WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfssl-examples/ebpf
History
sameeh.jubran 90f3a1ea9d Add eBPF examples 
This commit adds two examples:

1. Add eBPF syscall-write-trace example

Includes TCP client/server demo, write() syscall eBPF tracer, Makefile, and full README detailing problem, solution, architecture, and usage.

2. eBPF: add trace wolfSSL_write() and wolfSSL_read() using eBPF uprobes.

Includes:
 - TLS client and server examples
 - eBPF programs for write/read entry and read return
 - userspace loader with perf buffer handling
 - automatic symbol lookup (no hardcoded offsets)
 - x86_64 and ARM64 register handling
 - full README with usage, architecture, and explanation

Shows how to observe TLS plaintext inside applications without modifying
wolfSSL or application code.

Signed-off-by: sameeh.jubran <sameeh@wolfssl.com>
 		2025-12-24 12:10:15 +02:00
..
syscall-write-trace Add eBPF examples 2025-12-24 12:10:15 +02:00
tls-uprobe-trace Add eBPF examples 2025-12-24 12:10:15 +02:00
README.md Add eBPF examples 2025-12-24 12:10:15 +02:00

README.md

wolfSSL eBPF Examples

This directory contains eBPF-based observability examples demonstrating how Linux eBPF can be used to monitor system calls, user-space wolfSSL operations, network activity, and TLS behavior without modifying application code.

These examples are designed for:

  • debugging
  • education
  • performance tracing
  • understanding TLS internals
  • research and experimentation

All examples require:

  • Linux kernel with eBPF support (4.19+ recommended)
  • clang/LLVM (for compiling .bpf.c programs)
  • libbpf and libelf
  • root privileges
  • A recent installation of wolfSSL if running TLS examples