Skip to content

Commit 74be970

Browse files
balajiv113balajiv113
committed
Support for eBPF based port forwarding
Signed-off-by: Balaji Vijayakumar <[email protected]>
1 parent 9be3b9a commit 74be970

File tree

3 files changed

+45
-20
lines changed

3 files changed

+45
-20
lines changed

Diff for: ‎go.mod

+6-1
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ require (
99
github.com/Microsoft/go-winio v0.6.2
1010
github.com/apparentlymart/go-cidr v1.1.0
1111
github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e
12+
github.com/balajiv113/trackport v0.0.0-20250102132841-d36c7896b3ee
1213
github.com/cheggaaa/pb/v3 v3.1.5
1314
github.com/containerd/containerd v1.7.24
1415
github.com/containerd/continuity v0.4.5
@@ -65,6 +66,7 @@ require (
6566
github.com/bmatcuk/doublestar/v4 v4.6.0 // indirect
6667
github.com/braydonk/yaml v0.7.0 // indirect
6768
github.com/buger/jsonparser v1.1.1 // indirect
69+
github.com/cilium/ebpf v0.17.1 // indirect
6870
github.com/containerd/errdefs v0.3.0 // indirect
6971
github.com/containerd/log v0.1.0 // indirect
7072
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
@@ -87,12 +89,14 @@ require (
8789
github.com/google/gnostic-models v0.6.8 // indirect
8890
github.com/google/gofuzz v1.2.0 // indirect
8991
github.com/google/gopacket v1.1.19 // indirect
92+
github.com/google/nftables v0.2.0 // indirect
9093
github.com/google/uuid v1.6.0 // indirect
9194
github.com/imdario/mergo v0.3.13 // indirect
9295
github.com/inconshreveable/mousetrap v1.1.0 // indirect
9396
github.com/insomniacslk/dhcp v0.0.0-20240710054256-ddd8a41251c9 // indirect
9497
github.com/jinzhu/copier v0.4.0 // indirect
9598
github.com/josharian/intern v1.0.0 // indirect
99+
github.com/josharian/native v1.1.0 // indirect
96100
github.com/json-iterator/go v1.1.12 // indirect
97101
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
98102
github.com/kr/fs v0.1.0 // indirect
@@ -101,7 +105,8 @@ require (
101105
github.com/mailru/easyjson v0.7.7 // indirect
102106
github.com/mattn/go-colorable v0.1.13 // indirect
103107
github.com/mattn/go-runewidth v0.0.15 // indirect
104-
github.com/mdlayher/socket v0.4.1 // indirect
108+
github.com/mdlayher/netlink v1.7.2 // indirect
109+
github.com/mdlayher/socket v0.5.0 // indirect
105110
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
106111
github.com/mitchellh/mapstructure v1.5.0 // indirect
107112
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect

