I can successfully use eBPF to trace TLS traffic when using OpenSSL v1.1.1. Kernel is 5.15.0-102-generic

I want to get the fd of this SSL connection in order to know the end point of TLS traffic. Seems there are 2 options. One option is to create partially of struct ssl_st and struct bio_st to find the field num in bio_st. Second option is to use offset to get field num from those 2 structs.

I tried both options and they all return fd: 5 to me in different machines or containers. I use the following part of code to test, apparently, 5 is not a valid socket.

struct stat statbuf;
if (fstat(fd, &statbuf) == -1) {
    perror("fstat failed");
} else {
    if (S_ISSOCK(statbuf.st_mode)) {
        printf("fd %d is a socket.n", fd);
    } else {
        printf("fd %d is not a socket.n", fd);
    }
}

The test I did is using curl to a https website. It also can trace other TLS traffic, i.e. upgrade vscode, etc. All traffics return fd:5

wget-1393473 [002] d...1 320246.200736: bpf_trace_printk: uprobe/SSL_write wbio_num is 5
wget-1393473 [002] d...1 320247.743324: bpf_trace_printk: uprobe/SSL_read rbio_num is 5

Does anyone have an idea how to get the real fd from ssl_read/ssl_write? Did I miss anything?

Thanks in advance!