sensors

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 29, 2024 License: Apache-2.0 Imports: 23 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	BPF_PROG_TYPE_UNSPEC                  = 0
	BPF_PROG_TYPE_SOCKET_FILTER           = 1
	BPF_PROG_TYPE_KPROBE                  = 2
	BPF_PROG_TYPE_SCHED_CLS               = 3
	BPF_PROG_TYPE_SCHED_ACT               = 4
	BPF_PROG_TYPE_TRACEPOINT              = 5
	BPF_PROG_TYPE_XDP                     = 6
	BPF_PROG_TYPE_PERF_EVENT              = 7
	BPF_PROG_TYPE_CGROUP_SKB              = 8
	BPF_PROG_TYPE_CGROUP_SOCK             = 9
	BPF_PROG_TYPE_LWT_IN                  = 10
	BPF_PROG_TYPE_LWT_OUT                 = 11
	BPF_PROG_TYPE_LWT_XMIT                = 12
	BPF_PROG_TYPE_SOCK_OPS                = 13
	BPF_PROG_TYPE_SK_SKB                  = 14
	BPF_PROG_TYPE_CGROUP_DEVICE           = 15
	BPF_PROG_TYPE_SK_MSG                  = 16
	BPF_PROG_TYPE_RAW_TRACEPOINT          = 17
	BPF_PROG_TYPE_CGROUP_SOCK_ADDR        = 18
	BPF_PROG_TYPE_LWT_SEG6LOCAL           = 19
	BPF_PROG_TYPE_LIRC_MODE2              = 20
	BPF_PROG_TYPE_SK_REUSEPORT            = 21
	BPF_PROG_TYPE_FLOW_DISSECTOR          = 22
	BPF_PROG_TYPE_CGROUP_SYSCTL           = 23
	BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE = 24
	BPF_PROG_TYPE_CGROUP_SOCKOPT          = 25
	BPF_PROG_TYPE_TRACING                 = 26
	BPF_PROG_TYPE_STRUCT_OPS              = 27
	BPF_PROG_TYPE_EXT                     = 28
	BPF_PROG_TYPE_LSM                     = 29
)

Variables

View Source 
var (
	// AllPrograms are all the loaded programs. For use with Unload().
	AllPrograms = []*program.Program{}
	// AllMaps are all the loaded programs. For use with Unload().
	AllMaps = []*program.Map{}
)

Functions

func LoadConfig 

func LoadConfig(bpfDir string, sens []*Sensor) error

LoadConfig loads the default sensor, including any from the configuration file.

func PathJoin 

func PathJoin(elem ...string) string

PathJoin creates a path meant for sensor filenames in /sys/fs/bpf.

At some point, we would like to have a file hierarchy under /sys/fs/bpf for each sensor. see: https://github.com/cilium/tetragon/issues/408

Unfortunately, this requires changes, for properly creating and deleting these directories requires. As an intermediate step, we use this function that uses dashes instead of / to create unique files in flat hierarchy, without needeing to manage directories.

func RegisterPolicyHandlerAtInit added in v0.9.0 

func RegisterPolicyHandlerAtInit(name string, h policyHandler)

RegisterPolicyHandlerAtInit registers a handler for a tracing policy.

func RegisterProbeType 

func RegisterProbeType(probeType string, s probeLoader)

RegisterProbeType registers a handler for a probe type string

This function is meant to be called in an init() by sensors that need extra logic when loading a specific probe type.

func UnloadAll 

func UnloadAll()

func UnloadSensors added in v1.0.0 

func UnloadSensors(sens []*Sensor)

func UpdateStatsMap added in v0.8.3 

func UpdateStatsMap(m *ebpf.Map, val int64) error

Types

type LoadArg 

type LoadArg struct{}

type LoadProbeArgs 

type LoadProbeArgs struct {
	BPFDir           string
	Load             *program.Program
	Version, Verbose int
}

LoadProbeArgs are the args to the LoadProbe function.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager handles dynamic sensor management, such as adding / removing sensors at runtime.

func StartSensorManager 

func StartSensorManager(
	bpfDir string,
	waitChan chan struct{},
) (*Manager, error)

StartSensorManager initializes the sensorCtlHandle by spawning a sensor controller goroutine.

The purpose of this goroutine is to serialize loading and unloading of sensors as requested from different goroutines (e.g., different GRPC clients).

if waitChan is not nil, the serving of sensor requests will block until something is received. The intention of this is to allow the main function to first load the base sensor before the sensor manager starts loading other sensors.

func (*Manager) AddSensor 

func (h *Manager) AddSensor(ctx context.Context, name string, sensor *Sensor) error

AddSensor adds a sensor

func (*Manager) AddTracingPolicy 

func (h *Manager) AddTracingPolicy(ctx context.Context, tp tracingpolicy.TracingPolicy) error

