https posts请求body抓包缺失

[yzx-fish]

在5.15.0-136-generic #147~20.04.1-Ubuntu SMP Wed Mar 19 16:13:14 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux 上测试， 存在无法抓取https请求的body

1. curl 'https://baidu.com/aaaaaaa?a=1&b=22' -d 'aaaaaaaaaaaaaaaaa' 请求时， 抓包正常

2025-04-16T15:49:36+08:00 ??? UUID:17274_17274_curl_5_1_172.19.145.179:32968-110.242.68.66:443, Name:HTTPRequest, Type:1, Length:176
POST /aaaaaaa?a=1&b=22 HTTP/1.1
Host: baidu.com
Accept: */*
Content-Length: 17
Content-Type: application/x-www-form-urlencoded
User-Agent: curl/7.68.0

aaaaaaaaaaaaaaaaa

2. curl请求body >1024时，发现无法抓取body

curl 'https://baidu.com/aaaaaaa?a=1&b=22'  -d 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'

2025-04-16T15:50:12+08:00 ??? UUID:17283_17283_curl_5_1_172.19.145.179:47154-110.242.68.66:443, Name:HTTPRequest, Type:1, Length:183
POST /aaaaaaa?a=1&b=22 HTTP/1.1
Host: baidu.com
Accept: */*
Content-Length: 1025
Content-Type: application/x-www-form-urlencoded
Expect: 100-continue
User-Agent: curl/7.68.0

[dosubot]

Hello @yzx-fish! 👋 I'm Dosu, a bot here to help you solve bugs, answer questions, and assist you in becoming a contributor. While you wait for a human maintainer, feel free to let me know how I can assist you! 🚀

在 ecapture 中，HTTP 请求体的抓包可能会受到数据片段大小限制的影响。根据现有信息，ecapture 的 MaxDataSize 常量设置为 16,384 字节（16 KB），这意味着最大可捕获的数据大小限制为 16 KB ^[1]。如果请求体超过此大小，可能会导致无法完整抓取。

此外，当捕获 SSL 流量时，数据片段大于 MAX_DATA_SIZE_OPENSSL（4KB）时会被截断，导致输出不完整。要处理更大的 SSL 数据，可以在源代码中修改以下常量，将缓冲区大小增加到 16KB，以匹配 TLS 规范的最大片段大小：

1. 在 kern/common.h 中，将 #define MAX_DATA_SIZE_OPENSSL 1024 * 4 改为 #define MAX_DATA_SIZE_OPENSSL 1024 * 16。
2. 在 user/event/event_openssl.go 中，将 const MaxDataSize = 1024 * 4 改为 const MaxDataSize = 1024 * 16 ^[2]。

这些更改将允许完整捕获更大的 SSL 数据传输。请注意，修改源代码需要重新编译 ecapture。

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[yzx-fish]

body的大小是1024字节， 没有超过这2个限制

[cfc4n]

先用 pcapng模式代替，晚点我看下这个问题。

[chilli13]

@yzx-fish Ubuntu 22.04.5 LTS kernel 5.15.0-136-generic 工作正常，请提供下 ./bin/ecapture tls -d 的完成输出

