Keylog capture not working with OpenSSL 1.1.0

[AmazingPP]

Describe the bug

When using the ecapture tool with OpenSSL 1.1.0 to capture keylog data with the -m keylog option, no output is generated.

To Reproduce

Steps to reproduce the behavior:


1. Clone the ecapture repository using git clone https://github.com/gojue/ecapture.git
2. Compile OpenSSL 1.1.0a from source and install it in /opt/openssl
3. Compile curl with the provided OpenSSL 1.1.0 library
4. Start ecapture in text mode to capture TLS traffic using sudo ./bin/ecapture tls --libssl=/opt/openssl/lib/libssl.so.1.1
5. Initiate an HTTPS request using a tool compiled against the same OpenSSL 1.1.0 library (e.g., curl)
6. Observe that the decrypted TLS traffic is correctly captured and displayed
7. Stop the ecapture process
8. Attempt to capture keylog data using sudo ./bin/ecapture tls -m keylog -k ecapture.txt --libssl=/opt/openssl/lib/libssl.so.1.1
9. No output is generated in the ecapture.txt file
   

Expected behavior

When using the -m keylog option with OpenSSL 1.1.0, ecapture should capture and output keylog data to the specified file (ecapture.txt in this case).


Screenshots

I cannot provide screenshots directly, but here is the relevant output from the terminal:


$ sudo ./bin/ecapture tls --libssl=/opt/openssl/lib/libssl.so.1.1
# ... TLS decryption output ...

$ sudo ./bin/ecapture tls -m keylog -k ecapture.txt --libssl=/opt/openssl/lib/libssl.so.1.1
# No output in ecapture.txt


Linux Server:


• OS: Ubuntu 20.04.6 LTS
• Arch: x86_64
• Kernel Version: 5.4.0-176-generic
• Version: a8acece
  

Additional context

This issue seems to be specific to the OpenSSL 1.1.0 version. I have tried reproducing this issue on multiple Linux distributions and kernel versions, and the behavior is consistent with OpenSSL 1.1.0. It seems that the keylog capture functionality is not working as expected with this particular OpenSSL version, despite TLS decryption working correctly. I would appreciate if this issue could be investigated and resolved for OpenSSL 1.1.0 compatibility.

[AmazingPP]

The issue seems to be related to the incorrect assignment of the OpenSSL offset for OpenSSL 1.1.0 in the probe_openssl_lib.go file.

ecapture/user/module/probe_openssl_lib.go

Line 107 in a8acece

m.sslVersionBpfMap["openssl 1.1.0"+string(ch)] = "openssl_1_1_1a_kern.o"

After correcting the file assignment, the keylog capture starts working, but the captured data appears to be incorrect.

[cfc4n]

Can text mode work?

[AmazingPP]

Can text mode work?

Yes, the text mode works normally.