tetragon: Add cgrouprate support to send throttle messages

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Mar 23, 2024 · d8b4ee3 · d8b4ee3
1 parent cebc2c3
commit d8b4ee3
Show file tree

Hide file tree

Showing 2 changed files with 57 additions and 0 deletions.
diff --git a/pkg/cgrouprate/cgrouprate.go b/pkg/cgrouprate/cgrouprate.go
@@ -5,14 +5,17 @@ package cgrouprate
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"sync"
 	"time"
 
 	"github.com/cilium/ebpf"
+	"github.com/cilium/tetragon/api/v1/tetragon"
 	"github.com/cilium/tetragon/pkg/api/ops"
 	"github.com/cilium/tetragon/pkg/api/processapi"
 	"github.com/cilium/tetragon/pkg/bpf"
+	"github.com/cilium/tetragon/pkg/grpc/tracing"
 	"github.com/cilium/tetragon/pkg/ktime"
 	"github.com/cilium/tetragon/pkg/logger"
 	"github.com/cilium/tetragon/pkg/option"
@@ -153,11 +156,21 @@ func (r *CgroupRate) checkRate(rate *cgroupRate, last uint64) bool {
 
 	if !isThrottled && events >= opts.Events {
 		setThrottle(1)
+		r.Notify(&tracing.MsgProcessThrottleUnix{
+			Type:   tetragon.ThrottleType_THROTTLE_START,
+			Op:     uint8(rate.key.Op),
+			Cgroup: fmt.Sprintf("%d", rate.key.Id),
+		})
 		return true
 	}
 
 	if isThrottled && events < opts.Events {
 		setThrottle(0)
+		r.Notify(&tracing.MsgProcessThrottleUnix{
+			Type:   tetragon.ThrottleType_THROTTLE_STOP,
+			Op:     uint8(rate.key.Op),
+			Cgroup: fmt.Sprintf("%d", rate.key.Id),
+		})
 		return true
 	}
 

diff --git a/pkg/grpc/tracing/tracing.go b/pkg/grpc/tracing/tracing.go
@@ -784,3 +784,47 @@ func (msg *MsgGenericUprobeUnix) Cast(o interface{}) notify.Message {
 	t := o.(MsgGenericUprobeUnix)
 	return &t
 }
+
+type MsgProcessThrottleUnix struct {
+	Type   tetragon.ThrottleType
+	Op     uint8
+	Cgroup string
+}
+
+func (msg *MsgProcessThrottleUnix) Notify() bool {
+	return true
+}
+
+func (msg *MsgProcessThrottleUnix) RetryInternal(ev notify.Event, timestamp uint64) (*process.ProcessInternal, error) {
+	return nil, fmt.Errorf("Unreachable state: MsgProcessThrottleUnix RetryInternal() was called")
+}
+
+func (msg *MsgProcessThrottleUnix) Retry(internal *process.ProcessInternal, ev notify.Event) error {
+	return fmt.Errorf("Unreachable state: MsgProcessThrottleUnix Retry() was called")
+}
+
+type OpVal uint8
+
+func (op OpVal) EventType() int32 {
+	return [...]int32{
+		5:  1, // ops.MSG_OP_EXECVE -> tetragon.PROCESS_EXEC
+		23: 5, // ops.MSG_OP_CLONE  -> tetragon.PROCESS_EXIT
+	}[op]
+}
+
+func (msg *MsgProcessThrottleUnix) HandleMessage() *tetragon.GetEventsResponse {
+	event := &tetragon.ProcessThrottle{
+		Type:   msg.Type,
+		Event:  tetragon.OpType((OpVal(msg.Op).EventType())),
+		Cgroup: msg.Cgroup,
+	}
+	return &tetragon.GetEventsResponse{
+		Event:    &tetragon.GetEventsResponse_ProcessThrottle{ProcessThrottle: event},
+		NodeName: nodeName,
+	}
+}
+
+func (msg *MsgProcessThrottleUnix) Cast(o interface{}) notify.Message {
+	t := o.(MsgProcessThrottleUnix)
+	return &t
+}