Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Httptap: View HTTP/HTTPS requests made by any Linux program

github.com

Post reply on HN
Print view View original

91–100 of 148 posts

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#91

Post by dgl »

freedomben wrote: post #34
trallnag wrote: post #32

Earlier quoted context omitted.

I'm having a hard time coming up with a use case where I want to use a tool like that but I'm also lacking root privileges

Inside most production environments. I could use this today inside a Pod that isn't allowed root privs.

This won't work in most cases inside a Kubernetes pod, as the default seccomp policies don't allow creating namespaces within them. You can obviously relax the seccomp policies, but at that point you can also just give yourself the capabilities.

There are eBPF tools which will work, for example https://inspektor-gadget.io/docs/latest/gadgets/trace_ssl

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#92

Post by sitkack »

why_at wrote: post #64
beachy wrote: post #13

Earlier quoted context omitted.

Reminds me of a quote from "Soul of a new machine": > During one period, when the microcode and logic were glitching at the nanosecond level, one of the overworked engineers departed the company, leaving behind a note on his terminal as his letter of resignation: "I am going to a commune in Vermont and will deal with no unit of time shorter than a season."

Great quote, although the nitpicky part of my brain immediately thought "They must have days though?"

The day washes over you, but this person only needs to "deal with" the harvest.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#93

Post by 0x696C6961 »

xorcist wrote: post #74
alexflint wrote: post #51

Earlier quoted context omitted.

Thanks! But yep I agree, you're exactly right, it's ultimately... frustrating that there isn't really an agreed-upon or system-enforced way to specify CA roots to an arbitrary process. It's true that httptap mounts an overlay on /etc/resolv.conf. This is, as you'd expect, due to the also-sort-of-frustrating situation with respect to DNS resolution in which, like CA roots, there isn't a truly reliable way to tell an a…

It's a bit thin solution though, isn't it? As you say, it's dependent on both specific CA store and resolver behaviour. It's probably going to be robust enough on the most common SSL libraries, such as OpenSSL. But if we're going that route, why not just run the software against a patched SSL library which dumps the traffic? That also doesn't require any elevated privileges (as opposed to other methods of syscall int…

> why not just run the software against a patched SSL library which dumps the traffic?

Why run strace when you can just patch libc?

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#94

Post by arjvik »

alexflint wrote: post #51
wzyboy wrote: post #39

It's a genius idea to run the process in a isolated network namespace! I'm more interested in the HTTPS part. I see that it sets some common environment variables [1] to instruct the program to use the CA bundle in the temporary directory. This seems to pose a similar issue like all the variants of `http_proxy`: the program may simply choose to ignore the variable. I see it also mounts an overlay fs for `/etc/resolv.…

Thanks! But yep I agree, you're exactly right, it's ultimately... frustrating that there isn't really an agreed-upon or system-enforced way to specify CA roots to an arbitrary process. It's true that httptap mounts an overlay on /etc/resolv.conf. This is, as you'd expect, due to the also-sort-of-frustrating situation with respect to DNS resolution in which, like CA roots, there isn't a truly reliable way to tell an a…

What if instead you bound your own DNS server to localhost:53 inside the network namespace? I suppose you'd still have to mess with /etc/resolv.conf in case it points to hardcoded public resolvers instead like mine does.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#95

Post by graerg »

boobsbr wrote: post #59
wutwutwat wrote: post #50

Earlier quoted context omitted.

Did everyone forget about wireshark, which can totally be ran as non-root? https://blog.wireshark.org/2010/02/running-wireshark-as-you/

It's still more setup than just installing this tool. Also, can Wireshark/libpcap decrypt SSL/TLS traffic this easily?

Not in my experience; I think I gave up and opted for mitmproxy which works but is not this easy/seamless.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#96

Post by drio »

alexflint wrote: post #55
maxmcd wrote: post #18

Amazing, such a great use of the gvisor userspace tcp/ip stack!

