4 ms·
I've not used it in anger, so take it with a grain of salt. it sorta gives you a kernel space VM. you can inspect the state of things, make decisions about tha
by jfoutz 2y ago
I've not used it in anger, so take it with a grain of salt.
it sorta gives you a kernel space VM. you can inspect the state of things, make decisions about that state, and react to those things.
for example, you could look at uri requests coming into your web server. if it's not a known good path, reply back with a canned 400 - without ever hitting the web server. you can do this in the kernel.
_edit_ I think this particular trick would only work with http. the web server still has all the glue to decrypt the incoming request - but you could probably hook into ebpf at that point.
- chatmasta 2y agoMaybe you could do this with HTTPS if you’re using Kernel TLS offloading?
- tptacek 2y agoYou can instrument userland binaries with eBPF, so as long as you have probes built for the TLS library your target is using, you're fine.
- Arnavion 2y agoYes, if the server uses kTLS, it'll be easy for such a probe to get the plaintext, because the syscalls themselves will contain the plaintext. It won't have to do TLS library-specific shenanigans to hook userspace functions or extract the key material like this submission does.