ebpf

type CommonTracer interface {
	// Load the bpf object that is generated by the bpf2go compiler
	Load() (*ebpf.CollectionSpec, error)
	// AddCloser adds io.Closer instances that need to be invoked when the
	// Run function ends.
	AddCloser(c ...io.Closer)
	// BpfObjects that are created by the bpf2go compiler
	BpfObjects() any
}

type KprobesTracer interface {
	CommonTracer
	// KProbes returns a map with the name of the kernel probes that need to be
	// tapped into. Start matches kprobe, End matches kretprobe
	KProbes() map[string]ebpfcommon.FunctionPrograms
	Tracepoints() map[string]ebpfcommon.FunctionPrograms
}

type PIDsAccounter interface {
	// AllowPID notifies the tracer to accept traces from the process with the
	// provided PID. Unless system-wide instrumentation, the Tracer should discard
	// traces from processes whose PID has not been allowed before
	AllowPID(uint32, svc.ID)
	// BlockPID notifies the tracer to stop accepting traces from the process
	// with the provided PID. After receiving them via ringbuffer, it should
	// discard them.
	BlockPID(uint32)
}

type ProcessTracer struct {
	Programs []Tracer
	ELFInfo  *exec.FileInfo
	Goffsets *goexec.Offsets
	Exe      *link.Executable
	PinPath  string

	SystemWide bool
	Type       ProcessTracerType
	// contains filtered or unexported fields
}

type ProcessTracerType int

type Tracer interface {
	PIDsAccounter
	KprobesTracer
	// Constants returns a map of constants to be overriden into the eBPF program.
	// The key is the constant name and the value is the value to overwrite.
	Constants(*exec.FileInfo, *goexec.Offsets) map[string]any
	// GoProbes returns a map with the name of Go functions that need to be inspected
	// in the executable, as well as the eBPF programs that optionally need to be
	// inserted as the Go function start and end probes
	GoProbes() map[string]ebpfcommon.FunctionPrograms
	// UProbes returns a map with the module name mapping to the uprobes that need to be
	// tapped into. Start matches uprobe, End matches uretprobe
	UProbes() map[string]map[string]ebpfcommon.FunctionPrograms
	// SocketFilters  returns a list of programs that need to be loaded as a
	// generic eBPF socket filter
	SocketFilters() []*ebpf.Program
	// Probes can potentially instrument a shared library among multiple executables
	// These two functions alow programs to remember this and avoid duplicated instrumentations
	// The argument is the OS file id
	RecordInstrumentedLib(uint64)
	AlreadyInstrumentedLib(uint64) bool
	// Run will do the action of listening for eBPF traces and forward them
	// periodically to the output channel.
	Run(context.Context, chan<- []request.Span)
}

type UtilityTracer interface {
	KprobesTracer
	Run(context.Context)
}