ebpf/utils/modelse/bpf_struct.go

package modelse

const (
	ETR_OK                   = 0
	ETR_NOTEXIST             = -4
	ETR_UPDATE_MAP_FAILD     = -9 /* update map failed */
	ETR_NOTSUPP              = -14
	ETR_MAP_DELETE_KEY_FAILD = -2 /* map delete key failed */
)

const (
	// eBPF Map Name
	MAP_MEMBERS_OFFSET_NAME    = "__members_offset"
	MAP_SOCKET_INFO_NAME       = "__socket_info_map"
	MAP_TRACE_NAME             = "__trace_map"
	MAP_PERF_SOCKET_DATA_NAME  = "__socket_data"
	MAP_TRACE_CONF_NAME        = "__trace_conf_map"
	MAP_TRACE_STATS_NAME       = "__trace_stats_map"
	MAP_PROTO_FILTER_NAME      = "__protocol_filter"
	MAP_ALLOW_PORT_BITMAP_NAME = "__allow_port_bitmap"
	MAP_ADAPT_KERN_UID_NAME    = "__adapt_kern_uid_map"

	//Program jmp tables
	MAP_PROGS_JMP_KP_NAME = "__progs_jmp_kp_map"
	MAP_PROGS_JMP_TP_NAME = "__progs_jmp_tp_map"
	MAP_PROGS_JMP_UP_NAME = "__progs_jmp_up_map"

	MAP_PROC_INFO_MAP_NAME        = "proc_info_map"
	MAP_L4_HEADER_CODE_TYPES_NAME = "l4_header_code_types"
	MAP_L4_CWOTHER_ENABLED_NAME   = "l4_cwother_enabled"
	// This prog is designed to handle data transfer
	PROGUP                         = "bpf_prog_up__"
	PROGKP                         = "bpf_prog_kp__"
	PROGTP                         = "bpf_prog_tp__"
	PROG_DATA_SUBMIT_NAME_FOR_KP   = PROGKP + "data_submit"
	PROG_DATA_SUBMIT_NAME_FOR_TP   = PROGTP + "data_submit"
	PROG_OUTPUT_DATA_NAME_FOR_KP   = PROGKP + "output_data"
	PROG_OUTPUT_DATA_NAME_FOR_TP   = PROGTP + "output_data"
	PROG_IO_EVENT_NAME_FOR_TP      = PROGTP + "io_event"
	PROG_SAVE_SC_DATA_FOR_UP       = PROGUP + "java_save_sc"
	PROG_JAVA_UPDATE_HEADER_FOR_UP = PROGUP + "java_update_header"
	PROG_JAVA_FIND_HOST_FOR_UP     = PROGUP + "java_find_host"
	PROG_JAVA_BUILD_HEADER_FOR_UP  = PROGUP + "java_build_header"
	PROG_GO_UPDATE_HEADER_FOR_UP   = PROGUP + "go_update_header"
	PROG_L7_HTTP_TRACE_ID_FOR_TP   = PROGTP + "l7_http_trace_id"
)

const (
	PROG_DATA_SUBMIT_TP_IDX = iota
	PROG_OUTPUT_DATA_TP_IDX
	PROG_IO_EVENT_TP_IDX
	PROG_DATA_L7_HTTP_TRACE_ID_TP_IDX
	PROG_TP_NUM
)

const (
	PROG_DATA_SUBMIT_KP_IDX = iota
	PROG_OUTPUT_DATA_KP_IDX
	PROG_KP_NUM
)

const (
	PROG_DATA_SAVE_UP_IDX = iota
	PROG_DATA_JAVA_UPDATE_HEADER_UP_IDX
	PROG_DATA_JAVA_FIND_HOST_UP_IDX
	PROG_DATA_JAVA_BUILD_HEADER_UP_IDX
	PROG_DATA_GO_UPDATE_HEADER_UP_IDX
	PROG_UPROBE_NUM
)

