pangolin_mirror/gerbil
1
0
Fork 0
mirror of https://github.com/fosrl/gerbil.git synced 2026-09-07 22:51:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Compare commits

base: pangolin_mirror:dev
Branches Tags
pangolin_mirror:main pangolin_mirror:dev pangolin_mirror:proxy-context-tunnel-tracking pangolin_mirror:pp pangolin_mirror:proxy-lock-perf-improvements
pangolin_mirror:1.5.1 pangolin_mirror:1.5.0-s.0 pangolin_mirror:1.5.0 pangolin_mirror:1.4.3 pangolin_mirror:1.4.2-s.1 pangolin_mirror:1.4.2 pangolin_mirror:1.4.2-s.0 pangolin_mirror:1.4.1 pangolin_mirror:1.4.0 pangolin_mirror:1.3.1 pangolin_mirror:1.3.0-s.0 pangolin_mirror:1.3.0 pangolin_mirror:1.2.2 pangolin_mirror:1.2.1 pangolin_mirror:1.2.0 pangolin_mirror:1.1.0 pangolin_mirror:1.0.0 pangolin_mirror:1.0.0-beta.3 pangolin_mirror:1.0.0-beta.2 pangolin_mirror:1.0.0-beta.1
..
compare: pangolin_mirror:proxy-context-tunnel-tracking
Branches Tags
pangolin_mirror:dev pangolin_mirror:main pangolin_mirror:proxy-context-tunnel-tracking pangolin_mirror:pp pangolin_mirror:proxy-lock-perf-improvements
pangolin_mirror:1.5.1 pangolin_mirror:1.5.0-s.0 pangolin_mirror:1.5.0 pangolin_mirror:1.4.3 pangolin_mirror:1.4.2-s.1 pangolin_mirror:1.4.2 pangolin_mirror:1.4.2-s.0 pangolin_mirror:1.4.1 pangolin_mirror:1.4.0 pangolin_mirror:1.3.1 pangolin_mirror:1.3.0-s.0 pangolin_mirror:1.3.0 pangolin_mirror:1.2.2 pangolin_mirror:1.2.1 pangolin_mirror:1.2.0 pangolin_mirror:1.1.0 pangolin_mirror:1.0.0 pangolin_mirror:1.0.0-beta.3 pangolin_mirror:1.0.0-beta.2 pangolin_mirror:1.0.0-beta.1

5 Commits
dev ... proxy-cont

Author SHA1 Message Date
Laurence
390b401998 Merge remote-tracking branch 'upstream/dev' into proxy-context-tunnel-tracking 2026-04-09 15:03:00 +01:00
Laurence
5eacbb7239 fix(proxy): prevent deleting wrong tunnel in defer cleanup 
Add pointer check before delete to handle race where UpdateLocalSNIs
removes our tunnel and a new one is created for the same hostname.
 2026-03-13 16:43:16 +00:00
Laurence
d21c09c84f refactor(proxy): simplify tunnel tracking with mutex-only approach 
Remove atomic counter in favor of simple int protected by mutex.
Eliminates race condition complexity and recheck logic.
 2026-03-13 16:36:56 +00:00
Laurence
28c65b950c fix(proxy): avoid shadowing ctx variable in pipe() 2026-03-13 15:51:23 +00:00
Laurence
1643d71905 refactor(proxy): use context cancellation for tunnel tracking 
- Replace []net.Conn slice with context + atomic counter in activeTunnel
- Use errgroup.WithContext for pipe() to handle goroutine lifecycle
- Use context.AfterFunc to close connections on cancellation
- Fix race condition by comparing tunnel pointers instead of map lookup
- UpdateLocalSNIs now cancels tunnel context instead of iterating conns

This eliminates O(n) connection removal, prevents goroutine leaks,
and provides cleaner cancellation semantics.
 2026-03-13 15:47:52 +00:00
29 changed files with 472 additions and 1972 deletions
Expand all files Collapse all files

5
.github/ISSUE_TEMPLATE/1.bug_report.yml vendored
View File

@@ -14,13 +14,12 @@ body:
label: Environment label: Environment
description: Please fill out the relevant details below for your environment. description: Please fill out the relevant details below for your environment.
value: | value: |
- OS Type & Version: - OS Type & Version: (e.g., Ubuntu 22.04)
- Pangolin Version: - Pangolin Version:
- Edition (Community or Enterprise):
- Gerbil Version: - Gerbil Version:
- Traefik Version: - Traefik Version:
- Newt Version: - Newt Version:
- Client Version: - Olm Version: (if applicable)
validations: validations:
required: true required: true

36
.github/dependabot.yml vendored
View File

@@ -1,32 +1,40 @@
version: 2 version: 2
updates: updates:
- package-ecosystem: "gomod" - package-ecosystem: "gomod"
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
open-pull-requests-limit: 1
groups: groups:
go-dependencies: dev-patch-updates:
patterns: dependency-type: "development"
- "*" update-types:
- "patch"
dev-minor-updates:
dependency-type: "development"
update-types:
- "minor"
prod-patch-updates:
dependency-type: "production"
update-types:
- "patch"
prod-minor-updates:
dependency-type: "production"
update-types:
- "minor"
- package-ecosystem: "docker" - package-ecosystem: "docker"
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
open-pull-requests-limit: 1
groups: groups:
docker-dependencies: patch-updates:
patterns: update-types:
- "*" - "patch"
minor-updates:
update-types:
- "minor"
- package-ecosystem: "github-actions" - package-ecosystem: "github-actions"
directory: "/" directory: "/"
schedule: schedule:
interval: "weekly" interval: "weekly"
open-pull-requests-limit: 1
groups:
github-actions-dependencies:
patterns:
- "*"

21
.github/workflows/cicd.yml vendored
View File

@@ -36,16 +36,16 @@ jobs:
steps: steps:
- name: Checkout code - name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Set up QEMU - name: Set up QEMU
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
- name: Set up Docker Buildx - name: Set up Docker Buildx
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
- name: Log in to Docker Hub - name: Log in to Docker Hub
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with: with:
registry: docker.io registry: docker.io
username: ${{ secrets.DOCKER_HUB_USERNAME }} username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -57,9 +57,9 @@ jobs:
shell: bash shell: bash
- name: Install Go - name: Install Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with: with:
go-version: 1.26 go-version: 1.25
- name: Update version in main.go - name: Update version in main.go
run: | run: |
@@ -80,7 +80,7 @@ jobs:
shell: bash shell: bash
- name: Login in to GHCR - name: Login in to GHCR
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
with: with:
registry: ghcr.io registry: ghcr.io
username: ${{ github.actor }} username: ${{ github.actor }}
@@ -107,9 +107,8 @@ jobs:
shell: bash shell: bash
- name: Install cosign - name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 # cosign is used to sign and verify container images (key and keyless)
with: uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
cosign-release: v3.0.6
- name: Dual-sign and verify (GHCR & Docker Hub) - name: Dual-sign and verify (GHCR & Docker Hub)
# Sign each image by digest using keyless (OIDC) and key-based signing, # Sign each image by digest using keyless (OIDC) and key-based signing,
@@ -156,7 +155,7 @@ jobs:
shell: bash shell: bash
- name: Upload artifacts from /bin - name: Upload artifacts from /bin
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
with: with:
name: binaries name: binaries
path: bin/ path: bin/

2
.github/workflows/mirror.yaml vendored
View File

@@ -23,7 +23,7 @@ jobs:
skopeo --version skopeo --version
- name: Install cosign - name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
- name: Input check - name: Input check
run: | run: |

10
.github/workflows/test.yml vendored
View File

@@ -14,16 +14,12 @@ jobs:
runs-on: amd64-runner runs-on: amd64-runner
steps: steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Read go version
id: goversion
run: echo "version=$(cat .go-version)" >> $GITHUB_OUTPUT
- name: Set up Go - name: Set up Go
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
with: with:
go-version: ${{ steps.goversion.outputs.version }} go-version: 1.26
- name: Build go - name: Build go
run: go build run: go build

2
.go-version
View File

@@ -1 +1 @@
1.26 1.25

5
Dockerfile
View File

@@ -1,5 +1,4 @@
ARG GO_VERSION=1.26 FROM golang:1.26-alpine AS builder
FROM golang:${GO_VERSION}-alpine AS builder
# Set the working directory inside the container # Set the working directory inside the container
WORKDIR /app WORKDIR /app
@@ -17,7 +16,7 @@ COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /gerbil RUN CGO_ENABLED=0 GOOS=linux go build -o /gerbil
# Start a new stage from scratch # Start a new stage from scratch
FROM alpine:3.24 AS runner FROM alpine:3.23 AS runner
RUN apk add --no-cache iptables iproute2 RUN apk add --no-cache iptables iproute2

6
Makefile
View File

@@ -1,6 +1,4 @@
GO_VERSION := $(shell cat .go-version 2>/dev/null)
all: build push all: build push
docker-build-release: docker-build-release:
@@ -9,10 +7,10 @@ docker-build-release:
exit 1; \ exit 1; \
fi fi
docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:latest -f Dockerfile --push . docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:latest -f Dockerfile --push .
docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:$(tag) -f Dockerfile --build-arg GO_VERSION=$(GO_VERSION) --push . docker buildx build --platform linux/arm64,linux/amd64 -t fosrl/gerbil:$(tag) -f Dockerfile --push .
build: build:
docker build -t fosrl/gerbil:latest --build-arg GO_VERSION=$(GO_VERSION) . docker build -t fosrl/gerbil:latest .
push: push:
docker push fosrl/gerbil:latest docker push fosrl/gerbil:latest

