| 1 | // SPDX-License-Identifier: GPL-3.0-or-later |
| 2 | #ifndef NETDATA_EBPF_SOCKET_H |
| 3 | #define NETDATA_EBPF_SOCKET_H 1 |
| 4 | #include <stdint.h> |
| 5 | #include "libnetdata/avl/avl.h" |
| 6 | |
| 7 | #include <sys/socket.h> |
| 8 | #ifdef HAVE_NETDB_H |
| 9 | #include <netdb.h> |
| 10 | #endif |
| 11 | |
| 12 | // Module name & description |
| 13 | #define NETDATA_EBPF_MODULE_NAME_SOCKET "socket" |
| 14 | #define NETDATA_EBPF_SOCKET_MODULE_DESC \ |
| 15 | "Monitors TCP and UDP bandwidth. This thread is integrated with apps and cgroup." |
| 16 | |
| 17 | // Vector indexes |
| 18 | #define NETDATA_UDP_START 3 |
| 19 | |
| 20 | // dimensions |
| 21 | #define EBPF_COMMON_UNITS_CONNECTIONS "connections/s" |
| 22 | #define EBPF_COMMON_UNITS_KILOBITS "kilobits/s" |
| 23 | |
| 24 | // config file |
| 25 | #define NETDATA_NETWORK_CONFIG_FILE "network.conf" |
| 26 | #define EBPF_NETWORK_VIEWER_SECTION "network connections" |
| 27 | #define EBPF_SERVICE_NAME_SECTION "service name" |
| 28 | #define EBPF_CONFIG_RESOLVE_HOSTNAME "resolve hostnames" |
| 29 | #define EBPF_CONFIG_RESOLVE_SERVICE "resolve service names" |
| 30 | #define EBPF_CONFIG_PORTS "ports" |
| 31 | #define EBPF_CONFIG_HOSTNAMES "hostnames" |
| 32 | #define EBPF_CONFIG_SOCKET_MONITORING_SIZE "socket monitoring table size" |
| 33 | #define EBPF_CONFIG_UDP_SIZE "udp connection table size" |
| 34 | |
| 35 | enum ebpf_socket_table_list { |
| 36 | NETDATA_SOCKET_GLOBAL, |
| 37 | NETDATA_SOCKET_LPORTS, |
| 38 | NETDATA_SOCKET_OPEN_SOCKET, |
| 39 | NETDATA_SOCKET_TABLE_UDP, |
| 40 | NETDATA_SOCKET_TABLE_CTRL |
| 41 | }; |
| 42 | |
| 43 | enum ebpf_socket_publish_index { |
| 44 | NETDATA_IDX_TCP_SENDMSG, |
| 45 | NETDATA_IDX_TCP_CLEANUP_RBUF, |
| 46 | NETDATA_IDX_TCP_CLOSE, |
| 47 | NETDATA_IDX_UDP_RECVBUF, |
| 48 | NETDATA_IDX_UDP_SENDMSG, |
| 49 | NETDATA_IDX_TCP_RETRANSMIT, |
| 50 | NETDATA_IDX_TCP_CONNECTION_V4, |
| 51 | NETDATA_IDX_TCP_CONNECTION_V6, |
| 52 | NETDATA_IDX_INCOMING_CONNECTION_TCP, |
| 53 | NETDATA_IDX_INCOMING_CONNECTION_UDP, |
| 54 | |
| 55 | // Keep this as last and don't skip numbers as it is used as element counter |
| 56 | NETDATA_MAX_SOCKET_VECTOR |
| 57 | }; |
| 58 | |
| 59 | enum socket_functions { |
| 60 | NETDATA_FCNT_INET_CSK_ACCEPT, |
| 61 | NETDATA_FCNT_TCP_RETRANSMIT, |
| 62 | NETDATA_FCNT_CLEANUP_RBUF, |
| 63 | NETDATA_FCNT_TCP_CLOSE, |
| 64 | NETDATA_FCNT_UDP_RECEVMSG, |
| 65 | NETDATA_FCNT_TCP_SENDMSG, |
| 66 | NETDATA_FCNT_UDP_SENDMSG, |
| 67 | NETDATA_FCNT_TCP_V4_CONNECT, |
| 68 | NETDATA_FCNT_TCP_V6_CONNECT |
| 69 | }; |
| 70 | |
| 71 | typedef enum ebpf_socket_idx { |
| 72 | NETDATA_KEY_CALLS_TCP_SENDMSG, |
| 73 | NETDATA_KEY_ERROR_TCP_SENDMSG, |
| 74 | NETDATA_KEY_BYTES_TCP_SENDMSG, |
| 75 | |
| 76 | NETDATA_KEY_CALLS_TCP_CLEANUP_RBUF, |
| 77 | NETDATA_KEY_ERROR_TCP_CLEANUP_RBUF, |
| 78 | NETDATA_KEY_BYTES_TCP_CLEANUP_RBUF, |
| 79 | |
| 80 | NETDATA_KEY_CALLS_TCP_CLOSE, |
| 81 | |
| 82 | NETDATA_KEY_CALLS_UDP_RECVMSG, |
| 83 | NETDATA_KEY_ERROR_UDP_RECVMSG, |
| 84 | NETDATA_KEY_BYTES_UDP_RECVMSG, |
| 85 | |
| 86 | NETDATA_KEY_CALLS_UDP_SENDMSG, |
| 87 | NETDATA_KEY_ERROR_UDP_SENDMSG, |
