NETOBSERV-2858: export readable OpenSSL TLS plaintext to JSONL by jpinsonneau · Pull Request #540 · netobserv/netobserv-cli

jpinsonneau · 2026-07-06T15:29:38Z

Description

Add --enable_openssl (and related TLS plaintext options) to packets capture, wiring agent env vars via packet-capture.yml.
Export decrypted payloads to output/plaintext/<timestamp>.jsonl with a human-readable PlaintextDisplay field (HTTP body / request line / JSON text extraction, OpenSSL metadata prefix stripping).
Add openssl-test-pod and http-test-pod examples plus TLS coverage notes in docs/tls-decryption-coverage.md.

JSONL export only — TUI wire buffer and live plaintext columns are deferred to NETOBSERV-2859.

Test plan

make build
go test ./cmd
NETOBSERV_AGENT_IMAGE=<2857-image> ./build/oc-netobserv packets --port=8443 --peer_ip=<pod> --enable_openssl --privileged --background
Confirm JSONL rows contain PlaintextDisplay with readable HTTP (not raw TLS/binary)

Dependencies

netobserv/netobserv-ebpf-agent#1006

Checklist

Does the changes in PR need specific configuration or environment set up for testing?
- if so please describe it in PR description.
I have added thorough unit tests for the change.
QE requirements (check 1 from the list):
- Standard QE validation, with pre-merge tests unless stated otherwise.
- Regression tests only (e.g. refactoring with no user-facing change).
- No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

openshift-ci · 2026-07-06T15:29:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci-robot · 2026-07-06T15:29:42Z

openshift-ci · 2026-07-06T15:29:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign jotak for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2026-07-06T15:34:46Z

Codecov Report

❌ Patch coverage is 45.41485% with 250 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.40%. Comparing base (fe9ba2f) to head (512ca99).
⚠️ Report is 9 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/plaintext_format.go	53.50%	122 Missing and 37 partials ⚠️
cmd/packet_capture.go	5.43%	87 Missing ⚠️
cmd/packet_capture_plaintext.go	75.00%	3 Missing ⚠️
cmd/root.go	91.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #540      +/-   ##
==========================================
+ Coverage   13.18%   18.40%   +5.22%     
==========================================
  Files          20       22       +2     
  Lines        2443     2880     +437     
==========================================
+ Hits          322      530     +208     
- Misses       2095     2287     +192     
- Partials       26       63      +37

Flag	Coverage Δ
unittests	`18.40% <45.41%> (+5.22%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/root.go	`35.23% <91.66%> (+7.57%)`	⬆️
cmd/packet_capture_plaintext.go	`75.00% <75.00%> (ø)`
cmd/packet_capture.go	`2.67% <5.43%> (+2.67%)`	⬆️
cmd/plaintext_format.go	`53.50% <53.50%> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Add --enable_openssl packet capture wiring, PlaintextDisplay formatting (prefix stripping, HTTP peeling), and openssl/http example workloads. Writes output/plaintext/*.jsonl without wire correlation or TUI (NETOBSERV-2859). Use --background during capture; pair with agent image from NETOBSERV-2857. Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-07-07T14:40:22Z

New image:

quay.io/netobserv/network-observability-cli:d504c4dc

It will expire in two weeks.

To use this build, update your commands using:

USER=netobserv VERSION=d504c4dc make commands

or download the updated commands.

jpinsonneau · 2026-07-07T15:39:03Z

Tested and works as expected 🥳

To generate fake traffic:

cd examples

# Build, deploy, wait, generate traffic
make images-all IMAGE_ORG=<your-user>
make deploy-all wait-all traffic-all

# Pod IPs for scoped capture
make pod-ips
make capture-hint   # prints ready-to-paste commands

Then run the capture using:

NETOBSERV_AGENT_IMAGE=<your-agent> ./build/oc-netobserv packets --port=8443 --peer_ip="$OPENSSL_POD_IP" --enable_openssl --privileged

See the plaintext output when capture finished with:

