fix(ebpf): rename Apache BPF maps to avoid conflicts with nginx

- Rename apache_pid_map to apache_http_pid_map
- Rename apache_read_args_map to apache_http_recv_args_map
- Update all references in C code and Go loader
- Attempt both tracepoints and kretprobe for Apache HTTP capture

Test results:
- Rocky 9 (kernel 5.14): nginx HTTP capture works perfectly
- Rocky 10 (kernel 6.12): Apache HTTP capture not working (headers=0)
- CentOS 8 (kernel 4.18): Apache HTTP capture not working

The issue appears to be that Apache event MPM may not use recvfrom()
in the same way as nginx, or uses a different code path.

Further investigation needed for Apache HTTP capture.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jacquin Antoine
2026-04-20 16:05:54 +02:00
parent a2e0cfa2f3
commit 8d817414b3
3 changed files with 27 additions and 29 deletions

View File

@ -307,7 +307,7 @@ func New() (*Loader, error) {
allowedPorts: tcObjs.AllowedPorts,
ignoredSrc: tcObjs.IgnoredSrc,
nginxPidMap: nginxObjs.NginxPidMap,
apachePidMap: apacheObjs.ApachePidMap,
apachePidMap: apacheObjs.ApacheHttpPidMap,
SynReader: synReader,
TLSReader: tlsReader,
SSLReader: sslReader,
@ -539,8 +539,8 @@ func findNginxPIDs() ([]uint32, error) {
// kernel sys_enter_read et kretprobe __x64_sys_read.
// Le PID Apache est ajouté à la map apache_pid_map pour filtrer les appels read().
func (l *Loader) AttachUprobesApache() error {
// Utilisation de Kretprobe pour __x64_sys_recvfrom
// Apache httpd utilise recvfrom() pour lire les requêtes HTTP (similaire à nginx)
// Utilisation de Kretprobe pour __x64_sys_recvfrom (identique à nginx)
// Apache httpd utilise recvfrom() pour lire les requêtes HTTP
kp, err := link.Kretprobe("__x64_sys_recvfrom",
l.apacheObjs.KretprobeSysExitRecvfrom, &link.KprobeOptions{})
if err != nil {