ebpf

package
v1.6.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: May 21, 2024 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// DirectionUnset is a convenience value to specify an unset/removed direction field
	DirectionUnset = 0xFF
	// DirectionIngress and DirectionEgress values according to field 61 in https://www.iana.org/assignments/ipfix/ipfix.xhtml
	DirectionIngress = 0
	DirectionEgress  = 1

	InterfaceUnset = 0xFFFFFFFF
)

Variables

This section is empty.

Functions

func LoadNet

func LoadNet() (*ebpf.CollectionSpec, error)

LoadNet returns the embedded CollectionSpec for Net.

func LoadNetObjects

func LoadNetObjects(obj interface{}, opts *ebpf.CollectionOptions) error

LoadNetObjects loads Net and converts it into a struct.

The following types are suitable as obj argument:

*NetObjects
*NetPrograms
*NetMaps

See ebpf.CollectionSpec.LoadAndAssign documentation for details.

func LoadNetSk added in v1.5.0

func LoadNetSk() (*ebpf.CollectionSpec, error)

LoadNetSk returns the embedded CollectionSpec for NetSk.

func LoadNetSkObjects added in v1.5.0

func LoadNetSkObjects(obj interface{}, opts *ebpf.CollectionOptions) error

LoadNetSkObjects loads NetSk and converts it into a struct.

The following types are suitable as obj argument:

*NetSkObjects
*NetSkPrograms
*NetSkMaps

See ebpf.CollectionSpec.LoadAndAssign documentation for details.

func RecordGetters added in v1.6.0

func RecordGetters(name attr.Name) (attributes.Getter[*Record, string], bool)

RecordGetters returns the attributes.Getter function that returns the string value of a given attribute name.

Types

type FlowFetcher

type FlowFetcher struct {
	// contains filtered or unexported fields
}

FlowFetcher reads and forwards the Flows from the Traffic Control hooks in the eBPF kernel space. It provides access both to flows that are aggregated in the kernel space (via PerfCPU hashmap) and to flows that are forwarded by the kernel via ringbuffer because could not be aggregated in the map

func NewFlowFetcher

func NewFlowFetcher(
	sampling, cacheMaxSize int,
	ingress, egress bool,
) (*FlowFetcher, error)

func (*FlowFetcher) Close

func (m *FlowFetcher) Close() error

Close the eBPF fetcher from the system. We don't need an "Close(iface)" method because the filters and qdiscs are automatically removed when the interface is down

func (*FlowFetcher) LookupAndDeleteMap

func (m *FlowFetcher) LookupAndDeleteMap() map[NetFlowId][]NetFlowMetrics

LookupAndDeleteMap reads all the entries from the eBPF map and removes them from it. It returns a map where the key For synchronization purposes, we get/delete a whole snapshot of the flows map. This way we avoid missing packets that could be updated on the ebpf side while we process/aggregate them here Changing this method invocation by BatchLookupAndDelete could improve performance TODO: detect whether BatchLookupAndDelete is supported (Kernel>=5.6) and use it selectively Supported Lookup/Delete operations by kernel: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md Race conditions here causes that some flows are lost in high-load scenarios

func (*FlowFetcher) ReadRingBuf

func (m *FlowFetcher) ReadRingBuf() (ringbuf.Record, error)

func (*FlowFetcher) Register

func (m *FlowFetcher) Register(iface ifaces.Interface) error

Register and links the eBPF fetcher into the system. The program should invoke Unregister before exiting.

type IPAddr

type IPAddr [net.IPv6len]uint8

IPAddr encodes v4 and v6 IPs with a fixed length. IPv4 addresses are encoded as IPv6 addresses with prefix ::ffff/96 as described in https://datatracker.ietf.org/doc/html/rfc4038#section-4.2 (same behavior as Go's net.IP type)

func (*IPAddr) IP

func (ia *IPAddr) IP() net.IP

IP returns the net.IP equivalent object

func (*IPAddr) IntEncodeV4

func (ia *IPAddr) IntEncodeV4() uint32

IntEncodeV4 encodes an IPv4 address as an integer (in network encoding, big endian). It assumes that the passed IP is already IPv4. Otherwise it would just encode the last 4 bytes of an IPv6 address

func (*IPAddr) MarshalJSON

func (ia *IPAddr) MarshalJSON() ([]byte, error)

type NetFlowId

type NetFlowId NetFlowIdT

func (*NetFlowId) DstIP

func (fi *NetFlowId) DstIP() *IPAddr

DstIP is never null. Returned as pointer for efficiency.

