JVM & TLS: eBPF's Out-of-Comfort Zone
summary
eBPF kprobes and uprobes fail to extract TLS plaintext from JVMs because JITted code and dynamic memory layout remove stable userland symbols, so Datadog builds a PoC that injects a Java agent via dynamic attach (jattach ported to Go), instruments SSL sockets with Byte Buddy to proxy getOutputStream/getInputStream, reuses dd-java-tracer to capture pre-encryption payloads, and ships them out over a small eRPC channel into USM; it works in tests and in customers, though Java 21 disables attach by default.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:36Cloud Application Monitoring
- 3:54Java and JVM
- 8:53Full solution
- 13:03Injection
- 19:22Example
- 21:16Implementation
related talks
24meBPF Application Instrumentation for Java: Challenges, Design, and Real...
39mJava Agent vs. eBPF: A Deep Dive into OpenTelemetry Instrumentation Technologies
33mTracing SSL/TLS Encrypted Microservices with eBPF
34mTroubles and Tidbits from Datadogs eBPF journey
45mProfiling the HotSpot JVM Using eBPF
51mMonitoring Java Application Security with JDK tools and JFR Events
37meBPF: Revolutionizing Observability and Telemetry for Modern Applications
44mJVM Profiling under the Hood