@mark1russell7/prober 0.0.0-stage → 0.1.0

package/native/Cargo.lock

@@ -0,0 +1,206 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "cc"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
+dependencies = [
+ "find-msvc-tools",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libbpf-rs"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffef943d6690772a293abe80412ca438c227867cac93448af2518166df1b1a7b"
+dependencies = [
+ "bitflags",
+ "libbpf-sys",
+ "libc",
+ "vsprintf",
+]
+
+[[package]]
+name = "libbpf-sys"
+version = "1.7.0+v1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a109478760b2900aa2a6f2087e9d0de1d9c535b1758602af2845d5d2ccfaed7c"
+dependencies = [
+ "cc",
+ "nix",
+ "pkg-config",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.190"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "prober"
+version = "0.1.0"
+dependencies = [
+ "libbpf-rs",
+ "libc",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
+
+[[package]]
+name = "vsprintf"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aec2f81b75ca063294776b4f7e8da71d1d5ae81c2b1b149c8d89969230265d63"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

package/native/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "prober"
+version = "0.1.0"
+edition = "2021"
+publish = false
+description = "The prober's native side: the record contract, the clock, and the collector for the kernel source"
+
+[lib]
+name = "prober"
+path = "src/lib.rs"
+
+# the collector loads the kernel source, so it alone needs libbpf: the harness's tools use the
+# library without it
+[[bin]]
+name = "prober"
+path = "src/bin/prober.rs"
+required-features = ["collector"]
+
+[features]
+collector = ["dep:libbpf-rs"]
+
+[dependencies]
+libbpf-rs = { version = "=0.27.2", optional = true }
+libc = "0.2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+[profile.release]
+lto = true
+codegen-units = 1

