Home

Awesome

openssl-hook

When debugging network applications it's common to look at the data being sent to and from the application, using tools like e.g., tcpdump or wireshark.

When that data is sent over TLS, it's often times harder to use these tools due to the private keys for the TLS sessions not being available to the person doing the debugging.

A commonly used library for sending data over TLS is OpenSSL.

openssl-hook uses LD_PRELOAD to hook the OpenSSL functions SSL_read and SSL_write and writes the read/written data to disk for later inspection. This can be used to debug network applications sending/receiving data using a dynamically linked OpenSSL library.

The logged data is written to hooklog.bin in the current working directory. The file format is platform-dependent.

Any encountered errors in the hook code gets written to stderr. Hook errors causes application termination.

Example

using a POSIX shell and socat:

$ make
cc -Wall -Werror -g -fPIC -shared -o hook.so.1 hook.c -lc
cc -Wall -Werror -g -o print-hooklog print-hooklog.c -lc
$ printf 'GET / HTTP/1.1\r\nHost: www.google.com\r\n\r\n' | \
	LD_PRELOAD=`pwd`/hook.so.1 \
	socat stdio openssl-connect:www.google.com:443
[...]
$ ./print-hooklog hooklog.bin
write - 192.168.0.8 39808 -> 83.255.235.89 443
00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
00000010  48 6f 73 74 3a 20 77 77  77 2e 67 6f 6f 67 6c 65  |Host: www.google|
00000020  2e 63 6f 6d 0d 0a 0d 0a                           |.com....|
00000028

read  - 83.255.235.89 443 -> 192.168.0.8 39808
00000000  48 54 54 50 2f 31 2e 31  20 33 30 32 20 46 6f 75  |HTTP/1.1 302 Fou|
00000010  6e 64 0d 0a 43 61 63 68  65 2d 43 6f 6e 74 72 6f  |nd..Cache-Contro|
00000020  6c 3a 20 70 72 69 76 61  74 65 0d 0a 43 6f 6e 74  |l: private..Cont|
00000030  65 6e 74 2d 54 79 70 65  3a 20 74 65 78 74 2f 68  |ent-Type: text/h|
00000040  74 6d 6c 3b 20 63 68 61  72 73 65 74 3d 55 54 46  |tml; charset=UTF|
00000050  2d 38 0d 0a 4c 6f 63 61  74 69 6f 6e 3a 20 68 74  |-8..Location: ht|
00000060  74 70 73 3a 2f 2f 77 77  77 2e 67 6f 6f 67 6c 65  |tps://www.google|
00000070  2e 73 65 2f 3f 67 66 65  5f 72 64 3d 63 72 26 65  |.se/?gfe_rd=cr&e|
00000080  69 3d 64 4b 71 51 56 70  47 67 47 49 71 41 38 51  |i=dKqQVpGgGIqA8Q|
00000090  66 6c 6c 71 61 41 42 51  0d 0a 43 6f 6e 74 65 6e  |fllqaABQ..Conten|
000000a0  74 2d 4c 65 6e 67 74 68  3a 20 32 35 39 0d 0a 44  |t-Length: 259..D|
000000b0  61 74 65 3a 20 53 61 74  2c 20 30 39 20 4a 61 6e  |ate: Sat, 09 Jan|
000000c0  20 32 30 31 36 20 30 36  3a 33 36 3a 33 36 20 47  | 2016 06:36:36 G|
000000d0  4d 54 0d 0a 53 65 72 76  65 72 3a 20 47 46 45 2f  |MT..Server: GFE/|
000000e0  32 2e 30 0d 0a 0d 0a 3c  48 54 4d 4c 3e 3c 48 45  |2.0....<HTML><HE|
000000f0  41 44 3e 3c 6d 65 74 61  20 68 74 74 70 2d 65 71  |AD><meta http-eq|
00000100  75 69 76 3d 22 63 6f 6e  74 65 6e 74 2d 74 79 70  |uiv="content-typ|
00000110  65 22 20 63 6f 6e 74 65  6e 74 3d 22 74 65 78 74  |e" content="text|
00000120  2f 68 74 6d 6c 3b 63 68  61 72 73 65 74 3d 75 74  |/html;charset=ut|
00000130  66 2d 38 22 3e 0a 3c 54  49 54 4c 45 3e 33 30 32  |f-8">.<TITLE>302|
00000140  20 4d 6f 76 65 64 3c 2f  54 49 54 4c 45 3e 3c 2f  | Moved</TITLE></|
00000150  48 45 41 44 3e 3c 42 4f  44 59 3e 0a 3c 48 31 3e  |HEAD><BODY>.<H1>|
00000160  33 30 32 20 4d 6f 76 65  64 3c 2f 48 31 3e 0a 54  |302 Moved</H1>.T|
00000170  68 65 20 64 6f 63 75 6d  65 6e 74 20 68 61 73 20  |he document has |
00000180  6d 6f 76 65 64 0a 3c 41  20 48 52 45 46 3d 22 68  |moved.<A HREF="h|
00000190  74 74 70 73 3a 2f 2f 77  77 77 2e 67 6f 6f 67 6c  |ttps://www.googl|
000001a0  65 2e 73 65 2f 3f 67 66  65 5f 72 64 3d 63 72 26  |e.se/?gfe_rd=cr&|
000001b0  61 6d 70 3b 65 69 3d 64  4b 71 51 56 70 47 67 47  |amp;ei=dKqQVpGgG|
000001c0  49 71 41 38 51 66 6c 6c  71 61 41 42 51 22 3e 68  |IqA8QfllqaABQ">h|
000001d0  65 72 65 3c 2f 41 3e 2e  0d 0a 3c 2f 42 4f 44 59  |ere</A>...</BODY|
000001e0  3e 3c 2f 48 54 4d 4c 3e  0d 0a                    |></HTML>..|
000001ea