alt Hacker NewsSurprised that works, I thought TLS was done entirely in process space.
I think I found it, My first thought was some sort of builtin ssl library backdoor, but it looks like you do some ld.preload shenanigans to inject a eBPF monitor. I am not sure exactly what the BPF brings to the table here. A convenient interface to intercept the accept() syscall?
It is similar but no real shenanigans but rather a common functionality called uprobes. For most of these LLM clients which uses a static compiled OpenSSL or BoringSSL the functions you attach to is also the same overall, making it easily reusable when you know what to do. There has been plenty of srticles over the time on it, quite a fun thing to play around with. I made it work already with most of them for research purposes.