Source-based capture of clear text from encrypted data traffic for network traffic visibility processing

At least one machine-readable storage device having instructions stored thereon, execution of which by at least one processor causes performance of operations comprising:

• for each of a plurality of packets, where each packet is associated with a different one of a plurality of connections,
• storing, in a data structure in a memory, contextual metadata for the packet and a connection pointer in association with the contextual metadata, the connection pointer corresponding to a security protocol;
• detecting a call to an encryption/decryption function implemented in a worker node, wherein the call is to trigger encryption or decryption of a packet, at least a portion of which is produced by or destined for a workload application in the worker node;
• and
• in response to detecting the call to the encryption/decryption function,
• capturing a clear text payload of the packet from an entry point or an exit point of the encryption/decryption function,
• creating a modified packet based on the captured clear text payload of the packet, including synthesizing a plurality of headers for the modified packet and appending the plurality of headers to the clear text payload, and wherein creating the modified packet further includes
• identifying the contextual metadata for the packet,
• using the contextual metadata to identify the connection pointer in the data structure, and thereby identifying a connection with which the packet is associated, and
• based on the identifying the connection with which the packet is associated, including additional metadata in at least one of the synthesized headers to indicate the connection with which the packet is associated, wherein the stored contextual metadata is indicative of a mapping between the modified packet and an encrypted packet corresponding to the modified packet within a session of the security protocol;
• and
• sending the modified packet to a processing entity that is external to the worker node.

A computer system comprising:

• a memory;
• a network interface;
• a processor coupled to the memory and the network interface and configured to perform operations comprising, for each of a plurality of packets, where each packet is associated with a different one of a plurality of connections:
• storing, in a data structure in a memory, contextual metadata for the packet and a connection pointer in association with the contextual metadata, the connection pointer corresponding to a security protocol;
• detecting a call to an encryption/decryption function implemented in a worker node, wherein the call is to trigger encryption or decryption of a packet, at least a portion of which is produced by or destined for a workload application in the worker node;
• and
• in response to detecting the call to the encryption/decryption function,
• capturing a clear text payload of the packet from an entry point or an exit point of the encryption/decryption function,
• creating a modified packet based on the captured clear text payload of the packet, including synthesizing a plurality of headers for the modified packet and appending the plurality of headers to the clear text payload, and wherein creating the modified packet further includes
• identifying the contextual metadata for the packet,
• using the contextual metadata to identify the connection pointer in the data structure, and thereby identifying a connection with which the packet is associated, wherein the stored contextual metadata is indicative of a mapping between the modified packet and an encrypted packet corresponding to the modified packet within a session of the security protocol, and
• based on the identifying the connection with which the packet is associated, including additional metadata in at least one of the synthesized headers to indicate the connection with which the packet is associated;
• and
• sending the modified packet to a processing entity that is external to the worker node.