ebpf/ebpftracer/tracer/common.go

package tracer

import "github.com/coroot/coroot-node-agent/utils"

const (
	ETR_OK               = 0
	ETR_NOTEXIST         = -4
	ETR_UPDATE_MAP_FAILD = -9 /* update map failed */
	ETR_NOTSUPP          = -14
)

const (
	// eBPF Map Name
	MAP_MEMBERS_OFFSET_NAME    = "__members_offset"
	MAP_SOCKET_INFO_NAME       = "__socket_info_map"
	MAP_TRACE_NAME             = "__trace_map"
	MAP_PERF_SOCKET_DATA_NAME  = "__socket_data"
	MAP_TRACE_CONF_NAME        = "__trace_conf_map"
	MAP_TRACE_STATS_NAME       = "__trace_stats_map"
	MAP_PROTO_FILTER_NAME      = "__protocol_filter"
	MAP_ALLOW_PORT_BITMAP_NAME = "__allow_port_bitmap"
	MAP_ADAPT_KERN_UID_NAME    = "__adapt_kern_uid_map"

	//Program jmp tables
	MAP_PROGS_JMP_KP_NAME = "__progs_jmp_kp_map"
	MAP_PROGS_JMP_TP_NAME = "__progs_jmp_tp_map"
	MAP_PROGS_JMP_UP_NAME = "__progs_jmp_up_map"

	MAP_PROC_INFO_MAP_NAME = "proc_info_map"
	// This prog is designed to handle data transfer
	PROGUP                         = "bpf_prog_up__"
	PROGKP                         = "bpf_prog_kp__"
	PROGTP                         = "bpf_prog_tp__"
	PROG_DATA_SUBMIT_NAME_FOR_KP   = PROGKP + "data_submit"
	PROG_DATA_SUBMIT_NAME_FOR_TP   = PROGTP + "data_submit"
	PROG_OUTPUT_DATA_NAME_FOR_KP   = PROGKP + "output_data"
	PROG_OUTPUT_DATA_NAME_FOR_TP   = PROGTP + "output_data"
	PROG_IO_EVENT_NAME_FOR_TP      = PROGTP + "io_event"
	PROG_SAVE_SC_DATA_FOR_UP       = PROGUP + "java_save_sc"
	PROG_JAVA_UPDATE_HEADER_FOR_UP = PROGUP + "java_update_header"
	PROG_GO_UPDATE_HEADER_FOR_UP   = PROGUP + "go_update_header"
)

const (
	PROG_DATA_SUBMIT_TP_IDX = iota
	PROG_OUTPUT_DATA_TP_IDX
	PROG_IO_EVENT_TP_IDX
	PROG_TP_NUM
)

const (
	PROG_DATA_SUBMIT_KP_IDX = iota
	PROG_OUTPUT_DATA_KP_IDX
	PROG_KP_NUM
)

const (
	PROG_DATA_SAVE_UP_IDX = iota
	PROG_DATA_JAVA_UPDATE_HEADER_UP_IDX
	PROG_DATA_GO_UPDATE_HEADER_UP_IDX
	PROG_UPROBE_NUM
)

// 数据协议
const (
	PROTO_UNKNOWN    = 0
	PROTO_ORTHER     = 1
	PROTO_HTTP1      = 20
	PROTO_HTTP2      = 21
	PROTO_TLS_HTTP1  = 22
	PROTO_TLS_HTTP2  = 23
	PROTO_DUBBO      = 40
	PROTO_SOFARPC    = 43
	PROTO_MYSQL      = 60
	PROTO_POSTGRESQL = 61
	PROTO_REDIS      = 80
	PROTO_KAFKA      = 100
	PROTO_MQTT       = 101
	PROTO_DNS        = 120
	PROTO_NUM        = 130
)

const (
	HASH_SIZE = 8
)