AddTracingPolicy adds a new sensor based on a tracing policy NB: if tp implements tracingpolicy.TracingPolicyNamespaced, it will be treated as a namespaced policy

func (*Manager) DeleteTracingPolicy added in v0.11.0 

func (h *Manager) DeleteTracingPolicy(ctx context.Context, name string) error

DeleteTracingPolicy deletes a new sensor based on a tracing policy

func (*Manager) DisableSensor 

func (h *Manager) DisableSensor(ctx context.Context, name string) error

DisableSensor disables a sensor by name

func (*Manager) DisableTracingPolicy added in v1.0.0 

func (h *Manager) DisableTracingPolicy(ctx context.Context, name string) error

func (*Manager) EnableSensor 

func (h *Manager) EnableSensor(ctx context.Context, name string) error

EnableSensor enables a sensor by name

func (*Manager) EnableTracingPolicy added in v1.0.0 

func (h *Manager) EnableTracingPolicy(ctx context.Context, name string) error

func (*Manager) ListSensors 

func (h *Manager) ListSensors(ctx context.Context) (*[]SensorStatus, error)

func (*Manager) ListTracingPolicies added in v0.9.0 

func (h *Manager) ListTracingPolicies(ctx context.Context) (*tetragon.ListTracingPoliciesResponse, error)

ListTracingPolicies returns a list of the active tracing policies

func (*Manager) LogSensorsAndProbes added in v0.9.0 

func (h *Manager) LogSensorsAndProbes(ctx context.Context)

func (*Manager) RemoveAllSensors added in v1.0.0 

func (h *Manager) RemoveAllSensors(ctx context.Context) error

func (*Manager) RemoveSensor 

func (h *Manager) RemoveSensor(ctx context.Context, sensorName string) error

func (*Manager) StopSensorManager 

func (h *Manager) StopSensorManager(ctx context.Context) error

type Sensor 

type Sensor struct {
	// Name is a human-readbale description.
	Name string
	// Progs are all the BPF programs that exist on the filesystem.
	Progs []*program.Program
	// Maps are all the BPF Maps that the progs use.
	Maps []*program.Map
	// Loaded indicates whether the sensor has been Loaded.
	Loaded bool
	// Destroyed indicates whether the sensor had been destroyed.
	Destroyed bool
	// PreUnloadHook can optionally contain a pointer to a function to be
	// called during sensor unloading, prior to the programs and maps being
	// unloaded.
	PreUnloadHook SensorHook
	// PostUnloadHook can optionally contain a pointer to a function to be
	// called during sensor unloading, after the programs and maps being
	// unloaded.
	PostUnloadHook SensorHook
	// DestroyHook can optionally contain a pointer to a function to be called
	// when removing the sensor, sensor cannot be loaded again after this hook
	// being triggered and must be recreated.
	DestroyHook SensorHook
}

Sensor is a set of BPF programs and maps that are managed as a unit.

func GetMergedSensorFromParserPolicy 

func GetMergedSensorFromParserPolicy(tp tracingpolicy.TracingPolicy) (*Sensor, error)

func SensorBuilder 

func SensorBuilder(name string, p []*program.Program, m []*program.Map) *Sensor

func SensorCombine 

func SensorCombine(name string, sensors ...*Sensor) *Sensor

func SensorsFromPolicy added in v0.9.0 

func SensorsFromPolicy(tp tracingpolicy.TracingPolicy, filterID policyfilter.PolicyID) ([]*Sensor, error)

revive:disable:exported

func (*Sensor) Destroy added in v1.0.0 

func (s *Sensor) Destroy()

Destroy will unload the hook and call DestroyHook, this hook is usually used to clean up resources that were created during creation of the sensor.

func (*Sensor) FindPrograms 

func (s *Sensor) FindPrograms() error

FindPrograms finds all the BPF programs in the sensor on the filesytem.

func (*Sensor) Load 

func (s *Sensor) Load(bpfDir string) error

Load loads the sensor, by loading all the BPF programs and maps.

func (*Sensor) Unload added in v0.9.0 

func (s *Sensor) Unload() error

type SensorHook added in v1.0.0 

type SensorHook func() error

SensorHook is the function signature for an optional function that can be called during sensor unloading and removing.

type SensorStatus 

type SensorStatus struct {
	Name       string
	Enabled    bool
	Collection string
}

type TracingPolicy added in v0.9.0 

type TracingPolicy interface {
	// TpName returns the name of the policy.
	TpName() string
	// TpSpec  returns the specification of the policy
	TpSpec() *v1alpha1.TracingPolicySpec
	// TpInfo returns a description of the policy
	TpInfo() string
}

TracingPolicy is an interface for a tracing policy This is implemented by v1alpha1.types.TracingPolicy and config.GenericTracingConf. The former is what is the k8s API server uses, and the latter is used when we load files directly (e.g., via the cli).

type TracingPolicyState added in v1.1.0 

type TracingPolicyState int
const (
	UnknownState TracingPolicyState = iota
	EnabledState
	DisabledState
	LoadErrorState
	ErrorState
)

func (TracingPolicyState) ToTetragonState added in v1.1.0 

func (s TracingPolicyState) ToTetragonState() tetragon.TracingPolicyState

type UnloadArg 

type UnloadArg = LoadArg

Source Files

View all Source files

Directories

Path Synopsis
cgroup
cgrouptrackmap
config
confmap
execvemap
procevents
cgroup

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.