Show HN: Using eBPF to see through encryption without a proxy

Re:Show HN: Using eBPF to see through encryption without a p... by pclmulqdq on Thursday May 08, 2025 @01:13PM (#43928491)

To hook into OpenSSL, don't you either need dynamic linking or userspace programs to compile your hooks in? Go and many Rust and C++ binaries tend to prefer static linking, so I wonder if this solution is workable there.

[ Parent | on HN ]

Re:Show HN: Using eBPF to see through encryption without a p... by tylerflint on Thursday May 08, 2025 @01:17PM (#43928572)

Great point! Yes it supports both scenarios. Qtap scans the binary ELF (curl, rust, etc) and looks for the TLS symbols. If they were statically compiled the eBPF probes will be attached directly to the binary, if dynamically linked the probes will be attached to the symbols in the library (.so).

[ Parent | on HN ]

Re:Show HN: Using eBPF to see through encryption without a p... by pclmulqdq on Thursday May 08, 2025 @01:57PM (#43929179)

Yeah, so -O2 and -O3 are likely to be problems for you, and the ELF surgery is very invasive.

[ Parent | on HN ]

Re:Show HN: Using eBPF to see through encryption without a p... by jonfriesen on Thursday May 08, 2025 @02:18PM (#43929445)

Fair point on -O2 and -O3 optimized bins. We've approached this by building custom bin utils that are optimized for blazingly fast symbol recognition. Traditional ELF tools that focus on providing comprehensive context for debugging, we are strip away everything that is not the symbol locations we need.

We've also added caching so frequently used bins don't require multiple scans. Shared libraries as well. This has proven effective with optimized binaries, especially bins that are optimized, start, make a super quick network call, then exit, which was the bane of our existence for a little while.

[ Parent | on HN ]