Diff for: ‎go.sum

+17-2
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPn
2828
github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
2929
github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e h1:IdMhFPEfTZQU971tIHx3UhY4l+yCeynprnINrDTSrOc=
3030
github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e/go.mod h1:aXGMJsd3XrnUFTuyf/pTGg5jG6CY8JMZ5juywvShjgQ=
31+
github.com/balajiv113/trackport v0.0.0-20250102132841-d36c7896b3ee h1:ntAxeN+e2s7vRPqnSOm2M4f9xvNOhwqV/LC4CXoV7t8=
32+
github.com/balajiv113/trackport v0.0.0-20250102132841-d36c7896b3ee/go.mod h1:TuG7+ZQGuoORH3v7kqEMdvKYDSdSmXaowTGQNRAccYM=
3133
github.com/bmatcuk/doublestar/v4 v4.6.0 h1:HTuxyug8GyFbRkrffIpzNCSK4luc0TY3wzXvzIZhEXc=
3234
github.com/bmatcuk/doublestar/v4 v4.6.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
3335
github.com/braydonk/yaml v0.7.0 h1:ySkqO7r0MGoCNhiRJqE0Xe9yhINMyvOAB3nFjgyJn2k=
@@ -36,6 +38,8 @@ github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMU
3638
github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
3739
github.com/cheggaaa/pb/v3 v3.1.5 h1:QuuUzeM2WsAqG2gMqtzaWithDJv0i+i6UlnwSCI4QLk=
3840
github.com/cheggaaa/pb/v3 v3.1.5/go.mod h1:CrxkeghYTXi1lQBEI7jSn+3svI3cuc19haAj6jM60XI=
41+
github.com/cilium/ebpf v0.17.1 h1:G8mzU81R2JA1nE5/8SRubzqvBMmAmri2VL8BIZPWvV0=
42+
github.com/cilium/ebpf v0.17.1/go.mod h1:vay2FaYSmIlv3r8dNACd4mW/OCaZLJKJOo+IHBvCIO8=
3943
github.com/containerd/containerd v1.7.24 h1:zxszGrGjrra1yYJW/6rhm9cJ1ZQ8rkKBR48brqsa7nA=
4044
github.com/containerd/containerd v1.7.24/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
4145
github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
@@ -104,6 +108,8 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En
104108
github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
105109
github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
106110
github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
111+
github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
112+
github.com/go-quicktest/qt v1.101.0/go.mod h1:14Bz/f7NwaXPtdYEgzsx46kqSxVwTbzVZsDC26tQJow=
107113
github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
108114
github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
109115
github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
@@ -128,6 +134,8 @@ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
128134
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
129135
github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
130136
github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
137+
github.com/google/nftables v0.2.0 h1:PbJwaBmbVLzpeldoeUKGkE2RjstrjPKMl6oLrfEJ6/8=
138+
github.com/google/nftables v0.2.0/go.mod h1:Beg6V6zZ3oEn0JuiUQ4wqwuyqqzasOltcoXPtgLbFp4=
131139
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af h1:kmjWCqn2qkEml422C2Rrd27c3VGxi6a/6HNq8QmHRKM=
132140
github.com/google/pprof v0.0.0-20240525223248-4bfdf5a9a2af/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
133141
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
@@ -154,6 +162,9 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
154162
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
155163
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
156164
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
165+
github.com/jsimonetti/rtnetlink v1.3.5 h1:hVlNQNRlLDGZz31gBPicsG7Q53rnlsz1l1Ix/9XlpVA=
166+
github.com/jsimonetti/rtnetlink/v2 v2.0.1 h1:xda7qaHDSVOsADNouv7ukSuicKZO7GgVUCXxpaIEIlM=
167+
github.com/jsimonetti/rtnetlink/v2 v2.0.1/go.mod h1:7MoNYNbb3UaDHtF8udiJo/RH6VsTKP1pqKLUTVCvToE=
157168
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
158169
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
159170
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
@@ -192,10 +203,12 @@ github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZ
192203
github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
193204
github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
194205
github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
206+
github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
207+
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
195208
github.com/mdlayher/packet v1.1.2 h1:3Up1NG6LZrsgDVn6X4L9Ge/iyRyxFEFD9o6Pr3Q1nQY=
196209
github.com/mdlayher/packet v1.1.2/go.mod h1:GEu1+n9sG5VtiRE4SydOmX5GTwyyYlteZiFU+x0kew4=
197-
github.com/mdlayher/socket v0.4.1 h1:eM9y2/jlbs1M615oshPQOHZzj6R6wMT7bX5NPiQvn2U=
198-
github.com/mdlayher/socket v0.4.1/go.mod h1:cAqeGjoufqdxWkD7DkpyS+wcefOtmu5OQ8KuoJGIReA=
210+
github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
211+
github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
199212
github.com/mdlayher/vsock v1.2.1 h1:pC1mTJTvjo1r9n9fbm7S1j04rCgCzhCOS5DY0zqHlnQ=
200213
github.com/mdlayher/vsock v1.2.1/go.mod h1:NRfCibel++DgeMD8z/hP+PPTjlNJsdPOmxcnENvE+SE=
201214
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
@@ -280,6 +293,8 @@ github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8
280293
github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
281294
github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
282295
github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
296+
github.com/vishvananda/netns v0.0.4 h1:Oeaw1EM2JMxD51g9uhtC0D7erkIjgmj8+JZc26m1YX8=
297+
github.com/vishvananda/netns v0.0.4/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
283298
github.com/wk8/go-ordered-map/v2 v2.1.8 h1:5h/BUHu93oj4gIdvHHHGsScSTMijfx5PeYkE/fJgbpc=
284299
github.com/wk8/go-ordered-map/v2 v2.1.8/go.mod h1:5nJHM5DyteebpVlHnWMV0rPz6Zp7+xBAnxjb1X5vnTw=
285300
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

Diff for: ‎pkg/guestagent/guestagent_linux.go

+22-17
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,13 @@ import (
55
"errors"
66
"os"
77
"reflect"
8+
"strconv"
89
"sync"
910
"syscall"
1011
"time"
1112

13+
"github.com/balajiv113/trackport/pkg/trackapi"
14+
"github.com/balajiv113/trackport/pkg/tracker"
1215
"github.com/elastic/go-libaudit/v2"
1316
"github.com/elastic/go-libaudit/v2/auparse"
1417
"github.com/lima-vm/lima/pkg/guestagent/api"
@@ -195,24 +198,26 @@ func isEventEmpty(ev *api.Event) bool {
195198

196199
func (a *agent) Events(ctx context.Context, ch chan *api.Event) {
197200
defer close(ch)
198-
tickerCh, tickerClose := a.newTicker()
199-
defer tickerClose()
200-
var st eventState
201-
for {
202-
var ev *api.Event
203-
ev, st = a.collectEvent(ctx, st)
204-
if !isEventEmpty(ev) {
205-
ch <- ev
206-
}
207-
select {
208-
case <-ctx.Done():
209-
return
210-
case _, ok := <-tickerCh:
211-
if !ok {
212-
return
213-
}
214-
logrus.Debug("tick!")
201+
202+
portMonitor := tracker.NewRunner(tracker.WithBpf(), tracker.WithNft())
203+
204+
callbackFn := func(event *trackapi.PortEvent) {
205+
port := make([]*api.IPPort, 1)
206+
ev := &api.Event{Time: timestamppb.Now()}
207+
atoi, _ := strconv.Atoi(event.Port)
208+
if event.Action == trackapi.OPEN {
209+
port[0] = &api.IPPort{Ip: event.Ip.String(), Port: int32(atoi), Protocol: trackapi.ProtocolToString(event.Protocol)}
210+
ev.LocalPortsAdded = port
211+
} else {
212+
port[0] = &api.IPPort{Ip: event.Ip.String(), Port: int32(atoi), Protocol: trackapi.ProtocolToString(event.Protocol)}
213+
ev.LocalPortsRemoved = port
215214
}
215+
ch <- ev
216+
}
217+
errCh := portMonitor.Run(ctx, callbackFn)
218+
err := <-errCh
219+
if err != nil {
220+
return
216221
}
217222
}
218223

0 commit comments

Comments
 (0)