| 88 | NETDATA_KEY_BYTES_UDP_SENDMSG, |
| 89 | |
| 90 | NETDATA_KEY_TCP_RETRANSMIT, |
| 91 | |
| 92 | NETDATA_KEY_CALLS_TCP_CONNECT_IPV4, |
| 93 | NETDATA_KEY_ERROR_TCP_CONNECT_IPV4, |
| 94 | |
| 95 | NETDATA_KEY_CALLS_TCP_CONNECT_IPV6, |
| 96 | NETDATA_KEY_ERROR_TCP_CONNECT_IPV6, |
| 97 | |
| 98 | // Keep this as last and don't skip numbers as it is used as element counter |
| 99 | NETDATA_SOCKET_COUNTER |
| 100 | } ebpf_socket_index_t; |
| 101 | |
| 102 | #define NETDATA_SOCKET_KERNEL_FUNCTIONS "kernel" |
| 103 | #define NETDATA_SOCKET_CHART_ORDER_BASE 21070 |
| 104 | #define NETDATA_SOCKET_CGROUP_ORDER_BASE 5300 |
| 105 | #define NETDATA_SOCKET_APPS_ORDER_BASE 20130 |
| 106 | #define NETDATA_SOCKET_SYSTEMD_ORDER_BASE 20080 |
| 107 | #define TCP_V6_CONNECT_TYPE 'T' |
| 108 | #define NETDATA_CGROUP_NET_GROUP "network" |
| 109 | |
| 110 | // Global chart name |
| 111 | #define NETDATA_TCP_OUTBOUND_CONNECTIONS "tcp_outbound_conn" |
| 112 | #define NETDATA_INBOUND_CONNECTIONS "inbound_conn" |
| 113 | #define NETDATA_TCP_FUNCTION_COUNT "tcp_functions" |
| 114 | #define NETDATA_TCP_FUNCTION_BITS "total_tcp_bandwidth" |
| 115 | #define NETDATA_TCP_FUNCTION_ERROR "tcp_error" |
| 116 | #define NETDATA_TCP_RETRANSMIT "tcp_retransmit" |
| 117 | #define NETDATA_UDP_FUNCTION_COUNT "udp_functions" |
| 118 | #define NETDATA_UDP_FUNCTION_BITS "total_udp_bandwidth" |
| 119 | #define NETDATA_UDP_FUNCTION_ERROR "udp_error" |
| 120 | |
| 121 | // Charts created (id or suffix) |
| 122 | #define NETDATA_SOCK_ID_OR_SUFFIX_CONNECTION_TCP_V4 "outbound_conn_v4" |
| 123 | #define NETDATA_SOCK_ID_OR_SUFFIX_CONNECTION_TCP_V6 "outbound_conn_v6" |
| 124 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH "total_bandwidth" |
| 125 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH_TCP_SEND_CALLS "bandwidth_tcp_send" |
| 126 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH_TCP_RECV_CALLS "bandwidth_tcp_recv" |
| 127 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH_TCP_RETRANSMIT "bandwidth_tcp_retransmit" |
| 128 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH_UDP_SEND_CALLS "bandwidth_udp_send" |
| 129 | #define NETDATA_SOCK_ID_OR_SUFFIX_BANDWIDTH_UDP_RECV_CALLS "bandwidth_udp_recv" |
| 130 | |
| 131 | // Port range |
| 132 | #define NETDATA_MINIMUM_PORT_VALUE 1 |
| 133 | #define NETDATA_MAXIMUM_PORT_VALUE 65535 |
| 134 | #define NETDATA_COMPILED_CONNECTIONS_ALLOWED 65535U |
| 135 | #define NETDATA_MAXIMUM_CONNECTIONS_ALLOWED 16384U |
| 136 | #define NETDATA_COMPILED_UDP_CONNECTIONS_ALLOWED 8192U |
| 137 | #define NETDATA_MAXIMUM_UDP_CONNECTIONS_ALLOWED 4096U |
| 138 | |
| 139 | #define NETDATA_MINIMUM_IPV4_CIDR 0 |
| 140 | #define NETDATA_MAXIMUM_IPV4_CIDR 32 |
| 141 | |
| 142 | // Contexts |
| 143 | #define NETDATA_CGROUP_TCP_V4_CONN_CONTEXT "cgroup.net_conn_ipv4" |
| 144 | #define NETDATA_CGROUP_TCP_V6_CONN_CONTEXT "cgroup.net_conn_ipv6" |
| 145 | #define NETDATA_CGROUP_SOCKET_TCP_BANDWIDTH_CONTEXT "cgroup.net_total_bandwidth" |
| 146 | #define NETDATA_CGROUP_SOCKET_TCP_RECV_CONTEXT "cgroup.net_tcp_recv" |
| 147 | #define NETDATA_CGROUP_SOCKET_TCP_SEND_CONTEXT "cgroup.net_tcp_send" |
