how to get http whole request content from bpftrace

Question

I Want to use bpftrace to get all the http request content of my program.

cat /etc/redhat-release

CentOS Linux release 8.0.1905 (Core)

uname -a

Linux infra-test4.18.0-305.12.1.el8_4.x86_64 #1 SMP Wed Aug 11 01:59:55 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

bpftrace bt :

BEGIN
{
  printf("Welcome to Offensive BPF... Use Ctrl-C to exit.\n");
}

tracepoint:syscalls:sys_enter_accept*
{
  @sk[tid] = args->upeer_sockaddr;
}

tracepoint:syscalls:sys_exit_accept*
/ @sk[tid] /
{
  @sys_accepted[tid] = @sk[tid];
}

tracepoint:syscalls:sys_enter_read
/ @sys_accepted[tid] /
{
  printf("->sys_enter_read for allowed thread (fd: %d)\n", args->fd);
  @sys_read[tid] = args->buf;
}

tracepoint:syscalls:sys_exit_read
{
  if (@sys_read[tid] != 0)
  {
    $len = args->ret;
    $cmd = str(@sys_read[tid], $len);
    printf("*** Command: %s\n", $cmd);
  }
}

END
{
    clear(@sk);
    clear(@sys_read);
    clear(@sys_accepted);
    printf("Exiting. Bye.\n");
}

And I star my server on 8080 and then start bpftrace :

Attaching 8 probes...
Welcome to Offensive BPF... Use Ctrl-C to exit.

then I start to curl :

curl -H "traceparent: 00-123-456-01" 127.0.0.1:8080/misc/ping -lv

The bpftrace only output :

bpftrace --unsafe http.bt
Attaching 8 probes...
Welcome to Offensive BPF... Use Ctrl-C to exit.
->sys_enter_read for allowed thread (fd: 15)
*** Command: GET /misc/ping HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: curl
->sys_enter_read for allowed thread (fd: 15)
*** Command: GET /misc/ping HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: curl

output is not the whole curl content, I don`t know why, Can anyone help?

how to get http whole request content from bpftrace

0 Answers0