LD_PRELOAD TLS keylog sidecar)| Field | Value |
|---|---|
| Tech Lead | mesbrj |
| Product Manager | mesbrj |
| Team | MESBRJ HOME LABs |
| Epic/Ticket | taskwarrior project: Go-eBPF-Proxy |
| Design/Refs | PRD (docs/prd/product-requirements-document.md), Feasibility study (docs/feasibility-study.md), Feature 01 (docs/prd/feature-01.md), Feature 02 (docs/prd/feature-02.md), Feature 03 (docs/prd/feature-03.md) |
| Status | Approved |
| Created | 2026-08-30 |
| Last Updated | 2026-09-19 (AD-013: supported-platform tiers added — all Planned, none verified). Previously 2026-09-18 (AD-011/AD-012: pcapng flush interval, ci.InterfaceIndex/GSO SetCaptureLength(65536) fixes, CAPTURE-04 segment-loss limitation disclosed, LINK_MODE=static default) |
go-ebpf-proxy is a sidecar that transparently redirects an unmodified application's
outbound IPv4 TCP egress to a local pass-through L4 relay using an eBPF cgroup/connect4
program (no iptables/NAT), and passively extracts the app's TLS session keys via an
LD_PRELOAD interposer that registers OpenSSL's own keylog callback — emitting NSS-format
keylogs so that the captured (still end-to-end encrypted) TLS 1.2/1.3 egress can be decrypted
and inspected offline. There is no TLS termination, no man-in-the-middle, and no CA: the
app's handshake stays end-to-end with the real server, and its certificate validation is never
weakened.
Background: The MVP is implemented across internal/{ebpf,proxy,keylog,capture}, bpf/,
preload/, cmd/app/, and deploy/podman/; internal/{convert,analisys}, internal/shared/db
and pkg/tui remain empty post-MVP placeholders. This TDD documents the authoritative,
technically-reviewed MVP direction. The chosen model is eBPF cgroup/connect4 transparent
redirection to a raw L4 relay (a single capture choke point) + passive TLS key extraction via
an LD_PRELOAD interposer — deliberately no MITM/CA and no sockmap acceleration in the
MVP. This supersedes two earlier directions: (1) the original exploratory MITM/CA direction,
dropped because certificate pinning defeats it, it weakens the app's trust store, and it