| 148 | #define NETDATA_CGROUP_SOCKET_TCP_RETRANSMIT_CONTEXT "cgroup.net_retransmit" |
| 149 | #define NETDATA_CGROUP_SOCKET_UDP_RECV_CONTEXT "cgroup.net_udp_recv" |
| 150 | #define NETDATA_CGROUP_SOCKET_UDP_SEND_CONTEXT "cgroup.net_udp_send" |
| 151 | |
| 152 | #define NETDATA_SERVICES_SOCKET_TCP_V4_CONN_CONTEXT "systemd.service.net_conn_ipv4" |
| 153 | #define NETDATA_SERVICES_SOCKET_TCP_V6_CONN_CONTEXT "systemd.service.net_conn_ipv6" |
| 154 | #define NETDATA_SERVICES_SOCKET_TCP_BANDWIDTH_CONTEXT "systemd.service.net_total_bandwidth" |
| 155 | #define NETDATA_SERVICES_SOCKET_TCP_RECV_CONTEXT "systemd.service.net_tcp_recv" |
| 156 | #define NETDATA_SERVICES_SOCKET_TCP_SEND_CONTEXT "systemd.service.net_tcp_send" |
| 157 | #define NETDATA_SERVICES_SOCKET_TCP_RETRANSMIT_CONTEXT "systemd.service.net_retransmit" |
| 158 | #define NETDATA_SERVICES_SOCKET_UDP_RECV_CONTEXT "systemd.service.net_udp_recv" |
| 159 | #define NETDATA_SERVICES_SOCKET_UDP_SEND_CONTEXT "systemd.service.net_udp_send" |
| 160 | |
| 161 | // ARAL name |
| 162 | #define NETDATA_EBPF_SOCKET_ARAL_NAME "ebpf_socket" |
| 163 | #define NETDATA_EBPF_PID_SOCKET_ARAL_TABLE_NAME "ebpf_pid_socket" |
| 164 | #define NETDATA_EBPF_SOCKET_ARAL_TABLE_NAME "ebpf_socket_tbl" |
| 165 | |
| 166 | typedef struct ebpf_network_viewer_dimension_names { |
| 167 | char *name; |
| 168 | uint32_t hash; |
| 169 | |
| 170 | uint16_t port; |
| 171 | |
| 172 | struct ebpf_network_viewer_dimension_names *next; |
| 173 | } ebpf_network_viewer_dim_name_t; |
| 174 | |
| 175 | typedef struct ebpf_network_viewer_port_list { |
| 176 | char *value; |
| 177 | uint32_t hash; |
| 178 | |
| 179 | uint16_t first; |
| 180 | uint16_t last; |
| 181 | |
| 182 | uint16_t cmp_first; |
| 183 | uint16_t cmp_last; |
| 184 | |
| 185 | uint16_t protocol; |
| 186 | uint32_t pid; |
| 187 | uint32_t tgid; |
| 188 | uint64_t connections; |
| 189 | struct ebpf_network_viewer_port_list *next; |
| 190 | } ebpf_network_viewer_port_list_t; |
| 191 | |
| 192 | typedef struct netdata_passive_connection { |
| 193 | uint32_t tgid; |
| 194 | uint32_t pid; |
| 195 | uint64_t counter; |
| 196 | } netdata_passive_connection_t; |
| 197 | |
| 198 | typedef struct netdata_passive_connection_idx { |
| 199 | uint16_t protocol; |
| 200 | uint16_t port; |
| 201 | } netdata_passive_connection_idx_t; |
| 202 | |
| 203 | /** |
| 204 | * Union used to store ip addresses |
| 205 | */ |
| 206 | union netdata_ip_t { |
| 207 | uint8_t addr8[16]; |
| 208 | uint16_t addr16[8]; |
| 209 | uint32_t addr32[4]; |
| 210 | uint64_t addr64[2]; |
| 211 | }; |
| 212 | |
| 213 | typedef struct ebpf_network_viewer_ip_list { |
| 214 | char *value; // IP value |
| 215 | uint32_t hash; // IP hash |
| 216 | |
| 217 | uint8_t ver; // IP version |
| 218 | |
| 219 | union netdata_ip_t first; // The IP address informed |
| 220 | union netdata_ip_t last; // The IP address informed |
| 221 | |
| 222 | struct ebpf_network_viewer_ip_list *next; |
| 223 | } ebpf_network_viewer_ip_list_t; |
| 224 | |
| 225 | typedef struct ebpf_network_viewer_hostname_list { |
| 226 | char *value; // IP value |
