Commit Graph

10 Commits

Author SHA1 Message Date
Matthias Radestock
59f777a066 don't read all of /proc when probe.proc.spy=false
Previously we were doing the reading even though we weren't looking at
the result.
2017-06-02 14:01:25 +01:00
Alban Crequy
d715ccc391 ebpf: handle fd_install events from tcptracer-bpf
Since https://github.com/weaveworks/tcptracer-bpf/pull/39, tcptracer-bpf
can generate "fd_install" events when a process installs a new file
descriptor in its fd table. Those events must be requested explicitely
on a per-pid basis with tracer.AddFdInstallWatcher(pid).

This is useful to know about "accept" events that would otherwise be
missed because kretprobes are not triggered for functions that were
called before the installation of the kretprobe.

This patch find all the processes that are currently blocked on an
accept() syscall during the EbpfTracker initialization.
feedInitialConnections() will use tracer.AddFdInstallWatcher() to
subscribe to fd_install  events. When a fd_install event is received,
synthesise an accept event with the connection tuple and the network
namespace (from /proc).
2017-05-19 14:49:38 +02:00
Bryan Boreham
515f4b1a47 Make various anonymous fields named
Anonymous fields make any methods on the inner object visible on the
outer, so they should only be used when the outer is-a inner.
2017-04-01 11:35:10 +00:00
Alfonso Acosta
2be26e2be4 Limit connections to established and half-closed 2017-01-10 15:35:32 +00:00
Alfonso Acosta
7716d96810 Report persistent connections in states other than ESTABLISHED
This aligns the `/proc` connection tracking (persistent connections) with
conntrack (short-lived connections).
2017-01-03 18:38:02 +00:00
Alfonso Acosta
3892273096 Append namespace to endpoint scope for loopback connections 2016-08-10 10:43:04 +00:00
Alfonso Acosta
b93c3232cd Make linter happy 2016-02-08 13:42:53 +00:00
Alfonso Acosta
d4c68f48fa Get rid of the package-level Connections func 2016-02-08 13:42:53 +00:00
Tom Wilkie
e15fe2b747 Use caching proc walker in procspy. 2015-12-10 14:00:42 +00:00
Tom Wilkie
b94751ac10 Move procspy out of vendor into probe/endpoint. 2015-12-09 11:06:04 +00:00