activator

package
v0.13.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 23, 2026 License: Apache-2.0 Imports: 28 Imported by: 0

Documentation

Overview

Package activator contains a userspace TCP proxy that listens on a random port and loads an eBPF program to intercept and redirect packets destined to the configured ports. The activator accepts the connection, calls onAccept, signals to disable the eBPF redirect and then proxies the initial data to the defined ports as soon as something is listening.

Index

Constants

View Source 
const (
	IfaceETH0     = "eth0"
	IfaceLoopback = "lo"
)
View Source 
const (
	BPFFSPath           = "/sys/fs/bpf"
	SocketTrackerMap    = bpfMapSocketTracker
	PodKubeletAddrMapv4 = bpfMapKubeletAddrV4
	PodKubeletAddrMapv6 = bpfMapKubeletAddrV6

	ManagedByShimSuffix = "_managed_by_shim"
)
View Source 
const AttachActivatorFlag = "-zeropod-attach-activator"

Variables

View Source 
var (
	ErrMapNotFound = errors.New("bpf map could not be found")
	DefaultIfaces  = []string{IfaceLoopback, IfaceETH0}
)
View Source 
var ErrNoListeningSockets = errors.New("no listening sockets found")

Functions

func CleanPinPath added in v0.12.1 

func CleanPinPath(pid int) error

func ContainerPids added in v0.13.0 

func ContainerPids(pid int) ([]int, error)

ContainerPids returns a slice of all pids in the same pidns of pid (including pid).

func ConvertBPFTime added in v0.13.0 

func ConvertBPFTime(t uint64) (time.Time, error)

ConvertBPFTime takes the value of bpf_ktime_get_ns and converts it to a time.Time.

func GetSandboxIPs added in v0.13.0 

func GetSandboxIPs(ifaceName string) ([]netip.Addr, error)

func ManagedByShim added in v0.12.0 

func ManagedByShim(pid int) bool

ManagedByShim returns true if loading/pinning is managed by the shim itself.

func MapsPath added in v0.2.0 

func MapsPath() string

func MountBPFFS added in v0.2.0 

func MountBPFFS(path string) error

MountBPFFS executes a bpf mount on the supplied path. It has been adapted by: https://github.com/cilium/cilium/blob/cf3889af46a4058d5e89495d502fc19c10713110/pkg/bpf/bpffs_linux.go#L124

func PinPath added in v0.2.0 

func PinPath(pid int) string

func SetKubeletAddr added in v0.13.0 

func SetKubeletAddr(pid int, addr netip.Addr) error

SetKubeletAddr puts the kubelet addr in the respective BPF map for v4/v6. It will create and pin the map if it does not exist and freeze it afterwards. If the map already exists and is frozen, this is a noop.

func TCXPinned added in v0.12.0 

func TCXPinned(pid int, ifaces ...string) bool

TCXPinned returns true if all TCX programs for the pid are pinned.

Types

type Activator added in v0.13.0 

type Activator interface {
	Start(ctx context.Context, pid int, listeners Listeners, skipStart bool) error
	Started() bool
	Reset() error
	DisableRedirects() error
	AttachExec() error
	SetProxyTimeout(d time.Duration)
	SetConnectTimeout(d time.Duration)
	LastActivity(port uint16) (time.Time, error)
	Stop(ctx context.Context)
	GetListeners(ctx context.Context, pid int) []Listener
	ForwardToTarget(ctx context.Context, addr string) error
}

type BPF added in v0.2.0 

type BPF struct {
	// contains filtered or unexported fields
}

func InitBPF added in v0.2.0 

func InitBPF(pid int, log *slog.Logger, opts ...BPFOpts) (*BPF, error)

func (*BPF) AttachInNetNS added in v0.12.0 

func (bpf *BPF) AttachInNetNS(pid int, ifaces ...string) error

func (*BPF) AttachRedirector added in v0.2.0 

func (bpf *BPF) AttachRedirector(ifaces ...string) error

func (*BPF) Cleanup added in v0.2.0 

func (bpf *BPF) Cleanup() error

type BPFConfig added in v0.9.0 

type BPFConfig struct {
	// contains filtered or unexported fields
}

type BPFOpts added in v0.9.0 

type BPFOpts func(cfg *BPFConfig)

func DisablePinning added in v0.10.0 

func DisablePinning() BPFOpts

func OverrideMapSize added in v0.9.0 

func OverrideMapSize(mapSizes map[string]uint32) BPFOpts

func ShimManaged added in v0.12.0 

func ShimManaged() BPFOpts

func TrackerIgnoreLocalhost added in v0.9.2 

func TrackerIgnoreLocalhost(ignore bool) BPFOpts

type ConnHook added in v0.7.0 

type ConnHook func(net.Conn) (conn net.Conn, cont bool, err error)