// 数据协议
const (
	PROTO_UNKNOWN    = 0
	PROTO_ORTHER     = 1
	PROTO_HTTP1      = 20
	PROTO_HTTP2      = 21
	PROTO_TLS_HTTP1  = 22
	PROTO_TLS_HTTP2  = 23
	PROTO_DUBBO      = 40
	PROTO_SOFARPC    = 43
	PROTO_MYSQL      = 60
	PROTO_POSTGRESQL = 61
	PROTO_REDIS      = 80
	PROTO_KAFKA      = 100
	PROTO_MQTT       = 101
	PROTO_DNS        = 120
	PROTO_NUM        = 130
)

const (
	HASH_SIZE = 8
)

var EbpfConfigProtocolFilter [PROTO_NUM]uint32

type TestStruct struct {
	Test_id uint32
}

type BpfOffsetParam struct {
	Ready                          uint32 `json:"ready"`
	TaskFilesOffset                uint32 `json:"task__files_offset"`
	SockFlagsOffset                uint32 `json:"sock__flags_offset"`
	TcpSockCopiedSeqOffset         uint32 `json:"tcp_sock__copied_seq_offset"`
	TcpSockWriteSeqOffset          uint32 `json:"tcp_sock__write_seq_offset"`
	StructFilesStructFdtOffset     uint32 `json:"struct_files_struct_fdt_offset"`
	StructFilesPrivateDataOffset   uint32 `json:"struct_files_private_data_offset"`
	StructFileFInodeOffset         uint32 `json:"struct_file_f_inode_offset"`
	StructInodeIModeOffset         uint32 `json:"struct_inode_i_mode_offset"`
	StructFileDentryOffset         uint32 `json:"struct_file_dentry_offset"`
	StructDentryNameOffset         uint32 `json:"struct_dentry_name_offset"`
	StructSockFamilyOffset         uint32 `json:"struct_sock_family_offset"`
	StructSockSaddrOffset          uint32 `json:"struct_sock_saddr_offset"`
	StructSockDaddrOffset          uint32 `json:"struct_sock_daddr_offset"`
	StructSockIp6saddrOffset       uint32 `json:"struct_sock_ip6saddr_offset"`
	StructSockIp6daddrOffset       uint32 `json:"struct_sock_ip6daddr_offset"`
	StructSockDportOffset          uint32 `json:"struct_sock_dport_offset"`
	StructSockSportOffset          uint32 `json:"struct_sock_sport_offset"`
	StructSockSkcStateOffset       uint32 `json:"struct_sock_skc_state_offset"`
	StructSockCommonIpv6onlyOffset uint32 `json:"struct_sock_common_ipv6only_offset"`
}

const (
	OFFSET_IDX_GOID_RUNTIME_G = iota
	OFFSET_IDX_CONN_TLS_CONN
	OFFSET_IDX_SYSFD_POLL_FD
	OFFSET_IDX_CONN_HTTP2_SERVER_CONN
	OFFSET_IDX_TCONN_HTTP2_CLIENT_CONN
	OFFSET_IDX_CC_HTTP2_CLIENT_CONN_READ_LOOP
	OFFSET_IDX_CONN_GRPC_HTTP2_CLIENT
	OFFSET_IDX_CONN_GRPC_HTTP2_SERVER
	OFFSET_IDX_FRAMER_GRPC_TRANSPORT_LOOPY_WRITER
	OFFSET_IDX_WRITER_GRPC_TRANSPORT_FRAMER
	OFFSET_IDX_CONN_GRPC_TRANSPORT_BUFWRITER
	OFFSET_IDX_SIDE_GRPC_TRANSPORT_LOOPY_WRITER
	OFFSET_IDX_FIELDS_HTTP2_META_HEADERS_FRAME
	OFFSET_IDX_STREAM_HTTP2_CLIENT_CONN
	OFFSET_IDX_STREAM_ID_HTTP2_FRAME_HEADER
	OFFSET_IDX_P_GOIDCACHE // runtime.p.goidcache
	OFFSET_IDX_P_RUNNEXT   // runtime.p.runnext
	OFFSET_IDX_MAX
)

type EbpfTraceConf struct {
	SocketID               uint64 // 会话标识
	CoroutineTraceID       uint64 // 同一协程的数据转发关联
	ThreadTraceID          uint64 // 同一进程/线程的数据转发关联，用于多事务流转场景
	DataLimitMax           uint64 // Maximum number of data transfers
	GoTracingTimeout       uint64
	IOEventCollectMode     uint64
	IOEventMinimalDuartion uint64
	TotalCpus              uint64
	HostID                 HashByte
	APPID                  HashByte
}

/*
	struct ebpf_proc_info {
		__u32 version;
		__u16 offsets[OFFSET_IDX_MAX];

