bpf

Documentation

Index

• func ConsumeEvents[T Event](ctx context.Context, log *slog.Logger, evReader *ringbuf.Reader, evCh chan *T)
• func ProcessNetworkEvent(event *NetworkEvent, pod string, log *slog.Logger)
• func ProcessSyscallEvent(event *SyscallEvent, pod string, log *slog.Logger)
• type Event
• type KBContext
  • func Attach(log *slog.Logger, bpfProgramElf string) (*KBContext, error)
• type KProbeMeta
• type NetworkEvent
• type NetworkEventDirection
  • func (d NetworkEventDirection) String() string
• type NetworkEventProtocol
  • func (p NetworkEventProtocol) String() string
• type SyscallEvent
  • func (s SyscallEvent) GetSyscallName() string
• type TpMeta

Functions

func ConsumeEvents

func ConsumeEvents[T Event](
	ctx context.Context,
	log *slog.Logger,
	evReader *ringbuf.Reader,
	evCh chan *T,
)

func ProcessNetworkEvent

func ProcessNetworkEvent(
	event *NetworkEvent,
	pod string,
	log *slog.Logger,
)

func ProcessSyscallEvent

func ProcessSyscallEvent(
	event *SyscallEvent,
	pod string,
	log *slog.Logger,
)

Types

type Event

type Event interface {
	SyscallEvent | NetworkEvent
}

type KBContext

type KBContext struct {
	SyscallRingBuffer *ringbuf.Reader
	NetworkRingBuffer *ringbuf.Reader

	Tps []link.Link
	Kps []link.Link
}

Define a Kernel BPF context.

func Attach

func Attach(
	log *slog.Logger,
	bpfProgramElf string,
) (*KBContext, error)

type KProbeMeta

type KProbeMeta struct {
	// contains filtered or unexported fields
}

Struct that holds bpf kprobe required metadata

type NetworkEvent

type NetworkEvent struct {
	Pid      uint64
	CgroupID uint64
	Size     uint64

	Saddr uint32
	Daddr uint32

	Sport uint16
	Dport uint16

	Direction NetworkEventDirection
	Protocol  NetworkEventProtocol
}

type NetworkEventDirection

type NetworkEventDirection uint8

const (
	NetworkEventDirectionInbound  NetworkEventDirection = 0
	NetworkEventDirectionOutbound NetworkEventDirection = 1
)

func (NetworkEventDirection) String

func (d NetworkEventDirection) String() string

type NetworkEventProtocol

type NetworkEventProtocol uint8

const (
	NetworkEventProtocolTCP NetworkEventProtocol = 6
	NetworkEventProtocolUDP NetworkEventProtocol = 17
)

func (NetworkEventProtocol) String

func (p NetworkEventProtocol) String() string

type SyscallEvent

type SyscallEvent struct {
	SyscallNr int64
	CgroupID  uint64
	Pid       uint64
}

func (SyscallEvent) GetSyscallName

func (s SyscallEvent) GetSyscallName() string

type TpMeta

type TpMeta struct {
	// contains filtered or unexported fields
}

Struct that holds bpf tracepoint required metadata