ebpfcommon

package
v1.10.0-alloy Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 22, 2025 License: Apache-2.0 Imports: 35 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	FrameData         http2FrameType = 0x0
	FrameHeaders      http2FrameType = 0x1
	FramePriority     http2FrameType = 0x2
	FrameRSTStream    http2FrameType = 0x3
	FrameSettings     http2FrameType = 0x4
	FramePushPromise  http2FrameType = 0x5
	FramePing         http2FrameType = 0x6
	FrameGoAway       http2FrameType = 0x7
	FrameWindowUpdate http2FrameType = 0x8
	FrameContinuation http2FrameType = 0x9
)
View Source 
const EventTypeGoKafkaGo = 11 // Kafka-Go client from Segment-io
View Source 
const EventTypeGoRedis = 10 // Redis client for Go
View Source 
const EventTypeGoSarama = 9 // Kafka client for Go (Shopify/IBM Sarama)
View Source 
const EventTypeKHTTP = 6 // HTTP Events generated by kprobes
View Source 
const EventTypeKHTTP2 = 7 // HTTP2/gRPC Events generated by kprobes
View Source 
const EventTypeSQL = 5 // EVENT_SQL_CLIENT
View Source 
const EventTypeTCP = 8 // Unknown TCP protocol to be classified by user space
View Source 
const KafkaMaxPayload = 20 * 1024 * 1024 // 20 MB max, 1MB is default for most Kafka installations
View Source 
const KafkaMinLength = 14

Variables

View Source 
var ActiveNamespaces = make(map[uint32]uint32)
View Source 
var IntegrityModeOverride = false
View Source 
var MisclassifiedEvents = make(chan MisclassifiedEvent)

Functions

func ForwardRingbuf 

func ForwardRingbuf(
	cfg *config.EBPFTracer,
	ringbuffer *ebpf.Map,
	filter ServiceFilter,
	reader func(*config.EBPFTracer, *ringbuf.Record, ServiceFilter) (request.Span, bool, error),
	logger *slog.Logger,
	metrics imetrics.Reporter,
	closers ...io.Closer,
) func(context.Context, chan<- []request.Span)

func GoKafkaSaramaToSpan added in v1.7.0 

func GoKafkaSaramaToSpan(event *GoSaramaClientInfo, data *KafkaInfo) request.Span

func HTTPInfoEventToSpan added in v1.6.0 

func HTTPInfoEventToSpan(event BPFHTTPInfo) (request.Span, bool, error)

func HTTPRequestTraceToSpan added in v0.0.5 

func HTTPRequestTraceToSpan(trace *HTTPRequestTrace) request.Span

func KernelVersion added in v1.2.0 

func KernelVersion() (major, minor int)

Copied from https://github.com/golang/go/blob/go1.21.3/src/internal/syscall/unix/kernel_version_linux.go

func ReadBPFTraceAsSpan added in v1.7.0 

func ReadBPFTraceAsSpan(cfg *config.EBPFTracer, record *ringbuf.Record, filter ServiceFilter) (request.Span, bool, error)

func ReadGoKafkaGoRequestIntoSpan added in v1.7.0 

func ReadGoKafkaGoRequestIntoSpan(record *ringbuf.Record) (request.Span, bool, error)

func ReadGoRedisRequestIntoSpan added in v1.7.0 

func ReadGoRedisRequestIntoSpan(record *ringbuf.Record) (request.Span, bool, error)

func ReadGoSaramaRequestIntoSpan added in v1.7.0 

func ReadGoSaramaRequestIntoSpan(record *ringbuf.Record) (request.Span, bool, error)

func ReadHTTP2InfoIntoSpan added in v1.4.0 

func ReadHTTP2InfoIntoSpan(record *ringbuf.Record, filter ServiceFilter) (request.Span, bool, error)

func ReadHTTPInfoIntoSpan added in v1.3.0 

func ReadHTTPInfoIntoSpan(record *ringbuf.Record, filter ServiceFilter) (request.Span, bool, error)

func ReadSQLRequestTraceAsSpan added in v1.0.0 

func ReadSQLRequestTraceAsSpan(record *ringbuf.Record) (request.Span, bool, error)

func ReadTCPRequestIntoSpan added in v1.6.0 

func ReadTCPRequestIntoSpan(cfg *config.EBPFTracer, record *ringbuf.Record, filter ServiceFilter) (request.Span, bool, error)

nolint:cyclop

func SQLRequestTraceToSpan added in v1.0.0 

func SQLRequestTraceToSpan(trace *SQLRequestTrace) request.Span

func SharedRingbuf added in v1.3.0 

func SharedRingbuf(
	cfg *config.EBPFTracer,
	filter ServiceFilter,
	ringbuffer *ebpf.Map,
	metrics imetrics.Reporter,
) func(context.Context, []io.Closer, chan<- []request.Span)

