ebpfcommon

type BPFConnInfo ¶

type BPFConnInfo BpfConnectionInfoT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type BPFHTTP2Info ¶

type BPFHTTP2Info BpfHttp2GrpcRequestT

type BPFHTTPInfo ¶

type BPFHTTPInfo BpfHttpInfoT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type DNSInfo ¶

type DNSInfo BpfDnsReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type EBPFEventContext ¶

type EBPFEventContext struct {
	CommonPIDsFilter ServiceFilter
	SharedRingBuffer *ringBufForwarder
	EBPFMaps         map[string]*ebpf.Map
	RingBufLock      sync.Mutex
	MapsLock         sync.Mutex
	LoadLock         sync.Mutex
}

func NewEBPFEventContext() *EBPFEventContext

type EBPFParseContext ¶

type EBPFParseContext struct {
	// contains filtered or unexported fields
}

func NewEBPFParseContext(cfg *config.EBPFTracer, spansChan *msg.Queue[[]request.Span], filter ServiceFilter) *EBPFParseContext

type Filter ¶

type Filter struct {
	io.Closer
	Fd int
}

func (f *Filter) Close() error

type GoKafkaGoClientInfo ¶

type GoKafkaGoClientInfo BpfKafkaGoReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type GoMongoClientInfo ¶

type GoMongoClientInfo BpfMongoGoClientReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type GoOTelSpanTrace ¶

type GoOTelSpanTrace BpfOtelSpanT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type GoRedisClientInfo ¶

type GoRedisClientInfo BpfRedisClientReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type GoSaramaClientInfo ¶

type GoSaramaClientInfo BpfKafkaClientReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type HTTPInfo ¶

type HTTPInfo struct {
	BPFHTTPInfo
	Method     string
	URL        string
	Host       string
	Peer       string
	HeaderHost string
	Body       string
}

type HTTPRequestTrace ¶

type HTTPRequestTrace BpfHttpRequestTraceT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type IdentityPidsFilter ¶

type IdentityPidsFilter struct{}

IdentityPidsFilter is a PIDsFilter that does not filter anything. It is feasible for concrete cases like GPU tracer

func (pf *IdentityPidsFilter) AllowPID(_ uint32, _ uint32, _ *svc.Attrs, _ PIDType)

func (pf *IdentityPidsFilter) BlockPID(_ uint32, _ uint32)

func (pf *IdentityPidsFilter) CurrentPIDs(_ PIDType) map[uint32]map[uint32]svc.Attrs

func (pf *IdentityPidsFilter) Filter(inputSpans []request.Span) []request.Span

func (pf *IdentityPidsFilter) ValidPID(_ uint32, _ uint32, _ PIDType) bool

type InstrumentedLibsT ¶

type InstrumentedLibsT map[uint64]*LibModule

Hold onto Linux inode numbers of files that are already instrumented, e.g. libssl.so.3

func (libs InstrumentedLibsT) AddRef(id uint64) *LibModule

func (libs InstrumentedLibsT) At(id uint64) *LibModule

func (libs InstrumentedLibsT) Find(id uint64) *LibModule

func (libs InstrumentedLibsT) RemoveRef(id uint64) (*LibModule, error)

type Iter ¶

type Iter struct {
	Program *ebpf.Program
	Link    link.Link
}

type KafkaInfo ¶

type KafkaInfo struct {
	Operation     Operation
	Topic         string
	ClientID      string
	PartitionInfo *PartitionInfo
}

func ProcessKafkaEvent(pkt []byte, rpkt []byte, kafkaTopicUUIDToName *simplelru.LRU[kafkaparser.UUID, string]) (*KafkaInfo, bool, error)

func ProcessKafkaRequest(pkt []byte, kafkaTopicUUIDToName *simplelru.LRU[kafkaparser.UUID, string]) (*KafkaInfo, bool, error)

func ProcessPossibleKafkaEvent(event *TCPRequestInfo, pkt []byte, rpkt []byte, kafkaTopicUUIDToName *simplelru.LRU[kafkaparser.UUID, string]) (*KafkaInfo, bool, error)

type KernelLockdown ¶

type KernelLockdown uint8

const (
	KernelLockdownNone KernelLockdown = iota + 1
	KernelLockdownIntegrity
	KernelLockdownConfidentiality
	KernelLockdownOther
)

