Documentation
¶
Overview ¶
Package conntrack observes inbound connections through the kernel's connection tracking over netlink (ADR-0003). Every subscribe listens for NEW and DESTROY events and then dumps the table on a second socket, so a connection that predates the subscription is seen as well as one that opens after it: a NEW event or a dumped entry counts a connection, and a DESTROY event attributes its bytes. Only connections whose original destination is one of this host's addresses are inbound and reported (ADR-0010); everything else the kernel tracks (forwarded, outbound, loopback) is ignored at the source.
A record's connection count is the connections opened, or found live at subscription, in its window: a dumped connection is counted once at the subscribe that found it, and a DESTROY for a connection the subscription never sighted counts it once, found at close. Every connection the source observes is therefore counted, and its bytes land on a record that has one.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Source ¶
type Source struct {
Log *slog.Logger
// Classify maps a connection mark to the decision and rule id the
// observation carries. Nil classifies everything as OBSERVED with no
// rule, which is visibility mode.
Classify func(mark uint32) (innerwallv1.PolicyDecision, string)
// LocalAddresses returns the host's own addresses; net.InterfaceAddrs
// when nil.
LocalAddresses func() []netip.Addr
// Gaps records the evidence this source knows it lost; nil records
// nothing.
Gaps *collect.Gaps
// ReadBuffer is the event socket's receive buffer in bytes, set at
// every subscribe; the kernel's default when zero.
ReadBuffer int
// DumpMax caps the table entries processed from the dump at each
// subscribe, and the connections a subscription tracks to count each
// once; collect.DefaultBufferRecords when zero.
DumpMax int
// contains filtered or unexported fields
}
Source is the conntrack event source.
func (*Source) EvidenceGaps ¶
EvidenceGaps implements collect.Gapped.
Source Files