Tracing SSL/TLS Encrypted Microservices with eBPF
summary
Shows how eBPF uprobes attach to TLS libraries to capture cleartext inside the TLS stack, implemented on Pixie and inspired by BCC sslsniff. It uses u-probes on OpenSSL/BoringSSL/goTLS or raw addresses for statically linked binaries, computes offsets with an ELF parser plus dlopen to call version symbols, and extracts connection identity by walking SSL->rbio->num. Work includes upstreamed Netty/Netty-tcnative changes to populate bio->num, handles BoringSSL layout differences, demonstrates a Minikube demo, and reports minor performance impact and one remaining bug for Finagle.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:11Background and Motivation
- 2:54Protocol Tracing
- 4:13Tracing encrypted traffic
- 5:52Challenges Tracing Encrypted Messages
- 11:37Encrypted finagle traffic challenges
- 22:31TLS library support matrix
related talks
26mChecking your cryptography usage with eBPF
17meBPF in Microservices Observability
54mTracing Go Programs with eBPF!
10mLightning Talk: What Can eBPF Actually do for Modern-day Observability?
24meBPF Application Instrumentation for Java: Challenges, Design, and Real...
40mExploring Runtime Security and Forensic using eBPF
46mReal World Debugging with eBPF
53mGetting Started with BPF Security Observability