feat: add ebpf plugins #2049

KayzzzZ · 2025-01-19T11:37:04Z

引入 coolbpf 子模块，作为 bpf 底座
新增 ebpf driver 目录，作为 coolbpf 的驱动
AbstractManager 将负责管理每个 eBPF 插件，所有的 AbstractManagers 由 eBPFServer 管理
SourceManager 仍然负责与 ebpf driver 交互，不过 eBPF Server 不再直接调用 SourceManager，转而由 AbstractManager 来调用
整体包括三组线程：Poller 线程负责拉取 eBPF PerfBuffer；Handler 线程负责处理 eBPF 事件；Scheduler 线程负责定时将聚合后的数据写入到 ProcessQueue 中

2. add sampler 3. add some ut

…rity

2. add ebpf wrapper ut 3. add ebpf map traits ut

core/ebpf/plugin/ProcessCacheManager.cpp

yyuuttaaoo · 2025-02-20T06:47:47Z

core/ebpf/plugin/ProcessCacheManager.cpp

+            LOG_ERROR(sLogger, ("user thread, proc is null", ""));
+            return 1;
+        }
+        event->msg->common.size = MSG_UNIX_SIZE + proc->psize + proc->size;


proc->psize 和 proc->size从未赋值

看了下代码，我们的逻辑里面，对于 /proc 目录读取的进程，这个参数没有用到，可以删掉这个赋值。
对于内核里面 poll 到的event，我们需要common.size 来判断 args 里面到底有多少数据。

core/ebpf/plugin/ProcessCacheManager.cpp

core/ebpf/type/ProcessEvent.h

core/ebpf/plugin/ProcessCacheManager.cpp

…butes

core/ebpf/driver/NetworkFilter.cpp

2. add some ut

KayzzzZ added 30 commits January 23, 2025 10:48

add some utils

d6e1030

add protocol parser and aggregator

04f6599

1. add some third party utils

d4aafbd

2. add sampler 3. add some ut

update coolbpf and add driver layer framework

c290c30

compile coolbpf and driver lib

feeb539

export some functions for driver

b575f94

network observer start done ..

ca8b008

network observer support log scenario

bdd653d

fix enterprise compile

a660ac8

update

0186592

move id allocator

e9b9297

format && add some framework

96a4cca

update

cf01f07

update

58962e7

update

b438364

update

697b82c

update

58ad778

add aggregator ut and setup aggregator for networksecurity & filesecu…

497b097

…rity

add some annotations

fa8bee1

add lock

6313b5e

add data handler

0374e83

update

08b5201

update

cdf4ff3

fix conflict

65cca2c

update

3176f41

flush span

978b903

fix url path

4d15e92

set to event tag instead of event group tag

0f916e7

update

3545ec5

clang format

10217de

KayzzzZ and others added 12 commits February 18, 2025 20:51

fix

5f442c4

fix

a499da6

refine class names

c4c7dce

fix build

bc71222

fix aggregator ut

d327f0d

tag constants ref to data elements

ed22b13

fix ut

0d791d0

add id_allocator ut

aad04a5

1. update coolbpf

459a346

2. add ebpf wrapper ut 3. add ebpf map traits ut

fix Go Lint

460aeba

fix ut

3573256

lint data table

21078aa