Qtap - an open-source tool to see through encrypted traffic
Posted by 4e57ljni@reddit | linux | View on Reddit | 47 comments
Posted by 4e57ljni@reddit | linux | View on Reddit | 47 comments
void4@reddit
why it's better than wireshark? E.g. set
SSLKEYLOGFILEwherever appropriate and see all the decrypted packets in nice familiar interfaceNonStandardUser@reddit
eBPF is the epitome of "do whatever you want" for the kernel and networking stack. I love eBPF and Linux
StatementOwn4896@reddit
Could you recommend any good resources to recommend how to use it?
NonStandardUser@reddit
The first book (what is ebpf) gives you a smoother landing when you're first starting off writing eBPF code, but the second book has all the necessary details. If you're short on time, I suggest quickly skimming the first and selectively reading the second.
The fact that Linux, via eBPF, gives you a magical "x-ray magnifying glass" into itself is awesome. I used eBPF to create a network usage monitor that monitors ingress traffic by the process, which uses XDP(networking) and various kernel function hooks that detect when a process creates a TCP/UDP socket. Fun stuff.
Catenane@reddit
eBPF is so insanely overpowered it's unbelievable. I was able to very quickly set up rules to listen for execution calls of image processing CLI tools running in a docker-compose stack with semaphores, and then time each call and generate histograms that could be exported to grafana. Like when I use eBPF shit I feel like a fucking wizard (and my colleagues look at me like one too). Meanwhile smarter people than me already did all the difficult shit lol.
DudeWithaTwist@reddit
Never heard of eBPF before, thanks for mentioning it. I was surprised to learn a few of the FAANG companies helped develop this.
4e57ljni@reddit (OP)
eBPF is the bees knees!
Hotshot55@reddit
Dang, I was looking for something just like this like a month ago.
zmaile@reddit
Please no one ever do this. And to the devs, please don’t encourage people to do this. I know it's beating a dead horse, and everyone has their own line-in-the-sand as to what is a acceptable tradeoff for convenience/security. But encouraging people to run arbitrary code as root from an unknown website without a checksum, and without even glancing over the first few lines of code is a bit too irresponsible (imho).
I imagine the security community that uses these tools are a bit more able to think for themselves and not run those commands as-is. But still.
sp_dev_guy@reddit
These people built a tool to quietly read encrypted traffic encryption free.. does that really seem like the kinda people who could slip something else into your sudo execution?
lelddit97@reddit
someone could (and many times has) easier masquerade as the people who built the useful tool and post malware
obviously the odds are unlikely, but its still very very bad practice and avoids safeguards like digital signatures. a simple website compromise = easy RCE for anyone who runs it
sp_dev_guy@reddit
You can add in: blog posts with typo squatting, temporary infection of that script, and more. Plenty of reasons not run it & build a habit of doing better
Super likely it is & will be safe from this team. But that's true everywhere until it isn't, precautions are the only protection
Arm_Lucky@reddit
You do forget the time that the FBI made a "anonymous phone" to catch criminals, and it worked so well because the criminals trusted the company with blind faith just based on vibes alone?
Same concept is why people are sketched out by this behavior.
sp_dev_guy@reddit
Omg yes, that had me laughing so hard. Ty for the reminder
salvah@reddit
If someone, they have the power
yawara25@reddit
Yes
ThomasterXXL@reddit
If you don't trust the project, then there is no acceptable way to install the software. Once you run malicious code (as root), it doesn't really make a difference where it came from.
Whether or not you trust a random stranger and trust them to maintain and secure their website and to never let that domain expire until the end of the internet... that is for you to decide.
hi65435@reddit
Well, since it's hosted on Github, at least there is some sort of public audit trail.
On a side note, unless a system is very run down already only in rare exceptions I install software that isn't available as package or at least from source. I really don't get why anyone would prefer to run a script to install
deepthought-64@reddit
Thanks! You're absolutely right!
ThatsARivetingTale@reddit
Also a huge pet peeve of mine, good PSA.
4e57ljni@reddit (OP)
Hey all!
We recently open-sourced Q.Tap, a Linux-native eBPF agent that captures encrypted traffic before encryption happens—by hooking into TLS libraries at runtime. It’s like having Wireshark for TLS traffic—but faster to deploy and easier to understand.
It supports OpenSSL, GoTLS, NodeTLS, and TLS in Java (via JSSE). Using uprobes on functions like SSL_write, it captures payloads as they enter the TLS library, giving you structured request/response logs—without decrypting anything.
Q.Tap runs on bare metal, in containers, or as a daemonset in Kubernetes. Just needs a recent kernel.
