←back to thread

664 points alexflint | 1 comments | | HN request time: 0.225s | source
Show context
ranger_danger ◴[] No.42921763[source]
Why not use eBPF instead? Then you could see all http requests from all processes at once, including ones that are already running. Plus you wouldn't need to bother with TLS at all, just hook on e.g. write(2).
replies(5): >>42921870 #>>42921954 #>>42923824 #>>42924500 #>>42927428 #
alexflint ◴[] No.42924500[source]
Unfortunately TLS happens inside the the application, not in the kernel, so using eBPF to hook syscalls to write won't help with TLS decryption.
replies(2): >>42924670 #>>42928250 #
1. ranger_danger ◴[] No.42928250[source]
But read and write syscalls are used by the application to do I/O on the sockets before/after the encryption, which can be intercepted. Or you can attach uprobes directly to the TLS library's own functions.