Support for eBPF based port forwarding #3067
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -5,10 +5,13 @@ | |
| "errors" | ||
| "os" | ||
| "reflect" | ||
| "strconv" | ||
| "sync" | ||
| "syscall" | ||
| "time" | ||
|
|
||
| "github.com/balajiv113/trackport/pkg/trackapi" | ||
| "github.com/balajiv113/trackport/pkg/tracker" | ||
| "github.com/elastic/go-libaudit/v2" | ||
| "github.com/elastic/go-libaudit/v2/auparse" | ||
| "github.com/lima-vm/lima/pkg/guestagent/api" | ||
|
|
@@ -138,11 +141,11 @@ | |
| } | ||
| } | ||
|
|
||
| type eventState struct { | ||
| ports []*api.IPPort | ||
| } | ||
|
|
||
| func comparePorts(old, neww []*api.IPPort) (added, removed []*api.IPPort) { | ||
| mRaw := make(map[string]*api.IPPort, len(old)) | ||
| mStillExist := make(map[string]bool, len(old)) | ||
|
|
||
|
|
@@ -169,7 +172,7 @@ | |
| return | ||
| } | ||
|
|
||
| func (a *agent) collectEvent(ctx context.Context, st eventState) (*api.Event, eventState) { | ||
| var ( | ||
| ev = &api.Event{} | ||
| err error | ||
|
|
@@ -186,7 +189,7 @@ | |
| return ev, newSt | ||
| } | ||
|
|
||
| func isEventEmpty(ev *api.Event) bool { | ||
| empty := &api.Event{} | ||
| copied := ev | ||
| copied.Time = nil | ||
|
|
@@ -195,24 +198,26 @@ | |
|
|
||
| func (a *agent) Events(ctx context.Context, ch chan *api.Event) { | ||
| defer close(ch) | ||
|
There was a problem hiding this comment. To simplify https://github.com/balajiv113/trackport/tree/main/pkg/internal/bpftracker , can we keep the existing There was a problem hiding this comment. Yes yes will do that. I wanted to purely use eBPF because fentry and fexit will wait for the eBPF logic to complete. So I wanted to verify if the UDP forwarding issue is resolved in that case |
||
|
|
||
| portMonitor := tracker.NewRunner(tracker.WithBpf(), tracker.WithNft()) | ||
|
|
||
| callbackFn := func(event *trackapi.PortEvent) { | ||
| port := make([]*api.IPPort, 1) | ||
| ev := &api.Event{Time: timestamppb.Now()} | ||
| atoi, _ := strconv.Atoi(event.Port) | ||
| if event.Action == trackapi.OPEN { | ||
| port[0] = &api.IPPort{Ip: event.Ip.String(), Port: int32(atoi), Protocol: trackapi.ProtocolToString(event.Protocol)} | ||
|
||
| ev.LocalPortsAdded = port | ||
| } else { | ||
| port[0] = &api.IPPort{Ip: event.Ip.String(), Port: int32(atoi), Protocol: trackapi.ProtocolToString(event.Protocol)} | ||
|
||
| ev.LocalPortsRemoved = port | ||
| } | ||
| ch <- ev | ||
| } | ||
| errCh := portMonitor.Run(ctx, callbackFn) | ||
| err := <-errCh | ||
| if err != nil { | ||
| return | ||
| } | ||
| } | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The binary blobs such as https://github.com/balajiv113/trackport/blob/main/pkg/internal/bpftracker/bpf_arm64_bpfel.o have to be removed
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Those are actually needed it will be embedded in go logics
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we compile them from source in the Lima repo?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes yes that's the ultimate goal after it's all good.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I will clean up stuff and verify it again and see if all still holds good.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It might be even fine to just execute the
bpftracecommand to stimulate the ticker, if thego buildstuff is too complicatedlima/cmd/lima-guestagent/daemon_linux.go
Lines 57 to 63 in 7459f45
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We can do that as a temp solution.
If we use ebpf then i wanted to avoid parsing the proc file again. As this will add further delay only in forwarding. But identifying ip and ports just by using bpftrace its hard. we need multiple variations. That's where using celium helped to write down our logics
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This sounds like it is not really a generic solution and requires custom rules for each container runtime.
I wonder how much latency parsing the proc file is adding; maybe it is not noticeable?
As long as we manage to close the port forwarding before a new container can reopen the port, we should be fine. I guess we can do some stress-testing to see how it works.