cellos_telemetry/probes/
net_connect.rs

1//! `net.connect_attempted` probe — stub.
2//!
3//! Linux-only. Pre-syscall observation of `connect(2)` requires either
4//! seccomp-notify, eBPF tracepoints (`tracepoint:syscalls:sys_enter_connect`),
5//! or `/proc/[pid]/net/tcp{,6}` polling. The first two need a syscall surface
6//! and a debugfs / BPF-mounted /sys this skeleton does not assume; the third
7//! gives only post-facto state, not "attempted". Path C / post-1.0
8//! territory (ADR-0006).
9//!
10//! For Phase F3a we emit no events. Frames the agent sends when wired up
11//! will use [`probe_source::NET_CONNECT_ATTEMPTED`].
12
13#![cfg(target_os = "linux")]
14
15use crate::ProbeEvent;
16
17/// Stub network connect-attempt probe.
18///
19/// TODO syscall surface — choose one of:
20///   1. seccomp-notify with the listener fd held by `cellos-init` parent
21///      (kernel-version gated; needs Linux ≥ 5.0 and BPF-friendly seccomp),
22///   2. BPF tracepoint on `sys_enter_connect` (BPF mount + CAP_BPF needed),
23///   3. polling `/proc/net/tcp{,6}` for `SYN_SENT` rows (cheap; loses
24///      already-completed connects between polls — false negatives the
25///      `cell.observability.guest.declaration_unwitnessed` check on the
26///      host will surface anyway).
27#[derive(Debug, Default)]
28pub struct NetConnectProbe;
29
30impl NetConnectProbe {
31    /// Construct the stub probe.
32    pub fn new() -> Self {
33        Self
34    }
35
36    /// Poll for connect attempts. Currently a no-op.
37    pub fn poll(&mut self) -> Vec<ProbeEvent> {
38        // TODO syscall surface — see module doc.
39        Vec::new()
40    }
41}
42
43#[cfg(test)]
44mod tests {
45    use super::*;
46
47    #[test]
48    fn stub_returns_empty() {
49        let mut p = NetConnectProbe::new();
50        assert!(p.poll().is_empty());
51    }
52}
cellos_telemetry/probes/net_connect.rs

cellos_telemetry/probes/
net_connect.rs