2
README.md
View File

@@ -138,7 +138,7 @@ make
### Binary ### Binary
Make sure to have Go 1.26 installed. Make sure to have Go 1.23.1 installed.
```bash ```bash
make local make local

12
docs/observability.md
View File

@@ -83,7 +83,6 @@ type OTelConfig struct {
Endpoint string // default: "localhost:4317" Endpoint string // default: "localhost:4317"
Insecure bool // default: true Insecure bool // default: true
ExportInterval time.Duration // default: 60s ExportInterval time.Duration // default: 60s
Timeout time.Duration // default: 10s
} }
``` ```
@@ -98,7 +97,6 @@ type OTelConfig struct {
| `OTEL_METRICS_ENDPOINT` | `localhost:4317` | OTLP collector address | | `OTEL_METRICS_ENDPOINT` | `localhost:4317` | OTLP collector address |
| `OTEL_METRICS_INSECURE` | `true` | Disable TLS for OTLP | | `OTEL_METRICS_INSECURE` | `true` | Disable TLS for OTLP |
| `OTEL_METRICS_EXPORT_INTERVAL` | `60s` | Push interval (e.g. `10s`, `1m`) | | `OTEL_METRICS_EXPORT_INTERVAL` | `60s` | Push interval (e.g. `10s`, `1m`) |
| `OTEL_METRICS_TIMEOUT` | `10s` | Timeout for OTLP exporter connection setup |
| `DEPLOYMENT_ENVIRONMENT` | _(unset)_ | OTel deployment.environment attribute | | `DEPLOYMENT_ENVIRONMENT` | _(unset)_ | OTel deployment.environment attribute |
### CLI flags ### CLI flags
@@ -110,8 +108,7 @@ type OTelConfig struct {
--otel-metrics-protocol string (default: grpc) --otel-metrics-protocol string (default: grpc)
--otel-metrics-endpoint string (default: localhost:4317) --otel-metrics-endpoint string (default: localhost:4317)
--otel-metrics-insecure bool (default: true) --otel-metrics-insecure bool (default: true)
--otel-metrics-export-interval duration (default: 60s) --otel-metrics-export-interval duration (default: 1m0s)
--otel-metrics-timeout duration (default: 10s)
``` ```
--- ---
@@ -167,7 +164,6 @@ export OTEL_METRICS_PROTOCOL=grpc
export OTEL_METRICS_ENDPOINT=otel-collector:4317 export OTEL_METRICS_ENDPOINT=otel-collector:4317
export OTEL_METRICS_INSECURE=true export OTEL_METRICS_INSECURE=true
export OTEL_METRICS_EXPORT_INTERVAL=10s export OTEL_METRICS_EXPORT_INTERVAL=10s
export OTEL_METRICS_TIMEOUT=10s
export DEPLOYMENT_ENVIRONMENT=production export DEPLOYMENT_ENVIRONMENT=production
``` ```
@@ -180,7 +176,6 @@ export DEPLOYMENT_ENVIRONMENT=production
--otel-metrics-endpoint=otel-collector:4317 \ --otel-metrics-endpoint=otel-collector:4317 \
--otel-metrics-insecure \ --otel-metrics-insecure \
--otel-metrics-export-interval=10s \ --otel-metrics-export-interval=10s \
--otel-metrics-timeout=10s \
--config=/etc/gerbil/config.json --config=/etc/gerbil/config.json
``` ```
@@ -230,6 +225,7 @@ All metrics use the prefix `gerbil_<component>_<name>`.
| Metric | Type | Labels | | Metric | Type | Labels |
|--------|------|--------| |--------|------|--------|
| `gerbil_proxy_mapping_active` | UpDownCounter | `ifname` | | `gerbil_proxy_mapping_active` | UpDownCounter | `ifname` |
| `gerbil_session_active` | UpDownCounter | `ifname` |
| `gerbil_active_sessions` | UpDownCounter | `ifname` | | `gerbil_active_sessions` | UpDownCounter | `ifname` |
| `gerbil_udp_packets_total` | Counter | `ifname`, `type`, `direction` | | `gerbil_udp_packets_total` | Counter | `ifname`, `type`, `direction` |
| `gerbil_hole_punch_events_total` | Counter | `ifname`, `result` | | `gerbil_hole_punch_events_total` | Counter | `ifname`, `result` |
@@ -260,7 +256,7 @@ The `docker-compose.metrics.yml` provides a complete observability stack.
**Prometheus mode:** **Prometheus mode:**
```bash ```bash
METRICS_BACKEND=prometheus docker-compose -f docker compose.metrics.yml up -d METRICS_BACKEND=prometheus docker-compose -f docker-compose.metrics.yml up -d
# Scrape at http://localhost:3003/metrics # Scrape at http://localhost:3003/metrics
# Grafana at http://localhost:3000 (admin/admin) # Grafana at http://localhost:3000 (admin/admin)
``` ```
@@ -269,5 +265,5 @@ METRICS_BACKEND=prometheus docker-compose -f docker compose.metrics.yml up -d
```bash ```bash
METRICS_BACKEND=otel OTEL_METRICS_ENDPOINT=otel-collector:4317 \ METRICS_BACKEND=otel OTEL_METRICS_ENDPOINT=otel-collector:4317 \
docker compose -f docker-compose.metrics.yml up -d docker-compose -f docker-compose.metrics.yml up -d
``` ```

1
examples/otel-collector-config.yaml
View File

@@ -1,4 +1,3 @@
file_format: '1.0'
receivers: receivers:
otlp: otlp:
protocols: protocols:

47
go.mod
View File

@@ -4,16 +4,16 @@ go 1.26.0
require ( require (
github.com/patrickmn/go-cache v2.1.0+incompatible github.com/patrickmn/go-cache v2.1.0+incompatible
github.com/prometheus/client_golang v1.24.1 github.com/prometheus/client_golang v1.20.5
github.com/vishvananda/netlink v1.3.1 github.com/vishvananda/netlink v1.3.1
go.opentelemetry.io/otel v1.46.0 go.opentelemetry.io/otel v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0
go.opentelemetry.io/otel/metric v1.46.0 go.opentelemetry.io/otel/metric v1.42.0
go.opentelemetry.io/otel/sdk v1.46.0 go.opentelemetry.io/otel/sdk v1.42.0
go.opentelemetry.io/otel/sdk/metric v1.46.0 go.opentelemetry.io/otel/sdk/metric v1.42.0
golang.org/x/crypto v0.55.0 golang.org/x/crypto v0.49.0
golang.org/x/sync v0.22.0 golang.org/x/sync v0.20.0
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
) )
@@ -21,29 +21,30 @@ require (
github.com/beorn7/perks v1.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect github.com/go-logr/stdr v1.2.2 // indirect
github.com/google/go-cmp v0.7.0 // indirect github.com/google/go-cmp v0.7.0 // indirect
github.com/google/uuid v1.6.0 // indirect github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
github.com/josharian/native v1.1.0 // indirect github.com/josharian/native v1.1.0 // indirect
github.com/klauspost/compress v1.17.9 // indirect
github.com/mdlayher/genetlink v1.3.2 // indirect github.com/mdlayher/genetlink v1.3.2 // indirect
github.com/mdlayher/netlink v1.7.2 // indirect github.com/mdlayher/netlink v1.7.2 // indirect
github.com/mdlayher/socket v0.4.1 // indirect github.com/mdlayher/socket v0.4.1 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.70.1 // indirect github.com/prometheus/common v0.61.0 // indirect
github.com/prometheus/procfs v0.21.1 // indirect github.com/prometheus/procfs v0.15.1 // indirect
github.com/vishvananda/netns v0.0.5 // indirect github.com/vishvananda/netns v0.0.5 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect go.opentelemetry.io/otel/trace v1.42.0 // indirect
go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.opentelemetry.io/proto/otlp v1.9.0 // indirect
golang.org/x/net v0.58.0 // indirect golang.org/x/net v0.51.0 // indirect
golang.org/x/sys v0.47.0 // indirect golang.org/x/sys v0.42.0 // indirect
golang.org/x/text v0.41.0 // indirect golang.org/x/text v0.35.0 // indirect
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 // indirect
google.golang.org/grpc v1.83.1 // indirect google.golang.org/grpc v1.79.3 // indirect
google.golang.org/protobuf v1.36.12 // indirect google.golang.org/protobuf v1.36.11 // indirect
) )

118
go.sum
View File

@@ -4,9 +4,11 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x
github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -15,12 +17,12 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA= github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w= github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw= github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
@@ -35,69 +37,65 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc= github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ= github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY= github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc= github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0= github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4= github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY= github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM= github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc= go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE= go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 h1:qkDYCAFiZXLcs1L4aY+tP2wguQ4kURANqHOQMA2et2s= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0/go.mod h1:tkipS4DRzmpAmvg+Gw4++O1IdDq6TVDnvnYU6cmbQVs= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0 h1:AP23h/mFgb/lc7tdck1Kfn9qxsM8TAeNPCU5C3pzaps= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0 h1:H7O6RlGOMTizyl3R08Kn5pdM06bnH8oscSj7o11tmLA=
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.46.0/go.mod h1:K4EqCe1b4kGk5WR690ntg9LaBfsPoV32FwthbyoptuA= go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.42.0/go.mod h1:mBFWu/WOVDkWWsR7Tx7h6EpQB8wsv7P0Yrh0Pb7othc=
go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8= go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o= go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
go.opentelemetry.io/otel/metric/x v0.68.0 h1:TA/cBT23D3MnxYPwHL7YFOdYGdx0A0v+s7Mzotpd1dU= go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
go.opentelemetry.io/otel/metric/x v0.68.0/go.mod h1:agudOmvWhwUTjgibWDzxD2PoWYnpw5Ht5jISYOD2Hd4= go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI= go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM= go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE= go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4= go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c= go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A=
go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI= go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4=
go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo= golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b h1:J1CaxgLerRR5lgx3wnr6L04cJFbWoceSK9JWBdglINo=
golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4= golang.zx2c4.com/wireguard v0.0.0-20230325221338-052af4a8072b/go.mod h1:tqur9LnfstdR9ep2LaJT4lFUl0EjlHtge+gAjmsHUG4=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE= golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80= golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI= google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 h1:JLQynH/LBHfCTSbDWl+py8C+Rg/k1OVH3xfcaiANuF0=
google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:kSJwQxqmFXeo79zOmbrALdflXQeAYcUbgS7PbpMknCY=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57 h1:mWPCjDEyshlQYzBpMNHaEof6UX1PmHcaUODUywQ0uac=
google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

559
internal/metrics/metrics.go
View File

@@ -7,9 +7,7 @@ package metrics
import ( import (
"context" "context"
"fmt"
"net/http" "net/http"
"sync"
"github.com/fosrl/gerbil/internal/observability" "github.com/fosrl/gerbil/internal/observability"
) )
@@ -26,7 +24,6 @@ type OTelConfig = observability.OTelConfig
var ( var (
backend observability.Backend backend observability.Backend
initMu sync.Mutex
// Interface and peer metrics // Interface and peer metrics
wgInterfaceUp observability.Int64Gauge wgInterfaceUp observability.Int64Gauge
@@ -58,7 +55,7 @@ var (
udpPacketSizeBytes observability.Histogram udpPacketSizeBytes observability.Histogram
holePunchEventsTotal observability.Counter holePunchEventsTotal observability.Counter
proxyMappingActive observability.UpDownCounter proxyMappingActive observability.UpDownCounter
relayUDPConnectionsActive observability.UpDownCounter sessionActive observability.UpDownCounter
sessionRebuiltTotal observability.Counter sessionRebuiltTotal observability.Counter
