package tracer import "github.com/coroot/coroot-node-agent/utils" const ( ETR_OK = 0 ETR_NOTEXIST = -4 ETR_UPDATE_MAP_FAILD = -9 /* update map failed */ ETR_NOTSUPP = -14 ) const ( // eBPF Map Name MAP_MEMBERS_OFFSET_NAME = "__members_offset" MAP_SOCKET_INFO_NAME = "__socket_info_map" MAP_TRACE_NAME = "__trace_map" MAP_PERF_SOCKET_DATA_NAME = "__socket_data" MAP_TRACE_CONF_NAME = "__trace_conf_map" MAP_TRACE_STATS_NAME = "__trace_stats_map" MAP_PROTO_FILTER_NAME = "__protocol_filter" MAP_ALLOW_PORT_BITMAP_NAME = "__allow_port_bitmap" MAP_ADAPT_KERN_UID_NAME = "__adapt_kern_uid_map" //Program jmp tables MAP_PROGS_JMP_KP_NAME = "__progs_jmp_kp_map" MAP_PROGS_JMP_TP_NAME = "__progs_jmp_tp_map" // This prog is designed to handle data transfer PROG_DATA_SUBMIT_NAME_FOR_KP = "bpf_prog_kp__data_submit" PROG_DATA_SUBMIT_NAME_FOR_TP = "bpf_prog_tp__data_submit" PROG_OUTPUT_DATA_NAME_FOR_KP = "bpf_prog_kp__output_data" PROG_OUTPUT_DATA_NAME_FOR_TP = "bpf_prog_tp__output_data" PROG_IO_EVENT_NAME_FOR_TP = "bpf_prog_tp__io_event" MAP_PROC_INFO_MAP_NAME = "proc_info_map" ) const ( PROG_DATA_SUBMIT_TP_IDX = iota PROG_OUTPUT_DATA_TP_IDX PROG_IO_EVENT_TP_IDX PROG_TP_NUM ) const ( PROG_DATA_SUBMIT_KP_IDX = iota PROG_OUTPUT_DATA_KP_IDX PROG_KP_NUM ) // 数据协议 const ( PROTO_UNKNOWN = 0 PROTO_ORTHER = 1 PROTO_HTTP1 = 20 PROTO_HTTP2 = 21 PROTO_TLS_HTTP1 = 22 PROTO_TLS_HTTP2 = 23 PROTO_DUBBO = 40 PROTO_SOFARPC = 43 PROTO_MYSQL = 60 PROTO_POSTGRESQL = 61 PROTO_REDIS = 80 PROTO_KAFKA = 100 PROTO_MQTT = 101 PROTO_DNS = 120 PROTO_NUM = 130 ) const ( HASH_SIZE = 8 ) var EbpfConfigProtocolFilter [PROTO_NUM]uint32 type testStruct struct { test_id uint32 } type bpfOffsetParam struct { Ready uint32 `json:"ready"` TaskFilesOffset uint32 `json:"task__files_offset"` SockFlagsOffset uint32 `json:"sock__flags_offset"` TcpSockCopiedSeqOffset uint32 `json:"tcp_sock__copied_seq_offset"` TcpSockWriteSeqOffset uint32 `json:"tcp_sock__write_seq_offset"` StructFilesStructFdtOffset uint32 `json:"struct_files_struct_fdt_offset"` StructFilesPrivateDataOffset uint32 `json:"struct_files_private_data_offset"` StructFileFInodeOffset uint32 `json:"struct_file_f_inode_offset"` StructInodeIModeOffset uint32 `json:"struct_inode_i_mode_offset"` StructFileDentryOffset uint32 `json:"struct_file_dentry_offset"` StructDentryNameOffset uint32 `json:"struct_dentry_name_offset"` StructSockFamilyOffset uint32 `json:"struct_sock_family_offset"` StructSockSaddrOffset uint32 `json:"struct_sock_saddr_offset"` StructSockDaddrOffset uint32 `json:"struct_sock_daddr_offset"` StructSockIp6saddrOffset uint32 `json:"struct_sock_ip6saddr_offset"` StructSockIp6daddrOffset uint32 `json:"struct_sock_ip6daddr_offset"` StructSockDportOffset uint32 `json:"struct_sock_dport_offset"` StructSockSportOffset uint32 `json:"struct_sock_sport_offset"` StructSockSkcStateOffset uint32 `json:"struct_sock_skc_state_offset"` StructSockCommonIpv6onlyOffset uint32 `json:"struct_sock_common_ipv6only_offset"` } const ( OFFSET_IDX_GOID_RUNTIME_G = iota OFFSET_IDX_CONN_TLS_CONN OFFSET_IDX_SYSFD_POLL_FD OFFSET_IDX_CONN_HTTP2_SERVER_CONN OFFSET_IDX_TCONN_HTTP2_CLIENT_CONN OFFSET_IDX_CC_HTTP2_CLIENT_CONN_READ_LOOP OFFSET_IDX_CONN_GRPC_HTTP2_CLIENT OFFSET_IDX_CONN_GRPC_HTTP2_SERVER OFFSET_IDX_FRAMER_GRPC_TRANSPORT_LOOPY_WRITER OFFSET_IDX_WRITER_GRPC_TRANSPORT_FRAMER OFFSET_IDX_CONN_GRPC_TRANSPORT_BUFWRITER OFFSET_IDX_SIDE_GRPC_TRANSPORT_LOOPY_WRITER OFFSET_IDX_FIELDS_HTTP2_META_HEADERS_FRAME OFFSET_IDX_STREAM_HTTP2_CLIENT_CONN OFFSET_IDX_STREAM_ID_HTTP2_FRAME_HEADER OFFSET_IDX_MAX ) type traceConf struct { SocketID uint64 // 会话标识 CoroutineTraceID uint64 // 同一协程的数据转发关联 ThreadTraceID uint64 // 同一进程/线程的数据转发关联,用于多事务流转场景 DataLimitMax uint64 // Maximum number of data transfers GoTracingTimeout uint64 IOEventCollectMode uint64 IOEventMinimalDuartion uint64 HostID utils.HashByte APPID utils.HashByte } /* struct ebpf_proc_info { __u32 version; __u16 offsets[OFFSET_IDX_MAX]; // In golang, itab represents type, and in interface, struct is represented // by the address of itab. We use itab to judge the structure type, and // find the fd representing the connection after multiple jumps. These // types are not available in Go ELF files without a symbol table. // Go 用 itab 表示类型, 在 interface 中通过 itab 确定具体的 struct, 并根据 // struct 找到表示连接的 fd. __u64 net_TCPConn_itab; __u64 crypto_tls_Conn_itab; // TLS_HTTP1,TLS_HTTP2 __u64 credentials_syscallConn_itab; // gRPC // __u64 start_addr; // __u64 end_addr; unsigned char instance_id[APM_INSTANCE_ID_SIZE]; } __attribute__((packed)) */ type EbpfProcInfo struct { Version uint32 Offsets [OFFSET_IDX_MAX]uint16 NetTCPConnItab uint64 CryptoTLSConnItab uint64 // TLS_HTTP1,TLS_HTTP2 CredentialsSyscallConnItab uint64 // gRPC StartAddr uint64 EndAddr uint64 InstanceId utils.HashByte } type allowPortBitmap struct { Bitmap [65536 / 8]uint8 }