networktracer

Documentation

Overview

Package networktracer installs the dispatcher ebpf program in each network namespace of interest. The dispatcher program runs a tail call to the actual gadget program.

This is done both for builtin gadgets and containerized gadgets. In the case of containerized gadgets, the dispatcher program is installed before knowning the actual gadget program. Once it knows the actual gadget program, the tail call map is updated.

In the case of builtin gadgets, the Run() method can be called to fetch and process events from ebpf. The containerized gadgets won't call Run() because run/tracer.go fetches and processes the events themselves. Instead, it will just call AttachProg().

The actual gadget program is instantiated only once for performance reason. The network namespace is passed to the actual gadget program via the skb->cb[0] variable.

https://github.com/inspektor-gadget/inspektor-gadget/blob/main/docs/devel/network-gadget-dispatcher.png

Index

• type Tracer
  • func NewTracer[Event any]() (_ *Tracer[Event], err error)
  • func (t *Tracer[Event]) Attach(pid uint32) error
  • func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error
  • func (t *Tracer[Event]) AttachProg(prog *ebpf.Program) error
  • func (t *Tracer[Event]) Close()
  • func (t *Tracer[Event]) Detach(pid uint32) error
  • func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error
  • func (t *Tracer[Event]) EventCallback(event any)
  • func (t *Tracer[Event]) GetMap(name string) *ebpf.Map
  • func (t *Tracer[Event]) Run(spec *ebpf.CollectionSpec, baseEvent func(ev types.Event) *Event, ...) (err error)
  • func (t *Tracer[Event]) SetEventHandler(handler any)
  • func (t *Tracer[Event]) SetSocketEnricherMap(m *ebpf.Map)

Types

type Tracer

type Tracer[Event any] struct {
	// contains filtered or unexported fields
}

func NewTracer

func NewTracer[Event any]() (_ *Tracer[Event], err error)

func (*Tracer[Event]) Attach

func (t *Tracer[Event]) Attach(pid uint32) error

func (*Tracer[Event]) AttachContainer

func (t *Tracer[Event]) AttachContainer(container *containercollection.Container) error

func (*Tracer[Event]) AttachProg

func (t *Tracer[Event]) AttachProg(prog *ebpf.Program) error

AttachProg is used directly by containerized gadgets

func (*Tracer[Event]) Close

func (t *Tracer[Event]) Close()

func (*Tracer[Event]) Detach

func (t *Tracer[Event]) Detach(pid uint32) error

func (*Tracer[Event]) DetachContainer

func (t *Tracer[Event]) DetachContainer(container *containercollection.Container) error

func (*Tracer[Event]) EventCallback

func (t *Tracer[Event]) EventCallback(event any)

EventCallback provides support for legacy pkg/gadget-collection

func (*Tracer[Event]) GetMap

func (t *Tracer[Event]) GetMap(name string) *ebpf.Map

func (*Tracer[Event]) Run

func (t *Tracer[Event]) Run(
	spec *ebpf.CollectionSpec,
	baseEvent func(ev types.Event) *Event,
	processEvent func(rawSample []byte, netns uint64) (*Event, error),
) (err error)

func (*Tracer[Event]) SetEventHandler

func (t *Tracer[Event]) SetEventHandler(handler any)

func (*Tracer[Event]) SetSocketEnricherMap

func (t *Tracer[Event]) SetSocketEnricherMap(m *ebpf.Map)