commPatternActive observability.UpDownCounter commPatternActive observability.UpDownCounter
proxyCleanupRemovedTotal observability.Counter proxyCleanupRemovedTotal observability.Counter
@@ -110,13 +107,6 @@ func DefaultConfig() Config {
// Initialize sets up the metrics system using the selected backend. // Initialize sets up the metrics system using the selected backend.
// It returns the /metrics HTTP handler (non-nil only for Prometheus backend). // It returns the /metrics HTTP handler (non-nil only for Prometheus backend).
func Initialize(cfg Config) (http.Handler, error) { func Initialize(cfg Config) (http.Handler, error) {
initMu.Lock()
defer initMu.Unlock()
if backend != nil {
return backend.HTTPHandler(), nil
}
b, err := observability.New(cfg) b, err := observability.New(cfg)
if err != nil { if err != nil {
return nil, err return nil, err
@@ -124,7 +114,6 @@ func Initialize(cfg Config) (http.Handler, error) {
backend = b backend = b
if err := createInstruments(); err != nil { if err := createInstruments(); err != nil {
backend = nil
return nil, err return nil, err
} }
@@ -133,13 +122,8 @@ func Initialize(cfg Config) (http.Handler, error) {
// Shutdown gracefully shuts down the metrics backend. // Shutdown gracefully shuts down the metrics backend.
func Shutdown(ctx context.Context) error { func Shutdown(ctx context.Context) error {
initMu.Lock() if backend != nil {
b := backend return backend.Shutdown(ctx)
backend = nil
initMu.Unlock()
if b != nil {
return b.Shutdown(ctx)
} }
return nil return nil
} }
@@ -151,351 +135,129 @@ func createInstruments() error {
b := backend b := backend
newCounter := func(name, desc string, labelNames ...string) (observability.Counter, error) { wgInterfaceUp = b.NewInt64Gauge("gerbil_wg_interface_up",
c, err := b.NewCounter(name, desc, labelNames...)
if err != nil {
return nil, fmt.Errorf("create counter %q: %w", name, err)
}
return c, nil
}
newUpDownCounter := func(name, desc string, labelNames ...string) (observability.UpDownCounter, error) {
c, err := b.NewUpDownCounter(name, desc, labelNames...)
if err != nil {
return nil, fmt.Errorf("create updown counter %q: %w", name, err)
}
return c, nil
}
newInt64Gauge := func(name, desc string, labelNames ...string) (observability.Int64Gauge, error) {
g, err := b.NewInt64Gauge(name, desc, labelNames...)
if err != nil {
return nil, fmt.Errorf("create int64 gauge %q: %w", name, err)
}
return g, nil
}
newFloat64Gauge := func(name, desc string, labelNames ...string) (observability.Float64Gauge, error) {
g, err := b.NewFloat64Gauge(name, desc, labelNames...)
if err != nil {
return nil, fmt.Errorf("create float64 gauge %q: %w", name, err)
}
return g, nil
}
newHistogram := func(name, desc string, buckets []float64, labelNames ...string) (observability.Histogram, error) {
h, err := b.NewHistogram(name, desc, buckets, labelNames...)
if err != nil {
return nil, fmt.Errorf("create histogram %q: %w", name, err)
}
return h, nil
}
var err error
wgInterfaceUp, err = newInt64Gauge("gerbil_wg_interface_up",
"Operational state of a WireGuard interface (1=up, 0=down)", "ifname", "instance") "Operational state of a WireGuard interface (1=up, 0=down)", "ifname", "instance")
if err != nil { wgPeersTotal = b.NewUpDownCounter("gerbil_wg_peers_total",
return err
}
wgPeersTotal, err = newUpDownCounter("gerbil_wg_peers_total",
"Total number of configured peers per interface", "ifname") "Total number of configured peers per interface", "ifname")
if err != nil { wgPeerConnected = b.NewInt64Gauge("gerbil_wg_peer_connected",
return err
}
wgPeerConnected, err = newInt64Gauge("gerbil_wg_peer_connected",
"Whether a specific peer is connected (1=connected, 0=disconnected)", "ifname", "peer") "Whether a specific peer is connected (1=connected, 0=disconnected)", "ifname", "peer")
if err != nil { allowedIPsCount = b.NewUpDownCounter("gerbil_allowed_ips_count",
return err
}
allowedIPsCount, err = newUpDownCounter("gerbil_allowed_ips_count",
"Number of allowed IPs configured per peer", "ifname", "peer") "Number of allowed IPs configured per peer", "ifname", "peer")
if err != nil { keyRotationTotal = b.NewCounter("gerbil_key_rotation_total",
return err
}
keyRotationTotal, err = newCounter("gerbil_key_rotation_total",
"Key rotation events", "ifname", "reason") "Key rotation events", "ifname", "reason")
if err != nil { wgHandshakesTotal = b.NewCounter("gerbil_wg_handshakes_total",
return err
}
wgHandshakesTotal, err = newCounter("gerbil_wg_handshakes_total",
"Count of handshake attempts with their result status", "ifname", "peer", "result") "Count of handshake attempts with their result status", "ifname", "peer", "result")
if err != nil { wgHandshakeLatency = b.NewHistogram("gerbil_wg_handshake_latency_seconds",
return err
}
wgHandshakeLatency, err = newHistogram("gerbil_wg_handshake_latency_seconds",
"Distribution of handshake latencies in seconds", durationBuckets, "ifname", "peer") "Distribution of handshake latencies in seconds", durationBuckets, "ifname", "peer")
if err != nil { wgPeerRTT = b.NewHistogram("gerbil_wg_peer_rtt_seconds",
return err
}
wgPeerRTT, err = newHistogram("gerbil_wg_peer_rtt_seconds",
"Observed round-trip time to a peer in seconds", durationBuckets, "ifname", "peer") "Observed round-trip time to a peer in seconds", durationBuckets, "ifname", "peer")
if err != nil { wgBytesReceived = b.NewCounter("gerbil_wg_bytes_received_total",
return err
}
wgBytesReceived, err = newCounter("gerbil_wg_bytes_received_total",
"Number of bytes received from a peer", "ifname", "peer") "Number of bytes received from a peer", "ifname", "peer")
if err != nil { wgBytesTransmitted = b.NewCounter("gerbil_wg_bytes_transmitted_total",
return err
}
wgBytesTransmitted, err = newCounter("gerbil_wg_bytes_transmitted_total",
"Number of bytes transmitted to a peer", "ifname", "peer") "Number of bytes transmitted to a peer", "ifname", "peer")
if err != nil { netlinkEventsTotal = b.NewCounter("gerbil_netlink_events_total",
return err
}
netlinkEventsTotal, err = newCounter("gerbil_netlink_events_total",
"Number of netlink events processed", "event_type") "Number of netlink events processed", "event_type")
if err != nil { netlinkErrorsTotal = b.NewCounter("gerbil_netlink_errors_total",
return err
}
netlinkErrorsTotal, err = newCounter("gerbil_netlink_errors_total",
"Count of netlink or kernel errors", "component", "error_type") "Count of netlink or kernel errors", "component", "error_type")
if err != nil { syncDuration = b.NewHistogram("gerbil_sync_duration_seconds",
return err
}
syncDuration, err = newHistogram("gerbil_sync_duration_seconds",
"Duration of reconciliation/sync loops in seconds", durationBuckets, "component") "Duration of reconciliation/sync loops in seconds", durationBuckets, "component")
if err != nil { workqueueDepth = b.NewUpDownCounter("gerbil_workqueue_depth",
return err
}
workqueueDepth, err = newUpDownCounter("gerbil_workqueue_depth",
"Current length of internal work queues", "queue") "Current length of internal work queues", "queue")
if err != nil { kernelModuleLoads = b.NewCounter("gerbil_kernel_module_loads_total",
return err
}
kernelModuleLoads, err = newCounter("gerbil_kernel_module_loads_total",
"Count of kernel module load attempts", "result") "Count of kernel module load attempts", "result")
if err != nil { firewallRulesApplied = b.NewCounter("gerbil_firewall_rules_applied_total",
return err
}
firewallRulesApplied, err = newCounter("gerbil_firewall_rules_applied_total",
"IPTables/NFT rules applied", "result", "chain") "IPTables/NFT rules applied", "result", "chain")
if err != nil { activeSessions = b.NewUpDownCounter("gerbil_active_sessions",
return err
}
activeSessions, err = newUpDownCounter("gerbil_active_sessions",
"Number of active UDP relay sessions", "ifname") "Number of active UDP relay sessions", "ifname")
if err != nil { activeProxyConnections = b.NewUpDownCounter("gerbil_active_proxy_connections",
return err
}
activeProxyConnections, err = newUpDownCounter("gerbil_active_proxy_connections",
"Active SNI proxy connections") "Active SNI proxy connections")
if err != nil { proxyRouteLookups = b.NewCounter("gerbil_proxy_route_lookups_total",
return err
}
proxyRouteLookups, err = newCounter("gerbil_proxy_route_lookups_total",
"Number of route lookups", "result") "Number of route lookups", "result")
if err != nil { proxyTLSHandshake = b.NewHistogram("gerbil_proxy_tls_handshake_seconds",
return err
}
proxyTLSHandshake, err = newHistogram("gerbil_proxy_tls_handshake_seconds",
"TLS handshake duration for SNI proxy in seconds", durationBuckets) "TLS handshake duration for SNI proxy in seconds", durationBuckets)
if err != nil { proxyBytesTransmitted = b.NewCounter("gerbil_proxy_bytes_transmitted_total",
return err
}
proxyBytesTransmitted, err = newCounter("gerbil_proxy_bytes_transmitted_total",
"Bytes sent/received by the SNI proxy", "direction") "Bytes sent/received by the SNI proxy", "direction")
if err != nil { configReloadsTotal = b.NewCounter("gerbil_config_reloads_total",
return err
}
configReloadsTotal, err = newCounter("gerbil_config_reloads_total",
"Number of configuration reloads", "result") "Number of configuration reloads", "result")
if err != nil { restartTotal = b.NewCounter("gerbil_restart_total",
return err
}
restartTotal, err = newCounter("gerbil_restart_total",
"Process restart count") "Process restart count")
if err != nil { authFailuresTotal = b.NewCounter("gerbil_auth_failures_total",
return err
}
authFailuresTotal, err = newCounter("gerbil_auth_failures_total",
"Count of authentication or peer validation failures", "peer", "reason") "Count of authentication or peer validation failures", "peer", "reason")
if err != nil { aclDeniedTotal = b.NewCounter("gerbil_acl_denied_total",
return err
}
aclDeniedTotal, err = newCounter("gerbil_acl_denied_total",
"Access control denied events", "ifname", "peer", "policy") "Access control denied events", "ifname", "peer", "policy")
if err != nil { certificateExpiryDays = b.NewFloat64Gauge("gerbil_certificate_expiry_days",
return err
}
certificateExpiryDays, err = newFloat64Gauge("gerbil_certificate_expiry_days",
"Days until certificate expiry", "cert_name", "ifname") "Days until certificate expiry", "cert_name", "ifname")
if err != nil { udpPacketsTotal = b.NewCounter("gerbil_udp_packets_total",
return err
}
udpPacketsTotal, err = newCounter("gerbil_udp_packets_total",
"Count of UDP packets processed by relay workers", "ifname", "type", "direction") "Count of UDP packets processed by relay workers", "ifname", "type", "direction")
if err != nil { udpPacketSizeBytes = b.NewHistogram("gerbil_udp_packet_size_bytes",
return err
}
udpPacketSizeBytes, err = newHistogram("gerbil_udp_packet_size_bytes",
"Size distribution of packets forwarded through relay", sizeBuckets, "ifname", "type") "Size distribution of packets forwarded through relay", sizeBuckets, "ifname", "type")
if err != nil { holePunchEventsTotal = b.NewCounter("gerbil_hole_punch_events_total",
return err
}
holePunchEventsTotal, err = newCounter("gerbil_hole_punch_events_total",
"Count of hole punch messages processed", "ifname", "result") "Count of hole punch messages processed", "ifname", "result")
if err != nil { proxyMappingActive = b.NewUpDownCounter("gerbil_proxy_mapping_active",
return err
}
proxyMappingActive, err = newUpDownCounter("gerbil_proxy_mapping_active",
"Number of active proxy mappings", "ifname") "Number of active proxy mappings", "ifname")
