github/weave-scope
1
0
Fork 0
mirror of https://github.com/weaveworks/scope.git synced 2026-09-06 10:17:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,438 Commits 85 Branches 64 Tags
mike/temp
Commit Graph
145 Commits
Author SHA1 Message Date
Alfonso Acosta 6347238f10 Review feedback 2017-01-27 13:05:50 +00:00
Alfonso Acosta 7ae94a8c8a DNSSnooper: Support Dot1Q and limit decoding errors 2017-01-27 10:59:33 +00:00
Alban Crequy f1e2b5d93a probe: conntrack: fix output parsing 
With net.netfilter.nf_conntrack_acct = 1, conntrack adds the following
fields in the output: packets=3 bytes=164

And with SELinux (e.g. Fedora), conntrack adds: secctx=...

The parsing with fmt.Sscanf introduced in #2095 was unfortunately
rejecting lines with those fields. This patch fixes that by adding more
complicated parsing in decodeFlowKeyValues() with FieldsFunc and SplitN.

Fixes #2117
Regression from #2095
 2017-01-17 19:30:56 +01:00
Alfonso Acosta 496e3f2072 Merge pull request #2114 from weaveworks/1972-non-established-proc-conns 
Report persistent connections in states other than ESTABLISHED
 2017-01-17 10:45:53 +01:00
Alfonso Acosta 2be26e2be4 Limit connections to established and half-closed 2017-01-10 15:35:32 +00:00
Alfonso Acosta 89a0ab6799 Fix test data and improve /proc/net/tcp header parsing 
The header checking code was unsafe because:

1. It was accessing the byteslice at [2] without ensuring a length >= 3
2. It was assuming that the indentation of the 'sl' header is always 2 (which seems to be the case in recent kernels https://github.com/torvalds/linux/blob/8f18e4d03ed8fa5e4a300c94550533bd8ce4ff9a/net/ipv4/tcp_ipv4.c#L2304 and https://github.com/torvalds/linux/blob/8f18e4d03ed8fa5e4a300c94550533bd8ce4ff9a/net/ipv6/tcp_ipv6.c#L1831 ) but it's more robust to simply trim the byteslice.
 2017-01-04 00:27:16 +00:00
Alfonso Acosta 99a7dc3b9a Fix tests 2017-01-03 23:34:32 +00:00
Alfonso Acosta a8b4e65b5c Make linter happy 2017-01-03 22:55:28 +00:00
Alfonso Acosta 7716d96810 Report persistent connections in states other than ESTABLISHED 
This aligns the `/proc` connection tracking (persistent connections) with
conntrack (short-lived connections).
 2017-01-03 18:38:02 +00:00
Alfonso Acosta b4e1fc7074 Merge pull request #2112 from weaveworks/2032-ensure-conntrack-events 
Check that conntrack events are enabled in the kernel
 2017-01-02 23:11:52 +01:00
Alfonso Acosta 5c3ea83846 Fix minor typo 2017-01-02 14:28:22 +00:00
Alfonso Acosta dfb52f0d93 Clarify even further that proc/PID/net/tcp varies by namespace 2017-01-02 14:27:37 +00:00
Alfonso Acosta 64f1a5d0f5 Check that conntrack events are enabled in the kernel 2017-01-02 09:22:26 +00:00
Alfonso Acosta 9d352e96f5 Review feedback 2016-12-22 09:33:52 +00:00
Alfonso Acosta d22d64c710 Cleanup 
* Remove XML traces
* Improve performance
* Fix tests
 2016-12-21 19:35:37 +00:00
Alfonso Acosta f19889f63c Reduce garbage 2016-12-19 19:30:23 +00:00
Alfonso Acosta 5c02dfcbd2 Complete hacky manual parser 2016-12-19 11:30:00 +00:00
Alfonso Acosta 710c3bf82e [WIP] Diable XML in conntrack parsing 
Not working yet
 2016-12-19 11:30:00 +00:00
Alfonso Acosta 07aee0ed97 Merge pull request #2020 from kinvolk/alban/fix-getWalkedProcPid 
procspy: use a Reader to copy the background reader buffer
 2016-12-07 12:53:53 +01:00
Jonathan Lange 1020fc5f85 Use test.Diff from common 2016-12-07 11:22:40 +00:00
Jonathan Lange b5c750ddea Move test & fs 2016-12-07 11:22:39 +00:00
Jonathan Lange e8085b01b6 Use 'common' library 2016-12-07 11:22:38 +00:00
Alban Crequy 543f3d5bdc procspy: use a Reader to copy the background reader buffer 
getWalkedProcPid() reads latestBuf every 3 seconds (for each report).
But performWalk() writes latestBuf every 10 seconds or so. So we need to
be able to read the same buffer several times.
 2016-12-05 18:12:11 +01:00
Alfonso Acosta 6ed79a7427 Merge pull request #1897 from weaveworks/stricter-dns-over-tcp-snooping 
Be more strict when snooping DNS over TCP traffic
 2016-09-27 21:12:35 +02:00
Alfonso Acosta 45a9367d97 Be more strict when snooping DNS over TCP traffic 2016-09-27 12:48:25 +00:00
Tom Wilkie b130f1ba13 Allow users to specify conntrack buffer size. (#1896) 
* Allow users to specify conntrack buffer size.

