tjh.dev
1{
2 buildGoModule,
3 fetchFromGitHub,
4 bpftools,
5 lib,
6 nspr,
7 libpcap,
8 clang,
9 fd,
10 go-bindata,
11 glibc,
12 gnutls,
13 bashInteractive,
14 postgresql,
15 mariadb,
16 openssl,
17 bash,
18 zsh,
19 nix-update-script,
20 llvmPackages,
21 withNonBTF ? false,
22 kernel ? null,
23}:
24
25buildGoModule rec {
26 pname = "ecapture";
27 version = "1.3.1";
28
29 src = fetchFromGitHub {
30 owner = "gojue";
31 repo = "ecapture";
32 tag = "v${version}";
33 hash = "sha256-SY7Q8WlxE473An6/MntjPaIT3mFE/u9JJS6nb8BWiuQ=";
34 fetchSubmodules = true;
35 };
36
37 nativeBuildInputs = [
38 llvmPackages.libllvm
39 clang
40 fd
41 bpftools
42 go-bindata
43 ];
44
45 newlibpcap = libpcap.overrideAttrs (previousAttrs: {
46 configureFlags = previousAttrs.configureFlags ++ [ "--without-libnl" ];
47 });
48
49 buildInputs = [
50 newlibpcap
51 glibc.static
52 glibc
53 ];
54
55 CGO_LDFLAGS = "-lpcap -lpthread -static";
56
57 ldflags = [
58 "-extldflags '-static'"
59 "-linkmode=external"
60 ];
61
62 hardeningDisable = [
63 "zerocallusedregs"
64 ];
65
66 postPatch = ''
67 substituteInPlace user/config/config_gnutls_linux.go \
68 --replace-fail 'return errors.New("cant found Gnutls so load path")' 'gc.Gnutls = "${lib.getLib gnutls}/lib/libgnutls.so.30"' \
69 --replace-fail '"errors"' ' '
70
71 substituteInPlace user/module/probe_bash.go \
72 --replace-fail '/bin/bash' '${lib.getExe bashInteractive}'
73
74 substituteInPlace user/config/config_bash.go \
75 --replace-fail '/bin/bash' '${lib.getExe bashInteractive}'
76
77 substituteInPlace user/config/config_nspr_linux.go \
78 --replace-fail '/usr/lib/firefox/libnspr4.so' '${lib.getLib nspr}/lib/libnspr4.so'
79
80 substituteInPlace user/config/config_zsh.go \
81 --replace-fail '/bin/zsh' '${lib.getExe zsh}'
82
83 substituteInPlace user/module/probe_zsh.go \
84 --replace-fail '/bin/zsh' '${lib.getExe zsh}'
85
86 substituteInPlace cli/cmd/postgres.go \
87 --replace-fail '/usr/bin/postgres' '${postgresql}/bin/postgres'
88
89 substituteInPlace cli/cmd/mysqld.go \
90 --replace-fail '/usr/sbin/mariadbd' '${mariadb}/bin/mariadbd'
91
92 substituteInPlace user/module/probe_mysqld.go \
93 --replace-fail '/usr/sbin/mariadbd' '${mariadb}/bin/mariadbd'
94
95 substituteInPlace user/config/config_openssl_linux.go \
96 --replace-fail 'return errors.New("cant found openssl so load path")' 'oc.Openssl = "${lib.getLib openssl}/lib/libssl.so.3"' \
97 --replace-fail '"errors"' ' '
98 '';
99
100 postConfigure = ''
101 sed -i '/git/d' Makefile
102 sed -i '/git/d' variables.mk
103
104 substituteInPlace Makefile \
105 --replace-fail '/bin/bash' '${lib.getExe bash}'
106 ''
107 + lib.optionalString withNonBTF ''
108 substituteInPlace variables.mk \
109 --replace-fail "-emit-llvm" "-emit-llvm -I${kernel.dev}/lib/modules/${kernel.modDirVersion}/build/include -Wno-error=implicit-function-declaration"
110 KERN_BUILD_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build KERN_SRC_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source make ebpf_noncore
111 ''
112 + ''
113 make ebpf
114 go-bindata -pkg assets -o "assets/ebpf_probe.go" $(find user/bytecode -name "*.o" -printf "./%p ")
115 '';
116
117 checkFlags =
118 let
119 skippedTests = [
120 "TestCheckLatest"
121 ];
122 in
123 [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
124
125 vendorHash = "sha256-B2Jq6v1PibZ1P9OylFsVp/ULZa/ne5T+vCsBWWrjW/4=";
126
127 passthru.updateScript = nix-update-script { };
128
129 meta = {
130 description = "Capture SSL/TLS text content without CA certificate Using eBPF";
131 changelog = "https://github.com/gojue/ecapture/releases/tag/v${version}";
132 homepage = "https://ecapture.cc";
133 platforms = [
134 "x86_64-linux"
135 "aarch64-linux"
136 ];
137 license = lib.licenses.asl20;
138 maintainers = with lib.maintainers; [ bot-wxt1221 ];
139 mainProgram = "ecapture";
140 };
141}