func KernelLockdownMode() KernelLockdown

type LibModule ¶

type LibModule struct {
	References uint64
	Closers    []io.Closer
}

type MisclassifiedEvent ¶

type MisclassifiedEvent struct {
	EventType int
	TCPInfo   *TCPRequestInfo
}

type MongoRequestKey ¶

type MongoRequestKey struct {
	// contains filtered or unexported fields
}

type MongoRequestValue ¶

type MongoRequestValue struct {
	RequestSections  []mongoSection
	ResponseSections []mongoSection
	StartTime        int64 // timestamp when the request was received
	EndTime          int64 // timestamp when the response was received
	Flags            int32 // Flags to indicate the state of the request
}

func ProcessMongoEvent(buf []uint8, startTime int64, endTime int64, connInfo BpfConnectionInfoT, requests PendingMongoDBRequests) (*MongoRequestValue, bool, error)

type Operation ¶

type Operation int8

const (
	Produce Operation = 0
	Fetch   Operation = 1
)

func (k Operation) String() string

type PIDInfo ¶

type PIDInfo struct {
	// contains filtered or unexported fields
}

type PIDType ¶

type PIDType uint8

const (
	PIDTypeKProbes PIDType = iota + 1
	PIDTypeGo
)

type PIDsFilter ¶

type PIDsFilter struct {
	// contains filtered or unexported fields
}

PIDsFilter keeps a thread-safe copy of the PIDs whose traces are allowed to be forwarded. Its Filter method filters the request.Span instances whose PIDs are not in the allowed list.

func (pf *PIDsFilter) AllowPID(pid, ns uint32, svc *svc.Attrs, pidType PIDType)

func (pf *PIDsFilter) BlockPID(pid, ns uint32)

func (pf *PIDsFilter) CurrentPIDs(t PIDType) map[uint32]map[uint32]svc.Attrs

func (pf *PIDsFilter) Filter(inputSpans []request.Span) []request.Span

func (pf *PIDsFilter) ValidPID(userPID, ns uint32, pidType PIDType) bool

type PartitionInfo ¶

type PartitionInfo struct {
	Partition int
	Offset    int64
}

type PendingMongoDBRequests ¶

type PendingMongoDBRequests = *expirable.LRU[MongoRequestKey, *MongoRequestValue]

type ProbeDesc ¶

type ProbeDesc struct {
	// Required, if true, will cancel the execution of the eBPF Tracer
	// if the function has not been found in the executable
	Required bool

	// The eBPF program to attach to the symbol as a uprobe (either to the
	// symbol name or to StartOffset)
	Start *ebpf.Program

	// The eBPF program to attach to the symbol either as a uretprobe or as a
	// uprobe to ReturnOffsets
	End *ebpf.Program

	// Optional offset to the start of the symbol
	StartOffset uint64

	// Optional list of the offsets of every RET instruction in the symbol
	ReturnOffsets []uint64
}

ProbeDesc holds the information of the instrumentation points of a given function/symbol

type Protocol ¶

type Protocol uint8

const (
	HTTP2 Protocol = iota + 1
	GRPC
)

type SQLRequestTrace ¶

type SQLRequestTrace BpfSqlRequestTraceT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type SectionType ¶

type SectionType uint8

https://www.mongodb.com/docs/manual/reference/mongodb-wire-protocol/#sections

type ServiceFilter ¶

type ServiceFilter interface {
	AllowPID(uint32, uint32, *svc.Attrs, PIDType)
	BlockPID(uint32, uint32)
	ValidPID(uint32, uint32, PIDType) bool
	Filter(inputSpans []request.Span) []request.Span
	CurrentPIDs(PIDType) map[uint32]map[uint32]svc.Attrs
}

func CommonPIDsFilter(c *services.DiscoveryConfig, metrics imetrics.Reporter) ServiceFilter

type SockMsg ¶

type SockMsg struct {
	io.Closer
	Program  *ebpf.Program
	MapFD    int
	AttachAs ebpf.AttachType
}

func (s *SockMsg) Close() error

type SockOps ¶

type SockOps struct {
	io.Closer
	Program       *ebpf.Program
	AttachAs      ebpf.AttachType
	SockopsCgroup link.Link
}

func (s *SockOps) Close() error

type TCPLargeBufferHeader ¶

type TCPLargeBufferHeader BpfTcpLargeBufferT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.

type TCPRequestInfo ¶

type TCPRequestInfo BpfTcpReqT

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer.