microsoft / microsoft/retina

Support capturing/tracing unix domain sockets with kprobe ebpf

Open
#225 4 comments 0 reactions 0 assignees View on GitHub
area/ebpf area/plugins help wanted priority/1 type/enhancement
Dominant language
Go
Stars
3.2k
Forks
304
Avg merge
1d 19h
Merged PRs (30d)
78

Description

Today Retina only watches for events from either tc prog or some drop reason kprobes, Retina should be watching for events of unix domain socket as well. This will need additional work to understand how to distinguish src and dest pod/container/process.

For starters, attaching to below kprobes:
`kprobe/unix_stream_sendmsg`
`kprobe/unix_dgram_sendmsg`
`fentry/unix_stream_sendmsg`
`fentry/unix_dgram_sendmsg`

Example:
https://github.com/Asphaltt/sockdump

Contributor guide

Open the contributing guide

Research direction

Start by tracing Retina's existing tc-program and drop-reason kprobe event paths, then review the unix_stream_sendmsg and unix_dgram_sendmsg kprobe and fentry hooks. Use the linked sockdump example for context. Done means Unix domain socket events are captured and their source and destination pod, container, and process can be distinguished.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
networking, observability
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.