Re:Show HN: Subtrace – Wireshark for Docker Containers
by chatmasta on Thursday February 20, 2025 @01:13AM
(#43111657)
No general solution? :) If you came up with this hack I’m sure you can extend it…
Cert pinning has to read a public cert from memory, right? And a public cert has a well-known shape… and you have bpf and access to the memory…
Re:Show HN: Subtrace – Wireshark for Docker Containers
by adtac on Thursday February 20, 2025 @02:19AM
(#43111986)
in a different context, maybe: https://news.ycombinator.com/item?id=38044786 :)
Re:Show HN: Subtrace – Wireshark for Docker Containers
by smw on Thursday February 20, 2025 @01:25PM
(#43118244)
kubeshark [0] is using ebpf to catch calls to openssl/go's tls lib and thus no need to juggle certs. Has pros and cons compared to your method, but an interesting comparison.
Re:Show HN: Subtrace – Wireshark for Docker Containers
by ddelnano on Thursday February 20, 2025 @01:47PM
(#43118481)
The approach you describe above is common for similar projects:
- Pixie (https://px.dev) -- which I contribute to
- Beyla (https://github.com/grafana/beyla)
- Coroot (https://github.com/coroot/coroot)
If you are interested in the details and how the strategy for this tracing has evolved, you can learn more in this blog (https://blog.px.dev/ebpf-tls-tracing-past-present-future/).
We still try our best by handling as much of the long tail of environments with some library/framework specific environment variables (e.g. Deno bundles all TLS certs in its binary so we set the DENO_CERT env var when applicable).
[1] https://news.ycombinator.com/item?id=42923998