forked from cilium/cilium
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
cilium: add wildcarded capture map representation
Add a basic v4/v6 map representation so that the user space bits can build on top of it. This is needed for later map+mask management as well as a Cilium CLI map dump for introspection. Default map size is currently fixed, but we can add an agent knob at some point if needed. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
- Loading branch information
Showing
8 changed files
with
237 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| // Copyright 2021 Authors of Cilium | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| // Package recorder represents the BPF map used to (wildcard-)filter | ||
| // traffic that is subject to the pcap recorder. | ||
| // +groupName=maps | ||
| package recorder |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| // Copyright 2021 Authors of Cilium | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package recorder | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "unsafe" | ||
|
|
||
| "github.com/cilium/cilium/pkg/bpf" | ||
| "github.com/cilium/cilium/pkg/byteorder" | ||
| "github.com/cilium/cilium/pkg/types" | ||
| ) | ||
|
|
||
| type CaptureWcard4 struct { | ||
| DestAddr types.IPv4 `align:"daddr"` | ||
| SrcAddr types.IPv4 `align:"saddr"` | ||
| DestPort uint16 `align:"dport"` | ||
| SrcPort uint16 `align:"sport"` | ||
| NextHdr uint8 `align:"nexthdr"` | ||
| DestMask uint8 `align:"dmask"` | ||
| SrcMask uint8 `align:"smask"` | ||
| Flags uint8 `align:"flags"` | ||
| } | ||
|
|
||
| type CaptureRule4 CaptureRule | ||
|
|
||
| func (k *CaptureWcard4) GetKeyPtr() unsafe.Pointer { return unsafe.Pointer(k) } | ||
| func (k *CaptureWcard4) NewValue() bpf.MapValue { return &CaptureRule4{} } | ||
| func (k *CaptureWcard4) DeepCopyMapKey() bpf.MapKey { | ||
| return &CaptureWcard4{ | ||
| DestAddr: k.DestAddr, | ||
| SrcAddr: k.SrcAddr, | ||
| DestPort: k.DestPort, | ||
| SrcPort: k.SrcPort, | ||
| NextHdr: k.NextHdr, | ||
| DestMask: k.DestMask, | ||
| SrcMask: k.SrcMask, | ||
| Flags: k.Flags, | ||
| } | ||
| } | ||
| func (k *CaptureWcard4) String() string { | ||
| return fmt.Sprintf("%s/%d %s/%d %d %d %d\n", | ||
| k.DestAddr, | ||
| int(k.DestMask), | ||
| k.SrcAddr, | ||
| int(k.SrcMask), | ||
| byteorder.NetworkToHost(k.DestPort), | ||
| byteorder.NetworkToHost(k.SrcPort), | ||
| int(k.NextHdr)) | ||
| } | ||
|
|
||
| func (v *CaptureRule4) GetValuePtr() unsafe.Pointer { return unsafe.Pointer(v) } | ||
| func (v *CaptureRule4) DeepCopyMapValue() bpf.MapValue { | ||
| return &CaptureRule4{ | ||
| RuleId: v.RuleId, | ||
| Reserved: v.Reserved, | ||
| CapLen: v.CapLen, | ||
| } | ||
| } | ||
| func (v *CaptureRule4) String() string { | ||
| return fmt.Sprintf("%d %d", int(v.RuleId), int(v.CapLen)) | ||
| } | ||
|
|
||
| var CaptureMap4 = bpf.NewMap( | ||
| MapNameWcard4, | ||
| bpf.MapTypeHash, | ||
| &CaptureWcard4{}, int(unsafe.Sizeof(CaptureWcard4{})), | ||
| &CaptureRule4{}, int(unsafe.Sizeof(CaptureRule4{})), | ||