		// In golang, itab represents type, and in interface, struct is represented
		// by the address of itab. We use itab to judge the structure type, and
		// find the fd representing the connection after multiple jumps. These
		// types are not available in Go ELF files without a symbol table.
		// Go 用 itab 表示类型, 在 interface 中通过 itab 确定具体的 struct, 并根据
		// struct 找到表示连接的 fd.
		__u64 net_TCPConn_itab;
		__u64 crypto_tls_Conn_itab; // TLS_HTTP1,TLS_HTTP2
		__u64 credentials_syscallConn_itab; // gRPC
		__u64 start_addr;
		__u64 end_addr;
		unsigned char instance_id[APM_INSTANCE_ID_SIZE];
		__u64 method_ptr_pos;
		__u64 url_ptr_pos;
		__u64 path_ptr_pos;
		__u64 status_code_pos;
		__u64 request_host_pos;
		__u64 request_proto_pos;
		__u64 ctx_ptr_pos;
		__u64 headers_ptr_pos;
		__u64 buckets_ptr_pos;
		__u64 use_swiss_map;
		//gRPC
		__u64 httpclient_nextid_pos;
		__u64 stream_method_ptr_pos;
		__u64 stream_ctx_pos;
		__u8 is_new_frame_pos;
	} __attribute__((packed));
*/
type EbpfProcInfo struct {
	Version                    uint32
	Offsets                    [OFFSET_IDX_MAX]uint16
	NetTCPConnItab             uint64
	CryptoTLSConnItab          uint64 // TLS_HTTP1,TLS_HTTP2
	CredentialsSyscallConnItab uint64 // gRPC
	StartAddr                  uint64
	EndAddr                    uint64
	InstanceId                 HashByte
	AppId                      HashByte
	CodeType                   uint16
	// go http
	MethodPtrPos   uint64
	UrlPtrPos      uint64
	PathPtrPos     uint64
	StatusCodePos  uint64
	RequestHostPos uint64
	UrlHostPos     uint64 // url.URL.Host field offset
	ProtoPos       uint64
	CtxPtrPos      uint64
	HeadersPtrPos  uint64
	BucketsPtrPos  uint64
	UseSwissMap    uint64
	// gRPC
	HttpClientNextidPos uint64
	StreamMethodPtrPos  uint64
	StreamCtxPos        uint64
	IsNewFramePos       uint8

	// io writer
	IoWriterBufPtrPos uint64
	IoWriterNPos      uint64
	// Kafka
	KafkaMessageKeyPos          uint64
	KafkaMessageTopicPos        uint64
	KafkaMessageHeadersPos      uint64
	KafkaMessageTimePos         uint64
	KafkaMessagePartitionPos    uint64 // Message.Partition field offset
	KafkaMessageOffsetPos       uint64 // Message.Offset field offset
	KafkaMessageValuePos        uint64 // Message.Value field offset
	KafkaWriterTopicPos         uint64
	KafkaWriterAddrPos          uint64 // Writer.Brokers field offset
	KafkaReaderConfigPos        uint64 // Reader.Config field offset
	KafkaReaderConfigGroupIDPos uint64 // Reader.Config.GroupID field offset
	KafkaReaderConfigTopicsPos  uint64 // Reader.Config.Topics field offset
	// net.TCPAddr offsets
	TcpAddrIPOffset   uint64 // net.TCPAddr.IP field offset
	TcpAddrPortOffset uint64 // net.TCPAddr.Port field offset
	// cwother header value: {app_name_len}:app_name:{SysTagLen}[:SysTag]
	Sysvc [76]byte // CW_SYS_HEADER_VAL_LENGTH
}

type allowedHeaderCodeTypes struct {
	CodeType uint16
}

type allowPortBitmap struct {
	Bitmap [65536 / 8]uint8
}

/*
struct connection_id {
    __u64 fd;
    __u32 pid;
};
*/

type ConnectionId struct {
	FD  uint64
	PID uint32
	_   uint32
}

/*
struct connection {
    __u64 timestamp;
    __u64 bytes_sent;
    __u64 bytes_received;
    __u64 first_read_time;
    __u64 first_write_time;
    __u64 new_read_time;
    __u16 sport;
    __u16 dport;
    __u8 saddr[16];
    __u8 daddr[16];
} __attribute__((packed));
*/

/* 保持与c符号对齐 */
type Connection struct {
	Timestamp      uint64    // __u64
	BytesSent      uint64    // __u64
	BytesReceived  uint64    // __u64
	FirstReadTime  uint64    // __u64
	FirstWriteTime uint64    // __u64
	NewReadTime    uint64    // __u64
	Sport          uint16    // __u16
	Dport          uint16    // __u16
	Saddr          [16]uint8 // __u8[16]
	Daddr          [16]uint8 // __u8[16]
}

/* 保持与c符号对齐 */