Yeah learning about gVisor was one of the most fun parts of this project. The gVisor devs are incredibly helpful. If you look through the gvisor-users mailing list you'll see me asking them various questions about this and they really helped out a bunch with some incredibly thorough answers.

Outstanding! Congratulations on writing such a wonderful project!

I have a suggestion regarding the "How It Works" section. When reading it, I initially thought you had implemented your TCP/IP stack from scratch. Later, I discovered through the comments that you're using gVisor. Perhaps you might consider mentioning this explicitly in the documentation?

As an interesting side note, gVisor's netstack is also used in the Tailscale client, enabling features like connecting a machine to multiple tailnets without requiring special privileges.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#98

Post by bityard »

yoavm wrote: post #72
erdii wrote: post #11

Earlier quoted context omitted.

To be honest: This sounds like just another of the many many other yoga/spiritual cults that currently exist all over the western world. EDIT: typos and slight wording changes

I believe I grew up in a cult myself, and one of the things I've concluded from that experience, and from leaving it, is that everywhere is a cult. Humans have a tendency towards cult-ish life, and if the cult is big enough we just refer to it as "society". People were as afraid (more or less) to leave the cult I was at, as people are around me now when they consider doing anything that is out of the norm. By no mean…

A "cult" is a rather specific kind of organization. The typical hallmarks are non-mainstream spiritual beliefs, highly controlling and exploitative leadership, and rules against interacting with outsiders. Non-conformity generally results in outsized (sometimes violent) punishment and shame.

Under this definition, for example, Catholic nuns are decidedly not a cult. They know what they are in for when the join, and may leave the convent any time they wish. Most Amish communities are _probably_ not cults. I am undecided about Mormons but leaning towards maybe.

I don't know what kind of cult you grew up in (and you have my empathy if it was painful) but "society" by definition cannot be a cult.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#99

Post by js2 »

whartung wrote: post #97

So if I have a Java program using the AWS libraries and I run it under this thing, it can decode the HTTPS AWS payloads going to Amazon? How does that work with the AWS certs? How does the program not reject whatever this tool is doing to pull it off?

1. Yes. The following commit taught httptap how to configure Java processes to use its CA cert:

https://github.com/monasticacademy/httptap/commit/4288a89504...

2. How it works is explained in the last two paragraphs of the "How It Works" section of the readme:

> When a client makes an HTTPS request, it asks the server for evidence that it is who it says it is. If the server has a certificate signed by a certificate authority, it can use that certificate to prove that it is who it says it is. The client will only accept such a certificate if it trusts the certificate authority that signed the certificate. Operating systems, web browsers, and many other pieces of software come with a list of a few hundred certificate authorities that they trust. Many of these pieces of software have ways for users to add additional certificate authorities to this list. We make use of this.

> When httptap starts, it creates a certificate authority (actually a private key plus a corresponding x509 certificate), writes it to a file on the filesystem visible only to the subprocess, and sets a few environment variables -- again only visible to the subprocess being run -- that add this certificate authority to the list of trusted certificate authorities. Since the subprocess trusts this certificate authority, and httptap holds the private key for the certificate authority, it can prove to the subprocess that it is the server which which the subprocess was trying to communicate. In this way we can read the plaintext HTTP requests.

Re: Httptap: View HTTP/HTTPS requests made by any Linux program

#100

Post by maybehewasright »

erdii wrote: post #11
yoavm wrote: post #4

The "How it was made" section of the README was not less interesting than the tool itself: > The way we have set things up is that we live and practice together on a bit over a hundred acres of land. In the mornings and evenings we chant and meditate together, and for about one week out of every month we run and participate in a meditation retreat. The rest of the time we work together on everything from caring for t…

To be honest: This sounds like just another of the many many other yoga/spiritual cults that currently exist all over the western world. EDIT: typos and slight wording changes

https://www.youtube.com/watch?v=5It1zarINv0&pp=ygUOa2diIGFnZ... Former KGB Agent Yuri Bezmenov Explains How to Brainwash a Nation (Full Length)
Post reply on HN