trace

Documentation

Overview

Package trace defines the public types exported through the EBPF code and produced outwards from tracker-ebpf

Package trace defines the public types exported through the EBPF code and produced outwards from tracker-ebpf

Index

• Constants
• type ArgMeta
• type Argument
  • func (arg *Argument) UnmarshalJSON(b []byte) error
• type Container
• type ContextFlags
• type DnsAnswer
• type DnsQueryData
• type DnsResponseData
• type Event
  • func (e Event) Origin() EventOrigin
  • func (e Event) ToProtocol() protocol.Event
• type EventOrigin
• type File
• type HiddenKernelModule
• type HookedSymbolData
• type KernelReadType
  • func (readType KernelReadType) String() string
• type Kubernetes
• type MemProtAlert
  • func (alert MemProtAlert) String() string
• type Metadata
• type PacketDirection
  • func (dir *PacketDirection) String() string
• type PacketMetadata
• type PktMeta
• type ProtoDNS
• type ProtoDNSMX
• type ProtoDNSOPT
• type ProtoDNSQuestion
• type ProtoDNSResourceRecord
• type ProtoDNSSOA
• type ProtoDNSSRV
• type ProtoDNSURI
• type ProtoHTTP
• type ProtoHTTPRequest
• type ProtoHTTPResponse
• type ProtoICMP
• type ProtoICMPv6
• type ProtoIPv4
• type ProtoIPv6
• type ProtoTCP
• type ProtoUDP
• type SlimCred

Constants

const (
	EventSource = "tracker"
)

Types

type ArgMeta

type ArgMeta struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

ArgMeta describes an argument

type Argument

type Argument struct {
	ArgMeta
	Value interface{} `json:"value"`
}

Argument holds the information for one argument

func (*Argument) UnmarshalJSON

func (arg *Argument) UnmarshalJSON(b []byte) error

UnmarshalJSON implements the json.Unmarshaler interface. All the values in this function should be supported in finding.go in the `getCType` function and vice versa.

type Container

type Container struct {
	ID          string `json:"id,omitempty"`
	Name        string `json:"name,omitempty"`
	ImageName   string `json:"image,omitempty"`
	ImageDigest string `json:"imageDigest,omitempty"`
}

type ContextFlags

type ContextFlags struct {
	ContainerStarted bool `json:"containerStarted"`
	IsCompat         bool `json:"isCompat"`
}

ContextFlags are flags representing event context

type DnsAnswer

type DnsAnswer struct {
	Type   string `json:"answer_type"`
	Ttl    uint32 `json:"ttl"`
	Answer string `json:"answer"`
}

type DnsQueryData

type DnsQueryData struct {
	Query      string `json:"query"`
	QueryType  string `json:"query_type"`
	QueryClass string `json:"query_class"`
}

type DnsResponseData

type DnsResponseData struct {
	QueryData DnsQueryData `json:"query_data"`
	DnsAnswer []DnsAnswer  `json:"dns_answer"`
}

