Documentation
¶
Index ¶
Constants ¶
const ( FallbackConfigured = "configured" FallbackNoInterface = "no_interface" FallbackNotPermitted = "not_permitted" FallbackUnsupported = "unsupported" FallbackAttachFailed = "attach_failed" )
Fallback reasons. FallbackConfigured is decided by the configuration, which this package does not see; the executor reports it.
Variables ¶
This section is empty.
Functions ¶
func FallbackReason ¶ added in v0.3.0
func FallbackReason(pc PacketCount) string
FallbackReason is why pc stands in for eBPF, or empty when pc is not a fallback counter or its reason is unknown.
func GetDefaultInterface ¶
getDefaultInterface determines the default interface used when connecting to the internet
Types ¶
type Accountant ¶
type Accountant struct {
// contains filtered or unexported fields
}
Accountant accounts traffic that no connection wrapper covers. Attach returns a wrapper that accounts a connected socket as the guest reads and writes it; a job's listener is not a connected socket, and neither is a SCION connection, so the datagrams they carry would otherwise be moved without touching any limit. They are accounted here against the same per-destination and per-run limits as a connected socket.
A nil Accountant accounts nothing, which is what a run without a limiter has; the policy decision that admitted the peer is separate and always applies.
func NewAccountant ¶
func NewAccountant(limiter *app.Limiter, id uuid.UUID) *Accountant
NewAccountant returns an accountant for one run, or nil when the run has no limiter to account against.
func (*Accountant) Account ¶
func (a *Accountant) Account(ctx context.Context, direction app.TransferDirection, addr string, size int) error
Account waits until size bytes in the given direction fit within the limits of addr, which is the declared destination the traffic belongs to. It returns when the bytes are covered, or with the context's error.
type PacketCount ¶
type PacketCount interface {
// Attach associates a connection with the given ID for packet counting, returning an updated ratelimited connection.
// It is important to call [net.Conn.Close] on the received connection once done to ensure correct cleanup for ratelimiting.
// addr is the raw address string (IP or domain) used in the original policy.
Attach(conn net.Conn, id uuid.UUID, addr string) (net.Conn, error)
// SetLimit sets a bitrate limit for a specific address (IP or domain) and debuglet ID.
// If addr is a plain IP, the limit is set directly. If addr is a domain, the limit is applied to all
// currently tracked IPs for that (domain, id) pair.
SetLimit(addr string, id uuid.UUID, limit bitrate.Bitrate) error
// SetExecLimit sets a bitrate limit for all traffic associated with the given debuglet ID.
SetExecLimit(id uuid.UUID, limit bitrate.Bitrate) error
// DeleteLimit removes the bitrate limit for a specific IP address and debuglet ID.
DeleteLimit(addr netutil.IPv6, id uuid.UUID) error
// DeleteExecLimit removes the bitrate limit for all traffic associated with the given debuglet ID.
// Removing a limit that is not set succeeds.
DeleteExecLimit(id uuid.UUID) error
// Detach removes the domain→IP association for a connection that was previously attached.
Detach(addr string, id uuid.UUID, ipv6 netutil.IPv6) error
Close() error
Type() string
}
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package destinations holds the bookkeeping both packet counters keep to apply a per-destination limit given by name: which resolved addresses each debuglet's connections to that name reached.
|
Package destinations holds the bookkeeping both packet counters keep to apply a per-destination limit given by name: which resolved addresses each debuglet's connections to that name reached. |