network

package
v0.8.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 23, 2020 License: Apache-2.0 Imports: 17 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// DEBUGCLIENT is the ClientID for debugging
	DEBUGCLIENT = "-1"
)
View Source 
const (
	MaxStateMapSize = 10000
)

This const limits the maximum size of the state map. Benchmark results show that allocated space is less than 3MB for 10000 entries.

Variables

This section is empty.

Functions

func BeautifyKey 

func BeautifyKey(key string) string

BeautifyKey returns a human readable byte key (used for debugging purposes) it should be in sync with ByteKey Note: This is only used in /debug/* endpoints

func ConnectionSummary 

func ConnectionSummary(c ConnectionStats, names map[util.Address][]string) string

ConnectionSummary returns a string summarizing a connection

func IsBlacklistedConnection 

func IsBlacklistedConnection(scf []*ConnectionFilter, dcf []*ConnectionFilter, conn *ConnectionStats) bool

IsBlacklistedConnection returns true if a given connection should be excluded by the tracer based on user defined filters

Types

type ConnTypeFilter 

type ConnTypeFilter struct {
	TCP bool
	UDP bool
}

ConnTypeFilter holds user-defined protocols

type ConnectionDirection 

type ConnectionDirection uint8

ConnectionDirection indicates if the connection is incoming to the host or outbound 

const (
	// INCOMING represents connections inbound to the host
	INCOMING ConnectionDirection = 1

	// OUTGOING represents outbound connections from the host
	OUTGOING ConnectionDirection = 2

	// LOCAL represents connections that don't leave the host
	LOCAL ConnectionDirection = 3

	// NONE represents connections that have no direction (udp, for example)
	NONE ConnectionDirection = 4
)

func (ConnectionDirection) String 

func (d ConnectionDirection) String() string

type ConnectionFamily 

type ConnectionFamily uint8

ConnectionFamily will be either v4 or v6 

const (
	// AFINET represents v4 connections
	AFINET ConnectionFamily = 0

	// AFINET6 represents v6 connections
	AFINET6 ConnectionFamily = 1
)

type ConnectionFilter 

type ConnectionFilter struct {
	IP       *net.IPNet // If nil, then all IPs will be considered matching.
	AllPorts ConnTypeFilter

	Ports map[uint16]ConnTypeFilter
}

ConnectionFilter holds a user-defined blacklisted IP/CIDR, and ports

func ParseConnectionFilters 

func ParseConnectionFilters(filters map[string][]string) (blacklist []*ConnectionFilter)

ParseConnectionFilters takes the user defined blacklist and returns a slice of ConnectionFilters

type ConnectionStats 

type ConnectionStats struct {
	Source util.Address
	Dest   util.Address

	MonotonicSentBytes uint64
	LastSentBytes      uint64

	MonotonicRecvBytes uint64
	LastRecvBytes      uint64

	// Last time the stats for this connection were updated
	LastUpdateEpoch uint64

	MonotonicRetransmits uint32
	LastRetransmits      uint32

	RTT    uint32 // Stored in µs
	RTTVar uint32

	Pid   uint32
	NetNS uint32

	SPort                  uint16
	DPort                  uint16
	Type                   ConnectionType
	Family                 ConnectionFamily
	Direction              ConnectionDirection
	IPTranslation          *IPTranslation
	IntraHost              bool
	DNSSuccessfulResponses uint32
	DNSFailedResponses     uint32
	DNSTimeouts            uint32
	DNSSuccessLatencySum   uint64
	DNSFailureLatencySum   uint64
}

ConnectionStats stores statistics for a single connection. Field order in the struct should be 8-byte aligned

func (ConnectionStats) ByteKey 

func (c ConnectionStats) ByteKey(buffer *bytes.Buffer) ([]byte, error)

ByteKey returns a unique key for this connection represented as a byte array It's as following: 

32b     16b     16b      4b      4b     32/128b      32/128b

| PID | SPORT | DPORT | Family | Type | SrcAddr | DestAddr

func (ConnectionStats) String 

func (c ConnectionStats) String() string

type ConnectionType 

type ConnectionType uint8

ConnectionType will be either TCP or UDP 

const (
	// TCP connection type
	TCP ConnectionType = 0

	// UDP connection type
	UDP ConnectionType = 1
)

func (ConnectionType) String 

func (c ConnectionType) String() string

type Connections 

type Connections struct {
	DNS       map[util.Address][]string
	Conns     []ConnectionStats
	Telemetry *ConnectionsTelemetry
}

