bsc::ebpf Namespace Reference

Classes
struct	ConnEvent
class	EBPFMon

Enumerations
enum	EventKind : uint8_t { EVT_TP_SET_STATE = 0 , EVT_TCP_CONNECT = 1 , EVT_UDP_SENDMSG = 2 }

Functions
bsc::model::Connection	event_to_connection (const ConnEvent &ev)

Enumeration Type Documentation

EventKind

enum bsc::ebpf::EventKind : uint8_t

Enumerator
EVT_TP_SET_STATE
EVT_TCP_CONNECT
EVT_UDP_SENDMSG

Definition at line 45 of file EBPFMon.hpp.

               : uint8_t {
    EVT_TP_SET_STATE    = 0,   // tracepoint inet_sock_set_state
    EVT_TCP_CONNECT     = 1,   // kprobe tcp_v{4,6}_connect
    EVT_UDP_SENDMSG     = 2,   // kprobe udp{,v6}_sendmsg
};

Function Documentation

event_to_connection()

bsc::model::Connection bsc::ebpf::event_to_connection

(

const ConnEvent &

ev

)

Definition at line 34 of file EBPFMon.cpp.

{
    bsc::model::Connection c;
 
    c.process_id   = ev.pid;
    c.user_id      = ev.uid;
    c.process_comm = std::string(ev.comm,
                                 strnlen(ev.comm, sizeof(ev.comm)));
 
    c.protocol = (ev.proto == 6) ? "tcp" : "udp";
 
    char buf[INET6_ADDRSTRLEN]{};
    if (ev.family == AF_INET) {
        // src
        inet_ntop(AF_INET, ev.src_addr, buf, sizeof(buf));
        c.src_ip = buf;
        // dst
        inet_ntop(AF_INET, ev.dst_addr, buf, sizeof(buf));
        c.dst_ip = buf;
    } else {
        inet_ntop(AF_INET6, ev.src_addr, buf, sizeof(buf));
        c.src_ip = buf;
        inet_ntop(AF_INET6, ev.dst_addr, buf, sizeof(buf));
        c.dst_ip = buf;
    }
 
    c.src_port = ev.src_port;
    c.dst_port = ev.dst_port;
 
    // Timestamp: converte ns monotoni in system_clock (approssimato)
    // Il daemon usa seen_at solo per ordinamento nella UI — non critico.
    c.seen_at = std::chrono::system_clock::now();
 
    return c;
}

References AF_INET, AF_INET6, bsc::ebpf::ConnEvent::comm, bsc::ebpf::ConnEvent::dst_addr, bsc::model::Connection::dst_ip, bsc::ebpf::ConnEvent::dst_port, bsc::model::Connection::dst_port, event_to_connection(), bsc::ebpf::ConnEvent::family, bsc::ebpf::ConnEvent::pid, bsc::model::Connection::process_comm, bsc::model::Connection::process_id, bsc::ebpf::ConnEvent::proto, bsc::model::Connection::protocol, bsc::model::Connection::seen_at, bsc::ebpf::ConnEvent::src_addr, bsc::model::Connection::src_ip, bsc::ebpf::ConnEvent::src_port, bsc::model::Connection::src_port, bsc::ebpf::ConnEvent::uid, and bsc::model::Connection::user_id.

Referenced by event_to_connection().