netlink

Documentation

Overview

Package netlink contains the bare minimum needed to partially parse netlink messages.

Package netlink contains the bare minimum needed to partially parse netlink messages.

Index

• Constants
• Variables
• type ArchivalRecord
  • func LoadAllArchivalRecords(rdr io.Reader) ([]*ArchivalRecord, error)
  • func MakeArchivalRecord(msg *NetlinkMessage, skipLocal bool) (*ArchivalRecord, error)
  • func (pm *ArchivalRecord) Compare(previous *ArchivalRecord) (ChangeType, error)
• type ArchiveReader
  • func NewArchiveReader(rdr io.Reader) ArchiveReader
  • func NewRawReader(rdr io.Reader) ArchiveReader
• type ChangeType
• type Metadata
• type NetlinkMessage
  • func LoadRawNetlinkMessage(rdr io.Reader) (*NetlinkMessage, error)
• type NetlinkRouteAttr
  • func ParseRouteAttr(b []byte) ([]NetlinkRouteAttr, error)
• type NlMsghdr
• type RtAttr

Constants

const (
	RTA_ALIGNTO    = 4
	SizeofNlMsghdr = 0x10
	SizeofNlAttr   = 0x4
	SizeofRtAttr   = 0x4

	EINVAL = syscall.Errno(0x16)
)

TODO - get these from sys/unix or syscall

Variables

var (
	ErrNotType20   = errors.New("NetlinkMessage wrong type")
	ErrParseFailed = errors.New("Unable to parse InetDiagMsg")
)

Error types.

Types

type ArchivalRecord

type ArchivalRecord struct {
	// Timestamp should be truncated to 1 millisecond for best compression.
	// Using int64 milliseconds instead reduces compressed size by 0.5 bytes/record, or about 1.5%
	Timestamp time.Time `json:",omitempty"`

	// Storing the RawIDM instead of the parsed InetDiagMsg reduces Marshalling by 2.6 usec, and
	// typical compressed size by 3-4 bytes/record
	RawIDM inetdiag.RawInetDiagMsg `json:",omitempty"` // RawInetDiagMsg within NLMsg
	// Saving just the .Value fields reduces Marshalling by 1.9 usec.
	Attributes [][]byte `json:",omitempty"` // byte slices from RouteAttr.Value, backed by NLMsg

	// Metadata contains connection level metadata.  It is typically included in the very first record
	// in a file.
	Metadata *Metadata `json:",omitempty"`
}

ArchivalRecord is a container for parsed InetDiag messages and attributes.

func LoadAllArchivalRecords

func LoadAllArchivalRecords(rdr io.Reader) ([]*ArchivalRecord, error)

LoadAllArchivalRecords reads all PMs from a jsonl stream.

func MakeArchivalRecord

func MakeArchivalRecord(msg *NetlinkMessage, skipLocal bool) (*ArchivalRecord, error)

MakeArchivalRecord parses the NetlinkMessage into a ArchivalRecord. If skipLocal is true, it will return nil for loopback, local unicast, multicast, and unspecified connections. Note that Parse does not populate the Timestamp field, so caller should do so.

func (*ArchivalRecord) Compare

func (pm *ArchivalRecord) Compare(previous *ArchivalRecord) (ChangeType, error)

Compare compares important fields to determine whether significant updates have occurred. We ignore a bunch of fields:

• The TCPInfo fields matching last_* are rapidly changing, but don't have much significance. Are they elapsed time fields?
• The InetDiagMsg.Expires is also rapidly changing in many connections, but also seems unimportant.

Significant updates are reflected in the packet, segment and byte count updates, so we generally want to record a snapshot when any of those change. They are in the latter part of the linux struct, following the pmtu field.

The simplest test that seems to tell us what we care about is to look at all the fields in the TCPInfo struct related to packets, bytes, and segments. In addition to the TCPState and CAState fields, these are probably adequate, but we also check for new or missing attributes and any attribute difference outside of the TCPInfo (INET_DIAG_INFO) attribute.

type ArchiveReader

type ArchiveReader interface {
	// Next returns the next ArchivalRecord.  Returns nil, EOF if no more records, or other error if there is a problem.
	Next() (*ArchivalRecord, error)
}

ArchiveReader produces ArchivedRecord structs from some source.

func NewArchiveReader

func NewArchiveReader(rdr io.Reader) ArchiveReader

NewArchiveReader wraps a source of JSONL ArchiveRecords to create ArchiveReader

func NewRawReader

func NewRawReader(rdr io.Reader) ArchiveReader

NewRawReader wraps an io.Reader to create and ArchiveReader

type ChangeType

type ChangeType int

ChangeType indicates why a new record is worthwhile saving.

const (
	NoMajorChange        ChangeType = iota
	IDiagStateChange                // The IDiagState changed
	NoTCPInfo                       // There is no TCPInfo attribute
	NewAttribute                    // There is a new attribute
	LostAttribute                   // There is a dropped attribute
	AttributeLength                 // The length of an attribute changed
	StateOrCounterChange            // One of the early fields in DIAG_INFO changed.
	PacketCountChange               // One of the packet/byte/segment counts (or other late field) changed
	PreviousWasNil                  // The previous message was nil
	Other                           // Some other attribute changed
)

Constants to describe the degree of change between two different ParsedMessages.

type Metadata

type Metadata struct {
	UUID      string
	Sequence  int
	StartTime time.Time
}

Metadata contains the metadata for a particular TCP stream.

type NetlinkMessage

type NetlinkMessage = syscall.NetlinkMessage

func LoadRawNetlinkMessage

func LoadRawNetlinkMessage(rdr io.Reader) (*NetlinkMessage, error)

LoadRawNetlinkMessage is a simple utility to read the next NetlinkMessage from a source reader, e.g. from a file of naked binary netlink messages. NOTE: This is a bit fragile if there are any bit errors in the message headers.

type NetlinkRouteAttr

type NetlinkRouteAttr = syscall.NetlinkRouteAttr

func ParseRouteAttr

func ParseRouteAttr(b []byte) ([]NetlinkRouteAttr, error)

ParseRouteAttr parses a byte array into slice of NetlinkRouteAttr struct. Derived from "github.com/vishvananda/netlink/nl/nl_linux.go"

type NlMsghdr

type NlMsghdr = syscall.NlMsghdr

TODO use unix instead.

type RtAttr

type RtAttr = syscall.RtAttr