ForwardRingbuf returns a function reads HTTPRequestTraces from an input ring buffer, accumulates them into an internal buffer, and forwards them to an output events channel, previously converted to request.Span instances.

func SupportsContextPropagation added in v1.2.0 

func SupportsContextPropagation(log *slog.Logger) bool

func SupportsEBPFLoops added in v1.2.0 

func SupportsEBPFLoops() bool

func TCPToFastCGIToSpan 

func TCPToFastCGIToSpan(trace *TCPRequestInfo, op, uri string, status int) request.Span

func TCPToKafkaToSpan added in v1.7.0 

func TCPToKafkaToSpan(trace *TCPRequestInfo, data *KafkaInfo) request.Span

func TCPToRedisToSpan added in v1.7.0 

func TCPToRedisToSpan(trace *TCPRequestInfo, op, text string, status int) request.Span

func TCPToSQLToSpan added in v1.6.0 

func TCPToSQLToSpan(trace *TCPRequestInfo, op, table, sql string, kind request.SQLKind) request.Span

Types

type BPFConnInfo added in v1.3.0 

type BPFConnInfo bpfConnectionInfoT

type BPFHTTP2Info added in v1.4.0 

type BPFHTTP2Info bpfHttp2GrpcRequestT

type BPFHTTPInfo added in v1.3.0 

type BPFHTTPInfo bpfHttpInfoT

type Filter 

type Filter struct {
	io.Closer
	Fd int
}

func (*Filter) Close 

func (f *Filter) Close() error

type GoKafkaGoClientInfo added in v1.7.0 

type GoKafkaGoClientInfo bpfKafkaGoReqT

type GoRedisClientInfo added in v1.7.0 

type GoRedisClientInfo bpfRedisClientReqT

type GoSaramaClientInfo added in v1.7.0 

type GoSaramaClientInfo bpfKafkaClientReqT

type HTTPInfo added in v1.3.0 

type HTTPInfo struct {
	BPFHTTPInfo
	Method string
	URL    string
	Host   string
	Peer   string
}

type HTTPRequestTrace 

type HTTPRequestTrace bpfHttpRequestTrace

HTTPRequestTrace contains information from an HTTP request as directly received from the eBPF layer. This contains low-level C structures for accurate binary read from ring buffer. 

type Header struct {
	MessageSize   int32
	APIKey        int16
	APIVersion    int16
	CorrelationID int32
	ClientIDSize  int16
}

type IdentityPidsFilter added in v0.3.2 

type IdentityPidsFilter struct {
	// contains filtered or unexported fields
}

IdentityPidsFilter is a PIDsFilter that does not filter anything. It is feasible for system-wide instrumenation

func (*IdentityPidsFilter) AllowPID added in v0.3.2 

func (pf *IdentityPidsFilter) AllowPID(_ uint32, _ uint32, _ *svc.Attrs, _ PIDType)

func (*IdentityPidsFilter) BlockPID added in v0.3.2 

func (pf *IdentityPidsFilter) BlockPID(_ uint32, _ uint32)

func (*IdentityPidsFilter) CurrentPIDs added in v0.3.2 

func (pf *IdentityPidsFilter) CurrentPIDs(_ PIDType) map[uint32]map[uint32]svc.Attrs

func (*IdentityPidsFilter) Filter added in v0.3.2 

func (pf *IdentityPidsFilter) Filter(inputSpans []request.Span) []request.Span

func (*IdentityPidsFilter) ValidPID added in v1.7.0 

func (pf *IdentityPidsFilter) ValidPID(_ uint32, _ uint32, _ PIDType) bool

type InstrumentedLibsT 

type InstrumentedLibsT map[uint64]*LibModule

Hold onto Linux inode numbers of files that are already instrumented, e.g. libssl.so.3

func (InstrumentedLibsT) AddRef 

func (libs InstrumentedLibsT) AddRef(id uint64) *LibModule

func (InstrumentedLibsT) At 

func (libs InstrumentedLibsT) At(id uint64) *LibModule

func (InstrumentedLibsT) Find 

func (libs InstrumentedLibsT) Find(id uint64) *LibModule

func (InstrumentedLibsT) RemoveRef 

func (libs InstrumentedLibsT) RemoveRef(id uint64) (*LibModule, error)

type KafkaInfo added in v1.7.0 

type KafkaInfo struct {
	Operation   Operation
	Topic       string
	ClientID    string
	TopicOffset int
}

func ProcessKafkaRequest added in v1.7.0 

func ProcessKafkaRequest(pkt []byte) (*KafkaInfo, error)

https://kafka.apache.org/protocol.html

func ProcessPossibleKafkaEvent added in v1.7.0 

func ProcessPossibleKafkaEvent(event *TCPRequestInfo, pkt []byte, rpkt []byte) (*KafkaInfo, error)