var EbpfConfigProtocolFilter [PROTO_NUM]uint32

type testStruct struct {
	test_id uint32
}

type bpfOffsetParam struct {
	Ready                          uint32 `json:"ready"`
	TaskFilesOffset                uint32 `json:"task__files_offset"`
	SockFlagsOffset                uint32 `json:"sock__flags_offset"`
	TcpSockCopiedSeqOffset         uint32 `json:"tcp_sock__copied_seq_offset"`
	TcpSockWriteSeqOffset          uint32 `json:"tcp_sock__write_seq_offset"`
	StructFilesStructFdtOffset     uint32 `json:"struct_files_struct_fdt_offset"`
	StructFilesPrivateDataOffset   uint32 `json:"struct_files_private_data_offset"`
	StructFileFInodeOffset         uint32 `json:"struct_file_f_inode_offset"`
	StructInodeIModeOffset         uint32 `json:"struct_inode_i_mode_offset"`
	StructFileDentryOffset         uint32 `json:"struct_file_dentry_offset"`
	StructDentryNameOffset         uint32 `json:"struct_dentry_name_offset"`
	StructSockFamilyOffset         uint32 `json:"struct_sock_family_offset"`
	StructSockSaddrOffset          uint32 `json:"struct_sock_saddr_offset"`
	StructSockDaddrOffset          uint32 `json:"struct_sock_daddr_offset"`
	StructSockIp6saddrOffset       uint32 `json:"struct_sock_ip6saddr_offset"`
	StructSockIp6daddrOffset       uint32 `json:"struct_sock_ip6daddr_offset"`
	StructSockDportOffset          uint32 `json:"struct_sock_dport_offset"`
	StructSockSportOffset          uint32 `json:"struct_sock_sport_offset"`
	StructSockSkcStateOffset       uint32 `json:"struct_sock_skc_state_offset"`
	StructSockCommonIpv6onlyOffset uint32 `json:"struct_sock_common_ipv6only_offset"`
}

const (
	OFFSET_IDX_GOID_RUNTIME_G = iota
	OFFSET_IDX_CONN_TLS_CONN
	OFFSET_IDX_SYSFD_POLL_FD
	OFFSET_IDX_CONN_HTTP2_SERVER_CONN
	OFFSET_IDX_TCONN_HTTP2_CLIENT_CONN
	OFFSET_IDX_CC_HTTP2_CLIENT_CONN_READ_LOOP
	OFFSET_IDX_CONN_GRPC_HTTP2_CLIENT
	OFFSET_IDX_CONN_GRPC_HTTP2_SERVER
	OFFSET_IDX_FRAMER_GRPC_TRANSPORT_LOOPY_WRITER
	OFFSET_IDX_WRITER_GRPC_TRANSPORT_FRAMER
	OFFSET_IDX_CONN_GRPC_TRANSPORT_BUFWRITER
	OFFSET_IDX_SIDE_GRPC_TRANSPORT_LOOPY_WRITER
	OFFSET_IDX_FIELDS_HTTP2_META_HEADERS_FRAME
	OFFSET_IDX_STREAM_HTTP2_CLIENT_CONN
	OFFSET_IDX_STREAM_ID_HTTP2_FRAME_HEADER
	OFFSET_IDX_MAX
)

type traceConf struct {
	SocketID               uint64 // 会话标识
	CoroutineTraceID       uint64 // 同一协程的数据转发关联
	ThreadTraceID          uint64 // 同一进程/线程的数据转发关联，用于多事务流转场景
	DataLimitMax           uint64 // Maximum number of data transfers
	GoTracingTimeout       uint64
	IOEventCollectMode     uint64
	IOEventMinimalDuartion uint64
	TotalCpus              uint64
	HostID                 utils.HashByte
	APPID                  utils.HashByte
}

/*
	struct ebpf_proc_info {
		__u32 version;
		__u16 offsets[OFFSET_IDX_MAX];

		// In golang, itab represents type, and in interface, struct is represented
		// by the address of itab. We use itab to judge the structure type, and
		// find the fd representing the connection after multiple jumps. These
		// types are not available in Go ELF files without a symbol table.
		// Go 用 itab 表示类型, 在 interface 中通过 itab 确定具体的 struct, 并根据
		// struct 找到表示连接的 fd.
		__u64 net_TCPConn_itab;
		__u64 crypto_tls_Conn_itab; // TLS_HTTP1,TLS_HTTP2
		__u64 credentials_syscallConn_itab; // gRPC
		__u64 start_addr;
		__u64 end_addr;
		unsigned char instance_id[APM_INSTANCE_ID_SIZE];
		__u64 method_ptr_pos;
		__u64 url_ptr_pos;
		__u64 path_ptr_pos;
		__u64 status_code_pos;
		__u64 request_host_pos;
		__u64 request_proto_pos;
		__u64 ctx_ptr_pos;
		__u64 headers_ptr_pos;
		__u64 buckets_ptr_pos;
	} __attribute__((packed));
*/
type EbpfProcInfo struct {
	Version                    uint32
	Offsets                    [OFFSET_IDX_MAX]uint16
	NetTCPConnItab             uint64
	CryptoTLSConnItab          uint64 // TLS_HTTP1,TLS_HTTP2
	CredentialsSyscallConnItab uint64 // gRPC
	StartAddr                  uint64
	EndAddr                    uint64
	InstanceId                 utils.HashByte
	// go http
	MethodPtrPos   uint64
	UrlPtrPos      uint64
	PathPtrPos     uint64
	StatusCodePos  uint64
	RequestHostPos uint64
	ProtoPos       uint64
	CtxPtrPos      uint64
	HeadersPtrPos  uint64
	BucketsPtrPos  uint64
}

type allowPortBitmap struct {
	Bitmap [65536 / 8]uint8
}