Connections wraps a collection of ConnectionStats

type ConnectionsTelemetry 

type ConnectionsTelemetry struct {
	MonotonicKprobesTriggered          int64
	MonotonicKprobesMissed             int64
	MonotonicConntrackRegisters        int64
	MonotonicConntrackRegistersDropped int64
	MonotonicDNSPacketsProcessed       int64
	MonotonicConnsClosed               int64
	ConnsBpfMapSize                    int64
}

ConnectionsTelemetry stores telemetry from the system probe

type DNSPacketType 

type DNSPacketType uint8

DNSPacketType tells us whether the packet is a query or a reply (successful/failed) 

const (
	// SuccessfulResponse means the packet contains a DNS response and the response code is 0 (no error)
	SuccessfulResponse DNSPacketType = iota
	// FailedResponse means the packet contains a DNS response and the response code is not 0
	FailedResponse
	// Query means the packet contains a DNS query
	Query
)

type IPTranslation 

type IPTranslation struct {
	ReplSrcIP   util.Address
	ReplDstIP   util.Address
	ReplSrcPort uint16
	ReplDstPort uint16
}

IPTranslation can be associated with a connection to show the connection is NAT'd

type PortMapping 

type PortMapping struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

PortMapping tracks which ports a pid is listening on

func NewPortMapping 

func NewPortMapping(procRoot string, collectTCP, collectIPv6 bool) *PortMapping

NewPortMapping creates a new PortMapping instance

func (*PortMapping) AddMapping 

func (pm *PortMapping) AddMapping(port uint16)

AddMapping indicates that something is listening on the provided port

func (*PortMapping) IsListening 

func (pm *PortMapping) IsListening(port uint16) bool

IsListening returns true if something is listening on the given port

func (*PortMapping) ReadInitialState 

func (pm *PortMapping) ReadInitialState() error

ReadInitialState reads the /proc filesystem and determines which ports are being listened on

func (*PortMapping) ReadInitialUDPState 

func (pm *PortMapping) ReadInitialUDPState() error

ReadInitialUDPState reads the /proc filesystem and determines which ports are being used as UDP server

func (*PortMapping) RemoveMapping 

func (pm *PortMapping) RemoveMapping(port uint16)

RemoveMapping indicates that the provided port is no longer being listened on

type ReverseDNS 

type ReverseDNS interface {
	Resolve([]ConnectionStats) map[util.Address][]string
	GetDNSStats() map[dnsKey]dnsStats
	GetStats() map[string]int64
	Close()
}

ReverseDNS translates IPs to names

func NewNullReverseDNS 

func NewNullReverseDNS() ReverseDNS

NewNullReverseDNS returns a dummy implementation of ReverseDNS

type State 

type State interface {
	// Connections returns the list of connections for the given client when provided the latest set of active connections
	Connections(
		clientID string,
		latestTime uint64,
		latestConns []ConnectionStats,
		dns map[dnsKey]dnsStats,
	) []ConnectionStats

	// StoreClosedConnection stores a new closed connection
	StoreClosedConnection(conn ConnectionStats)

	// RemoveClient stops tracking stateful data for a given client
	RemoveClient(clientID string)

	// RemoveExpiredClients removes expired clients from the state
	RemoveExpiredClients(now time.Time)

	// RemoveConnections removes the given keys from the state
	RemoveConnections(keys []string)

	// GetStats returns a map of statistics about the current network state
	GetStats() map[string]interface{}

	// DebugState returns a map with the current network state for a client ID
	DumpState(clientID string) map[string]interface{}
}

State takes care of handling the logic for: - closed connections - sent and received bytes per connection

func NewState 

func NewState(clientExpiry time.Duration, maxClosedConns, maxClientStats int, maxDNSStats int) State

NewState creates a new network state

Source Files

View all Source files

Directories

Path Synopsis
payload module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.