* Fix tests.

* Use a config struct.
 2016-09-26 12:08:38 -07:00
Alfonso Acosta 326208c395 Skip DNS length field (only included over TCP) 2016-09-23 13:57:39 +00:00
Alfonso Acosta 6f95d05c59 Add support for snooping DNS over TCP 2016-09-23 12:41:32 +00:00
Alfonso Acosta c5ac315b38 Review feedback 2016-09-20 16:50:29 +00:00
Alfonso Acosta f5ad6a8e97 Minor fixes/refinements 2016-09-19 14:38:59 +00:00
Alfonso Acosta 028ed32b6f Simplify service node matching 2016-09-19 14:38:59 +00:00
Alfonso Acosta 0223b0b385 Implement DNS snooper 2016-09-19 14:38:59 +00:00
Matthias Radestock 9d010fabc8 refactor: extract makeEndpointNode helper 2016-09-02 21:12:23 +01:00
Matthias Radestock 5bc3a9d5ac correctly reverse-resolve source of inbound connections 
There were two problems:
- the renderer was looking for reverse names on the destination
- the probe was not annotating source nodes with reverse-resolved names

Fixes #1847
 2016-09-02 20:31:03 +01:00
Matthias Radestock 3ebe4a5303 cosmetic: formatting 2016-09-02 08:19:32 +01:00
Alfonso Acosta 7702905bbf Remove unused variable 2016-08-26 14:03:29 +00:00
Alfonso Acosta a904620908 Improve conntrack kernel-support detection for in-kernel compilations 2016-08-26 14:03:29 +00:00
Alfonso Acosta 3892273096 Append namespace to endpoint scope for loopback connections 2016-08-10 10:43:04 +00:00
Julius Volz 4fa40e22b2 Rework Scope metrics according to Prometheus conventions. (#1615) 
* Rework Scope metrics according to Prometheus conventions.

- counters should end with _total
- elaborated and added units to help strings
- recommended for cache hit/miss metrics: track only the total and the
  hits and in separate metrics, since the most common query will be
  "hits / total"
- track all times in seconds (base units), which has become the standard
  recommendation
- other small changes

There could be more changes that would require more thinking (what
dimensions to use, summaries vs. histograms, etc.), but this is probably
enough controversial material already :)

* Use timeRequestStatus() in sqs_control_router.go.
 2016-06-30 09:12:25 +01:00
Tom Wilkie 277bd70491 Don't every store NEW conntrack flows (only every store updates). (#1541) 
This closes a small window where we might produce reports which contain flows that are NEW but have never seen an UPDATE, which can potentially be invalid.
 2016-05-27 11:25:42 +01:00
Tom Wilkie 8f772a696d Add flag to disable reporting of processes (and procspied endpoints) 2016-05-17 17:29:09 +01:00
Tom Wilkie 23c5e9f820 Ignore conntracked connections on which we never saw an update; don't nat map conntracked connections. (#1466) 2016-05-11 15:30:45 +02:00
Alfonso Acosta b1836acb62 Only add DNAT'ed addresses for short-lived connections 2016-05-04 14:48:48 +00:00
Alfonso Acosta 1f825c52ff Correctly attribute DNAT-ed short-lived connections 2016-05-04 14:48:47 +00:00
Tom Wilkie 0a51064713 Use reverse-resolved DNS info in the connections table. 2016-04-20 17:18:32 +01:00
Paul Bellamy 1edeb8d190 Removing report.Node.WithID (#1315) 
* removing usage of report.Node.WithID

* report.Topology.AddNode can use the node's ID field
 2016-04-19 16:48:03 +01:00
Paul Bellamy b970b0561b Set the memory and open files maximums 
process memory limit is not cgroup-aware
 2016-04-06 13:07:55 +01:00
Tom Wilkie 7e2e4c9c45 Fix spelling mistakes in the codebase. 2016-03-23 10:51:27 +00:00
Paul Bellamy 0a910b422d only check the first two segments of the kernel version 2016-03-15 13:20:15 +00:00
Tom Wilkie e7c5fc7016 Remove address topology 2016-03-08 13:23:30 +00:00