ctmap

Documentation

Index

• Constants
• func DeleteIfUpgradeNeeded(e CtEndpoint)
• func Exists(e CtEndpoint, ipv4, ipv6 bool) bool
• func GC(m *Map, filter *GCFilter) int
• func GetInterval(mapType bpf.MapType, maxDeleteRatio float64) (interval time.Duration)
• func InitMapInfo(tcpMaxEntries, anyMaxEntries int)
• func NameIsGlobal(filename string) bool
• func WriteBPFMacros(fw io.Writer, e CtEndpoint)
• type CtEndpoint
• type CtEntry
  • func (c *CtEntry) GetValuePtr() unsafe.Pointer
  • func (c *CtEntry) String() string
• type GCFilter
• type Map
  • func GlobalMaps(ipv4, ipv6 bool) []*Map
  • func LocalMaps(e CtEndpoint, ipv4, ipv6 bool) []*Map
  • func NewMap(mapName string, mapType MapType) *Map
  • func (m *Map) DumpEntries() (string, error)
  • func (m *Map) Flush() int
• type MapType
  • func (m MapType) String() string

Constants

const (

	// Map names for TCP CT tables are retained from Cilium 1.0 naming
	// scheme to minimize disruption of ongoing connections during upgrade.
	MapNamePrefix     = "cilium_ct"
	MapNameTCP6       = MapNamePrefix + "6_"
	MapNameTCP4       = MapNamePrefix + "4_"
	MapNameTCP6Global = MapNameTCP6 + "global"
	MapNameTCP4Global = MapNameTCP4 + "global"

	// Map names for "any" protocols indicate CT for non-TCP protocols.
	MapNameAny6       = MapNamePrefix + "_any6_"
	MapNameAny4       = MapNamePrefix + "_any4_"
	MapNameAny6Global = MapNameAny6 + "global"
	MapNameAny4Global = MapNameAny4 + "global"

	MapNumEntriesLocal = 64000

	TUPLE_F_OUT     = 0
	TUPLE_F_IN      = 1
	TUPLE_F_RELATED = 2
	TUPLE_F_SERVICE = 4

	// MaxTime specifies the last possible time for GCFilter.Time
	MaxTime = math.MaxUint32
)

const (
	// MapTypeIPv4TCPLocal and friends are MapTypes which correspond to a
	// combination of the following attributes:
	// * IPv4 or IPv6;
	// * TCP or non-TCP (shortened to Any)
	// * Local (endpoint-specific) or global (endpoint-oblivious).
	MapTypeIPv4TCPLocal = iota
	MapTypeIPv6TCPLocal
	MapTypeIPv4TCPGlobal
	MapTypeIPv6TCPGlobal
	MapTypeIPv4AnyLocal
	MapTypeIPv6AnyLocal
	MapTypeIPv4AnyGlobal
	MapTypeIPv6AnyGlobal
	MapTypeMax
)

Functions

func DeleteIfUpgradeNeeded

func DeleteIfUpgradeNeeded(e CtEndpoint)

DeleteIfUpgradeNeeded attempts to open the conntrack maps associated with the specified endpoint, and delete the maps from the filesystem if any properties do not match the properties defined in this package.

The typical trigger for this is when, for example, the CT entry size changes from one version of Cilium to the next. When Cilium restarts, it may opt to restore endpoints from the prior life. Existing endpoints that use the old map style are incompatible with the new version, so the CT map must be destroyed and recreated during upgrade. By removing the old map location from the filesystem, we ensure that the next time that the endpoint is regenerated, it will recreate a new CT map with the new properties.

Note that if an existing BPF program refers to the map at the canonical paths (as fetched via the getMapPathsToKeySize() call below), then that BPF program will continue to operate on the old map, even once the map is removed from the filesystem. The old map will only be completely cleaned up once all referenced to the map are cleared - that is, all BPF programs which refer to the old map and removed/reloaded.

func Exists

func Exists(e CtEndpoint, ipv4, ipv6 bool) bool

Exists returns false if the CT maps for the specified endpoint (or global maps if nil) are not pinned to the filesystem, or true if they exist or an internal error occurs.

func GC

func GC(m *Map, filter *GCFilter) int

GC runs garbage collection for map m with name mapType with the given filter. It returns how many items were deleted from m.