if err != nil { sessionActive = b.NewUpDownCounter("gerbil_session_active",
return err "Number of active WireGuard sessions", "ifname")
} sessionRebuiltTotal = b.NewCounter("gerbil_session_rebuilt_total",
relayUDPConnectionsActive, err = newUpDownCounter("gerbil_relay_udp_connections_active",
"Number of open per-peer outbound UDP sockets held by the relay connection pool", "ifname")
if err != nil {
return err
}
sessionRebuiltTotal, err = newCounter("gerbil_session_rebuilt_total",
"Count of sessions rebuilt from communication patterns", "ifname") "Count of sessions rebuilt from communication patterns", "ifname")
if err != nil { commPatternActive = b.NewUpDownCounter("gerbil_comm_pattern_active",
return err
}
commPatternActive, err = newUpDownCounter("gerbil_comm_pattern_active",
"Number of active communication patterns", "ifname") "Number of active communication patterns", "ifname")
if err != nil { proxyCleanupRemovedTotal = b.NewCounter("gerbil_proxy_cleanup_removed_total",
return err
}
proxyCleanupRemovedTotal, err = newCounter("gerbil_proxy_cleanup_removed_total",
"Count of items removed during cleanup routines", "ifname", "component") "Count of items removed during cleanup routines", "ifname", "component")
if err != nil { proxyConnectionErrorsTotal = b.NewCounter("gerbil_proxy_connection_errors_total",
return err
}
proxyConnectionErrorsTotal, err = newCounter("gerbil_proxy_connection_errors_total",
"Count of connection errors in proxy operations", "ifname", "error_type") "Count of connection errors in proxy operations", "ifname", "error_type")
if err != nil { proxyInitialMappingsTotal = b.NewInt64Gauge("gerbil_proxy_initial_mappings",
return err
}
proxyInitialMappingsTotal, err = newInt64Gauge("gerbil_proxy_initial_mappings",
"Number of initial proxy mappings loaded", "ifname") "Number of initial proxy mappings loaded", "ifname")
if err != nil { proxyMappingUpdatesTotal = b.NewCounter("gerbil_proxy_mapping_updates_total",
return err
}
proxyMappingUpdatesTotal, err = newCounter("gerbil_proxy_mapping_updates_total",
"Count of proxy mapping updates", "ifname") "Count of proxy mapping updates", "ifname")
if err != nil { proxyIdleCleanupDuration = b.NewHistogram("gerbil_proxy_idle_cleanup_duration_seconds",
return err
}
proxyIdleCleanupDuration, err = newHistogram("gerbil_proxy_idle_cleanup_duration_seconds",
"Duration of cleanup cycles", durationBuckets, "ifname", "component") "Duration of cleanup cycles", durationBuckets, "ifname", "component")
if err != nil { sniConnectionsTotal = b.NewCounter("gerbil_sni_connections_total",
return err
}
sniConnectionsTotal, err = newCounter("gerbil_sni_connections_total",
"Count of connections processed by SNI proxy", "result") "Count of connections processed by SNI proxy", "result")
if err != nil { sniConnectionDuration = b.NewHistogram("gerbil_sni_connection_duration_seconds",
return err
}
sniConnectionDuration, err = newHistogram("gerbil_sni_connection_duration_seconds",
"Lifetime distribution of proxied TLS connections", sniDurationBuckets) "Lifetime distribution of proxied TLS connections", sniDurationBuckets)
if err != nil { sniActiveConnections = b.NewUpDownCounter("gerbil_sni_active_connections",
return err
}
sniActiveConnections, err = newUpDownCounter("gerbil_sni_active_connections",
"Number of active SNI tunnels") "Number of active SNI tunnels")
if err != nil { sniRouteCacheHitsTotal = b.NewCounter("gerbil_sni_route_cache_hits_total",
return err
}
sniRouteCacheHitsTotal, err = newCounter("gerbil_sni_route_cache_hits_total",
"Count of route cache hits and misses", "result") "Count of route cache hits and misses", "result")
if err != nil { sniRouteAPIRequestsTotal = b.NewCounter("gerbil_sni_route_api_requests_total",
return err
}
sniRouteAPIRequestsTotal, err = newCounter("gerbil_sni_route_api_requests_total",
"Count of route API requests", "result") "Count of route API requests", "result")
if err != nil { sniRouteAPILatency = b.NewHistogram("gerbil_sni_route_api_latency_seconds",
return err
}
sniRouteAPILatency, err = newHistogram("gerbil_sni_route_api_latency_seconds",
"Distribution of route API call latencies", durationBuckets) "Distribution of route API call latencies", durationBuckets)
if err != nil { sniLocalOverrideTotal = b.NewCounter("gerbil_sni_local_override_total",
return err
}
sniLocalOverrideTotal, err = newCounter("gerbil_sni_local_override_total",
"Count of routes using local overrides", "hit") "Count of routes using local overrides", "hit")
if err != nil { sniTrustedProxyEventsTotal = b.NewCounter("gerbil_sni_trusted_proxy_events_total",
return err
}
sniTrustedProxyEventsTotal, err = newCounter("gerbil_sni_trusted_proxy_events_total",
"Count of PROXY protocol events", "event") "Count of PROXY protocol events", "event")
if err != nil { sniProxyProtocolParseErrorsTotal = b.NewCounter("gerbil_sni_proxy_protocol_parse_errors_total",
return err
}
sniProxyProtocolParseErrorsTotal, err = newCounter("gerbil_sni_proxy_protocol_parse_errors_total",
"Count of PROXY protocol parse failures") "Count of PROXY protocol parse failures")
if err != nil { sniDataBytesTotal = b.NewCounter("gerbil_sni_data_bytes_total",
return err
}
sniDataBytesTotal, err = newCounter("gerbil_sni_data_bytes_total",
"Count of bytes proxied through SNI tunnels", "direction") "Count of bytes proxied through SNI tunnels", "direction")
if err != nil { sniTunnelTerminationsTotal = b.NewCounter("gerbil_sni_tunnel_terminations_total",
return err
}
sniTunnelTerminationsTotal, err = newCounter("gerbil_sni_tunnel_terminations_total",
"Count of tunnel terminations by reason", "reason") "Count of tunnel terminations by reason", "reason")
if err != nil { httpRequestsTotal = b.NewCounter("gerbil_http_requests_total",
return err
}
httpRequestsTotal, err = newCounter("gerbil_http_requests_total",
"Count of HTTP requests to management API", "endpoint", "method", "status_code") "Count of HTTP requests to management API", "endpoint", "method", "status_code")
if err != nil { httpRequestDuration = b.NewHistogram("gerbil_http_request_duration_seconds",
return err
}
httpRequestDuration, err = newHistogram("gerbil_http_request_duration_seconds",
"Distribution of HTTP request handling time", durationBuckets, "endpoint", "method") "Distribution of HTTP request handling time", durationBuckets, "endpoint", "method")
if err != nil { peerOperationsTotal = b.NewCounter("gerbil_peer_operations_total",
return err
}
peerOperationsTotal, err = newCounter("gerbil_peer_operations_total",
"Count of peer lifecycle operations", "operation", "result") "Count of peer lifecycle operations", "operation", "result")
if err != nil { proxyMappingUpdateRequestsTotal = b.NewCounter("gerbil_proxy_mapping_update_requests_total",
return err
}
proxyMappingUpdateRequestsTotal, err = newCounter("gerbil_proxy_mapping_update_requests_total",
"Count of proxy mapping update API calls", "result") "Count of proxy mapping update API calls", "result")
if err != nil { destinationsUpdateRequestsTotal = b.NewCounter("gerbil_destinations_update_requests_total",
return err
}
destinationsUpdateRequestsTotal, err = newCounter("gerbil_destinations_update_requests_total",
"Count of destinations update API calls", "result") "Count of destinations update API calls", "result")
if err != nil { remoteConfigFetchesTotal = b.NewCounter("gerbil_remote_config_fetches_total",
return err
}
remoteConfigFetchesTotal, err = newCounter("gerbil_remote_config_fetches_total",
"Count of remote configuration fetch attempts", "result") "Count of remote configuration fetch attempts", "result")
if err != nil { bandwidthReportsTotal = b.NewCounter("gerbil_bandwidth_reports_total",
return err
}
bandwidthReportsTotal, err = newCounter("gerbil_bandwidth_reports_total",
"Count of bandwidth report transmissions", "result") "Count of bandwidth report transmissions", "result")
if err != nil { peerBandwidthBytesTotal = b.NewCounter("gerbil_peer_bandwidth_bytes_total",
return err
}
peerBandwidthBytesTotal, err = newCounter("gerbil_peer_bandwidth_bytes_total",
"Bytes per peer tracked by bandwidth calculation", "peer", "direction") "Bytes per peer tracked by bandwidth calculation", "peer", "direction")
if err != nil { memorySpikeTotal = b.NewCounter("gerbil_memory_spike_total",
return err
}
memorySpikeTotal, err = newCounter("gerbil_memory_spike_total",
"Count of memory spikes detected", "severity") "Count of memory spikes detected", "severity")
if err != nil { heapProfilesWrittenTotal = b.NewCounter("gerbil_heap_profiles_written_total",
return err
}
heapProfilesWrittenTotal, err = newCounter("gerbil_heap_profiles_written_total",
"Count of heap profile files generated") "Count of heap profile files generated")
if err != nil {
return err
}
return nil return nil
} }
func RecordInterfaceUp(ifname, instance string, up bool) { func RecordInterfaceUp(ifname, instance string, up bool) {
if wgInterfaceUp == nil {
return
}
value := int64(0) value := int64(0)
if up { if up {
value = 1 value = 1
@@ -504,16 +266,10 @@ func RecordInterfaceUp(ifname, instance string, up bool) {
} }
func RecordPeersTotal(ifname string, delta int64) { func RecordPeersTotal(ifname string, delta int64) {
if wgPeersTotal == nil {
return
}
wgPeersTotal.Add(context.Background(), delta, observability.Labels{"ifname": ifname}) wgPeersTotal.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
} }
func RecordPeerConnected(ifname, peer string, connected bool) { func RecordPeerConnected(ifname, peer string, connected bool) {
if wgPeerConnected == nil {
return
}
value := int64(0) value := int64(0)
if connected { if connected {
value = 1 value = 1
@@ -522,400 +278,229 @@ func RecordPeerConnected(ifname, peer string, connected bool) {
} }
func RecordHandshake(ifname, peer, result string) { func RecordHandshake(ifname, peer, result string) {
if wgHandshakesTotal == nil {
return
}
wgHandshakesTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "peer": peer, "result": result}) wgHandshakesTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "peer": peer, "result": result})
} }
func RecordHandshakeLatency(ifname, peer string, seconds float64) { func RecordHandshakeLatency(ifname, peer string, seconds float64) {
if wgHandshakeLatency == nil {
return
}
wgHandshakeLatency.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "peer": peer}) wgHandshakeLatency.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "peer": peer})
} }
func RecordPeerRTT(ifname, peer string, seconds float64) { func RecordPeerRTT(ifname, peer string, seconds float64) {
if wgPeerRTT == nil {
return
}
wgPeerRTT.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "peer": peer}) wgPeerRTT.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "peer": peer})
} }
func RecordBytesReceived(ifname, peer string, bytes int64) { func RecordBytesReceived(ifname, peer string, bytes int64) {
if wgBytesReceived == nil {
return
}
wgBytesReceived.Add(context.Background(), bytes, observability.Labels{"ifname": ifname, "peer": peer}) wgBytesReceived.Add(context.Background(), bytes, observability.Labels{"ifname": ifname, "peer": peer})
} }
func RecordBytesTransmitted(ifname, peer string, bytes int64) { func RecordBytesTransmitted(ifname, peer string, bytes int64) {
if wgBytesTransmitted == nil {
return
}
wgBytesTransmitted.Add(context.Background(), bytes, observability.Labels{"ifname": ifname, "peer": peer}) wgBytesTransmitted.Add(context.Background(), bytes, observability.Labels{"ifname": ifname, "peer": peer})