ProcessKafkaRequest processes a TCP packet and returns error if the packet is not a valid Kafka request. Otherwise, return kafka.Info with the processed data.

type KernelLockdown added in v1.1.0 

type KernelLockdown uint8
const (
	KernelLockdownNone KernelLockdown = iota + 1
	KernelLockdownIntegrity
	KernelLockdownConfidentiality
	KernelLockdownOther
)

func KernelLockdownMode added in v1.1.0 

func KernelLockdownMode() KernelLockdown

type LibModule 

type LibModule struct {
	References uint64
	Closers    []io.Closer
}

type MisclassifiedEvent added in v1.7.0 

type MisclassifiedEvent struct {
	EventType int
	TCPInfo   *TCPRequestInfo
}

type Operation added in v1.7.0 

type Operation int8
const (
	Produce Operation = 0
	Fetch   Operation = 1
)

func (Operation) String added in v1.7.0 

func (k Operation) String() string

type PIDInfo added in v1.3.0 

type PIDInfo struct {
	// contains filtered or unexported fields
}

type PIDType added in v1.3.0 

type PIDType uint8
const (
	PIDTypeKProbes PIDType = iota + 1
	PIDTypeGo
)

type PIDsFilter added in v0.3.2 

type PIDsFilter struct {
	// contains filtered or unexported fields
}

PIDsFilter keeps a thread-safe copy of the PIDs whose traces are allowed to be forwarded. Its Filter method filters the request.Span instances whose PIDs are not in the allowed list.

func (*PIDsFilter) AllowPID added in v0.3.2 

func (pf *PIDsFilter) AllowPID(pid, ns uint32, svc *svc.Attrs, pidType PIDType)

func (*PIDsFilter) BlockPID added in v0.3.2 

func (pf *PIDsFilter) BlockPID(pid, ns uint32)

func (*PIDsFilter) CurrentPIDs added in v0.3.2 

func (pf *PIDsFilter) CurrentPIDs(t PIDType) map[uint32]map[uint32]svc.Attrs

func (*PIDsFilter) Filter added in v0.3.2 

func (pf *PIDsFilter) Filter(inputSpans []request.Span) []request.Span

func (*PIDsFilter) ValidPID added in v1.7.0 

func (pf *PIDsFilter) ValidPID(userPID, ns uint32, pidType PIDType) bool

type ProbeDesc 

type ProbeDesc struct {
	// Required, if true, will cancel the execution of the eBPF Tracer
	// if the function has not been found in the executable
	Required bool

	// The eBPF program to attach to the symbol as a uprobe (either to the
	// symbol name or to StartOffset)
	Start *ebpf.Program

	// The eBPF program to attach to the symbol either as a uretprobe or as a
	// uprobe to ReturnOffsets
	End *ebpf.Program

	// Optional offset to the start of the symbol
	StartOffset uint64

	// Optional list of the offsets of every RET instruction in the symbol
	ReturnOffsets []uint64
}

ProbeDesc holds the information of the instrumentation points of a given function/symbol

type Protocol added in v1.4.0 

type Protocol uint8
const (
	HTTP2 Protocol = iota + 1
	GRPC
)

The following consts need to coincide with some C identifiers: EVENT_HTTP_REQUEST, EVENT_GRPC_REQUEST, EVENT_HTTP_CLIENT, EVENT_GRPC_CLIENT, EVENT_SQL_CLIENT

type SQLRequestTrace added in v1.0.0 

type SQLRequestTrace bpfSqlRequestTrace

type ServiceFilter added in v1.3.0 

type ServiceFilter interface {
	AllowPID(uint32, uint32, *svc.Attrs, PIDType)
	BlockPID(uint32, uint32)
	ValidPID(uint32, uint32, PIDType) bool
	Filter(inputSpans []request.Span) []request.Span
	CurrentPIDs(PIDType) map[uint32]map[uint32]svc.Attrs
}

func CommonPIDsFilter added in v1.1.0 

func CommonPIDsFilter(c *services.DiscoveryConfig) ServiceFilter

type SockMsg 

type SockMsg struct {
	io.Closer
	Program  *ebpf.Program
	MapFD    int
	AttachAs ebpf.AttachType
}

func (*SockMsg) Close 

func (s *SockMsg) Close() error

type SockOps 

type SockOps struct {
	io.Closer
	Program       *ebpf.Program
	AttachAs      ebpf.AttachType
	SockopsCgroup link.Link
}

func (*SockOps) Close 

func (s *SockOps) Close() error

type TCPRequestInfo added in v1.6.0 

type TCPRequestInfo bpfTcpReqT

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.