[adtac]

How would hooking on write(2) solve TLS? You'll be able to read and modify the ciphertext, but the process will never call write(2) with the plaintext bytes, so you can't actually read the HTTP request. You'll just see the encrypted bytes that go on the wire, but so does the NSA :)

You need the kind of CA certificate trick that httptap uses. It comes with its own set of caveats (e.g. certificate pinning), but it can be made to work reliably in most practical scenarios.

I've spent an unjustifiable amount of time thinking about this specific problem building Subtrace [1], so I'm genuinely very interested in a simpler / more elegant approach.

[1] https://github.com/subtrace/subtrace

[jeroenhd]

I believe that's how https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!

[ddelnano]

Yep, that's correct. It uses eBPF upprobes to attach to the SSL_write/SSL_read functions.

[ranger_danger]

My understanding is that typically a TLS library provides a socket interface for the application to write() to, which can be intercepted by an eBPF program.