} }
func RecordAllowedIPsCount(ifname, peer string, delta int64) { func RecordAllowedIPsCount(ifname, peer string, delta int64) {
if allowedIPsCount == nil {
return
}
allowedIPsCount.Add(context.Background(), delta, observability.Labels{"ifname": ifname, "peer": peer}) allowedIPsCount.Add(context.Background(), delta, observability.Labels{"ifname": ifname, "peer": peer})
} }
func RecordKeyRotation(ifname, reason string) { func RecordKeyRotation(ifname, reason string) {
if keyRotationTotal == nil {
return
}
keyRotationTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "reason": reason}) keyRotationTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "reason": reason})
} }
func RecordNetlinkEvent(eventType string) { func RecordNetlinkEvent(eventType string) {
if netlinkEventsTotal == nil {
return
}
netlinkEventsTotal.Add(context.Background(), 1, observability.Labels{"event_type": eventType}) netlinkEventsTotal.Add(context.Background(), 1, observability.Labels{"event_type": eventType})
} }
func RecordNetlinkError(component, errorType string) { func RecordNetlinkError(component, errorType string) {
if netlinkErrorsTotal == nil {
return
}
netlinkErrorsTotal.Add(context.Background(), 1, observability.Labels{"component": component, "error_type": errorType}) netlinkErrorsTotal.Add(context.Background(), 1, observability.Labels{"component": component, "error_type": errorType})
} }
func RecordSyncDuration(component string, seconds float64) { func RecordSyncDuration(component string, seconds float64) {
if syncDuration == nil {
return
}
syncDuration.Record(context.Background(), seconds, observability.Labels{"component": component}) syncDuration.Record(context.Background(), seconds, observability.Labels{"component": component})
} }
func RecordWorkqueueDepth(queue string, delta int64) { func RecordWorkqueueDepth(queue string, delta int64) {
if workqueueDepth == nil {
return
}
workqueueDepth.Add(context.Background(), delta, observability.Labels{"queue": queue}) workqueueDepth.Add(context.Background(), delta, observability.Labels{"queue": queue})
} }
func RecordKernelModuleLoad(result string) { func RecordKernelModuleLoad(result string) {
if kernelModuleLoads == nil {
return
}
kernelModuleLoads.Add(context.Background(), 1, observability.Labels{"result": result}) kernelModuleLoads.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordFirewallRuleApplied(result, chain string) { func RecordFirewallRuleApplied(result, chain string) {
if firewallRulesApplied == nil {
return
}
firewallRulesApplied.Add(context.Background(), 1, observability.Labels{"result": result, "chain": chain}) firewallRulesApplied.Add(context.Background(), 1, observability.Labels{"result": result, "chain": chain})
} }
func RecordActiveSession(ifname string, delta int64) { func RecordActiveSession(ifname string, delta int64) {
if activeSessions == nil {
return
}
activeSessions.Add(context.Background(), delta, observability.Labels{"ifname": ifname}) activeSessions.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
} }
func RecordActiveProxyConnection(delta int64) { func RecordActiveProxyConnection(hostname string, delta int64) {
if activeProxyConnections == nil { _ = hostname
return
}
activeProxyConnections.Add(context.Background(), delta, nil) activeProxyConnections.Add(context.Background(), delta, nil)
} }
func RecordProxyRouteLookup(result string) { func RecordProxyRouteLookup(result, hostname string) {
if proxyRouteLookups == nil { _ = hostname
return
}
proxyRouteLookups.Add(context.Background(), 1, observability.Labels{"result": result}) proxyRouteLookups.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordProxyTLSHandshake(seconds float64) { func RecordProxyTLSHandshake(hostname string, seconds float64) {
if proxyTLSHandshake == nil { _ = hostname
return
}
proxyTLSHandshake.Record(context.Background(), seconds, nil) proxyTLSHandshake.Record(context.Background(), seconds, nil)
} }
func RecordProxyBytesTransmitted(direction string, bytes int64) { func RecordProxyBytesTransmitted(hostname, direction string, bytes int64) {
if proxyBytesTransmitted == nil { _ = hostname
return
}
proxyBytesTransmitted.Add(context.Background(), bytes, observability.Labels{"direction": direction}) proxyBytesTransmitted.Add(context.Background(), bytes, observability.Labels{"direction": direction})
} }
func RecordConfigReload(result string) { func RecordConfigReload(result string) {
if configReloadsTotal == nil {
return
}
configReloadsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) configReloadsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordRestart() { func RecordRestart() {
if restartTotal == nil {
return
}
restartTotal.Add(context.Background(), 1, nil) restartTotal.Add(context.Background(), 1, nil)
} }
func RecordAuthFailure(peer, reason string) { func RecordAuthFailure(peer, reason string) {
if authFailuresTotal == nil {
return
}
authFailuresTotal.Add(context.Background(), 1, observability.Labels{"peer": peer, "reason": reason}) authFailuresTotal.Add(context.Background(), 1, observability.Labels{"peer": peer, "reason": reason})
} }
func RecordACLDenied(ifname, peer, policy string) { func RecordACLDenied(ifname, peer, policy string) {
if aclDeniedTotal == nil {
return
}
aclDeniedTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "peer": peer, "policy": policy}) aclDeniedTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "peer": peer, "policy": policy})
} }
func RecordCertificateExpiry(certName, ifname string, days float64) { func RecordCertificateExpiry(certName, ifname string, days float64) {
if certificateExpiryDays == nil {
return
}
certificateExpiryDays.Record(context.Background(), days, observability.Labels{"cert_name": certName, "ifname": ifname}) certificateExpiryDays.Record(context.Background(), days, observability.Labels{"cert_name": certName, "ifname": ifname})
} }
func RecordUDPPacket(ifname, packetType, direction string) { func RecordUDPPacket(ifname, packetType, direction string) {
if udpPacketsTotal == nil {
return
}
udpPacketsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "type": packetType, "direction": direction}) udpPacketsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "type": packetType, "direction": direction})
} }
func RecordUDPPacketSize(ifname, packetType string, bytes float64) { func RecordUDPPacketSize(ifname, packetType string, bytes float64) {
if udpPacketSizeBytes == nil {
return
}
udpPacketSizeBytes.Record(context.Background(), bytes, observability.Labels{"ifname": ifname, "type": packetType}) udpPacketSizeBytes.Record(context.Background(), bytes, observability.Labels{"ifname": ifname, "type": packetType})
} }
func RecordHolePunchEvent(ifname, result string) { func RecordHolePunchEvent(ifname, result string) {
if holePunchEventsTotal == nil {
return
}
holePunchEventsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "result": result}) holePunchEventsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "result": result})
} }
func RecordProxyMapping(ifname string, delta int64) { func RecordProxyMapping(ifname string, delta int64) {
if proxyMappingActive == nil {
return
}
proxyMappingActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname}) proxyMappingActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
} }
func RecordSession(ifname string, delta int64) { func RecordSession(ifname string, delta int64) {
if activeSessions == nil { sessionActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
return
}
activeSessions.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
}
func RecordUDPConnection(ifname string, delta int64) {
if relayUDPConnectionsActive == nil {
return
}
relayUDPConnectionsActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
} }
func RecordSessionRebuilt(ifname string) { func RecordSessionRebuilt(ifname string) {
if sessionRebuiltTotal == nil {
return
}
sessionRebuiltTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname}) sessionRebuiltTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname})
} }
func RecordCommPattern(ifname string, delta int64) { func RecordCommPattern(ifname string, delta int64) {
if commPatternActive == nil {
return
}
commPatternActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname}) commPatternActive.Add(context.Background(), delta, observability.Labels{"ifname": ifname})
} }
func RecordProxyCleanupRemoved(ifname, component string, count int64) { func RecordProxyCleanupRemoved(ifname, component string, count int64) {
if proxyCleanupRemovedTotal == nil {
return
}
proxyCleanupRemovedTotal.Add(context.Background(), count, observability.Labels{"ifname": ifname, "component": component}) proxyCleanupRemovedTotal.Add(context.Background(), count, observability.Labels{"ifname": ifname, "component": component})
} }
func RecordProxyConnectionError(ifname, errorType string) { func RecordProxyConnectionError(ifname, errorType string) {
if proxyConnectionErrorsTotal == nil {
return
}
proxyConnectionErrorsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "error_type": errorType}) proxyConnectionErrorsTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname, "error_type": errorType})
} }
func RecordProxyInitialMappings(ifname string, count int64) { func RecordProxyInitialMappings(ifname string, count int64) {
if proxyInitialMappingsTotal == nil {
return
}
proxyInitialMappingsTotal.Record(context.Background(), count, observability.Labels{"ifname": ifname}) proxyInitialMappingsTotal.Record(context.Background(), count, observability.Labels{"ifname": ifname})
} }
func RecordProxyMappingUpdate(ifname string) { func RecordProxyMappingUpdate(ifname string) {
if proxyMappingUpdatesTotal == nil {
return
}
proxyMappingUpdatesTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname}) proxyMappingUpdatesTotal.Add(context.Background(), 1, observability.Labels{"ifname": ifname})
} }
func RecordProxyIdleCleanupDuration(ifname, component string, seconds float64) { func RecordProxyIdleCleanupDuration(ifname, component string, seconds float64) {
if proxyIdleCleanupDuration == nil {
return
}
proxyIdleCleanupDuration.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "component": component}) proxyIdleCleanupDuration.Record(context.Background(), seconds, observability.Labels{"ifname": ifname, "component": component})
} }
func RecordSNIConnection(result string) { func RecordSNIConnection(result string) {
if sniConnectionsTotal == nil {
return
}
sniConnectionsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) sniConnectionsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordSNIConnectionDuration(seconds float64) { func RecordSNIConnectionDuration(seconds float64) {
if sniConnectionDuration == nil {
return
}
sniConnectionDuration.Record(context.Background(), seconds, nil) sniConnectionDuration.Record(context.Background(), seconds, nil)
} }
func RecordSNIActiveConnection(delta int64) { func RecordSNIActiveConnection(delta int64) {
if sniActiveConnections == nil {
return
}
sniActiveConnections.Add(context.Background(), delta, nil) sniActiveConnections.Add(context.Background(), delta, nil)
} }
func RecordSNIRouteCacheHit(result string) { func RecordSNIRouteCacheHit(result string) {
if sniRouteCacheHitsTotal == nil {
return
}
sniRouteCacheHitsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) sniRouteCacheHitsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordSNIRouteAPIRequest(result string) { func RecordSNIRouteAPIRequest(result string) {
if sniRouteAPIRequestsTotal == nil {
