fix(ebpf): rename Apache BPF maps to avoid conflicts with nginx
- Rename apache_pid_map to apache_http_pid_map - Rename apache_read_args_map to apache_http_recv_args_map - Update all references in C code and Go loader - Attempt both tracepoints and kretprobe for Apache HTTP capture Test results: - Rocky 9 (kernel 5.14): nginx HTTP capture works perfectly - Rocky 10 (kernel 6.12): Apache HTTP capture not working (headers=0) - CentOS 8 (kernel 4.18): Apache HTTP capture not working The issue appears to be that Apache event MPM may not use recvfrom() in the same way as nginx, or uses a different code path. Further investigation needed for Apache HTTP capture. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@ -307,7 +307,7 @@ func New() (*Loader, error) {
|
||||
allowedPorts: tcObjs.AllowedPorts,
|
||||
ignoredSrc: tcObjs.IgnoredSrc,
|
||||
nginxPidMap: nginxObjs.NginxPidMap,
|
||||
apachePidMap: apacheObjs.ApachePidMap,
|
||||
apachePidMap: apacheObjs.ApacheHttpPidMap,
|
||||
SynReader: synReader,
|
||||
TLSReader: tlsReader,
|
||||
SSLReader: sslReader,
|
||||
@ -539,8 +539,8 @@ func findNginxPIDs() ([]uint32, error) {
|
||||
// kernel sys_enter_read et kretprobe __x64_sys_read.
|
||||
// Le PID Apache est ajouté à la map apache_pid_map pour filtrer les appels read().
|
||||
func (l *Loader) AttachUprobesApache() error {
|
||||
// Utilisation de Kretprobe pour __x64_sys_recvfrom
|
||||
// Apache httpd utilise recvfrom() pour lire les requêtes HTTP (similaire à nginx)
|
||||
// Utilisation de Kretprobe pour __x64_sys_recvfrom (identique à nginx)
|
||||
// Apache httpd utilise recvfrom() pour lire les requêtes HTTP
|
||||
kp, err := link.Kretprobe("__x64_sys_recvfrom",
|
||||
l.apacheObjs.KretprobeSysExitRecvfrom, &link.KprobeOptions{})
|
||||
if err != nil {
|
||||
|
||||
Reference in New Issue
Block a user