$ jq -r "select(.RecordType==\"plaintext\") | {TLSSource,PlaintextDisplay}" output/plaintext/*.jsonl
{
  "TLSSource": "openssl",
  "PlaintextDisplay": "GET /healthz HTTP/1.1"
}
{
  "TLSSource": "openssl",
  "PlaintextDisplay": "HTTP/1.1 200 OK"
}
{
  "TLSSource": "openssl",
  "PlaintextDisplay": "<html>\r\n<head><title>405 Not Allowed</title></head>\r\n<body>\r\n<center><h1>405 Not Allowed</h1></center>\r\n<hr><center>ngin..."
}
{
  "TLSSource": "openssl",
  "PlaintextDisplay": "GET /message?seq=6 HTTP/1.1"
}
{
  "TLSSource": "openssl",
  "PlaintextDisplay": "NETOBSERV-OPENSSL plaintext probe\nTLS stack: nginx + OpenSSL 3 (userspace libssl.so)\nWorkload: openssl-test-pod\nEndpoint..."
}

leandroberetta

Hi @jpinsonneau, few comments below, thanks!

leandroberetta · 2026-08-10T14:16:22Z

-			// display as flow async
 			go AppendFlow(genericMap.Copy())
-
 			writePacketData(ngw, &genericMap, &data)


I noticed that watchTLSKeylog acquires keylogMu when writing DSB blocks to ngw, but writePacketData writes packet data to the same NgWriter without acquiring that mutex. Since both run concurrently (main goroutine vs. the ticker goroutine), this could corrupt the pcapng output. Should keylogMu (or a shared writer mutex) also be held around writePacketData?

Addressed in 512ca99

leandroberetta · 2026-08-10T14:18:47Z

+// optionEnabled reports whether a named CLI option is set in the pipe-separated --options string.
+// The shell passes flags as --name or name=true.
+func optionEnabled(name string) bool {
+	if strings.Contains(options, name+"=false") {


optionEnabled uses strings.Contains, which means optionEnabled("enable_openssl") would also match an option like enable_openssl_debug. Minor risk today since no such option exists, but splitting by | and matching the key exactly would be safer.

Addressed in 512ca99

leandroberetta

LGTM

openshift-ci-robot added the jira/valid-reference label Jul 6, 2026

openshift-ci Bot added the do-not-merge/work-in-progress label Jul 6, 2026

jpinsonneau force-pushed the NETOBSERV-2858 branch from 7dfc84b to 7017fbf Compare July 6, 2026 15:58

jpinsonneau force-pushed the NETOBSERV-2858 branch from 7017fbf to d504c4d Compare July 6, 2026 16:17

jpinsonneau added the ok-to-test label Jul 7, 2026

jpinsonneau marked this pull request as ready for review July 7, 2026 15:36

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 7, 2026

jpinsonneau added the needs-review Tells that the PR needs a review label Jul 7, 2026

jpinsonneau requested review from jotak, leandroberetta and msherif1234 July 7, 2026 15:39

jpinsonneau mentioned this pull request Jul 7, 2026

NETOBSERV-2857: capture OpenSSL TLS plaintext with scope and export netobserv/netobserv-ebpf-agent#1006

Open

9 tasks

leandroberetta reviewed Aug 10, 2026

View reviewed changes

address feedback

512ca99

github-actions Bot removed the ok-to-test label Aug 10, 2026

leandroberetta self-requested a review August 18, 2026 13:37

leandroberetta approved these changes Aug 18, 2026

View reviewed changes

openshift-ci Bot assigned leandroberetta Aug 18, 2026

openshift-ci Bot added the lgtm label Aug 18, 2026

Uh oh!

Conversation

jpinsonneau commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test plan

Dependencies

Checklist

Uh oh!

openshift-ci Bot commented Jul 6, 2026

Uh oh!

openshift-ci-robot commented Jul 6, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Test plan

Dependencies

Checklist

Uh oh!

openshift-ci Bot commented Jul 6, 2026

Uh oh!

codecov Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

jpinsonneau commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

leandroberetta left a comment

Choose a reason for hiding this comment

Uh oh!

leandroberetta Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

jpinsonneau Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

leandroberetta Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

jpinsonneau Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

leandroberetta left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jpinsonneau commented Jul 6, 2026 •

edited

Loading

openshift-ci-robot commented Jul 6, 2026 •

edited by openshift-ci Bot

Loading

codecov Bot commented Jul 6, 2026 •

edited

Loading

jpinsonneau commented Jul 7, 2026 •

edited

Loading