orb8_common/
lib.rs

1//! Shared types between eBPF (kernel) and userspace
2//!
3//! This crate defines event structures that must be:
4//! - `#[repr(C)]` for stable memory layout
5//! - `no_std` compatible for eBPF
6//! - Shared between kernel probes and userspace agent
7
8#![cfg_attr(not(feature = "userspace"), no_std)]
9
10/// Simple packet event (legacy, kept for backward compatibility)
11#[repr(C)]
12#[derive(Clone, Copy, Debug)]
13#[cfg_attr(feature = "userspace", derive(PartialEq, Eq))]
14pub struct PacketEvent {
15    pub timestamp_ns: u64,
16    pub packet_len: u32,
17    pub _padding: u32,
18}
19
20/// Network flow event with full 5-tuple and container identification
21///
22/// Layout (32 bytes total, 8-byte aligned):
23/// - timestamp_ns: Kernel timestamp in nanoseconds
24/// - cgroup_id: Container cgroup ID for pod correlation
25/// - src_ip: Source IPv4 address (network byte order)
26/// - dst_ip: Destination IPv4 address (network byte order)
27/// - src_port: Source port (host byte order)
28/// - dst_port: Destination port (host byte order)
29/// - protocol: IP protocol (6=TCP, 17=UDP, 1=ICMP)
30/// - direction: Traffic direction (0=ingress, 1=egress)
31/// - packet_len: Packet size in bytes
32#[repr(C)]
33#[derive(Clone, Copy, Debug)]
34#[cfg_attr(feature = "userspace", derive(PartialEq, Eq))]
35pub struct NetworkFlowEvent {
36    pub timestamp_ns: u64,
37    pub cgroup_id: u64,
38    pub src_ip: u32,
39    pub dst_ip: u32,
40    pub src_port: u16,
41    pub dst_port: u16,
42    pub protocol: u8,
43    pub direction: u8,
44    pub packet_len: u16,
45}
46
47/// Traffic direction constants
48pub mod direction {
49    pub const INGRESS: u8 = 0;
50    pub const EGRESS: u8 = 1;
51}
52
53/// IP protocol constants
54pub mod protocol {
55    pub const ICMP: u8 = 1;
56    pub const TCP: u8 = 6;
57    pub const UDP: u8 = 17;
58}
59
60#[cfg(feature = "userspace")]
61const _: () = {
62    assert!(
63        core::mem::size_of::<PacketEvent>() == 16,
64        "PacketEvent must be exactly 16 bytes"
65    );
66    assert!(
67        core::mem::align_of::<PacketEvent>() == 8,
68        "PacketEvent must be 8-byte aligned"
69    );
70};
71
72#[cfg(feature = "userspace")]
73const _: () = {
74    assert!(
75        core::mem::size_of::<NetworkFlowEvent>() == 32,
76        "NetworkFlowEvent must be exactly 32 bytes"
77    );
78    assert!(
79        core::mem::align_of::<NetworkFlowEvent>() == 8,
80        "NetworkFlowEvent must be 8-byte aligned"
81    );
82};
orb8_common/lib.rs

orb8_common/
lib.rs
