Skip to content

Support TLS tracing for Python applications linking libpython #1347

@ddelnano

Description

@ddelnano

While enhancing our TLS tracing to support Python 3.10 and later (#1113), I noticed there is an another type of Python application that Pixie cannot trace today -- python interpreters that link libpython.

This was uncovered when developing the python 3.10 openssl_trace_bpf_test test added in #1338. When using an alpine based python 3.10 docker image, the tests succeeds (as long as the _ex variants have probes attached). However when switching to the rules_docker python base image (built on distroless), the test would fail. This is due to distroless using a python interpreter with --enable-shared which results in libpython${VERSION} containing the OpenSSL symbols as seen below:

# Distroless python links libpython3.10.so.1.0 which contains the openssl symbols. See the second, very long line below
$ sudo ldd /proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/bin/python3
linux-vdso.so.1 (0x00007fffbdf98000)
/proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/bin/../lib/libpython3.10.so.1.0 (0x00007f1ae0b34000)
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f1ae0ae7000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1ae0ae2000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1ae0add000)
libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f1ae0ad6000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f1ae09ef000)
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f1ae09ea000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1ae0600000)
/lib64/ld-linux-x86-64.so.2 (0x00007f1ae2001000)
 
$ sudo objdump -Tt /proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/lib/libpython3.10.so.1.0 \| grep SSL_write
0000000000b670e0 g     F .text  00000000000001c5              SSL_write_early_data
0000000000b67090 g     F .text  0000000000000040              SSL_write
0000000000b670d0 g     F .text  000000000000000f              SSL_write_ex
0000000000b670e0 g    DF .text  00000000000001c5  Base        SSL_write_early_data
0000000000b670d0 g    DF .text  000000000000000f  Base        SSL_write_ex
0000000000b67090 g    DF .text  0000000000000040  Base        SSL_write
 
# Inspecting a python interpreter that can be successfully TLS traced
$ ldd /usr/bin/python3.10
linux-vdso.so.1 (0x00007ffcedfdc000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48c0719000)
libexpat.so.1 => /lib/x86_64-linux-gnu/libexpat.so.1 (0x00007f48c0e8a000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f48c0e6e000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48c0400000)
/lib64/ld-linux-x86-64.so.2 (0x00007f48c0ed0000)

Metadata

Metadata

Assignees

Labels

area/datacollectorIssues related to Stirling (datacollector)triage/acceptedIndicates an issue or PR is ready to be actively worked on.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions