ugwis / ebpf-http-parser

Parse HTTP(S) requests by eBPF hooks without APM

eBPF HTTP Parser

Installation (self-build)

requirements

• LLVM Clang 9
• Go runtime

$ make
$ ./parser

https://github.com/cilium/ebpf/blob/0d439865ca157accbc60cc6f3cbeb028fa7901cb/testdata/docker/Dockerfile The Dockerfile of cilium/ebpf will be a reference for building environment.

Supported hooks

• HTTP with sys_send() / sys_recv()
• HTTP with sys_sendto() / sys_recvfrom()
• HTTP with sys_write() / sys_read()

Unsupported hooks (ToDo)

• HTTPS with Golang net/http Library
• HTTPS with OpenSSL
• HTTPS with LibreSSL
• HTTPS with GnuSSL
• HTTPS with BoringSSL
• HTTP/2 with nghttp2