Check it out and let us know if you have any questions on how it works!
telans__@reddit
Your FAQ states this is only for the paid version, not the open source version you linked. https://docs.qpoint.io/faq#licensing-and-versions
Is that accurate?
ddelnano@reddit
TLS tracing via eBPF has been mainstream for many years now. There are other truly open source projects in this space that provide Go TLS, Node TLS and Java TLS tracing.
Coroot, ecapture and Pixie to name a few.
Disclaimer: I'm a maintainer for the Pixie project.
small_kimono@reddit
Congrats!
One thing I'd ask: Is AGPL a permissible license for the eBPF bytecode? I've seen some claim that because such bytecode interacts so closely with the kernel it must be GPL2. See: https://ebpf.io/blog/ebpf-licensing-guide/ and https://docs.kernel.org/bpf/bpf_licensing.html.
I happen to disagree (perhaps as well) but curious as to your reasoning. Do you just not use any GPL only symbols?
Thanks!
4e57ljni@reddit (OP)
Yeah, you nailed it. We make sure we don't use any GPL, only symbols, and are extremely careful about it.
omenosdev@reddit
Slight nitpick request: when it comes to the GPL licenses, can you specify whether or not you are using AGPL-3.0-only or AGPL-3.0-or-later? It's a super minor detail but has the potential for large ramifications in the future (or today if using a 2.0 license).
spreetin@reddit
All *GPL licenses contain a provision allowing the developer to specify if they want their software licensed under only the current one, or current+future versions.
omenosdev@reddit
Yep, for posterity:
So my understanding is the license defaults to "only", with "or later" requiring explicit opt-in. And if left unversioned that implies "latest".
So with Qtap licensed as AGPLv3, that would suggest AGPL-3.0-only
space_fly@reddit
Can it intercept connections if the machine is used to forward traffic (like a router or a proxy)?
I was thinking of whether it is possible to analyze traffic from other devices, like Android, or "smart" appliances, or the smart TV. Even from a VM would be useful.
Catenane@reddit
This is fucking dope, but it means I'm probably not gonna end up seeing the sun this weekeend, lmao.
Dr0zD@reddit
Android version?
Skinkie@reddit
Imagine the reverse engineering possibilities with running this on Android...
privacyplsreddit@reddit
Could this work on windows apps through wine/ proton? Actually unsure of how theyd play together
4e57ljni@reddit (OP)
I don't think it would work but we've never tried
Confident-Ad-3465@reddit
3 letter agencies will fork this. Thanks for sharing
AlveolarThrill@reddit
You really think they don't have tools much more powerful than this already? Entire encryption schemes have been flagged as being backdoored down to the pure mathematics behind them. And the long list of exploits like EternalBlue prove they've always been able to do far more than cybersecurity professionals are aware of.
If your threat model includes nation-states and you don't have full backing of one yourself, you've lost already.
Jethro_Tell@reddit
Maybe, or maybe they already have this and haven’t released it. Either way, they have to have it running on your machine. If that is the case, they are running stuff in your kernel as root; they own your machine entirely. They could just as easily run a key logger or video record your entire session.
Additionally, they could probably just go out and get the other end of most any connection they wanted and lean on the other party.
I wonder what your threat model looks like that you can allow a nation state to have root on your machine but would worry about them sniffing pre encrypted packets?
The nature of open source is that it can be used for good or evil, and the goal is that it can in fact be used as people see fit.
These guys built something, with real world, white hat value and gave it to the community. Accusing them of aiding nation states, is both disingenuous and shows a glaring lack of understanding of how that threat model would truly play out in the wild.
Please don’t put people down when they share things, even if you don’t really understand them.
madroots2@reddit
Damn you Jethro-told him propper bouree!
0b0101011001001011@reddit
I hardly think they need to.
AlveolarThrill@reddit
Very cool! My immediate first thought is that this could be useful for reverse-engineering protocols of online-only games to allow private hosting (looking at you, Anno 2070). The cybersecurity applications of this tool are of course much more valuable and important, but still.
insanelygreat@reddit
Ooh! I tried to build something like this a while back but got sidetracked before I got very far. This looks great.
Especially handy for inspecting some stuff that uses certificate pinning.
4e57ljni@reddit (OP)
Yes! Couldn't agree more
Aggressive_Job_1031@reddit
Oh my this is good
AdrianoML@reddit
Is there any example of software that won't be intercepted by such tool? I mean, other than malware specifically crafted to not use common libraries.
Could it warn you about any remaining https traffic that it wasn't able to intercept?
4e57ljni@reddit (OP)
It's really all about the libraries! We're working on supporting more as time goes on. BoringSSL is probably next!
DudeWithaTwist@reddit
Interesting, I'll give this a shot next time I'm snooping https traffic. Setting up mitmproxy and Wireshark is a PITA.
4e57ljni@reddit (OP)
That's a perfect use case for Q.Tap