func GetInterval

func GetInterval(mapType bpf.MapType, maxDeleteRatio float64) (interval time.Duration)

GetInterval returns the interval adjusted based on the deletion ratio of the last run

func InitMapInfo

func InitMapInfo(tcpMaxEntries, anyMaxEntries int)

InitMapInfo builds the information about different CT maps for the combination of L3/L4 protocols, using the specified limits on TCP vs non-TCP maps.

func NameIsGlobal

func NameIsGlobal(filename string) bool

NameIsGlobal returns true if the specified filename (basename) denotes a global conntrack map.

func WriteBPFMacros

func WriteBPFMacros(fw io.Writer, e CtEndpoint)

WriteBPFMacros writes the map names for conntrack maps into the specified writer, defining usage of the global map or local maps depending on whether the specified CtEndpoint is nil.

Types

type CtEndpoint

type CtEndpoint interface {
	GetID() uint64
}

CtEndpoint represents an endpoint for the functions required to manage conntrack maps for the endpoint.

type CtEntry

type CtEntry struct {
	RxPackets uint64 `align:"rx_packets"`
	RxBytes   uint64 `align:"rx_bytes"`
	TxPackets uint64 `align:"tx_packets"`
	TxBytes   uint64 `align:"tx_bytes"`
	Lifetime  uint32 `align:"lifetime"`
	Flags     uint16 `align:"rx_closing"`
	// RevNAT is in network byte order
	RevNAT           uint16 `align:"rev_nat_index"`
	Slave            uint16 `align:"slave"`
	TxFlagsSeen      uint8  `align:"tx_flags_seen"`
	RxFlagsSeen      uint8  `align:"rx_flags_seen"`
	SourceSecurityID uint32 `align:"src_sec_id"`
	LastTxReport     uint32 `align:"last_tx_report"`
	LastRxReport     uint32 `align:"last_rx_report"`
}

CtEntry represents an entry in the connection tracking table.

func (*CtEntry) GetValuePtr

func (c *CtEntry) GetValuePtr() unsafe.Pointer

GetValuePtr returns the unsafe.Pointer for s.

func (*CtEntry) String

func (c *CtEntry) String() string

String returns the readable format

type GCFilter

type GCFilter struct {
	// RemoveExpired enables removal of all entries that have expired
	RemoveExpired bool

	// Time is the reference timestamp to reomove expired entries. If
	// RemoveExpired is true and lifetime is lesser than Time, the entry is
	// removed
	Time uint32

	// ValidIPs is the list of valid IPs to scrub all entries for which the
	// source or destination IP is *not* matching one of the valid IPs.
	// The key is the IP in string form: net.IP.String()
	ValidIPs map[string]struct{}

	// MatchIPs is the list of IPs to remove from the conntrack table
	MatchIPs map[string]struct{}
}

GCFilter contains the necessary fields to filter the CT maps. Filtering by endpoint requires both EndpointID to be > 0 and EndpointIP to be not nil.

type Map

type Map struct {
	bpf.Map
	// contains filtered or unexported fields
}

Map represents an instance of a BPF connection tracking map.

func GlobalMaps

func GlobalMaps(ipv4, ipv6 bool) []*Map

GlobalMaps returns a slice of CT maps that are used globally by all endpoints that are not otherwise configured to use their own local maps. If ipv6 or ipv6 are false, the maps for that protocol will not be returned.

The returned maps are not yet opened.

func LocalMaps

func LocalMaps(e CtEndpoint, ipv4, ipv6 bool) []*Map

LocalMaps returns a slice of CT maps for the endpoint, which are local to the endpoint and not shared with other endpoints. If ipv4 or ipv6 are false, the maps for that protocol will not be returned.

The returned maps are not yet opened.

func NewMap

func NewMap(mapName string, mapType MapType) *Map

NewMap creates a new CT map of the specified type with the specified name.

func (*Map) DumpEntries

func (m *Map) DumpEntries() (string, error)

ToString iterates through Map m and writes the values of the ct entries in m to a string.

func (*Map) Flush

func (m *Map) Flush() int

Flush runs garbage collection for map m with the name mapType, deleting all entries. The specified map must be already opened using bpf.OpenMap().

type MapType

type MapType int

MapType is a type of connection tracking map.

func (MapType) String

func (m MapType) String() string

String renders the map type into a user-readable string.