package/native/src/bin/prober.rs

@@ -0,0 +1,161 @@
+//! prober [--object PATH] NETNS... | prober --decode FILE
+//!
+//! The collector for the prober's kernel source. It loads `prober.bpf.o`, watches
+//! the network namespaces given by their inode numbers, and prints every record the kernel writes
+//! as one JSON line. Every second it also prints the clock track (CLOCK_TAI beside CLOCK_MONOTONIC)
+//! and how many records the ring buffer had to drop, which must stay at zero.
+
+use prober::record::{self, Ev};
+use prober::{monotonic_ns, tai_ns};
+use libbpf_rs::{MapCore, MapFlags, ObjectBuilder, RingBufferBuilder};
+use serde_json::json;
+use std::cell::RefCell;
+use std::error::Error;
+use std::ffi::CString;
+use std::io::{BufWriter, Stdout, Write};
+use std::path::Path;
+use std::rc::Rc;
+use std::time::Duration;
+
+const OBJECT: &str = "/opt/harness/prober.bpf.o";
+const TRACEFS: &str = "/sys/kernel/tracing";
+
+/// Classic tracepoints (the connect and accept syscalls) attach through tracefs, which a
+/// container does not mount. A privileged one may mount it for itself.
+fn mount_tracefs() -> Result<(), Box<dyn Error>> {
+    if Path::new(TRACEFS).join("events").exists() {
+        return Ok(());
+    }
+    let (source, target) = (CString::new("tracefs")?, CString::new(TRACEFS)?);
+    // SAFETY: every pointer is a NUL-terminated string that outlives the call; data may be null
+    let status = unsafe {
+        libc::mount(source.as_ptr(), target.as_ptr(), source.as_ptr(), 0, std::ptr::null())
+    };
+    if status != 0 {
+        return Err(format!("mount tracefs: {}", std::io::Error::last_os_error()).into());
+    }
+    Ok(())
+}
+
+fn line(out: &Rc<RefCell<BufWriter<Stdout>>>, value: &serde_json::Value) {
+    let mut out = out.borrow_mut();
+    let _ = serde_json::to_writer(&mut *out, value);
+    let _ = out.write_all(b"\n");
+}
+
+/// A record's line, written by hand into a buffer the caller reuses, then out in one write.
+fn record(out: &Rc<RefCell<BufWriter<Stdout>>>, ev: &Ev, buffer: &mut Vec<u8>) {
+    buffer.clear();
+    ev.append_line(buffer);
+    buffer.push(b'\n');
+    let _ = out.borrow_mut().write_all(buffer);
+}
+
+/// Prints the line for every record in a file of raw records, as the ring buffer would hand them
+/// over: how the three collectors are held to one contract byte for byte.
+fn decode_file(path: &str) -> Result<(), Box<dyn Error>> {
+    let data = std::fs::read(path).map_err(|error| format!("{path}: {error}"))?;
+    let out = Rc::new(RefCell::new(BufWriter::with_capacity(1 << 16, std::io::stdout())));
+    let mut buffer = Vec::with_capacity(1024);
+    for chunk in data.chunks(record::SIZE) {
+        match Ev::decode(chunk) {
+            Ok(ev) => record(&out, &ev, &mut buffer),
+            Err(why) => line(&out, &json!({ "ev": "undecodable", "why": why })),
+        }
+    }
+    out.borrow_mut().flush()?;
+    Ok(())
+}
+
+fn run() -> Result<(), Box<dyn Error>> {
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    if let Some(at) = args.iter().position(|arg| arg == "--decode") {
+        return decode_file(args.get(at + 1).ok_or("--decode needs a file")?);
+    }
+    let mut object = OBJECT.to_string();
+    if let Some(at) = args.iter().position(|arg| arg == "--object") {
+        object = args.get(at + 1).ok_or("--object needs a path")?.clone();
+        args.drain(at..=at + 1);
+    }
+    let watched: Vec<u32> = args
+        .iter()
+        .map(|arg| arg.parse::<u32>().map_err(|_| format!("{arg} is not a netns inode")))
+        .collect::<Result<_, _>>()?;
+    if watched.is_empty() {
+        return Err("name at least one network namespace to watch, by its inode".into());
+    }
+
+    mount_tracefs()?;
+    let obj = ObjectBuilder::default().open_file(&object)?.load()?;
+    let want = obj.maps().find(|map| map.name() == "want").ok_or("the object has no map want")?;
+    for netns in &watched {
+        want.update(&netns.to_ne_bytes(), &[1u8], MapFlags::ANY)?;
+    }
+    let mut links = Vec::new();
+    for prog in obj.progs_mut() {
+        let name = prog.name().to_string_lossy().into_owned();
+        links.push(prog.attach().map_err(|error| format!("attach {name}: {error}"))?);
+    }
+
+    let out = Rc::new(RefCell::new(BufWriter::with_capacity(1 << 16, std::io::stdout())));
+    let records = Rc::new(RefCell::new(0u64));
+    let ring = obj.maps().find(|map| map.name() == "rb").ok_or("the object has no map rb")?;
+    let mut builder = RingBufferBuilder::new();
+    {
+        let (out, records) = (Rc::clone(&out), Rc::clone(&records));
+        let mut buffer = Vec::with_capacity(1024);
+        builder.add(&ring, move |data: &[u8]| {
+            match Ev::decode(data) {
+                Ok(ev) => {
+                    *records.borrow_mut() += 1;
+                    record(&out, &ev, &mut buffer);
+                }
+                Err(why) => line(&out, &json!({ "ev": "undecodable", "why": why })),
+            }
+            0
+        })?;
+    }
+    let ring = builder.build()?;
+    let lost = obj.maps().find(|map| map.name() == "lost").ok_or("the object has no map lost")?;
+    let dropped = || -> u64 {
+        lost.lookup_percpu(&0u32.to_ne_bytes(), MapFlags::ANY)
+            .ok()
+            .flatten()
+            .map(|cpus| {
+                cpus.iter()
+                    .filter_map(|bytes| bytes.get(..8))
+                    .map(|bytes| u64::from_ne_bytes(bytes.try_into().unwrap_or([0; 8])))
+                    .sum()
+            })
+            .unwrap_or(0)
+    };
+
+    line(
+        &out,
+        &json!({ "ev": "begin", "mono": monotonic_ns(), "tai": tai_ns(), "netns": watched, "programs": links.len() }),
+    );
+    out.borrow_mut().flush()?;
+    let mut next = monotonic_ns() + 1_000_000_000;
+    loop {
+        // woken only when 256 KiB are waiting, so drain on every 20 ms tick as well
+        ring.poll(Duration::from_millis(20))?;
+        ring.consume()?;
+        let now = monotonic_ns();
+        if now >= next {
+            let count = *records.borrow();
+            line(
+                &out,
+                &json!({ "ev": "clock", "mono": now, "tai": tai_ns(), "records": count, "lost": dropped() }),
+            );
+            next += 1_000_000_000;
+        }
+        out.borrow_mut().flush()?;
+    }
+}
+
+fn main() {
+    if let Err(error) = run() {
+        println!("{}", json!({ "ev": "fail", "mono": monotonic_ns(), "why": error.to_string() }));
+        std::process::exit(1);
+    }
+}