func (*NetFlowId) SrcIP

func (fi *NetFlowId) SrcIP() *IPAddr

SrcIP is never null. Returned as pointer for efficiency.

type NetFlowIdT

type NetFlowIdT struct {
	SrcIp             struct{ In6U struct{ U6Addr8 [16]uint8 } }
	DstIp             struct{ In6U struct{ U6Addr8 [16]uint8 } }
	EthProtocol       uint16
	Direction         uint8
	SrcPort           uint16
	DstPort           uint16
	TransportProtocol uint8
	IfIndex           uint32
}

type NetFlowMetrics

type NetFlowMetrics NetFlowMetricsT

func (*NetFlowMetrics) Accumulate

func (fm *NetFlowMetrics) Accumulate(src *NetFlowMetrics)

type NetFlowMetricsT

type NetFlowMetricsT struct {
	Packets         uint32
	Bytes           uint64
	StartMonoTimeNs uint64
	EndMonoTimeNs   uint64
	Flags           uint16
	Errno           uint8
}

type NetFlowRecordT

type NetFlowRecordT struct {
	Id      NetFlowId
	Metrics NetFlowMetrics
}

func ReadFrom

func ReadFrom(reader io.Reader) (NetFlowRecordT, error)

ReadFrom reads a Record from a binary source, in LittleEndian order

type NetMapSpecs

type NetMapSpecs struct {
	AggregatedFlows *ebpf.MapSpec `ebpf:"aggregated_flows"`
	DirectFlows     *ebpf.MapSpec `ebpf:"direct_flows"`
}

NetMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type NetMaps

type NetMaps struct {
	AggregatedFlows *ebpf.Map `ebpf:"aggregated_flows"`
	DirectFlows     *ebpf.Map `ebpf:"direct_flows"`
}

NetMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetMaps) Close

func (m *NetMaps) Close() error

type NetObjects

type NetObjects struct {
	NetPrograms
	NetMaps
}

NetObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetObjects) Close

func (o *NetObjects) Close() error

type NetProgramSpecs

type NetProgramSpecs struct {
	EgressFlowParse  *ebpf.ProgramSpec `ebpf:"egress_flow_parse"`
	IngressFlowParse *ebpf.ProgramSpec `ebpf:"ingress_flow_parse"`
}

NetSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type NetPrograms

type NetPrograms struct {
	EgressFlowParse  *ebpf.Program `ebpf:"egress_flow_parse"`
	IngressFlowParse *ebpf.Program `ebpf:"ingress_flow_parse"`
}

NetPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetPrograms) Close

func (p *NetPrograms) Close() error

type NetSkFlowId added in v1.5.0

type NetSkFlowId NetSkFlowIdT

type NetSkFlowIdT added in v1.5.0

type NetSkFlowIdT struct {
	SrcIp             struct{ In6U struct{ U6Addr8 [16]uint8 } }
	DstIp             struct{ In6U struct{ U6Addr8 [16]uint8 } }
	EthProtocol       uint16
	Direction         uint8
	SrcPort           uint16
	DstPort           uint16
	TransportProtocol uint8
	IfIndex           uint32
}

type NetSkFlowMetrics added in v1.5.0

type NetSkFlowMetrics NetSkFlowMetricsT

type NetSkFlowMetricsT added in v1.5.0

type NetSkFlowMetricsT struct {
	Packets         uint32
	Bytes           uint64
	StartMonoTimeNs uint64
	EndMonoTimeNs   uint64
	Flags           uint16
	Errno           uint8
}

type NetSkFlowRecordT added in v1.5.0

type NetSkFlowRecordT struct {
	Id      NetSkFlowId
	Metrics NetSkFlowMetrics
}

type NetSkMapSpecs added in v1.5.0

type NetSkMapSpecs struct {
	AggregatedFlows *ebpf.MapSpec `ebpf:"aggregated_flows"`
	DirectFlows     *ebpf.MapSpec `ebpf:"direct_flows"`
}

NetSkMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type NetSkMaps added in v1.5.0

type NetSkMaps struct {
	AggregatedFlows *ebpf.Map `ebpf:"aggregated_flows"`
	DirectFlows     *ebpf.Map `ebpf:"direct_flows"`
}

NetSkMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadNetSkObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetSkMaps) Close added in v1.5.0

func (m *NetSkMaps) Close() error

type NetSkObjects added in v1.5.0

type NetSkObjects struct {
	NetSkPrograms
	NetSkMaps
}

NetSkObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadNetSkObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetSkObjects) Close added in v1.5.0

func (o *NetSkObjects) Close() error

type NetSkProgramSpecs added in v1.5.0

type NetSkProgramSpecs struct {
	SocketHttpFilter *ebpf.ProgramSpec `ebpf:"socket__http_filter"`
}

NetSkSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type NetSkPrograms added in v1.5.0

type NetSkPrograms struct {
	SocketHttpFilter *ebpf.Program `ebpf:"socket__http_filter"`
}

NetSkPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadNetSkObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*NetSkPrograms) Close added in v1.5.0

func (p *NetSkPrograms) Close() error

type NetSkSpecs added in v1.5.0

type NetSkSpecs struct {
	NetSkProgramSpecs
	NetSkMapSpecs
}

NetSkSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type NetSpecs

type NetSpecs struct {
	NetProgramSpecs
	NetMapSpecs
}

NetSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type Record

type Record struct {
	NetFlowRecordT

	// Attrs of the flow record: source/destination, Interface, Beyla IP, etc...
	Attrs RecordAttrs
}

Record contains accumulated metrics from a flow, with extra metadata that is added from the user space REMINDER: any attribute here must be also added to the functions RecordGetters and getDefinitions in pkg/internal/export/metric/definitions.go

func NewRecord

func NewRecord(
	key NetFlowId,
	metrics NetFlowMetrics,
) *Record

type RecordAttrs added in v1.4.0

type RecordAttrs struct {
	// SrcName and DstName might be set from several sources along the processing/decoration pipeline:
	// - K8s entity
	// - Host name
	// - IP
	SrcName string
	DstName string

	Interface string
	// BeylaIP provides information about the source of the flow (the Agent that traced it)
	BeylaIP  string
	Metadata map[attr.Name]string
}

type SockFlowFetcher added in v1.5.0

type SockFlowFetcher struct {
	// contains filtered or unexported fields
}

SockFlowFetcher reads and forwards the Flows from the eBPF kernel space with a socket filter implementation. It provides access both to flows that are aggregated in the kernel space (via PerfCPU hashmap) and to flows that are forwarded by the kernel via ringbuffer because could not be aggregated in the map

func NewSockFlowFetcher added in v1.5.0

func NewSockFlowFetcher(
	sampling, cacheMaxSize int,
) (*SockFlowFetcher, error)

func (*SockFlowFetcher) Close added in v1.5.0

func (m *SockFlowFetcher) Close() error

Close any resources that are taken up by the socket filter, the filter itself and some maps.

func (*SockFlowFetcher) LookupAndDeleteMap added in v1.5.0

func (m *SockFlowFetcher) LookupAndDeleteMap() map[NetFlowId][]NetFlowMetrics

LookupAndDeleteMap reads all the entries from the eBPF map and removes them from it. It returns a map where the key For synchronization purposes, we get/delete a whole snapshot of the flows map. This way we avoid missing packets that could be updated on the ebpf side while we process/aggregate them here Changing this method invocation by BatchLookupAndDelete could improve performance TODO: detect whether BatchLookupAndDelete is supported (Kernel>=5.6) and use it selectively Supported Lookup/Delete operations by kernel: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md Race conditions here causes that some flows are lost in high-load scenarios

func (*SockFlowFetcher) ReadRingBuf added in v1.5.0

func (m *SockFlowFetcher) ReadRingBuf() (ringbuf.Record, error)

func (*SockFlowFetcher) Register added in v1.5.0

func (m *SockFlowFetcher) Register(_ ifaces.Interface) error

Noop because socket filters don't require special registration for different network interfaces

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL