Skip to content

Commit 80a278e

Browse files
jpinsonneaujpinsonneau
committed
expose openssl feature
1 parent 5b9cf16 commit 80a278e

8 files changed

Lines changed: 55 additions & 6 deletions

File tree

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,8 @@ type FlowCollectorIPFIX struct {
183183
// - `EbpfManager`, to enable using eBPF Manager to manage NetObserv eBPF programs. [Unsupported (*)].<br>
184184
// - `UDNMapping`, to enable interfaces mapping to UDN.<br>
185185
// - `IPSec`, to track flows between nodes with IPsec encryption.<br>
186-
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping";"IPSec"
186+
// - `OpenSSLTracking`, to track SSL/TLS encrypted traffic using OpenSSL uprobes [Technology Preview].<br>
187+
// +kubebuilder:validation:Enum:="PacketDrop";"DNSTracking";"FlowRTT";"NetworkEvents";"PacketTranslation";"EbpfManager";"UDNMapping";"IPSec";"OpenSSLTracking"
187188
type AgentFeature string
188189

189190
const (
@@ -195,6 +196,7 @@ const (
195196
EbpfManager AgentFeature = "EbpfManager"
196197
UDNMapping AgentFeature = "UDNMapping"
197198
IPSec AgentFeature = "IPSec"
199+
OpenSSLTracking AgentFeature = "OpenSSLTracking"
198200
)
199201

200202
// Name of an eBPF agent alert.

‎api/flowcollector/v1beta2/flowcollector_validation_webhook.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,11 @@ var (
2525
CurrentClusterInfo *cluster.Info
2626
needPrivileged = []AgentFeature{UDNMapping, NetworkEvents}
2727
neededOpenShiftVersion = map[AgentFeature]string{
28-
PacketDrop: "4.14.0",
29-
UDNMapping: "4.18.0",
30-
NetworkEvents: "4.19.0",
31-
EbpfManager: "4.19.0",
28+
PacketDrop: "4.14.0",
29+
UDNMapping: "4.18.0",
30+
NetworkEvents: "4.19.0",
31+
EbpfManager: "4.19.0",
32+
OpenSSLTracking: "4.14.0", // Requires uprobe support
3233
}
3334
)
3435

‎api/flowcollector/v1beta2/helper.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,10 @@ func (spec *FlowCollectorEBPF) IsIPSecEnabled() bool {
109109
return spec.IsAgentFeatureEnabled(IPSec)
110110
}
111111

112+
func (spec *FlowCollectorEBPF) IsOpenSSLTrackingEnabled() bool {
113+
return spec.IsAgentFeatureEnabled(OpenSSLTracking)
114+
}
115+
112116
func (spec *FlowCollectorEBPF) IsEBPFMetricsEnabled() bool {
113117
return spec.Metrics.Enable == nil || *spec.Metrics.Enable
114118
}

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1152,6 +1152,7 @@ spec:
11521152
- `EbpfManager`, to enable using eBPF Manager to manage NetObserv eBPF programs. [Unsupported (*)].<br>
11531153
- `UDNMapping`, to enable interfaces mapping to UDN.<br>
11541154
- `IPSec`, to track flows between nodes with IPsec encryption.<br>
1155+
- `OpenSSLTracking`, to track SSL/TLS encrypted traffic using OpenSSL uprobes [Technology Preview].<br>
11551156
enum:
11561157
- PacketDrop
11571158
- DNSTracking
@@ -1161,6 +1162,7 @@ spec:
11611162
- EbpfManager
11621163
- UDNMapping
11631164
- IPSec
1165+
- OpenSSLTracking
11641166
type: string
11651167
type: array
11661168
flowFilter:

‎config/crd/bases/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1078,6 +1078,7 @@ spec:
10781078
- `EbpfManager`, to enable using eBPF Manager to manage NetObserv eBPF programs. [Unsupported (*)].<br>
10791079
- `UDNMapping`, to enable interfaces mapping to UDN.<br>
10801080
- `IPSec`, to track flows between nodes with IPsec encryption.<br>
1081+
- `OpenSSLTracking`, to track SSL/TLS encrypted traffic using OpenSSL uprobes [Technology Preview].<br>
10811082
enum:
10821083
- PacketDrop
10831084
- DNSTracking
@@ -1087,6 +1088,7 @@ spec:
10871088
- EbpfManager
10881089
- UDNMapping
10891090
- IPSec
1091+
- OpenSSLTracking
10901092
type: string
10911093
type: array
10921094
flowFilter:

‎helm/crds/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1082,6 +1082,7 @@ spec:
10821082
- `EbpfManager`, to enable using eBPF Manager to manage NetObserv eBPF programs. [Unsupported (*)].<br>
10831083
- `UDNMapping`, to enable interfaces mapping to UDN.<br>
10841084
- `IPSec`, to track flows between nodes with IPsec encryption.<br>
1085+
- `OpenSSLTracking`, to track SSL/TLS encrypted traffic using OpenSSL uprobes [Technology Preview].<br>
10851086
enum:
10861087
- PacketDrop
10871088
- DNSTracking
@@ -1091,6 +1092,7 @@ spec:
10911092
- EbpfManager
10921093
- UDNMapping
10931094
- IPSec
1095+
- OpenSSLTracking
10941096
type: string
10951097
type: array
10961098
flowFilter:

