Documentation
¶
Index ¶
- Constants
- func LoadNet() (*ebpf.CollectionSpec, error)
- func LoadNetObjects(obj interface{}, opts *ebpf.CollectionOptions) error
- type FlowFetcher
- type IPAddr
- type MacAddr
- type NetFlowId
- type NetFlowIdT
- type NetFlowMetrics
- type NetFlowMetricsT
- type NetFlowRecordT
- type NetMapSpecs
- type NetMaps
- type NetObjects
- type NetProgramSpecs
- type NetPrograms
- type NetSpecs
- type Record
Constants ¶
const MacLen = 6
Variables ¶
This section is empty.
Functions ¶
func LoadNet ¶
func LoadNet() (*ebpf.CollectionSpec, error)
LoadNet returns the embedded CollectionSpec for Net.
func LoadNetObjects ¶
func LoadNetObjects(obj interface{}, opts *ebpf.CollectionOptions) error
LoadNetObjects loads Net and converts it into a struct.
The following types are suitable as obj argument:
*NetObjects *NetPrograms *NetMaps
See ebpf.CollectionSpec.LoadAndAssign documentation for details.
Types ¶
type FlowFetcher ¶
type FlowFetcher struct {
// contains filtered or unexported fields
}
FlowFetcher reads and forwards the Flows from the Traffic Control hooks in the eBPF kernel space. It provides access both to flows that are aggregated in the kernel space (via PerfCPU hashmap) and to flows that are forwarded by the kernel via ringbuffer because could not be aggregated in the map
func NewFlowFetcher ¶
func NewFlowFetcher( sampling, cacheMaxSize int, ingress, egress bool, ) (*FlowFetcher, error)
func (*FlowFetcher) Close ¶
func (m *FlowFetcher) Close() error
Close the eBPF fetcher from the system. We don't need an "Close(iface)" method because the filters and qdiscs are automatically removed when the interface is down
func (*FlowFetcher) LookupAndDeleteMap ¶
func (m *FlowFetcher) LookupAndDeleteMap() map[NetFlowId][]NetFlowMetrics
LookupAndDeleteMap reads all the entries from the eBPF map and removes them from it. It returns a map where the key For synchronization purposes, we get/delete a whole snapshot of the flows map. This way we avoid missing packets that could be updated on the ebpf side while we process/aggregate them here Changing this method invocation by BatchLookupAndDelete could improve performance TODO: detect whether BatchLookupAndDelete is supported (Kernel>=5.6) and use it selectively Supported Lookup/Delete operations by kernel: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md Race conditions here causes that some flows are lost in high-load scenarios
func (*FlowFetcher) ReadRingBuf ¶
func (m *FlowFetcher) ReadRingBuf() (ringbuf.Record, error)
type IPAddr ¶
IPAddr encodes v4 and v6 IPs with a fixed length. IPv4 addresses are encoded as IPv6 addresses with prefix ::ffff/96 as described in https://datatracker.ietf.org/doc/html/rfc4038#section-4.2 (same behavior as Go's net.IP type)
func (*IPAddr) IntEncodeV4 ¶
IntEncodeV4 encodes an IPv4 address as an integer (in network encoding, big endian). It assumes that the passed IP is already IPv4. Otherwise it would just encode the last 4 bytes of an IPv6 address
func (*IPAddr) MarshalJSON ¶
type MacAddr ¶
func (*MacAddr) MarshalJSON ¶
type NetFlowId ¶
type NetFlowId NetFlowIdT
type NetFlowIdT ¶
type NetFlowMetrics ¶
type NetFlowMetrics NetFlowMetricsT
func (*NetFlowMetrics) Accumulate ¶
func (fm *NetFlowMetrics) Accumulate(src *NetFlowMetrics)
type NetFlowMetricsT ¶
type NetFlowRecordT ¶
type NetFlowRecordT struct {
Id NetFlowId
Metrics NetFlowMetrics
}
type NetMapSpecs ¶
type NetMapSpecs struct {
AggregatedFlows *ebpf.MapSpec `ebpf:"aggregated_flows"`
DirectFlows *ebpf.MapSpec `ebpf:"direct_flows"`
}
NetMapSpecs contains maps before they are loaded into the kernel.
It can be passed ebpf.CollectionSpec.Assign.
type NetMaps ¶
type NetMaps struct {
AggregatedFlows *ebpf.Map `ebpf:"aggregated_flows"`
DirectFlows *ebpf.Map `ebpf:"direct_flows"`
}
NetMaps contains all maps after they have been loaded into the kernel.
It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.
type NetObjects ¶
type NetObjects struct {
NetPrograms
NetMaps
}
NetObjects contains all objects after they have been loaded into the kernel.
It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.
func (*NetObjects) Close ¶
func (o *NetObjects) Close() error
type NetProgramSpecs ¶
type NetProgramSpecs struct {
EgressFlowParse *ebpf.ProgramSpec `ebpf:"egress_flow_parse"`
IngressFlowParse *ebpf.ProgramSpec `ebpf:"ingress_flow_parse"`
}
NetSpecs contains programs before they are loaded into the kernel.
It can be passed ebpf.CollectionSpec.Assign.
type NetPrograms ¶
type NetPrograms struct {
EgressFlowParse *ebpf.Program `ebpf:"egress_flow_parse"`
IngressFlowParse *ebpf.Program `ebpf:"ingress_flow_parse"`
}
NetPrograms contains all programs after they have been loaded into the kernel.
It can be passed to LoadNetObjects or ebpf.CollectionSpec.LoadAndAssign.
func (*NetPrograms) Close ¶
func (p *NetPrograms) Close() error
type NetSpecs ¶
type NetSpecs struct {
NetProgramSpecs
NetMapSpecs
}
NetSpecs contains maps and programs before they are loaded into the kernel.
It can be passed ebpf.CollectionSpec.Assign.
type Record ¶
type Record struct {
NetFlowRecordT
// TODO: redundant field from RecordMetrics. Reorganize structs
TimeFlowStart time.Time
TimeFlowEnd time.Time
Interface string
// Duplicate tells whether this flow has another duplicate so it has to be excluded from
// any metrics' aggregation (e.g. bytes/second rates between two pods).
// The reason for this field is that the same flow can be observed from multiple interfaces,
// so the agent needs to choose only a view of the same flow and mark the others as
// "exclude from aggregation". Otherwise rates, sums, etc... values would be multiplied by the
// number of interfaces this flow is observed from.
Duplicate bool
// AgentIP provides information about the source of the flow (the Agent that traced it)
AgentIP string
Metadata map[string]string
}
Record contains accumulated metrics from a flow, with extra metadata that is added from the user space
Source Files