bpf

type BPFCollector ¶

type BPFCollector struct {
	// contains filtered or unexported fields
}

BPFCollector manages the eBPF programs, maps, and links

func NewBPFCollector(cgroupPath string) (*BPFCollector, error)

func (c *BPFCollector) Close() error

func (c *BPFCollector) DrainDeltas() ([]FlowDelta, error)

func (c *BPFCollector) LookupPIDMetadata(pid uint32) (*MonitoProcInfo, bool)

func (c *BPFCollector) ReadCounters() DiagnosticCounters

func (c *BPFCollector) StopAccounting() error

type DiagnosticCounters ¶

type DiagnosticCounters struct {
	TotalIngressPackets      uint64
	TotalEgressPackets       uint64
	SocketsRegistered        uint64
	UnattributedIngress      uint64
	UnattributedEgress       uint64
	MapErrors                uint64
	RecoveredSockets         uint64
	RecoveryErrors           uint64
	ExcludedNamespacePackets uint64
	NamespaceReadErrors      uint64
}

DiagnosticCounters represents kernel BPF health and capacity metrics

type FlowDelta ¶

type FlowDelta struct {
	PID       uint32
	Category  TrafficCategory
	RxBytes   uint64
	TxBytes   uint64
	RxPackets uint64
	TxPackets uint64
}

FlowDelta represents accumulated network delta for a PID and category

type MonitoFlowKey ¶

type MonitoFlowKey struct {
	Pid      uint32
	Category uint8
	Pad      [3]uint8
}

type MonitoFlowMetrics ¶

type MonitoFlowMetrics struct {
	Generation uint64
	RxBytes    uint64
	TxBytes    uint64
	RxPackets  uint64
	TxPackets  uint64
}

type MonitoMapSpecs ¶

type MonitoMapSpecs struct {
	AccountingScope *ebpf.MapSpec `ebpf:"accounting_scope"`
	Counters        *ebpf.MapSpec `ebpf:"counters"`
	FlowStats       *ebpf.MapSpec `ebpf:"flow_stats"`
	PidMetadata     *ebpf.MapSpec `ebpf:"pid_metadata"`
	SockOwners      *ebpf.MapSpec `ebpf:"sock_owners"`
}

MonitoMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoMaps ¶

type MonitoMaps struct {
	AccountingScope *ebpf.Map `ebpf:"accounting_scope"`
	Counters        *ebpf.Map `ebpf:"counters"`
	FlowStats       *ebpf.Map `ebpf:"flow_stats"`
	PidMetadata     *ebpf.Map `ebpf:"pid_metadata"`
	SockOwners      *ebpf.Map `ebpf:"sock_owners"`
}

MonitoMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (m *MonitoMaps) Close() error

type MonitoObjects ¶

type MonitoObjects struct {
	MonitoPrograms
	MonitoMaps
	MonitoVariables
}

MonitoObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (o *MonitoObjects) Close() error

type MonitoProcInfo ¶

type MonitoProcInfo struct {
	Pid      uint32
	Tgid     uint32
	CgroupId uint64
	Comm     [16]int8
}

type MonitoProgramSpecs ¶

type MonitoProgramSpecs struct {
	OnEgress       *ebpf.ProgramSpec `ebpf:"on_egress"`
	OnIngress      *ebpf.ProgramSpec `ebpf:"on_ingress"`
	OnSockCreate   *ebpf.ProgramSpec `ebpf:"on_sock_create"`
	OnSocketIo     *ebpf.ProgramSpec `ebpf:"on_socket_io"`
	OnSocketListen *ebpf.ProgramSpec `ebpf:"on_socket_listen"`
}

MonitoProgramSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoPrograms ¶

type MonitoPrograms struct {
	OnEgress       *ebpf.Program `ebpf:"on_egress"`
	OnIngress      *ebpf.Program `ebpf:"on_ingress"`
	OnSockCreate   *ebpf.Program `ebpf:"on_sock_create"`
	OnSocketIo     *ebpf.Program `ebpf:"on_socket_io"`
	OnSocketListen *ebpf.Program `ebpf:"on_socket_listen"`
}

MonitoPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

func (p *MonitoPrograms) Close() error

type MonitoSpecs ¶

type MonitoSpecs struct {
	MonitoProgramSpecs
	MonitoMapSpecs
	MonitoVariableSpecs
}

MonitoSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoVariableSpecs ¶

type MonitoVariableSpecs struct {
}

MonitoVariableSpecs contains global variables before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type MonitoVariables ¶

type MonitoVariables struct {
}

MonitoVariables contains all global variables after they have been loaded into the kernel.

It can be passed to LoadMonitoObjects or ebpf.CollectionSpec.LoadAndAssign.

type NamespaceScope ¶ added in v1.1.2

type NamespaceScope struct {
	SocketNetOffset uint32
	NetInumOffset   uint32
	Inum            uint32
	Pad             uint32
}

NamespaceScope is initialized before hooks attach. Offsets come from this kernel's BTF, not build-machine layouts (Ubuntu 6.8 and Fedora differ).

type TrafficCategory ¶

type TrafficCategory uint8

TrafficCategory represents the traffic destination / type

const (
	CategoryLoopback TrafficCategory = 0
	CategoryPrivate  TrafficCategory = 1
	CategoryExternal TrafficCategory = 2
	CategoryUnknown  TrafficCategory = 3
)

func (c TrafficCategory) String() string