Support capturing/tracing unix domain sockets with kprobe ebpf
- Dominant language
- Go
- Stars
- 3.2k
- Forks
- 304
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 78
Description
Today Retina only watches for events from either tc prog or some drop reason kprobes, Retina should be watching for events of unix domain socket as well. This will need additional work to understand how to distinguish src and dest pod/container/process.
For starters, attaching to below kprobes:
`kprobe/unix_stream_sendmsg`
`kprobe/unix_dgram_sendmsg`
`fentry/unix_stream_sendmsg`
`fentry/unix_dgram_sendmsg`
Example:
https://github.com/Asphaltt/sockdump
Contributor guide
Research direction
Start by tracing Retina's existing tc-program and drop-reason kprobe event paths, then review the unix_stream_sendmsg and unix_dgram_sendmsg kprobe and fentry hooks. Use the linked sockdump example for context. Done means Unix domain socket events are captured and their source and destination pod, container, and process can be distinguished.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- networking, observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100