return
}
sniRouteAPIRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) sniRouteAPIRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordSNIRouteAPILatency(seconds float64) { func RecordSNIRouteAPILatency(seconds float64) {
if sniRouteAPILatency == nil {
return
}
sniRouteAPILatency.Record(context.Background(), seconds, nil) sniRouteAPILatency.Record(context.Background(), seconds, nil)
} }
func RecordSNILocalOverride(hit string) { func RecordSNILocalOverride(hit string) {
if sniLocalOverrideTotal == nil {
return
}
sniLocalOverrideTotal.Add(context.Background(), 1, observability.Labels{"hit": hit}) sniLocalOverrideTotal.Add(context.Background(), 1, observability.Labels{"hit": hit})
} }
func RecordSNITrustedProxyEvent(event string) { func RecordSNITrustedProxyEvent(event string) {
if sniTrustedProxyEventsTotal == nil {
return
}
sniTrustedProxyEventsTotal.Add(context.Background(), 1, observability.Labels{"event": event}) sniTrustedProxyEventsTotal.Add(context.Background(), 1, observability.Labels{"event": event})
} }
func RecordSNIProxyProtocolParseError() { func RecordSNIProxyProtocolParseError() {
if sniProxyProtocolParseErrorsTotal == nil {
return
}
sniProxyProtocolParseErrorsTotal.Add(context.Background(), 1, nil) sniProxyProtocolParseErrorsTotal.Add(context.Background(), 1, nil)
} }
func RecordSNIDataBytes(direction string, bytes int64) { func RecordSNIDataBytes(direction string, bytes int64) {
if sniDataBytesTotal == nil {
return
}
sniDataBytesTotal.Add(context.Background(), bytes, observability.Labels{"direction": direction}) sniDataBytesTotal.Add(context.Background(), bytes, observability.Labels{"direction": direction})
} }
func RecordSNITunnelTermination(reason string) { func RecordSNITunnelTermination(reason string) {
if sniTunnelTerminationsTotal == nil {
return
}
sniTunnelTerminationsTotal.Add(context.Background(), 1, observability.Labels{"reason": reason}) sniTunnelTerminationsTotal.Add(context.Background(), 1, observability.Labels{"reason": reason})
} }
func RecordHTTPRequest(endpoint, method, statusCode string) { func RecordHTTPRequest(endpoint, method, statusCode string) {
if httpRequestsTotal == nil {
return
}
httpRequestsTotal.Add(context.Background(), 1, observability.Labels{"endpoint": endpoint, "method": method, "status_code": statusCode}) httpRequestsTotal.Add(context.Background(), 1, observability.Labels{"endpoint": endpoint, "method": method, "status_code": statusCode})
} }
func RecordHTTPRequestDuration(endpoint, method string, seconds float64) { func RecordHTTPRequestDuration(endpoint, method string, seconds float64) {
if httpRequestDuration == nil {
return
}
httpRequestDuration.Record(context.Background(), seconds, observability.Labels{"endpoint": endpoint, "method": method}) httpRequestDuration.Record(context.Background(), seconds, observability.Labels{"endpoint": endpoint, "method": method})
} }
func RecordPeerOperation(operation, result string) { func RecordPeerOperation(operation, result string) {
if peerOperationsTotal == nil {
return
}
peerOperationsTotal.Add(context.Background(), 1, observability.Labels{"operation": operation, "result": result}) peerOperationsTotal.Add(context.Background(), 1, observability.Labels{"operation": operation, "result": result})
} }
func RecordProxyMappingUpdateRequest(result string) { func RecordProxyMappingUpdateRequest(result string) {
if proxyMappingUpdateRequestsTotal == nil {
return
}
proxyMappingUpdateRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) proxyMappingUpdateRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordDestinationsUpdateRequest(result string) { func RecordDestinationsUpdateRequest(result string) {
if destinationsUpdateRequestsTotal == nil {
return
}
destinationsUpdateRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) destinationsUpdateRequestsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordRemoteConfigFetch(result string) { func RecordRemoteConfigFetch(result string) {
if remoteConfigFetchesTotal == nil {
return
}
remoteConfigFetchesTotal.Add(context.Background(), 1, observability.Labels{"result": result}) remoteConfigFetchesTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordBandwidthReport(result string) { func RecordBandwidthReport(result string) {
if bandwidthReportsTotal == nil {
return
}
bandwidthReportsTotal.Add(context.Background(), 1, observability.Labels{"result": result}) bandwidthReportsTotal.Add(context.Background(), 1, observability.Labels{"result": result})
} }
func RecordPeerBandwidthBytes(peer, direction string, bytes int64) { func RecordPeerBandwidthBytes(peer, direction string, bytes int64) {
if peerBandwidthBytesTotal == nil {
return
}
peerBandwidthBytesTotal.Add(context.Background(), bytes, observability.Labels{"peer": peer, "direction": direction}) peerBandwidthBytesTotal.Add(context.Background(), bytes, observability.Labels{"peer": peer, "direction": direction})
} }
func RecordMemorySpike(severity string) { func RecordMemorySpike(severity string) {
if memorySpikeTotal == nil {
return
}
memorySpikeTotal.Add(context.Background(), 1, observability.Labels{"severity": severity}) memorySpikeTotal.Add(context.Background(), 1, observability.Labels{"severity": severity})
} }
func RecordHeapProfileWritten() { func RecordHeapProfileWritten() {
if heapProfilesWrittenTotal == nil {
return
}
heapProfilesWrittenTotal.Add(context.Background(), 1, nil) heapProfilesWrittenTotal.Add(context.Background(), 1, nil)
} }

12
internal/metrics/metrics_test.go
View File

@@ -89,9 +89,6 @@ func TestDefaultConfig(t *testing.T) {
} }
func TestShutdownNoInit(t *testing.T) { func TestShutdownNoInit(t *testing.T) {
// Ensure a known clean global state before testing no-init shutdown behavior.
_ = metrics.Shutdown(context.Background())
// Shutdown without Initialize should not panic or error. // Shutdown without Initialize should not panic or error.
if err := metrics.Shutdown(context.Background()); err != nil { if err := metrics.Shutdown(context.Background()); err != nil {
t.Errorf("unexpected error: %v", err) t.Errorf("unexpected error: %v", err)
@@ -171,7 +168,6 @@ func TestRecordRelay(t *testing.T) {
body := scrape(t, h) body := scrape(t, h)
assertContains(t, body, "gerbil_udp_packets_total") assertContains(t, body, "gerbil_udp_packets_total")
assertContains(t, body, "gerbil_proxy_mapping_active") assertContains(t, body, "gerbil_proxy_mapping_active")
assertContains(t, body, "gerbil_active_sessions")
} }
func TestRecordWireGuard(t *testing.T) { func TestRecordWireGuard(t *testing.T) {
@@ -220,10 +216,10 @@ func TestRecordNetlink(t *testing.T) {
metrics.RecordKernelModuleLoad("success") metrics.RecordKernelModuleLoad("success")
metrics.RecordFirewallRuleApplied("success", "INPUT") metrics.RecordFirewallRuleApplied("success", "INPUT")
metrics.RecordActiveSession("wg0", 1) metrics.RecordActiveSession("wg0", 1)
metrics.RecordActiveProxyConnection(1) metrics.RecordActiveProxyConnection(exampleHostname, 1)
metrics.RecordProxyRouteLookup("hit") metrics.RecordProxyRouteLookup("hit", exampleHostname)
metrics.RecordProxyTLSHandshake(0.05) metrics.RecordProxyTLSHandshake(exampleHostname, 0.05)
metrics.RecordProxyBytesTransmitted("tx", 1024) metrics.RecordProxyBytesTransmitted(exampleHostname, "tx", 1024)
body := scrape(t, h) body := scrape(t, h)
assertContains(t, body, "gerbil_netlink_events_total") assertContains(t, body, "gerbil_netlink_events_total")
assertContains(t, body, "gerbil_active_sessions") assertContains(t, body, "gerbil_active_sessions")

12
internal/observability/config.go
View File

@@ -60,10 +60,6 @@ type OTelConfig struct {
// ExportInterval is how often metrics are pushed to the collector. // ExportInterval is how often metrics are pushed to the collector.
// Defaults to 60 s. // Defaults to 60 s.
ExportInterval time.Duration ExportInterval time.Duration
// Timeout bounds OTLP exporter construction calls.
// Defaults to 10 s.
Timeout time.Duration
} }
// DefaultMetricsConfig returns a MetricsConfig with sensible defaults. // DefaultMetricsConfig returns a MetricsConfig with sensible defaults.
@@ -79,7 +75,6 @@ func DefaultMetricsConfig() MetricsConfig {
Endpoint: "localhost:4317", Endpoint: "localhost:4317",
Insecure: true, Insecure: true,
ExportInterval: 60 * time.Second, ExportInterval: 60 * time.Second,
Timeout: 10 * time.Second,
}, },
ServiceName: "gerbil", ServiceName: "gerbil",
ServiceVersion: "1.0.0", ServiceVersion: "1.0.0",
@@ -93,10 +88,8 @@ func (c *MetricsConfig) Validate() error {
} }
switch c.Backend { switch c.Backend {
case "prometheus", "none": case "prometheus", "none", "":
// valid // valid
case "":
return fmt.Errorf("metrics: enabled requires a non-empty backend")
case "otel": case "otel":
if c.OTel.Endpoint == "" { if c.OTel.Endpoint == "" {
return fmt.Errorf("metrics: backend=otel requires a non-empty OTel endpoint") return fmt.Errorf("metrics: backend=otel requires a non-empty OTel endpoint")
@@ -107,9 +100,6 @@ func (c *MetricsConfig) Validate() error {
if c.OTel.ExportInterval <= 0 { if c.OTel.ExportInterval <= 0 {
return fmt.Errorf("metrics: otel export interval must be positive") return fmt.Errorf("metrics: otel export interval must be positive")
} }
if c.OTel.Timeout <= 0 {
return fmt.Errorf("metrics: otel timeout must be positive")
}
default: default:
return fmt.Errorf("metrics: unknown backend %q (must be \"prometheus\", \"otel\", or \"none\")", c.Backend) return fmt.Errorf("metrics: unknown backend %q (must be \"prometheus\", \"otel\", or \"none\")", c.Backend)
} }

31
internal/observability/metrics.go
View File

@@ -43,20 +43,20 @@ type Histogram interface {
type Backend interface { type Backend interface {
// NewCounter creates a counter metric. // NewCounter creates a counter metric.
// labelNames declares the set of label keys that will be passed at observation time. // labelNames declares the set of label keys that will be passed at observation time.
NewCounter(name, desc string, labelNames ...string) (Counter, error) NewCounter(name, desc string, labelNames ...string) Counter
// NewUpDownCounter creates an up-down counter metric. // NewUpDownCounter creates an up-down counter metric.
NewUpDownCounter(name, desc string, labelNames ...string) (UpDownCounter, error) NewUpDownCounter(name, desc string, labelNames ...string) UpDownCounter
// NewInt64Gauge creates an integer gauge metric. // NewInt64Gauge creates an integer gauge metric.
NewInt64Gauge(name, desc string, labelNames ...string) (Int64Gauge, error) NewInt64Gauge(name, desc string, labelNames ...string) Int64Gauge
// NewFloat64Gauge creates a float gauge metric. // NewFloat64Gauge creates a float gauge metric.
NewFloat64Gauge(name, desc string, labelNames ...string) (Float64Gauge, error) NewFloat64Gauge(name, desc string, labelNames ...string) Float64Gauge
// NewHistogram creates a histogram metric. // NewHistogram creates a histogram metric.
// buckets are the explicit upper-bound bucket boundaries. // buckets are the explicit upper-bound bucket boundaries.
NewHistogram(name, desc string, buckets []float64, labelNames ...string) (Histogram, error) NewHistogram(name, desc string, buckets []float64, labelNames ...string) Histogram
// HTTPHandler returns the /metrics HTTP handler. // HTTPHandler returns the /metrics HTTP handler.
// Implementations that do not expose an HTTP endpoint return nil. // Implementations that do not expose an HTTP endpoint return nil.
@@ -88,7 +88,6 @@ func New(cfg MetricsConfig) (Backend, error) {