type Listener added in v0.13.0 

type Listener struct {
	Port    uint16   `json:"port"`
	Network Network  `json:"network"`
	UID     uint64   `json:"uid"`
	Inode   uint32   `json:"-"`
	OrigFd  int      `json:"-"`
	FD      *os.File `json:"-"`
	// contains filtered or unexported fields
}

func (Listener) OwnsFD added in v0.13.0 

func (ln Listener) OwnsFD() bool

type Listeners added in v0.13.0 

type Listeners []Listener

func GetListenersOfPID added in v0.13.0 

func GetListenersOfPID(ctx context.Context, pid int, ignoredInodes ...uint64) (Listeners, error)

GetListenersOfPID gets all Listeners in the pid namespace.

func GetListenersOfPIDWithFD added in v0.13.0 

func GetListenersOfPIDWithFD(ctx context.Context, pid int, ignoredInodes ...uint64) (Listeners, error)

GetListenersOfPIDWithFD gets all Listeners in the pid namespace. It's the callers responsibility to close the returned listener FDs.

func (Listeners) Ports added in v0.13.0 

func (lns Listeners) Ports() []uint16

type Network added in v0.13.0 

type Network string
const (
	NetworkTCPAny   Network = "tcp"
	NetworkTCP4     Network = "tcp4"
	NetworkTCP6ONLY Network = "tcp6"
)

func GetNetworkFromSock added in v0.13.0 

func GetNetworkFromSock(fd int) (Network, error)

GetNetworkFromSock queries the socket fd to get the Network of the listening socket.

type NoActivityRecordedErr added in v0.9.0 

type NoActivityRecordedErr struct{}

func (NoActivityRecordedErr) Error added in v0.9.0 

func (err NoActivityRecordedErr) Error() string

type Option added in v0.13.0 

type Option func(s *Server)

func SetTargetAddr added in v0.13.0 

func SetTargetAddr(addr string) Option

type RestoreHook added in v0.7.0 

type RestoreHook func() (int, error)

type Server 

type Server struct {
	// contains filtered or unexported fields
}

func NewServer 

func NewServer(ctx context.Context, nn ns.NetNS, connHook ConnHook, restoreHook RestoreHook, opts ...Option) (*Server, error)

func (*Server) AttachExec added in v0.12.0 

func (s *Server) AttachExec() error

AttachExec attaches the activator using exec on itself.

func (*Server) DisableRedirects added in v0.1.0 

func (s *Server) DisableRedirects() error

func (*Server) ForwardToTarget added in v0.13.0 

func (s *Server) ForwardToTarget(_ context.Context, addr string) error

ForwardToTarget instructs the activator to forward any incoming traffic to the specified address. The connHook and restoreHook will both be disabled.

func (*Server) GetKubeletAddr added in v0.13.0 

func (s *Server) GetKubeletAddr(isV6 bool) (*netip.Addr, error)

func (*Server) GetListeners added in v0.13.0 

func (s *Server) GetListeners(ctx context.Context, pid int) []Listener

func (*Server) LastActivity added in v0.9.0 

func (s *Server) LastActivity(port uint16) (time.Time, error)

func (*Server) RedirectPort added in v0.1.0 

func (s *Server) RedirectPort(from, to uint16) error

RedirectPort redirects the port from to on ingress and to from on egress.

func (*Server) Reset added in v0.1.0 

func (s *Server) Reset() error

func (*Server) SetConnectTimeout added in v0.11.0 

func (s *Server) SetConnectTimeout(d time.Duration)

func (*Server) SetKubeletAddr added in v0.13.0 

func (s *Server) SetKubeletAddr(addr *netip.Addr)

func (*Server) SetPeekBufferSize added in v0.7.0 

func (s *Server) SetPeekBufferSize(size int)

func (*Server) SetProxyTimeout added in v0.11.0 

func (s *Server) SetProxyTimeout(d time.Duration)

func (*Server) Start 

func (s *Server) Start(ctx context.Context, _ int, listeners Listeners, skipStart bool) error

func (*Server) Started added in v0.2.0 

func (s *Server) Started() bool

func (*Server) Stop 

func (s *Server) Stop(ctx context.Context)

Source Files

View all Source files

Directories

Path Synopsis
Package reuse implements a activator.Activator using BPF_PROG_TYPE_SK_REUSEPORT
 Package reuse implements a activator.Activator using BPF_PROG_TYPE_SK_REUSEPORT

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.