# ./bin/ecapture tls -d
2025-04-24T01:08:52Z INF AppName="eCapture(旁观者)"
2025-04-24T01:08:52Z INF HomePage=https://ecapture.cc
2025-04-24T01:08:52Z INF Repository=https://github.com/gojue/ecapture
2025-04-24T01:08:52Z INF Author="CFC4N <cfc4ncs@gmail.com>"
2025-04-24T01:08:52Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2025-04-24T01:08:52Z INF Version=linux_amd64:v1.0.1-20250417-3d59134:5.15.0-136-generic
2025-04-24T01:08:52Z INF Listen=localhost:28256
2025-04-24T01:08:52Z INF eCapture running logs logger=
2025-04-24T01:08:52Z INF the file handler that receives the captured event eventCollector=
2025-04-24T01:08:52Z INF Kernel Info=5.15.178 Pid=38750
2025-04-24T01:08:52Z INF TruncateSize=0 Unit=bytes
2025-04-24T01:08:52Z INF BTF bytecode mode: CORE. btfMode=0
2025-04-24T01:08:52Z INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2025-04-24T01:08:52Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2025-04-24T01:08:52Z INF Module.Run()
2025-04-24T01:08:52Z WRN OpenSSL/BoringSSL version not found. error="OpenSSL/BoringSSL version not found" soPath=/usr/lib/x86_64-linux-gnu/libssl.so.3
2025-04-24T01:08:52Z WRN Try to detect libcrypto.so.3. If you have doubts, See https://github.com/gojue/ecapture/discussions/675 for more information.
2025-04-24T01:08:52Z INF Try to detect imported libcrypto.so  imported=libcrypto.so.3 soPath=/usr/lib/x86_64-linux-gnu/libcrypto.so.3
2025-04-24T01:08:52Z INF origin versionKey="openssl 3.0.2" versionKeyLower="openssl 3.0.2"
2025-04-24T01:08:52Z INF OpenSSL/BoringSSL version found Android=false library version="openssl 3.0.2"
2025-04-24T01:08:52Z INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib/x86_64-linux-gnu/libssl.so.3
2025-04-24T01:08:52Z INF target all process.
2025-04-24T01:08:52Z INF target all users.
2025-04-24T01:08:52Z INF setupManagers eBPFProgramType=Text
2025-04-24T01:08:52Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_0_0_kern_core.o
2025-04-24T01:08:52Z INF listen=localhost:28256
2025-04-24T01:08:52Z INF https server starting...You can upgrade the configuration file via the HTTP interface.
2025-04-24T01:08:52Z DBG upgrade check failed: local version is ahead of latest version
2025-04-24T01:08:53Z INF perfEventReader created mapSize(MB)=4
2025-04-24T01:08:53Z INF perfEventReader created mapSize(MB)=4
2025-04-24T01:08:53Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
2025-04-24T01:08:54Z DBG AddConn success fd=5 pid=38761 sock=18446635720549848960 tuple=192.168.10.122:46928-39.156.66.10:443
2025-04-24T01:08:54Z DBG GetConn fd=5 pid=38761
2025-04-24T01:08:54Z DBG SSLDataEvent bio_type=1285 fd=5 pid=38761 tuple=192.168.10.122:46928-39.156.66.10:443
2025-04-24T01:08:54Z DBG GetConn fd=5 pid=38761
2025-04-24T01:08:54Z DBG SSLDataEvent bio_type=1285 fd=5 pid=38761 tuple=192.168.10.122:46928-39.156.66.10:443
2025-04-24T01:08:56Z ??? UUID:38761_38761_curl_5_1_192.168.10.122:46928-39.156.66.10:443, Name:HTTPRequest, Type:1, Length:1186
POST /aaaaaaa?a=1&b=22 HTTP/1.1
Host: baidu.com
Accept: */*
Content-Length: 1025
Content-Type: application/x-www-form-urlencoded
User-Agent: curl/7.81.0

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
2025-04-24T01:08:56Z ??? UUID:38761_38761_curl_5_0_192.168.10.122:46928-39.156.66.10:443, Name:HTTPResponse, Type:3, Length:373
HTTP/1.1 302 Moved Temporarily
Content-Length: 161
Connection: keep-alive
Content-Type: text/html
Date: Thu, 24 Apr 2025 01:08:54 GMT
Location: http://www.baidu.com/aaaaaaa?a=1&b=22
Server: bfe/1.0.8.18

<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
<hr><center>bfe/1.0.8.18</center>
</body>
</html>

2025-04-24T01:08:57Z DBG DestroyConn success fd=5 pid=38761 sock=18446635720549848960 tuple=192.168.10.122:46928-39.156.66.10:443

[cfc4n]

ping @yzx-fish