aquasecurity / aquasecurity/tracee
feature: trace HTTPS events
Open
Nobody has claimed this yet.
kind/feature
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 508
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Description
When trying to track network requests, HTTPS calls aren't tracked by net_packet_http (only net_packet_ipv4)
sudo docker run --name tracee -it --rm --pid=host --cgroupns=host --privileged -v /etc/os-release:/etc/os-release-host:ro -v /var/run:/var/run:ro aquasec/tracee:latest --events net_packet_http_request,net_packet_http_response --output json --scope comm=curl
curl http://www.google.com/ # works
curl https://www.google.com/ # does not work
Output of tracee version:
Tracee version: "v0.19.0"
Output of uname -a:
Linux instance-20240129-1148 5.15.0-200.131.27.1.el8uek.x86_64 #2 SMP Wed Nov 22 18:08:57 PST 2023 x86_64 x86_64 x86_64 GNU/Linux
Additional details
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the supplied Docker command with both HTTP and HTTPS curl requests, then trace the net_packet_http_request and net_packet_http_response event paths alongside net_packet_ipv4. Done means HTTPS requests produce the same request and response events that currently appear for HTTP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, linux
- Domain
- networking, observability, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100