Endpoint: cfg.OTel.Endpoint, Endpoint: cfg.OTel.Endpoint,
Insecure: cfg.OTel.Insecure, Insecure: cfg.OTel.Insecure,
ExportInterval: cfg.OTel.ExportInterval, ExportInterval: cfg.OTel.ExportInterval,
Timeout: cfg.OTel.Timeout,
ServiceName: cfg.ServiceName, ServiceName: cfg.ServiceName,
ServiceVersion: cfg.ServiceVersion, ServiceVersion: cfg.ServiceVersion,
DeploymentEnvironment: cfg.DeploymentEnvironment, DeploymentEnvironment: cfg.DeploymentEnvironment,
@@ -111,19 +110,19 @@ type promAdapter struct {
b *obsprom.Backend b *obsprom.Backend
} }
func (a *promAdapter) NewCounter(name, desc string, labelNames ...string) (Counter, error) { func (a *promAdapter) NewCounter(name, desc string, labelNames ...string) Counter {
return a.b.NewCounter(name, desc, labelNames...) return a.b.NewCounter(name, desc, labelNames...)
} }
func (a *promAdapter) NewUpDownCounter(name, desc string, labelNames ...string) (UpDownCounter, error) { func (a *promAdapter) NewUpDownCounter(name, desc string, labelNames ...string) UpDownCounter {
return a.b.NewUpDownCounter(name, desc, labelNames...) return a.b.NewUpDownCounter(name, desc, labelNames...)
} }
func (a *promAdapter) NewInt64Gauge(name, desc string, labelNames ...string) (Int64Gauge, error) { func (a *promAdapter) NewInt64Gauge(name, desc string, labelNames ...string) Int64Gauge {
return a.b.NewInt64Gauge(name, desc, labelNames...) return a.b.NewInt64Gauge(name, desc, labelNames...)
} }
func (a *promAdapter) NewFloat64Gauge(name, desc string, labelNames ...string) (Float64Gauge, error) { func (a *promAdapter) NewFloat64Gauge(name, desc string, labelNames ...string) Float64Gauge {
return a.b.NewFloat64Gauge(name, desc, labelNames...) return a.b.NewFloat64Gauge(name, desc, labelNames...)
} }
func (a *promAdapter) NewHistogram(name, desc string, buckets []float64, labelNames ...string) (Histogram, error) { func (a *promAdapter) NewHistogram(name, desc string, buckets []float64, labelNames ...string) Histogram {
return a.b.NewHistogram(name, desc, buckets, labelNames...) return a.b.NewHistogram(name, desc, buckets, labelNames...)
} }
func (a *promAdapter) HTTPHandler() http.Handler { return a.b.HTTPHandler() } func (a *promAdapter) HTTPHandler() http.Handler { return a.b.HTTPHandler() }
@@ -134,19 +133,19 @@ type otelAdapter struct {
b *obsotel.Backend b *obsotel.Backend
} }
func (a *otelAdapter) NewCounter(name, desc string, labelNames ...string) (Counter, error) { func (a *otelAdapter) NewCounter(name, desc string, labelNames ...string) Counter {
return a.b.NewCounter(name, desc, labelNames...) return a.b.NewCounter(name, desc, labelNames...)
} }
func (a *otelAdapter) NewUpDownCounter(name, desc string, labelNames ...string) (UpDownCounter, error) { func (a *otelAdapter) NewUpDownCounter(name, desc string, labelNames ...string) UpDownCounter {
return a.b.NewUpDownCounter(name, desc, labelNames...) return a.b.NewUpDownCounter(name, desc, labelNames...)
} }
func (a *otelAdapter) NewInt64Gauge(name, desc string, labelNames ...string) (Int64Gauge, error) { func (a *otelAdapter) NewInt64Gauge(name, desc string, labelNames ...string) Int64Gauge {
return a.b.NewInt64Gauge(name, desc, labelNames...) return a.b.NewInt64Gauge(name, desc, labelNames...)
} }
func (a *otelAdapter) NewFloat64Gauge(name, desc string, labelNames ...string) (Float64Gauge, error) { func (a *otelAdapter) NewFloat64Gauge(name, desc string, labelNames ...string) Float64Gauge {
return a.b.NewFloat64Gauge(name, desc, labelNames...) return a.b.NewFloat64Gauge(name, desc, labelNames...)
} }
func (a *otelAdapter) NewHistogram(name, desc string, buckets []float64, labelNames ...string) (Histogram, error) { func (a *otelAdapter) NewHistogram(name, desc string, buckets []float64, labelNames ...string) Histogram {
return a.b.NewHistogram(name, desc, buckets, labelNames...) return a.b.NewHistogram(name, desc, buckets, labelNames...)
} }
func (a *otelAdapter) HTTPHandler() http.Handler { return a.b.HTTPHandler() } func (a *otelAdapter) HTTPHandler() http.Handler { return a.b.HTTPHandler() }

99
internal/observability/metrics_test.go
View File

@@ -2,8 +2,6 @@ package observability_test
import ( import (
"context" "context"
"net"
"os"
"testing" "testing"
"time" "time"
@@ -41,19 +39,20 @@ func TestValidateValidConfigs(t *testing.T) {
}{ }{
{name: "disabled", cfg: observability.MetricsConfig{Enabled: false}}, {name: "disabled", cfg: observability.MetricsConfig{Enabled: false}},
{name: "backend none", cfg: observability.MetricsConfig{Enabled: true, Backend: "none"}}, {name: "backend none", cfg: observability.MetricsConfig{Enabled: true, Backend: "none"}},
{name: "backend empty", cfg: observability.MetricsConfig{Enabled: true, Backend: ""}},
{name: "prometheus", cfg: observability.MetricsConfig{Enabled: true, Backend: "prometheus"}}, {name: "prometheus", cfg: observability.MetricsConfig{Enabled: true, Backend: "prometheus"}},
{ {
name: "otel grpc", name: "otel grpc",
cfg: observability.MetricsConfig{ cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, ExportInterval: 10 * time.Second, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, ExportInterval: 10 * time.Second},
}, },
}, },
{ {
name: "otel http", name: "otel http",
cfg: observability.MetricsConfig{ cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "http", Endpoint: "localhost:4318", ExportInterval: 30 * time.Second, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "http", Endpoint: "localhost:4318", ExportInterval: 30 * time.Second},
}, },
}, },
} }
@@ -72,36 +71,25 @@ func TestValidateInvalidConfigs(t *testing.T) {
cfg observability.MetricsConfig cfg observability.MetricsConfig
}{ }{
{name: "unknown backend", cfg: observability.MetricsConfig{Enabled: true, Backend: "datadog"}}, {name: "unknown backend", cfg: observability.MetricsConfig{Enabled: true, Backend: "datadog"}},
{
name: "backend empty while enabled",
cfg: observability.MetricsConfig{Enabled: true, Backend: ""},
},
{ {
name: "otel missing endpoint", name: "otel missing endpoint",
cfg: observability.MetricsConfig{ cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: "", ExportInterval: 10 * time.Second, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: "", ExportInterval: 10 * time.Second},
}, },
}, },
{ {
name: "otel invalid protocol", name: "otel invalid protocol",
cfg: observability.MetricsConfig{ cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "tcp", Endpoint: otelGRPCEndpoint, ExportInterval: 10 * time.Second, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "tcp", Endpoint: otelGRPCEndpoint, ExportInterval: 10 * time.Second},
}, },
}, },
{ {
name: "otel zero interval", name: "otel zero interval",
cfg: observability.MetricsConfig{ cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, ExportInterval: 0, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, ExportInterval: 0},
},
},
{
name: "otel zero timeout",
cfg: observability.MetricsConfig{
Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, ExportInterval: 10 * time.Second, Timeout: 0},
}, },
}, },
} }
@@ -169,32 +157,11 @@ func TestPrometheusAdapterAllInstruments(t *testing.T) {
ctx := context.Background() ctx := context.Background()
labels := observability.Labels{"k": "v"} labels := observability.Labels{"k": "v"}
c, err := b.NewCounter("prom_adapter_counter_total", "desc", "k") b.NewCounter("prom_adapter_counter_total", "desc", "k").Add(ctx, 1, labels)
if err != nil { b.NewUpDownCounter("prom_adapter_updown", "desc", "k").Add(ctx, 2, labels)
t.Fatalf("NewCounter error: %v", err) b.NewInt64Gauge("prom_adapter_int_gauge", "desc", "k").Record(ctx, 99, labels)
} b.NewFloat64Gauge("prom_adapter_float_gauge", "desc", "k").Record(ctx, 1.23, labels)
u, err := b.NewUpDownCounter("prom_adapter_updown", "desc", "k") b.NewHistogram("prom_adapter_histogram", "desc", []float64{0.1, 1.0}, "k").Record(ctx, 0.5, labels)
if err != nil {
t.Fatalf("NewUpDownCounter error: %v", err)
}
ig, err := b.NewInt64Gauge("prom_adapter_int_gauge", "desc", "k")
if err != nil {
t.Fatalf("NewInt64Gauge error: %v", err)
}
fg, err := b.NewFloat64Gauge("prom_adapter_float_gauge", "desc", "k")
if err != nil {
t.Fatalf("NewFloat64Gauge error: %v", err)
}
h, err := b.NewHistogram("prom_adapter_histogram", "desc", []float64{0.1, 1.0}, "k")
if err != nil {
t.Fatalf("NewHistogram error: %v", err)
}
c.Add(ctx, 1, labels)
u.Add(ctx, 2, labels)
ig.Record(ctx, 99, labels)
fg.Record(ctx, 1.23, labels)
h.Record(ctx, 0.5, labels)
if b.HTTPHandler() == nil { if b.HTTPHandler() == nil {
t.Error("prometheus adapter HTTPHandler should not be nil") t.Error("prometheus adapter HTTPHandler should not be nil")
@@ -205,20 +172,9 @@ func TestPrometheusAdapterAllInstruments(t *testing.T) {
} }
func TestOtelAdapterAllInstruments(t *testing.T) { func TestOtelAdapterAllInstruments(t *testing.T) {
if os.Getenv("SKIP_OTEL_INTEGRATION") != "" {
t.Skip("skipping OTel integration test because SKIP_OTEL_INTEGRATION is set")
}
dialTimeout := 300 * time.Millisecond
conn, err := net.DialTimeout("tcp", otelGRPCEndpoint, dialTimeout)
if err != nil {
t.Skipf("skipping OTel integration test; collector %s not reachable: %v", otelGRPCEndpoint, err)
}
_ = conn.Close()
b, err := observability.New(observability.MetricsConfig{ b, err := observability.New(observability.MetricsConfig{
Enabled: true, Backend: "otel", Enabled: true, Backend: "otel",
OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, Insecure: true, ExportInterval: 100 * time.Millisecond, Timeout: 2 * time.Second}, OTel: observability.OTelConfig{Protocol: "grpc", Endpoint: otelGRPCEndpoint, Insecure: true, ExportInterval: 100 * time.Millisecond},
}) })
if err != nil { if err != nil {
t.Fatalf("failed to create otel backend: %v", err) t.Fatalf("failed to create otel backend: %v", err)
@@ -226,32 +182,11 @@ func TestOtelAdapterAllInstruments(t *testing.T) {
ctx := context.Background() ctx := context.Background()
labels := observability.Labels{"k": "v"} labels := observability.Labels{"k": "v"}
c, err := b.NewCounter("otel_adapter_counter_total", "desc", "k") b.NewCounter("otel_adapter_counter_total", "desc", "k").Add(ctx, 1, labels)
if err != nil { b.NewUpDownCounter("otel_adapter_updown", "desc", "k").Add(ctx, 2, labels)
t.Fatalf("NewCounter error: %v", err) b.NewInt64Gauge("otel_adapter_int_gauge", "desc", "k").Record(ctx, 99, labels)
} b.NewFloat64Gauge("otel_adapter_float_gauge", "desc", "k").Record(ctx, 1.23, labels)
u, err := b.NewUpDownCounter("otel_adapter_updown", "desc", "k") b.NewHistogram("otel_adapter_histogram", "desc", []float64{0.1, 1.0}, "k").Record(ctx, 0.5, labels)
if err != nil {
t.Fatalf("NewUpDownCounter error: %v", err)
}
ig, err := b.NewInt64Gauge("otel_adapter_int_gauge", "desc", "k")
if err != nil {
t.Fatalf("NewInt64Gauge error: %v", err)
}
fg, err := b.NewFloat64Gauge("otel_adapter_float_gauge", "desc", "k")
if err != nil {
t.Fatalf("NewFloat64Gauge error: %v", err)
}
h, err := b.NewHistogram("otel_adapter_histogram", "desc", []float64{0.1, 1.0}, "k")
if err != nil {
t.Fatalf("NewHistogram error: %v", err)
}
c.Add(ctx, 1, labels)
u.Add(ctx, 2, labels)
ig.Record(ctx, 99, labels)
fg.Record(ctx, 1.23, labels)
h.Record(ctx, 0.5, labels)
if b.HTTPHandler() != nil { if b.HTTPHandler() != nil {
t.Error("OTel adapter HTTPHandler should be nil") t.Error("OTel adapter HTTPHandler should be nil")

27
internal/observability/noop.go
View File

@@ -13,31 +13,38 @@ type NoopBackend struct{}
// Compile-time interface check. // Compile-time interface check.
