-
Notifications
You must be signed in to change notification settings - Fork 483
Closed
Labels
area/datacollectorIssues related to Stirling (datacollector)Issues related to Stirling (datacollector)triage/acceptedIndicates an issue or PR is ready to be actively worked on.Indicates an issue or PR is ready to be actively worked on.
Description
While enhancing our TLS tracing to support Python 3.10 and later (#1113), I noticed there is an another type of Python application that Pixie cannot trace today -- python interpreters that link libpython.
This was uncovered when developing the python 3.10 openssl_trace_bpf_test test added in #1338. When using an alpine based python 3.10 docker image, the tests succeeds (as long as the _ex variants have probes attached). However when switching to the rules_docker python base image (built on distroless), the test would fail. This is due to distroless using a python interpreter with --enable-shared which results in libpython${VERSION} containing the OpenSSL symbols as seen below:
# Distroless python links libpython3.10.so.1.0 which contains the openssl symbols. See the second, very long line below
$ sudo ldd /proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/bin/python3
linux-vdso.so.1 (0x00007fffbdf98000)
/proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/bin/../lib/libpython3.10.so.1.0 (0x00007f1ae0b34000)
libcrypt.so.1 => /lib/x86_64-linux-gnu/libcrypt.so.1 (0x00007f1ae0ae7000)
libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f1ae0ae2000)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f1ae0add000)
libutil.so.1 => /lib/x86_64-linux-gnu/libutil.so.1 (0x00007f1ae0ad6000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f1ae09ef000)
librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f1ae09ea000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1ae0600000)
/lib64/ld-linux-x86-64.so.2 (0x00007f1ae2001000)
$ sudo objdump -Tt /proc/2081563/root/app/src/stirling/source_connectors/socket_tracer/testing/containers/ssl/python_min_310_https_server.binary.runfiles/python3_10_x86_64-unknown-linux-gnu/lib/libpython3.10.so.1.0 \| grep SSL_write
0000000000b670e0 g F .text 00000000000001c5 SSL_write_early_data
0000000000b67090 g F .text 0000000000000040 SSL_write
0000000000b670d0 g F .text 000000000000000f SSL_write_ex
0000000000b670e0 g DF .text 00000000000001c5 Base SSL_write_early_data
0000000000b670d0 g DF .text 000000000000000f Base SSL_write_ex
0000000000b67090 g DF .text 0000000000000040 Base SSL_write
# Inspecting a python interpreter that can be successfully TLS traced
$ ldd /usr/bin/python3.10
linux-vdso.so.1 (0x00007ffcedfdc000)
libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48c0719000)
libexpat.so.1 => /lib/x86_64-linux-gnu/libexpat.so.1 (0x00007f48c0e8a000)
libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f48c0e6e000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48c0400000)
/lib64/ld-linux-x86-64.so.2 (0x00007f48c0ed0000)
Metadata
Metadata
Assignees
Labels
area/datacollectorIssues related to Stirling (datacollector)Issues related to Stirling (datacollector)triage/acceptedIndicates an issue or PR is ready to be actively worked on.Indicates an issue or PR is ready to be actively worked on.