Documentation
¶
Index ¶
- Constants
- Variables
- type ProtoEventKey
- type ProtoFilter
- func (p *ProtoFilter) AddProtocols(pair *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (p *ProtoFilter) Attach(cgPath string) (link.Link, error)
- func (p *ProtoFilter) DeleteProtocols(pair *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (p *ProtoFilter) FlagIdx(idx uint8) (bool, error)
- func (p *ProtoFilter) ReadProtoEvents() (map[ProtoEventKey]uint32, error)
- func (p *ProtoFilter) RunPacket(data []byte) (uint32, error)
- func (p *ProtoFilter) SeedProtoEvent(target Target, decision runtimeevent.KernelDecision, count uint32) error
- func (p *ProtoFilter) SetFlagIdx(idx uint8, val bool)
- type Target
Constants ¶
const ( DEFAULT_DENY = 1 // OBSERVE is LEARNING_MODE in the C. OBSERVE = 2 )
Flag bit indices in the BPF `flags` array map, mirroring the defines in _cprog/maps.h; the C program tests `*f & (1 << IDX)`.
Variables ¶
var ErrNotLoaded = errors.New("protofilter: bpf objects not loaded")
ErrNotLoaded is returned by map-touching methods when the BPF objects are not loaded (a filter built by a test, or a failed load).
Functions ¶
This section is empty.
Types ¶
type ProtoEventKey ¶
type ProtoEventKey struct {
Protocol string
ALPN string
Decision runtimeevent.KernelDecision
}
ProtoEventKey identifies one observation counter: a classified protocol plus the enforcement decision the kernel program applied to the flow.
type ProtoFilter ¶
type ProtoFilter struct {
// contains filtered or unexported fields
}
func (*ProtoFilter) AddProtocols ¶
func (p *ProtoFilter) AddProtocols(pair *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
AddProtocols programs the allow and deny targets of pair into the BPF maps. Targets ParseTargets cannot represent are returned as typed rejections and logged; err covers only map-write failures. Both may be non-empty at once.
func (*ProtoFilter) DeleteProtocols ¶
func (p *ProtoFilter) DeleteProtocols(pair *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
DeleteProtocols removes the allow and deny targets of pair from the BPF maps. Rejections are reported for symmetry with AddProtocols: a target that was never programmed cannot be removed either.
func (*ProtoFilter) FlagIdx ¶
func (p *ProtoFilter) FlagIdx(idx uint8) (bool, error)
FlagIdx reports whether bit idx is set. It panics on an out-of-range idx.
func (*ProtoFilter) ReadProtoEvents ¶
func (p *ProtoFilter) ReadProtoEvents() (map[ProtoEventKey]uint32, error)
ReadProtoEvents reads and resets the proto_events counter map, so each poll reports a delta rather than a running total. Entries whose counter is zero are omitted; entries whose key cannot be decoded are counted in the error, never dropped silently.
func (*ProtoFilter) RunPacket ¶
func (p *ProtoFilter) RunPacket(data []byte) (uint32, error)
RunPacket drives proto_egress over one synthetic packet via BPF_PROG_TEST_RUN and returns the verdict: 1 pass, 0 drop. data must start at the Ethernet header: the kernel derives skb->protocol from its ethertype and strips it, so the program still reads from L3 as it does on the cgroup hook. It exists for the kernel smoke test in test/e2e, which pins the classifier against hand-built packet shapes; production packets arrive via the cgroup attachment.
func (*ProtoFilter) SeedProtoEvent ¶
func (p *ProtoFilter) SeedProtoEvent(target Target, decision runtimeevent.KernelDecision, count uint32) error
SeedProtoEvent writes one observation entry through the proto_events map handle. It exists for the kernel smoke test in test/e2e, which pins the key marshaling seam; production counting happens in the BPF program.
func (*ProtoFilter) SetFlagIdx ¶
func (p *ProtoFilter) SetFlagIdx(idx uint8, val bool)
SetFlagIdx sets or clears bit idx of the flags map. It panics on an out-of-range idx, which can only be a programming error.
type Target ¶
Target is one protocol the maps can hold. ALPN is non-empty only for a tls/<alpn> value; an empty ALPN programmed for tls matches any ALPN.
func ParseTargets ¶
func ParseTargets(values []string) (targets []Target, star bool, rejected []compiler.RejectedTarget)
ParseTargets converts policy-authored protocol target strings into the targets the protocol maps can hold. The value schema is defined once, in compiler.ParseProtocolValue, and every token it accepts is programmable, so no narrowing happens here; a rejection carries the parser's own message.
- a protocol token (ssh, tls, tls/<alpn>, dns, http/1.1, http/2, quic) yields one target
- compiler.StarTarget ("*") sets star, the default-deny sentinel, and yields no target
- everything else is returned in rejected
Targets are de-duplicated, preserving first-seen order.
Source Files