type Event

type Event struct {
	Timestamp             int          `json:"timestamp"`
	ThreadStartTime       int          `json:"threadStartTime"`
	ProcessorID           int          `json:"processorId"`
	ProcessID             int          `json:"processId"`
	CgroupID              uint         `json:"cgroupId"`
	ThreadID              int          `json:"threadId"`
	ParentProcessID       int          `json:"parentProcessId"`
	HostProcessID         int          `json:"hostProcessId"`
	HostThreadID          int          `json:"hostThreadId"`
	HostParentProcessID   int          `json:"hostParentProcessId"`
	UserID                int          `json:"userId"`
	MountNS               int          `json:"mountNamespace"`
	PIDNS                 int          `json:"pidNamespace"`
	ProcessName           string       `json:"processName"`
	Executable            File         `json:"executable"`
	HostName              string       `json:"hostName"`
	ContainerID           string       `json:"containerId"`
	Container             Container    `json:"container,omitempty"`
	Kubernetes            Kubernetes   `json:"kubernetes,omitempty"`
	EventID               int          `json:"eventId,string"`
	EventName             string       `json:"eventName"`
	PoliciesVersion       uint16       `json:"-"`
	MatchedPoliciesKernel uint64       `json:"-"`
	MatchedPoliciesUser   uint64       `json:"-"`
	MatchedPolicies       []string     `json:"matchedPolicies,omitempty"`
	ArgsNum               int          `json:"argsNum"`
	ReturnValue           int          `json:"returnValue"`
	Syscall               string       `json:"syscall"`
	StackAddresses        []uint64     `json:"stackAddresses"`
	ContextFlags          ContextFlags `json:"contextFlags"`
	ThreadEntityId        uint32       `json:"threadEntityId"`  // thread task unique identifier (*)
	ProcessEntityId       uint32       `json:"processEntityId"` // process unique identifier (*)
	ParentEntityId        uint32       `json:"parentEntityId"`  // parent process unique identifier (*)
	Args                  []Argument   `json:"args"`            // args are ordered according their appearance in the original event
	Metadata              *Metadata    `json:"metadata,omitempty"`
}

Event is a single result of an ebpf event process. It is used as a payload later delivered to tracker-rules.

func (Event) Origin

func (e Event) Origin() EventOrigin

Origin derive the EventOrigin of a trace.Event

func (Event) ToProtocol

func (e Event) ToProtocol() protocol.Event

Converts a trace.Event into a protocol.Event that the rules engine can consume

type EventOrigin

type EventOrigin string

EventOrigin is where a trace.Event occured, it can either be from the host machine or from a container

const (
	ContainerOrigin     EventOrigin = "container"      // Events originated from within a container, starting with the entry-point execution
	HostOrigin          EventOrigin = "host"           // Events originated from the host
	ContainerInitOrigin EventOrigin = "container-init" // Events originated from within container, before entry-point execution
)

type File

type File struct {
	Path string `json:"path"`
}

type HiddenKernelModule

type HiddenKernelModule struct {
	Name    string `json:"name"`
	Address string `json:"address"`
}

type HookedSymbolData

type HookedSymbolData struct {
	SymbolName  string
	ModuleOwner string
}

type KernelReadType

type KernelReadType int

const (
	KernelReadUnknown KernelReadType = iota
	KernelReadFirmware
	KernelReadKernelModule
	KernelReadKExecImage
	KernelReadKExecInitRAMFS
	KernelReadSecurityPolicy
	KernelReadx509Certificate
)

func (KernelReadType) String

func (readType KernelReadType) String() string

type Kubernetes

type Kubernetes struct {
	PodName      string `json:"podName,omitempty"`
	PodNamespace string `json:"podNamespace,omitempty"`
	PodUID       string `json:"podUID,omitempty"`
	PodSandbox   bool   `json:"podSandbox,omitempty"`
}

type MemProtAlert

type MemProtAlert uint32

MemProtAlert is an enum of possible messages that can be sent by an event to pass some extra information about the event.

const (
	ProtAlertUnknown MemProtAlert = iota
	ProtAlertMmapWX
	ProtAlertMprotectToX
	ProtAlertMprotectXToWX
	ProtAlertMprotectWXToX
	ProtAlertLast
)

func (MemProtAlert) String

func (alert MemProtAlert) String() string

type Metadata

type Metadata struct {
	Version     string
	Description string
	Tags        []string
	Properties  map[string]interface{}
}

Metadata is a struct that holds metadata about an event

type PacketDirection

type PacketDirection uint8

const (
	InvalidPacketDirection PacketDirection = iota
	PacketIngress
	PacketEgress
)

func (*PacketDirection) String

func (dir *PacketDirection) String() string

type PacketMetadata

type PacketMetadata struct {
	Direction PacketDirection `json:"direction"`
}

TODO: move all ip and port arguments from packet events here This can be done once this struct is filterable. In order to filter structs the move to the new event structure (from protobuf) will need to be done (see issue #2870). Once it is done, cel-go filtering can be added for struct fields.

