Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
B
bcc
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Kirill Smelkov
bcc
Commits
50a74246
Commit
50a74246
authored
May 16, 2016
by
4ast
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #542 from mbertrone/master
http_filter fixes
parents
a67ef8aa
8cbc816a
Changes
3
Show whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
87 additions
and
11 deletions
+87
-11
examples/networking/http_filter/http-parse-complete.c
examples/networking/http_filter/http-parse-complete.c
+3
-5
examples/networking/http_filter/http-parse-complete.py
examples/networking/http_filter/http-parse-complete.py
+41
-4
examples/networking/http_filter/http-parse-simple.py
examples/networking/http_filter/http-parse-simple.py
+43
-2
No files found.
examples/networking/http_filter/http-parse-complete.c
View file @
50a74246
...
...
@@ -54,7 +54,7 @@ int http_filter(struct __sk_buff *skb) {
u32
payload_offset
=
0
;
u32
payload_length
=
0
;
struct
Key
key
;
struct
Leaf
leaf
;
struct
Leaf
zero
=
{
0
}
;
struct
tcp_t
*
tcp
=
cursor_advance
(
cursor
,
sizeof
(
*
tcp
));
...
...
@@ -135,9 +135,7 @@ int http_filter(struct __sk_buff *skb) {
//keep the packet and send it to userspace retruning -1
HTTP_MATCH:
//if not already present, insert into map <Key, Leaf>
leaf
.
timestamp
=
0
;
sessions
.
lookup_or_init
(
&
key
,
&
leaf
);
sessions
.
update
(
&
key
,
&
leaf
);
sessions
.
lookup_or_init
(
&
key
,
&
zero
);
//send packet to userspace returning -1
KEEP:
...
...
examples/networking/http_filter/http-parse-complete.py
View file @
50a74246
...
...
@@ -16,6 +16,7 @@ from __future__ import print_function
from
bcc
import
BPF
from
ctypes
import
*
from
struct
import
*
from
sys
import
argv
import
sys
import
socket
...
...
@@ -27,7 +28,6 @@ import time
CLEANUP_N_PACKETS
=
50
#run cleanup every CLEANUP_N_PACKETS packets received
MAX_URL_STRING_LEN
=
8192
#max url string len (usually 8K)
MAX_AGE_SECONDS
=
30
#max age entry in bpf_sessions map
#-----FUNCTIONS-BEGIN----------------------#
#convert a bin string into a string of hex char
#helper function to print raw packet in hex
...
...
@@ -73,8 +73,45 @@ def cleanup():
print
(
"cleanup exception."
)
return
#-----FUNCTIONS-END-------------------------#
#args
def
usage
():
print
(
"USAGE: %s [-i <if_name>]"
%
argv
[
0
])
print
(
""
)
print
(
"Try '%s -h' for more options."
%
argv
[
0
])
exit
()
#help
def
help
():
print
(
"USAGE: %s [-i <if_name>]"
%
argv
[
0
])
print
(
""
)
print
(
"optional arguments:"
)
print
(
" -h print this help"
)
print
(
" -i if_name select interface if_name. Default is eth0"
)
print
(
""
)
print
(
"examples:"
)
print
(
" http-parse # bind socket to eth0"
)
print
(
" http-parse -i wlan0 # bind socket to wlan0"
)
exit
()
#arguments
interface
=
"eth0"
if
len
(
argv
)
==
2
:
if
str
(
argv
[
1
])
==
'-h'
:
help
()
else
:
usage
()
if
len
(
argv
)
==
3
:
if
str
(
argv
[
1
])
==
'-i'
:
interface
=
argv
[
2
]
else
:
usage
()
if
len
(
argv
)
>
3
:
usage
()
print
(
"binding socket to '%s'"
%
interface
)
# initialize BPF - load source code from http-parse-complete.c
bpf
=
BPF
(
src_file
=
"http-parse-complete.c"
,
debug
=
0
)
...
...
@@ -84,9 +121,9 @@ bpf = BPF(src_file = "http-parse-complete.c",debug = 0)
#http://man7.org/linux/man-pages/man2/bpf.2.html
function_http_filter
=
bpf
.
load_func
(
"http_filter"
,
BPF
.
SOCKET_FILTER
)
#create raw socket, bind it to
eth0
#create raw socket, bind it to
interface
#attach bpf program to socket created
BPF
.
attach_raw_socket
(
function_http_filter
,
"eth0"
)
BPF
.
attach_raw_socket
(
function_http_filter
,
interface
)
#get file descriptor of the socket previously created inside BPF.attach_raw_socket
socket_fd
=
function_http_filter
.
sock
...
...
examples/networking/http_filter/http-parse-simple.py
View file @
50a74246
...
...
@@ -14,11 +14,52 @@
from
__future__
import
print_function
from
bcc
import
BPF
from
sys
import
argv
import
sys
import
socket
import
os
#args
def
usage
():
print
(
"USAGE: %s [-i <if_name>]"
%
argv
[
0
])
print
(
""
)
print
(
"Try '%s -h' for more options."
%
argv
[
0
])
exit
()
#help
def
help
():
print
(
"USAGE: %s [-i <if_name>]"
%
argv
[
0
])
print
(
""
)
print
(
"optional arguments:"
)
print
(
" -h print this help"
)
print
(
" -i if_name select interface if_name. Default is eth0"
)
print
(
""
)
print
(
"examples:"
)
print
(
" http-parse # bind socket to eth0"
)
print
(
" http-parse -i wlan0 # bind socket to wlan0"
)
exit
()
#arguments
interface
=
"eth0"
if
len
(
argv
)
==
2
:
if
str
(
argv
[
1
])
==
'-h'
:
help
()
else
:
usage
()
if
len
(
argv
)
==
3
:
if
str
(
argv
[
1
])
==
'-i'
:
interface
=
argv
[
2
]
else
:
usage
()
if
len
(
argv
)
>
3
:
usage
()
print
(
"binding socket to '%s'"
%
interface
)
# initialize BPF - load source code from http-parse-simple.c
bpf
=
BPF
(
src_file
=
"http-parse-simple.c"
,
debug
=
0
)
...
...
@@ -27,9 +68,9 @@ bpf = BPF(src_file = "http-parse-simple.c",debug = 0)
#http://man7.org/linux/man-pages/man2/bpf.2.html
function_http_filter
=
bpf
.
load_func
(
"http_filter"
,
BPF
.
SOCKET_FILTER
)
#create raw socket, bind it to
eth0
#create raw socket, bind it to
interface
#attach bpf program to socket created
BPF
.
attach_raw_socket
(
function_http_filter
,
"eth0"
)
BPF
.
attach_raw_socket
(
function_http_filter
,
interface
)
#get file descriptor of the socket previously created inside BPF.attach_raw_socket
socket_fd
=
function_http_filter
.
sock
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment