I need to read the payload of TCP packets. The following code always print an empty payload, even though payloadSize is greater than zero. What am I doing wrong?
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
struct data_t {
unsigned pid;
unsigned uid;
unsigned short sport;
unsigned short dport;
int payloadSize;
char payload[256];
};
SEC("tp/tcp/tcp_probe")
int trace_http2_headers(struct trace_event_raw_tcp_probe *ctx) {
struct data_t data = {};
data.pid = bpf_get_current_pid_tgid() >> 32;
data.uid = bpf_get_current_uid_gid() >> 32;
bpf_probe_read(&data.sport, sizeof(data.sport),&ctx->sport);
bpf_probe_read(&data.dport, sizeof(data.dport),&ctx->dport);
bpf_probe_read(&data.payloadSize, sizeof(data.payloadSize),&ctx->data_len);
bpf_probe_read(&data.payload, 256 * sizeof(char), ctx->__data);
if (data.payloadSize ==0) return 0;
bpf_printk("PAYLOAD: %.*sn", data.payloadSize, data.payload);
return 0;
}
char LICENSE[] SEC("license") = "Dual BSD/GPL";