| 227 | uint32_t hash; // IP hash |
| 228 | |
| 229 | SIMPLE_PATTERN *value_pattern; |
| 230 | |
| 231 | struct ebpf_network_viewer_hostname_list *next; |
| 232 | } ebpf_network_viewer_hostname_list_t; |
| 233 | |
| 234 | typedef struct ebpf_network_viewer_options { |
| 235 | RW_SPINLOCK rw_spinlock; |
| 236 | |
| 237 | uint32_t enabled; |
| 238 | uint32_t family; // AF_INET, AF_INET6 or AF_UNSPEC (both) |
| 239 | |
| 240 | uint32_t hostname_resolution_enabled; |
| 241 | uint32_t service_resolution_enabled; |
| 242 | |
| 243 | ebpf_network_viewer_port_list_t *excluded_port; |
| 244 | ebpf_network_viewer_port_list_t *included_port; |
| 245 | |
| 246 | ebpf_network_viewer_dim_name_t *names; |
| 247 | |
| 248 | ebpf_network_viewer_ip_list_t *excluded_ips; |
| 249 | ebpf_network_viewer_ip_list_t *included_ips; |
| 250 | |
| 251 | ebpf_network_viewer_hostname_list_t *excluded_hostnames; |
| 252 | ebpf_network_viewer_hostname_list_t *included_hostnames; |
| 253 | |
| 254 | ebpf_network_viewer_ip_list_t *ipv4_local_ip; |
| 255 | ebpf_network_viewer_ip_list_t *ipv6_local_ip; |
| 256 | } ebpf_network_viewer_options_t; |
| 257 | |
| 258 | extern ebpf_network_viewer_options_t network_viewer_opt; |
| 259 | |
| 260 | typedef enum netdata_socket_flags { NETDATA_SOCKET_FLAGS_ALREADY_OPEN = (1 << 0) } netdata_socket_flags_t; |
| 261 | |
| 262 | typedef enum netdata_socket_src_ip_origin { |
| 263 | NETDATA_EBPF_SRC_IP_ORIGIN_LOCAL, |
| 264 | NETDATA_EBPF_SRC_IP_ORIGIN_EXTERNAL |
| 265 | } netdata_socket_src_ip_origin_t; |
| 266 | |
| 267 | typedef struct netata_socket_plus { |
| 268 | netdata_socket_t data; // Data read from database |
| 269 | uint32_t pid; |
| 270 | time_t last_update; |
| 271 | netdata_socket_flags_t flags; |
| 272 | |
| 273 | struct { |
| 274 | char src_ip[INET6_ADDRSTRLEN + 1]; |
| 275 | // uint16_t src_port; |
| 276 | char dst_ip[INET6_ADDRSTRLEN + 1]; |
| 277 | char dst_port[NI_MAXSERV + 1]; |
| 278 | } socket_string; |
| 279 | } netdata_socket_plus_t; |
| 280 | |
| 281 | extern ARAL *aral_socket_table; |
| 282 | |
| 283 | /** |
| 284 | * Index used together previous structure |
| 285 | */ |
| 286 | typedef struct netdata_socket_idx { |
| 287 | union netdata_ip_t saddr; |
| 288 | //uint16_t sport; |
| 289 | union netdata_ip_t daddr; |
| 290 | uint16_t dport; |
| 291 | uint32_t pid; |
| 292 | } netdata_socket_idx_t; |
| 293 | |
| 294 | extern ebpf_network_viewer_port_list_t *listen_ports; |
| 295 | void update_listen_table(uint16_t value, uint16_t proto, netdata_passive_connection_t *values); |
| 296 | void ebpf_fill_ip_list_unsafe(ebpf_network_viewer_ip_list_t **out, ebpf_network_viewer_ip_list_t *in, char *table); |
| 297 | void ebpf_parse_service_name_section(struct config *cfg); |
| 298 | void ebpf_parse_ports(const char *ptr); |
| 299 | void ebpf_socket_read_open_connections(BUFFER *buf, struct ebpf_module *em); |
| 300 | void ebpf_socket_fill_publish_apps(ebpf_socket_publish_apps_t *curr, netdata_socket_t *ns); |
| 301 | |
| 302 | extern struct config socket_config; |
| 303 | extern netdata_ebpf_targets_t socket_targets[]; |
| 304 | |
| 305 | #endif |