| MapSize, | ||
| bpf.BPF_F_NO_PREALLOC, 0, | ||
| bpf.ConvertKeyValue, | ||
| ).WithCache() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| // Copyright 2021 Authors of Cilium | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package recorder | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "unsafe" | ||
|
|
||
| "github.com/cilium/cilium/pkg/bpf" | ||
| "github.com/cilium/cilium/pkg/byteorder" | ||
| "github.com/cilium/cilium/pkg/types" | ||
| ) | ||
|
|
||
| type CaptureWcard6 struct { | ||
| DestAddr types.IPv6 `align:"daddr"` | ||
| SrcAddr types.IPv6 `align:"saddr"` | ||
| DestPort uint16 `align:"dport"` | ||
| SrcPort uint16 `align:"sport"` | ||
| NextHdr uint8 `align:"nexthdr"` | ||
| DestMask uint8 `align:"dmask"` | ||
| SrcMask uint8 `align:"smask"` | ||
| Flags uint8 `align:"flags"` | ||
| } | ||
|
|
||
| type CaptureRule6 CaptureRule | ||
|
|
||
| func (k *CaptureWcard6) GetKeyPtr() unsafe.Pointer { return unsafe.Pointer(k) } | ||
| func (k *CaptureWcard6) NewValue() bpf.MapValue { return &CaptureRule6{} } | ||
| func (k *CaptureWcard6) DeepCopyMapKey() bpf.MapKey { | ||
| return &CaptureWcard6{ | ||
| DestAddr: k.DestAddr, | ||
| SrcAddr: k.SrcAddr, | ||
| DestPort: k.DestPort, | ||
| SrcPort: k.SrcPort, | ||
| NextHdr: k.NextHdr, | ||
| DestMask: k.DestMask, | ||
| SrcMask: k.SrcMask, | ||
| Flags: k.Flags, | ||
| } | ||
| } | ||
| func (k *CaptureWcard6) String() string { | ||
| return fmt.Sprintf("%s/%d %s/%d %d %d %d\n", | ||
| k.DestAddr, | ||
| int(k.DestMask), | ||
| k.SrcAddr, | ||
| int(k.SrcMask), | ||
| byteorder.NetworkToHost(k.DestPort), | ||
| byteorder.NetworkToHost(k.SrcPort), | ||
| int(k.NextHdr)) | ||
| } | ||
|
|
||
| func (v *CaptureRule6) GetValuePtr() unsafe.Pointer { return unsafe.Pointer(v) } | ||
| func (v *CaptureRule6) DeepCopyMapValue() bpf.MapValue { | ||
| return &CaptureRule6{ | ||
| RuleId: v.RuleId, | ||
| Reserved: v.Reserved, | ||
| CapLen: v.CapLen, | ||
| } | ||
| } | ||
| func (v *CaptureRule6) String() string { | ||
| return fmt.Sprintf("%d %d", int(v.RuleId), int(v.CapLen)) | ||
| } | ||
|
|
||
| var CaptureMap6 = bpf.NewMap( | ||
| MapNameWcard6, | ||
| bpf.MapTypeHash, | ||
| &CaptureWcard6{}, int(unsafe.Sizeof(CaptureWcard6{})), | ||
| &CaptureRule6{}, int(unsafe.Sizeof(CaptureRule6{})), | ||
| MapSize, | ||
| bpf.BPF_F_NO_PREALLOC, 0, | ||
| bpf.ConvertKeyValue, | ||
| ).WithCache() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| // Copyright 2021 Authors of Cilium | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package recorder | ||
|
|
||
| const ( | ||
| // MapNameWcard4 represents IPv4 capture wildcard table. | ||
| MapNameWcard4 = "cilium_capture4_rules" | ||
| // MapNameWcard6 represents IPv6 capture wildcard table. | ||
| MapNameWcard6 = "cilium_capture6_rules" | ||
| // MapSize is the default size of the v4 and v6 maps | ||
| MapSize = 16384 | ||
| ) | ||
|
|
||
| type CaptureRule struct { | ||
| RuleId uint16 `align:"rule_id"` | ||
| Reserved uint16 `align:"reserved"` | ||
| CapLen uint32 `align:"cap_len"` | ||
| } |