type PktMeta

type PktMeta struct {
	SrcIP     string `json:"src_ip"`
	DstIP     string `json:"dst_ip"`
	SrcPort   uint16 `json:"src_port"`
	DstPort   uint16 `json:"dst_port"`
	Protocol  uint8  `json:"protocol"`
	PacketLen uint32 `json:"packet_len"`
	Iface     string `json:"iface"` // TODO: currently it is always "any"
}

type ProtoDNS

type ProtoDNS struct {
	ID           uint16                   `json:"ID"`
	QR           uint8                    `json:"QR"`
	OpCode       string                   `json:"opCode"`
	AA           uint8                    `json:"AA"`
	TC           uint8                    `json:"TC"`
	RD           uint8                    `json:"RD"`
	RA           uint8                    `json:"RA"`
	Z            uint8                    `json:"Z"`
	ResponseCode string                   `json:"responseCode"`
	QDCount      uint16                   `json:"QDCount"`
	ANCount      uint16                   `json:"ANCount"`
	NSCount      uint16                   `json:"NSCount"`
	ARCount      uint16                   `json:"ARCount"`
	Questions    []ProtoDNSQuestion       `json:"questions"`
	Answers      []ProtoDNSResourceRecord `json:"answers"`
	Authorities  []ProtoDNSResourceRecord `json:"authorities"`
	Additionals  []ProtoDNSResourceRecord `json:"additionals"`
}

type ProtoDNSMX

type ProtoDNSMX struct {
	Preference uint16 `json:"preference"`
	Name       string `json:"name"`
}

type ProtoDNSOPT

type ProtoDNSOPT struct {
	Code string `json:"code"`
	Data string `json:"data"`
}

type ProtoDNSQuestion

type ProtoDNSQuestion struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Class string `json:"class"`
}

type ProtoDNSResourceRecord

type ProtoDNSResourceRecord struct {
	Name  string        `json:"name"`
	Type  string        `json:"type"`
	Class string        `json:"class"`
	TTL   uint32        `json:"TTL"`
	IP    string        `json:"IP"`
	NS    string        `json:"NS"`
	CNAME string        `json:"CNAME"`
	PTR   string        `json:"PTR"`
	TXTs  []string      `json:"TXTs"`
	SOA   ProtoDNSSOA   `json:"SOA"`
	SRV   ProtoDNSSRV   `json:"SRV"`
	MX    ProtoDNSMX    `json:"MX"`
	OPT   []ProtoDNSOPT `json:"OPT"`
	URI   ProtoDNSURI   `json:"URI"`
	TXT   string        `json:"TXT"`
}

type ProtoDNSSOA

type ProtoDNSSOA struct {
	MName   string `json:"MName"`
	RName   string `json:"RName"`
	Serial  uint32 `json:"serial"`
	Refresh uint32 `json:"refresh"`
	Retry   uint32 `json:"retry"`
	Expire  uint32 `json:"expire"`
	Minimum uint32 `json:"minimum"`
}

type ProtoDNSSRV

type ProtoDNSSRV struct {
	Priority uint16 `json:"priority"`
	Weight   uint16 `json:"weight"`
	Port     uint16 `json:"port"`
	Name     string `json:"name"`
}

type ProtoDNSURI

type ProtoDNSURI struct {
	Priority uint16 `json:"priority"`
	Weight   uint16 `json:"weight"`
	Target   string `json:"target"`
}

type ProtoHTTP

type ProtoHTTP struct {
	Direction     string      `json:"direction"`
	Method        string      `json:"method"`
	Protocol      string      `json:"protocol"`
	Host          string      `json:"host"`
	URIPath       string      `json:"uri_path"`
	Status        string      `json:"status"`
	StatusCode    int         `json:"status_code"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoHTTPRequest

type ProtoHTTPRequest struct {
	Method        string      `json:"method"`
	Protocol      string      `json:"protocol"`
	Host          string      `json:"host"`
	URIPath       string      `json:"uri_path"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoHTTPResponse

type ProtoHTTPResponse struct {
	Status        string      `json:"status"`
	StatusCode    int         `json:"status_code"`
	Protocol      string      `json:"protocol"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoICMP

type ProtoICMP struct {
	TypeCode string `json:"typeCode"`
	Checksum uint16 `json:"checksum"`
	Id       uint16 `json:"id"`
	Seq      uint16 `json:"seq"`
}

type ProtoICMPv6

type ProtoICMPv6 struct {
	TypeCode string `json:"typeCode"`
	Checksum uint16 `json:"checksum"`
}

type ProtoIPv4

type ProtoIPv4 struct {
	Version    uint8  `json:"version"`
	IHL        uint8  `json:"IHL"`
	TOS        uint8  `json:"TOS"`
	Length     uint16 `json:"length"`
	Id         uint16 `json:"id"`
	Flags      uint8  `json:"flags"`
	FragOffset uint16 `json:"fragOffset"`
	TTL        uint8  `json:"TTL"`
	Protocol   string `json:"protocol"`
	Checksum   uint16 `json:"checksum"`
	SrcIP      string `json:"srcIP"`
	DstIP      string `json:"dstIP"`
}

type ProtoIPv6

type ProtoIPv6 struct {
	Version      uint8  `json:"version"`
	TrafficClass uint8  `json:"trafficClass"`
	FlowLabel    uint32 `json:"flowLabel"`
	Length       uint16 `json:"length"`
	NextHeader   string `json:"nextHeader"`
	HopLimit     uint8  `json:"hopLimit"`
	SrcIP        string `json:"srcIP"`
	DstIP        string `json:"dstIP"`
}

type ProtoTCP

type ProtoTCP struct {
	SrcPort    uint16 `json:"srcPort"`
	DstPort    uint16 `json:"dstPort"`
	Seq        uint32 `json:"seq"`
	Ack        uint32 `json:"ack"`
	DataOffset uint8  `json:"dataOffset"`
	FIN        uint8  `json:"FIN"`
	SYN        uint8  `json:"SYN"`
	RST        uint8  `json:"RST"`
	PSH        uint8  `json:"PSH"`
	ACK        uint8  `json:"ACK"`
	URG        uint8  `json:"URG"`
	ECE        uint8  `json:"ECE"`
	CWR        uint8  `json:"CWR"`
	NS         uint8  `json:"NS"`
	Window     uint16 `json:"window"`
	Checksum   uint16 `json:"checksum"`
	Urgent     uint16 `json:"urgent"`
}

type ProtoUDP

type ProtoUDP struct {
	SrcPort  uint16 `json:"srcPort"`
	DstPort  uint16 `json:"dstPort"`
	Length   uint16 `json:"length"`
	Checksum uint16 `json:"checksum"`
}

type SlimCred

type SlimCred struct {
	Uid            uint32 /* real UID of the task */
	Gid            uint32 /* real GID of the task */
	Suid           uint32 /* saved UID of the task */
	Sgid           uint32 /* saved GID of the task */
	Euid           uint32 /* effective UID of the task */
	Egid           uint32 /* effective GID of the task */
	Fsuid          uint32 /* UID for VFS ops */
	Fsgid          uint32 /* GID for VFS ops */
	UserNamespace  uint32 /* User Namespace of the of the event */
	SecureBits     uint32 /* SUID-less security management */
	CapInheritable uint64 /* caps our children can inherit */
	CapPermitted   uint64 /* caps we're permitted */
	CapEffective   uint64 /* caps we can actually use */
	CapBounding    uint64 /* capability bounding set */
	CapAmbient     uint64 /* Ambient capability set */
}

SlimCred struct is a slim version of the kernel's cred struct it is used to unmarshal binary data and therefore should match (bit by bit) to the `slim_cred_t` struct in the ebpf code. ANY CHANGE TO THIS STRUCT WILL BE REQUIRED ALSO TO bufferdecoder.SlimCred