Socket filter to track HTTP requests for non Go #122
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mariomac
approved these changes
May 26, 2023
bpf/http_sock.c
Outdated
| @@ -53,7 +45,7 @@ int BPF_KRETPROBE(kretprobe_sock_alloc, struct socket *sock) { | |||
| return 0; | |||
| } | |||
|
|
|||
| bpf_dbg_printk("=== sock alloc %llx ===", id); | |||
| //bpf_dbg_printk("=== sock alloc %llx ===", id); | |||
There was a problem hiding this comment.
Did you forget to uncomment all these bpf_dbg_printk?
There was a problem hiding this comment.
Ah yeah! I was debugging an issue with system wide mode and there was too much output. I'll bring them back :)
Codecov Report
@@ Coverage Diff @@
## main #122 +/- ##
==========================================
- Coverage 71.78% 70.05% -1.73%
==========================================
Files 27 28 +1
Lines 1857 1927 +70
==========================================
+ Hits 1333 1350 +17
- Misses 420 471 +51
- Partials 104 106 +2
Flags with carried forward coverage won't be shown. Click here to find out more.
|
|
Thanks again Mario! |
mattdurham
pushed a commit
to mattdurham/beyla
that referenced
this pull request
Jan 22, 2025
Socket filter to track HTTP requests for non Go
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for tracking HTTP server and client requests, though a socket filter, which we can use for languages other than Go. We parse only minimal information on the eBPF side, which means we have to use a different ringbuffer structure than for Go applications. For this purpose I added an optional transformer function that takes the socket filter record and converts it to the standard HTTP trace record.
There are few things missing from this PR:
I forgot I had issues with closing the file descriptor required for the filter. I'll follow-up with the change in this PR shortly.bpf_builtins.h and compiler.h are two new headers I needed from Cilium, which bring the support for memcpy.