ebpf_exporter

1
#include <vmlinux.h>
2
#include <bpf/bpf_tracing.h>
3
#include "maps.bpf.h"
4

5
// 17 buckets for backlog sizes, max range is 64k..128k
6
#define MAX_BUCKET_SLOT 17
7

8
// Address on which docker accepts connections
9
#define DOCKER_SOCK_ADDR_PATH "/var/run/docker.sock"
10

11
// Keep in sync with static_map in the config
12
enum unix_addr {
13
    DOCKER_SOCK_ADDR,
14
    MAX_PATHS // Max number of paths to track
15
};
16

17
struct key_t {
18
    enum unix_addr addr;
19
    u64 bucket;
20
};
21

22
struct {
23
    __uint(type, BPF_MAP_TYPE_HASH);
24
    __uint(max_entries, (MAX_BUCKET_SLOT + 2) * MAX_PATHS);
25
    __type(key, struct key_t);
26
    __type(value, u64);
27
} unix_socket_backlog SEC(".maps");
28

29
// https://elixir.bootlin.com/linux/v6.6-rc1/source/include/linux/skbuff.h#L2133
30
static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
31
{
32
    return list_->qlen;
33
}
34

35
static int do_count(enum unix_addr addr, u64 backlog)
36
{
37
    struct key_t key = {};
38

39
    key.addr = addr;
40

41
    increment_exp2zero_histogram(&unix_socket_backlog, key, backlog, MAX_BUCKET_SLOT);
42

43
    return 0;
44
}
45

46
SEC("fexit/unix_find_other")
47
int BPF_PROG(unix_find_other, struct net *net, struct sockaddr_un *sunaddr, int addr_len, int type, struct sock *other)
48
{
49
    // Make sure to use clang-15, otherwise you might see:
50
    //   libbpf: failed to find BTF for extern 'memcmp': -2
51
    if (__builtin_memcmp(sunaddr->sun_path, DOCKER_SOCK_ADDR_PATH, sizeof(DOCKER_SOCK_ADDR_PATH)) == 0) {
52
        return do_count(DOCKER_SOCK_ADDR, skb_queue_len(&other->sk_receive_queue));
53
    }
54

55
    return 0;
56
}
57

58
char LICENSE[] SEC("license") = "GPL";
59