package/native/src/lib.rs

@@ -0,0 +1,75 @@
+//! The prober's native side:
+//! - the record contract: the C struct the kernel source writes (`record`), and the JSON line it
+//!   becomes;
+//! - the clock, the quantities and the errno names, which the harness's tools share;
+//! - with the `collector` feature, the `prober` binary, which loads `bpf/prober.bpf.c` and prints
+//!   every record the kernel writes as one JSON line.
+//!
+//! Every instant printed is CLOCK_MONOTONIC in nanoseconds: eBPF stamps with that clock, and every
+//! container on the VM shares it. Every amount is a quantity,
+//! `{ "value": …, "unit": … }`, in @mark1russell7/quantity's canonical units.
+
+pub mod record;
+
+use serde::Serialize;
+
+fn clock_ns(clock: libc::clockid_t) -> u64 {
+    let mut now = libc::timespec { tv_sec: 0, tv_nsec: 0 };
+    // SAFETY: clock_gettime only writes the timespec it is handed, which lives on this stack
+    let status = unsafe { libc::clock_gettime(clock, &mut now) };
+    assert_eq!(status, 0, "clock_gettime({clock}) failed");
+    now.tv_sec as u64 * 1_000_000_000 + now.tv_nsec as u64
+}
+
+/// CLOCK_MONOTONIC, the clock the kernel source stamps with.
+pub fn monotonic_ns() -> u64 {
+    clock_ns(libc::CLOCK_MONOTONIC)
+}
+
+/// CLOCK_TAI, for the clock track: REALTIME steps on this VM, TAI does not jump relative to it.
+pub fn tai_ns() -> u64 {
+    clock_ns(libc::CLOCK_TAI)
+}
+
+/// An amount and its canonical unit, as @mark1russell7/quantity writes one; its keys in byte order, as
+/// serde_json writes any object it holds as a map.
+#[derive(Serialize, Clone, Copy, Debug, PartialEq)]
+pub struct Quantity {
+    pub unit: &'static str,
+    pub value: f64,
+}
+
+pub fn quantity(value: impl Into<f64>, unit: &'static str) -> Quantity {
+    Quantity { value: value.into(), unit }
+}
+
+/// The name of an errno, as the harness's predictions name the error a detector raises.
+pub fn errno_name(code: i32) -> String {
+    match code {
+        libc::ETIMEDOUT => "ETIMEDOUT".into(),
+        libc::ECONNRESET => "ECONNRESET".into(),
+        libc::ECONNREFUSED => "ECONNREFUSED".into(),
+        libc::EHOSTUNREACH => "EHOSTUNREACH".into(),
+        libc::ENETUNREACH => "ENETUNREACH".into(),
+        libc::EPIPE => "EPIPE".into(),
+        libc::ECONNABORTED => "ECONNABORTED".into(),
+        other => format!("E{other}"),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn names_the_errors_a_detector_raises() {
+        assert_eq!(errno_name(libc::ETIMEDOUT), "ETIMEDOUT");
+        assert_eq!(errno_name(9999), "E9999");
+    }
+
+    #[test]
+    fn reads_a_monotonic_clock_that_never_steps_back() {
+        let first = monotonic_ns();
+        assert!(monotonic_ns() >= first);
+    }
+}