
        return 0;
    }

    // get ssl->bio->method->type
    u32 bio_type = process_BIO_type(ssl_rbio_addr);

    // get fd ssl->rbio->num
    ssl_rbio_num_ptr = (u64 *)(ssl_rbio_addr + BIO_ST_NUM);
    ret = bpf_probe_read_user(&ssl_rbio_num_addr, sizeof(ssl_rbio_num_addr),
                              ssl_rbio_num_ptr);
    if (ret) {
        debug_bpf_printk(
            "(OPENSSL) bpf_probe_read ssl_rbio_num_ptr failed, ret: %d\n",
            ret);
        return 0;
    }
    u32 fd = (u32)ssl_rbio_num_addr;
    if (fd == 0) {
        u64 ssl_addr = (u64)ssl;
        u64 *fd_ptr = bpf_map_lookup_elem(&ssl_st_fd, &ssl_addr);
        if (fd_ptr) {
            fd = (u64)*fd_ptr;
        } else {
        }
    }
    debug_bpf_printk("openssl uprobe/SSL_read fd: %d, version: %d\n", fd, ssl_version);

    const char* buf = (const char*)PT_REGS_PARM2(ctx);
    struct active_ssl_buf active_ssl_buf_t;
    __builtin_memset(&active_ssl_buf_t, 0, sizeof(active_ssl_buf_t));
    active_ssl_buf_t.fd = fd;
    active_ssl_buf_t.version = ssl_version;
    active_ssl_buf_t.buf = buf;
    active_ssl_buf_t.bio_type = bio_type;
    bpf_map_update_elem(&active_ssl_read_args_map, &current_pid_tgid,
                        &active_ssl_buf_t, BPF_ANY);
    return 0;
}