‎internal/controller/ebpf/agent_controller.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ const (
7272
envEnableEbpfMgr = "EBPF_PROGRAM_MANAGER_MODE"
7373
envEnableUDNMapping = "ENABLE_UDN_MAPPING"
7474
envEnableIPsec = "ENABLE_IPSEC_TRACKING"
75+
envEnableOpenSSLTracking = "ENABLE_OPENSSL_TRACKING"
76+
envOpenSSLPath = "OPENSSL_PATH"
7577
envDNSTrackingPort = "DNS_TRACKING_PORT"
7678
envPreferredInterface = "PREFERRED_INTERFACE_FOR_MAC_PREFIX"
7779
envAttachMode = "TC_ATTACH_MODE"
@@ -100,6 +102,7 @@ const (
100102

101103
const (
102104
defaultDNSTrackingPort = "53"
105+
defaultOpenSSLPath = "/usr/lib64/libssl.so.3"
103106
bpfmanMapsVolumeName = "bpfman-maps"
104107
bpfManBpfFSPath = "/run/netobserv/maps"
105108
)
@@ -762,6 +765,13 @@ func getEnvConfig(coll *flowslatest.FlowCollector, cinfo *cluster.Info) []corev1
762765
})
763766
}
764767

768+
if coll.Spec.Agent.EBPF.IsOpenSSLTrackingEnabled() {
769+
config = append(config, corev1.EnvVar{
770+
Name: envEnableOpenSSLTracking,
771+
Value: "true",
772+
})
773+
}
774+
765775
if coll.Spec.Agent.EBPF.IsEBPFMetricsEnabled() {
766776
config = append(config, corev1.EnvVar{
767777
Name: envEnableMetrics,
@@ -810,6 +820,7 @@ func getEnvConfig(coll *flowslatest.FlowCollector, cinfo *cluster.Info) []corev1
810820
envNetworkEventsGroupID: defaultNetworkEventsGroupID,
811821
envPreferredInterface: defaultPreferredInterface,
812822
envAttachMode: defaultAttach,
823+
envOpenSSLPath: defaultOpenSSLPath,
813824
}
814825
advancedConfig := helper.GetAdvancedAgentConfig(coll.Spec.Agent.EBPF.Advanced)
815826
moreConfig := helper.BuildEnvFromDefaults(advancedConfig.Env, defaults)

‎internal/controller/ebpf/bpfmanager-controller.go‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,8 @@ func (c *AgentController) bpfmanAttachNetobserv(ctx context.Context, fc *flowsla
6161
func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *flowslatest.FlowCollector, netobservBCImage string) {
6262
samplingValue := make([]byte, 4)
6363
dnsPortValue := make([]byte, 2)
64-
var enableDNSValue, enableRTTValue, enableFLowFilterValue, enableNetworkEvents, traceValue, networkEventsGroupIDValue, enablePktTranslation, enableIPSecValue []byte
64+
var enableDNSValue, enableRTTValue, enableFLowFilterValue, enableNetworkEvents, traceValue, networkEventsGroupIDValue, enablePktTranslation, enableIPSecValue, enableOpenSSLValue []byte
65+
openSSLPath := defaultOpenSSLPath
6566

6667
binary.NativeEndian.PutUint32(samplingValue, uint32(*fc.Spec.Agent.EBPF.Sampling))
6768

@@ -93,6 +94,10 @@ func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *f
9394
enableIPSecValue = append(enableIPSecValue, uint8(1))
9495
}
9596

97+
if fc.Spec.Agent.EBPF.IsOpenSSLTrackingEnabled() {
98+
enableOpenSSLValue = append(enableOpenSSLValue, uint8(1))
99+
}
100+
96101
bpfApp.Labels = map[string]string{
97102
"app": netobservApp,
98103
}
@@ -105,6 +110,8 @@ func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *f
105110
dnsPortValue = []byte(v)
106111
} else if k == envNetworkEventsGroupID {
107112
networkEventsGroupIDValue = []byte(v)
113+
} else if k == envOpenSSLPath {
114+
openSSLPath = v
108115
}
109116
}
110117

@@ -124,6 +131,7 @@ func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *f
124131
"network_events_monitoring_groupid": networkEventsGroupIDValue,
125132
"enable_pkt_translation_tracking": enablePktTranslation,
126133
"enable_ipsec": enableIPSecValue,
134+
"enable_openssl_tracking": enableOpenSSLValue,
127135
}
128136

129137
bpfApp.Spec.BpfAppCommon.ByteCode = bpfmaniov1alpha1.ByteCodeSelector{
@@ -286,6 +294,23 @@ func prepareBpfApplication(bpfApp *bpfmaniov1alpha1.ClusterBpfApplication, fc *f
286294
},
287295
}...)
288296
}
297+
298+
if fc.Spec.Agent.EBPF.IsOpenSSLTrackingEnabled() {
299+
bpfApp.Spec.Programs = append(bpfApp.Spec.Programs, []bpfmaniov1alpha1.ClBpfApplicationProgram{
300+
{
301+
Name: "probe_entry_SSL_write",
302+
Type: bpfmaniov1alpha1.ProgTypeUprobe,
303+
UProbe: &bpfmaniov1alpha1.ClUprobeProgramInfo{
304+
Links: []bpfmaniov1alpha1.ClUprobeAttachInfo{
305+
{
306+
Target: openSSLPath,
307+
Function: "SSL_write",
308+
},
309+
},
310+
},
311+
},
312+
}...)
313+
}
289314
}
290315

291316
func (c *AgentController) createBpfApplication(ctx context.Context, bpfApp *bpfmaniov1alpha1.ClusterBpfApplication) error {

0 commit comments

Comments
 (0)