ebpf

type Config ¶

type Config struct {
	// QueueSize is how many DNS events may be buffered on the way to the consumer.
	QueueSize         int
	CustomBTFFilePath string
}

type DNSAnswer ¶ added in v0.1.12

type DNSAnswer struct {
	Name  string
	Type  layers.DNSType
	Class layers.DNSClass
	IP    net.IP
	CNAME string
}

type DNSEvent ¶

type DNSEvent struct {
	SrcIP     net.IP
	DstIP     net.IP
	Questions []DNSQuestion
	Answers   []DNSAnswer
}

DNSEvent is one decoded DNS message. It owns everything reachable from it.

func (e DNSEvent) String() string

type DNSQuestion ¶ added in v0.1.12

type DNSQuestion struct {
	Name  string
	Type  layers.DNSType
	Class layers.DNSClass
}

DNSQuestion and DNSAnswer are the parts of a DNS message this agent has a use for.

They are deliberately not gopacket's layers.DNSQuestion and layers.DNSResourceRecord. Those carry their names, IPs and RDATA as []byte pointing into the packet buffer and into the decoder's scratch space, and the decoder reuses both -- so a record that crossed the events channel would be rewritten underneath its reader by whichever packet arrived next. Names are held as strings here, which are copies by construction, and the only mutable field left is the IP, which the decoder clones.

The narrower shape is also honest about what is filled in. A layers.DNSResourceRecord has fifteen fields; copying the three that are read would leave the other twelve looking valid and silently wrong.

type NetworkTrafficKey ¶ added in v0.0.53

type NetworkTrafficKey struct {
	SrcIP    string
	DstIP    string
	SrcPort  uint16
	DstPort  uint16
	Protocol uint8
	Family   uint16
}

type Tracer ¶

type Tracer struct {
	// contains filtered or unexported fields
}

func NewTracer(log logr.Logger, cfg Config) *Tracer

func (t *Tracer) CollectNetworkSummary() (map[NetworkTrafficKey]TrafficSummary, error)

func (t *Tracer) Events() <-chan []DNSEvent

func (t *Tracer) Run(ctx context.Context) error

type TrafficSummary ¶ added in v0.0.53

type TrafficSummary struct {
	RxPackets uint64
	RxBytes   uint64
	TxPackets uint64
	TxBytes   uint64
}