ebpf

Documentation

Index

• type BpfEvent
• type EbpfCollector
  • func NewEbpfCollector(parentCtx context.Context) *EbpfCollector
  • func (e *EbpfCollector) AttachGoTlsUprobesOnProcess(procfs string, pid uint32) []error
  • func (e *EbpfCollector) AttachSSlUprobes(pid uint32, executablePath string, version string) error
  • func (t *EbpfCollector) AttachSslUprobesOnProcess(procfs string, pid uint32) []error
  • func (e *EbpfCollector) AttachUprobesForEncrypted()
  • func (e *EbpfCollector) Done() chan struct{}
  • func (e *EbpfCollector) EbpfEvents() chan interface{}
  • func (e *EbpfCollector) EbpfProcEvents() chan interface{}
  • func (e *EbpfCollector) EbpfTcpEvents() chan interface{}
  • func (e *EbpfCollector) Init()
  • func (e *EbpfCollector) ListenEvents()
  • func (e *EbpfCollector) ListenForEncryptedReqs(pid uint32)
  • func (e *EbpfCollector) TlsAttachQueue() chan uint32
• type Program

Types

type BpfEvent

type BpfEvent interface {
	Type() string
}

type EbpfCollector

type EbpfCollector struct {
	// contains filtered or unexported fields
}

func NewEbpfCollector

func NewEbpfCollector(parentCtx context.Context) *EbpfCollector

func (*EbpfCollector) AttachGoTlsUprobesOnProcess

func (e *EbpfCollector) AttachGoTlsUprobesOnProcess(procfs string, pid uint32) []error

func (*EbpfCollector) AttachSSlUprobes

func (e *EbpfCollector) AttachSSlUprobes(pid uint32, executablePath string, version string) error

func (*EbpfCollector) AttachSslUprobesOnProcess

func (t *EbpfCollector) AttachSslUprobesOnProcess(procfs string, pid uint32) []error

func (*EbpfCollector) AttachUprobesForEncrypted

func (e *EbpfCollector) AttachUprobesForEncrypted()

runs as one goroutine

func (*EbpfCollector) Done

func (e *EbpfCollector) Done() chan struct{}

func (*EbpfCollector) EbpfEvents

func (e *EbpfCollector) EbpfEvents() chan interface{}

func (*EbpfCollector) EbpfProcEvents

func (e *EbpfCollector) EbpfProcEvents() chan interface{}

func (*EbpfCollector) EbpfTcpEvents

func (e *EbpfCollector) EbpfTcpEvents() chan interface{}

func (*EbpfCollector) Init

func (e *EbpfCollector) Init()

func (*EbpfCollector) ListenEvents

func (e *EbpfCollector) ListenEvents()

func (*EbpfCollector) ListenForEncryptedReqs

func (e *EbpfCollector) ListenForEncryptedReqs(pid uint32)

in order to prevent the memory peak at the beginning we'll attach to processes one by one

func (*EbpfCollector) TlsAttachQueue

func (e *EbpfCollector) TlsAttachQueue() chan uint32

type Program

type Program interface {
	Load()                                            // Load bpf program to kernel
	Attach()                                          // attach links to programs, in case error process must exit
	InitMaps()                                        // initialize bpf map readers, must be called before Consume
	Consume(ctx context.Context, ch chan interface{}) // consume bpf events, publishes to chan provided
	Close()                                           // release resources
}