Attempt fix missing http calls

bpf/bpf_dbg.h

@@ -34,7 +34,7 @@ enum bpf_func_id___x { BPF_FUNC_snprintf___x = 42 /* avoid zero */ };
         if(bpf_core_enum_value_exists(enum bpf_func_id___x, BPF_FUNC_snprintf___x)) { \
             BPF_SNPRINTF(__trace__->log, sizeof(__trace__->log), fmt, ##args); \
         } else { \
-            bpf_probe_read(__trace__->log, sizeof(__trace__->log), fmt); \
+            __builtin_memcpy(__trace__->log, fmt, sizeof(__trace__->log)); \
         } \
         u64 id = bpf_get_current_pid_tgid(); \
         bpf_get_current_comm(&__trace__->comm, sizeof(__trace__->comm)); \

bpf/http_sock.c

@@ -424,8 +424,6 @@ int BPF_KPROBE(kprobe_tcp_recvmsg, struct sock *sk, struct msghdr *msg, size_t l
     u64 sock_p = (u64)sk;
     ensure_sent_event(id, &sock_p);
 
-    // Important: We must work here to remember the iovec pointer, since the msghdr structure
-    // can get modified in non-reversible way if the incoming packet is large and broken down in parts. 
     recv_args_t args = {
         .sock_ptr = (u64)sk,
         .iovec_ptr = (u64)(msg)
@@ -446,12 +444,16 @@ int BPF_KRETPROBE(kretprobe_tcp_recvmsg, int copied_len) {
 
     recv_args_t *args = bpf_map_lookup_elem(&active_recv_args, &id);
 
-    if (!args || (copied_len <= 0)) {
-        bpf_map_delete_elem(&active_recv_args, &id);
+    bpf_dbg_printk("=== tcp_recvmsg ret id=%d args=%llx copied_len %d ===", id, args, copied_len);
+
+    if (!args) {
         goto done;
     }
 
-    bpf_dbg_printk("=== tcp_recvmsg ret id=%d sock=%llx copied_len %d ===", id, args->sock_ptr, copied_len);
+    if (copied_len <= 0) {
+        bpf_map_delete_elem(&active_recv_args, &id);
+        goto done;
+    }
 
     if (!args->iovec_ptr) {
         bpf_dbg_printk("iovec_ptr found in kprobe is NULL, ignoring this tcp_recvmsg");

bpf/protocol_http.h

@@ -230,6 +230,7 @@ int protocol_http(void *ctx) {
     in->ssl = args->ssl;
 
     http_info_t *info = get_or_set_http_info(in, &args->pid_conn, args->packet_type);
+    u8 fallback = 0;
     if (!info) {
         bpf_dbg_printk("No info, pid =%d?, looking for fallback...", args->pid_conn.pid);
         info = (http_info_t *)bpf_map_lookup_elem(&ongoing_http_fallback, &args->pid_conn.conn);
@@ -238,6 +239,13 @@ int protocol_http(void *ctx) {
             //dbg_print_http_connection_info(&pid_conn->conn); // commented out since GitHub CI doesn't like this call
             return 0;
         }
+        fallback = 1;
+        task_pid(&info->pid);
+        if (args->direction == TCP_RECV) {
+            info->type = EVENT_HTTP_CLIENT;
+        } else {
+            info->type = EVENT_HTTP_REQUEST;
+        }
     } 
 
     bpf_dbg_printk("=== http_buffer_event len=%d pid=%d still_reading=%d ===", args->bytes_len, pid_from_pid_tgid(bpf_get_current_pid_tgid()), still_reading(info));
@@ -276,6 +284,9 @@ int protocol_http(void *ctx) {
         process_http_request(info, args->bytes_len, meta, args->direction, args->orig_dport);
     } else if ((args->packet_type == PACKET_TYPE_RESPONSE) && (info->status == 0)) {
         handle_http_response(args->small_buf, &args->pid_conn, info, args->bytes_len, args->direction, args->ssl);
+        if (fallback) {
+            finish_http(info, &args->pid_conn);
+        }
     } else if (still_reading(info)) {
         info->len += args->bytes_len;
     }