var _ Backend = (*NoopBackend)(nil) var _ Backend = (*NoopBackend)(nil)
func (n *NoopBackend) NewCounter(_ string, _ string, _ ...string) (Counter, error) { func (n *NoopBackend) NewCounter(_ string, _ string, _ ...string) Counter {
return noopCounter{}, nil _ = n
return noopCounter{}
} }
func (n *NoopBackend) NewUpDownCounter(_ string, _ string, _ ...string) (UpDownCounter, error) { func (n *NoopBackend) NewUpDownCounter(_ string, _ string, _ ...string) UpDownCounter {
return noopUpDownCounter{}, nil _ = n
return noopUpDownCounter{}
} }
func (n *NoopBackend) NewInt64Gauge(_ string, _ string, _ ...string) (Int64Gauge, error) { func (n *NoopBackend) NewInt64Gauge(_ string, _ string, _ ...string) Int64Gauge {
return noopInt64Gauge{}, nil _ = n
return noopInt64Gauge{}
} }
func (n *NoopBackend) NewFloat64Gauge(_ string, _ string, _ ...string) (Float64Gauge, error) { func (n *NoopBackend) NewFloat64Gauge(_ string, _ string, _ ...string) Float64Gauge {
return noopFloat64Gauge{}, nil _ = n
return noopFloat64Gauge{}
} }
func (n *NoopBackend) NewHistogram(_ string, _ string, _ []float64, _ ...string) (Histogram, error) { func (n *NoopBackend) NewHistogram(_ string, _ string, _ []float64, _ ...string) Histogram {
return noopHistogram{}, nil _ = n
return noopHistogram{}
} }
func (n *NoopBackend) HTTPHandler() http.Handler { func (n *NoopBackend) HTTPHandler() http.Handler {
_ = n
return nil return nil
} }
func (n *NoopBackend) Shutdown(_ context.Context) error { func (n *NoopBackend) Shutdown(_ context.Context) error {
_ = n
return nil return nil
} }

67
internal/observability/noop_test.go
View File

@@ -13,32 +13,32 @@ func TestNoopBackendAllInstruments(t *testing.T) {
ctx := context.Background() ctx := context.Background()
labels := observability.Labels{"k": "v"} labels := observability.Labels{"k": "v"}
t.Run("Counter", func(t *testing.T) { t.Run("Counter", func(_ *testing.T) {
c, _ := n.NewCounter("test_counter", "desc") c := n.NewCounter("test_counter", "desc")
c.Add(ctx, 1, labels) c.Add(ctx, 1, labels)
c.Add(ctx, 0, nil) c.Add(ctx, 0, nil)
}) })
t.Run("UpDownCounter", func(t *testing.T) { t.Run("UpDownCounter", func(_ *testing.T) {
u, _ := n.NewUpDownCounter("test_updown", "desc") u := n.NewUpDownCounter("test_updown", "desc")
u.Add(ctx, 1, labels) u.Add(ctx, 1, labels)
u.Add(ctx, -1, nil) u.Add(ctx, -1, nil)
}) })
t.Run("Int64Gauge", func(t *testing.T) { t.Run("Int64Gauge", func(_ *testing.T) {
g, _ := n.NewInt64Gauge("test_int64gauge", "desc") g := n.NewInt64Gauge("test_int64gauge", "desc")
g.Record(ctx, 42, labels) g.Record(ctx, 42, labels)
g.Record(ctx, 0, nil) g.Record(ctx, 0, nil)
}) })
t.Run("Float64Gauge", func(t *testing.T) { t.Run("Float64Gauge", func(_ *testing.T) {
g, _ := n.NewFloat64Gauge("test_float64gauge", "desc") g := n.NewFloat64Gauge("test_float64gauge", "desc")
g.Record(ctx, 3.14, labels) g.Record(ctx, 3.14, labels)
g.Record(ctx, 0, nil) g.Record(ctx, 0, nil)
}) })
t.Run("Histogram", func(t *testing.T) { t.Run("Histogram", func(_ *testing.T) {
h, _ := n.NewHistogram("test_histogram", "desc", []float64{1, 5, 10}) h := n.NewHistogram("test_histogram", "desc", []float64{1, 5, 10})
h.Record(ctx, 2.5, labels) h.Record(ctx, 2.5, labels)
h.Record(ctx, 0, nil) h.Record(ctx, 0, nil)
}) })
@@ -56,47 +56,12 @@ func TestNoopBackendAllInstruments(t *testing.T) {
}) })
} }
func TestNoopBackendLabelNames(t *testing.T) { func TestNoopBackendLabelNames(_ *testing.T) {
// Verify that label names passed at creation time are accepted without panic. // Verify that label names passed at creation time are accepted without panic.
n := &observability.NoopBackend{} n := &observability.NoopBackend{}
n.NewCounter("c", "d", "label1", "label2")
assertNoPanic := func(t *testing.T, constructor string, fn func()) { n.NewUpDownCounter("u", "d", "l1")
t.Helper() n.NewInt64Gauge("g1", "d", "l1", "l2", "l3")
defer func() { n.NewFloat64Gauge("g2", "d")
if r := recover(); r != nil { n.NewHistogram("h", "d", []float64{0.1, 1.0}, "l1")
t.Fatalf("%s panicked: %v", constructor, r)
}
}()
fn()
}
t.Run("NewCounter", func(t *testing.T) {
assertNoPanic(t, "NewCounter", func() {
_, _ = n.NewCounter("c", "d", "label1", "label2")
})
})
t.Run("NewUpDownCounter", func(t *testing.T) {
assertNoPanic(t, "NewUpDownCounter", func() {
_, _ = n.NewUpDownCounter("u", "d", "l1")
})
})
t.Run("NewInt64Gauge", func(t *testing.T) {
assertNoPanic(t, "NewInt64Gauge", func() {
_, _ = n.NewInt64Gauge("g1", "d", "l1", "l2", "l3")
})
})
t.Run("NewFloat64Gauge", func(t *testing.T) {
assertNoPanic(t, "NewFloat64Gauge", func() {
_, _ = n.NewFloat64Gauge("g2", "d")
})
})
t.Run("NewHistogram", func(t *testing.T) {
assertNoPanic(t, "NewHistogram", func() {
_, _ = n.NewHistogram("h", "d", []float64{0.1, 1.0}, "l1")
})
})
} }

163
internal/observability/otel/backend.go
View File

@@ -9,10 +9,7 @@ package otel
import ( import (
"context" "context"
"fmt" "fmt"
"log"
"net/http" "net/http"
"regexp"
"strings"
"time" "time"
"go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/attribute"
@@ -20,8 +17,6 @@ import (
sdkmetric "go.opentelemetry.io/otel/sdk/metric" sdkmetric "go.opentelemetry.io/otel/sdk/metric"
) )
var metricLabelNameRE = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_]*$`)
// Config holds OTel backend configuration. // Config holds OTel backend configuration.
type Config struct { type Config struct {
// Protocol is "grpc" (default) or "http". // Protocol is "grpc" (default) or "http".
@@ -36,9 +31,6 @@ type Config struct {
// ExportInterval is the period between pushes to the collector. // ExportInterval is the period between pushes to the collector.
ExportInterval time.Duration ExportInterval time.Duration
// Timeout bounds exporter construction calls.
Timeout time.Duration
ServiceName string ServiceName string
ServiceVersion string ServiceVersion string
DeploymentEnvironment string DeploymentEnvironment string
@@ -65,15 +57,9 @@ func New(cfg Config) (*Backend, error) {
if cfg.Protocol == "" { if cfg.Protocol == "" {
cfg.Protocol = "grpc" cfg.Protocol = "grpc"
} }
if strings.TrimSpace(cfg.Endpoint) == "" {
return nil, fmt.Errorf("otel backend: empty cfg.Endpoint")
}
if cfg.ExportInterval <= 0 { if cfg.ExportInterval <= 0 {
cfg.ExportInterval = 60 * time.Second cfg.ExportInterval = 60 * time.Second
} }
if cfg.Timeout <= 0 {
cfg.Timeout = 10 * time.Second
}
if cfg.ServiceName == "" { if cfg.ServiceName == "" {
cfg.ServiceName = "gerbil" cfg.ServiceName = "gerbil"
} }
@@ -114,196 +100,111 @@ func (b *Backend) Shutdown(ctx context.Context) error {
} }
// NewCounter creates an OTel Int64Counter. // NewCounter creates an OTel Int64Counter.
func (b *Backend) NewCounter(name, desc string, labelNames ...string) (*Counter, error) { func (b *Backend) NewCounter(name, desc string, _ ...string) *Counter {
normalizedLabelNames, err := validateLabelNames(labelNames)
if err != nil {
return nil, fmt.Errorf("otel: create counter %q: %w", name, err)
}
c, err := b.meter.Int64Counter(name, metric.WithDescription(desc)) c, err := b.meter.Int64Counter(name, metric.WithDescription(desc))
if err != nil { if err != nil {
return nil, fmt.Errorf("otel: create counter %q: %w", name, err) panic(fmt.Sprintf("otel: create counter %q: %v", name, err))
} }
return &Counter{c: c, labelNames: normalizedLabelNames}, nil return &Counter{c: c}
} }
// NewUpDownCounter creates an OTel Int64UpDownCounter. // NewUpDownCounter creates an OTel Int64UpDownCounter.
func (b *Backend) NewUpDownCounter(name, desc string, labelNames ...string) (*UpDownCounter, error) { func (b *Backend) NewUpDownCounter(name, desc string, _ ...string) *UpDownCounter {
normalizedLabelNames, err := validateLabelNames(labelNames)
if err != nil {
return nil, fmt.Errorf("otel: create up-down counter %q: %w", name, err)
}
c, err := b.meter.Int64UpDownCounter(name, metric.WithDescription(desc)) c, err := b.meter.Int64UpDownCounter(name, metric.WithDescription(desc))
if err != nil { if err != nil {
return nil, fmt.Errorf("otel: create up-down counter %q: %w", name, err) panic(fmt.Sprintf("otel: create up-down counter %q: %v", name, err))
} }
return &UpDownCounter{c: c, labelNames: normalizedLabelNames}, nil return &UpDownCounter{c: c}
} }
// NewInt64Gauge creates an OTel Int64Gauge. // NewInt64Gauge creates an OTel Int64Gauge.
func (b *Backend) NewInt64Gauge(name, desc string, labelNames ...string) (*Int64Gauge, error) { func (b *Backend) NewInt64Gauge(name, desc string, _ ...string) *Int64Gauge {
normalizedLabelNames, err := validateLabelNames(labelNames)
if err != nil {
return nil, fmt.Errorf("otel: create int64 gauge %q: %w", name, err)
}
g, err := b.meter.Int64Gauge(name, metric.WithDescription(desc)) g, err := b.meter.Int64Gauge(name, metric.WithDescription(desc))
if err != nil { if err != nil {
return nil, fmt.Errorf("otel: create int64 gauge %q: %w", name, err) panic(fmt.Sprintf("otel: create int64 gauge %q: %v", name, err))
} }
return &Int64Gauge{g: g, labelNames: normalizedLabelNames}, nil return &Int64Gauge{g: g}
} }
// NewFloat64Gauge creates an OTel Float64Gauge. // NewFloat64Gauge creates an OTel Float64Gauge.
func (b *Backend) NewFloat64Gauge(name, desc string, labelNames ...string) (*Float64Gauge, error) { func (b *Backend) NewFloat64Gauge(name, desc string, _ ...string) *Float64Gauge {
normalizedLabelNames, err := validateLabelNames(labelNames)
if err != nil {
return nil, fmt.Errorf("otel: create float64 gauge %q: %w", name, err)
}
g, err := b.meter.Float64Gauge(name, metric.WithDescription(desc)) g, err := b.meter.Float64Gauge(name, metric.WithDescription(desc))
if err != nil { if err != nil {
return nil, fmt.Errorf("otel: create float64 gauge %q: %w", name, err) panic(fmt.Sprintf("otel: create float64 gauge %q: %v", name, err))
} }
return &Float64Gauge{g: g, labelNames: normalizedLabelNames}, nil return &Float64Gauge{g: g}
} }
// NewHistogram creates an OTel Float64Histogram with explicit bucket boundaries. // NewHistogram creates an OTel Float64Histogram with explicit bucket boundaries.
func (b *Backend) NewHistogram(name, desc string, buckets []float64, labelNames ...string) (*Histogram, error) { func (b *Backend) NewHistogram(name, desc string, buckets []float64, _ ...string) *Histogram {
normalizedLabelNames, err := validateLabelNames(labelNames)
if err != nil {
return nil, fmt.Errorf("otel: create histogram %q: %w", name, err)
}
h, err := b.meter.Float64Histogram(name, h, err := b.meter.Float64Histogram(name,
metric.WithDescription(desc), metric.WithDescription(desc),
metric.WithExplicitBucketBoundaries(buckets...), metric.WithExplicitBucketBoundaries(buckets...),
) )
if err != nil { if err != nil {
return nil, fmt.Errorf("otel: create histogram %q: %w", name, err) panic(fmt.Sprintf("otel: create histogram %q: %v", name, err))
} }
return &Histogram{h: h, labelNames: normalizedLabelNames}, nil return &Histogram{h: h}
} }
func validateLabelNames(labelNames []string) ([]string, error) { // labelsToAttrs converts a Labels map to OTel attribute key-value pairs.
if len(labelNames) == 0 { func labelsToAttrs(labels map[string]string) []attribute.KeyValue {
return nil, nil if len(labels) == 0 {
return nil
} }
attrs := make([]attribute.KeyValue, 0, len(labels))
normalized := make([]string, len(labelNames)) for k, v := range labels {
seen := make(map[string]struct{}, len(labelNames)) attrs = append(attrs, attribute.String(k, v))
for i, name := range labelNames {
if !metricLabelNameRE.MatchString(name) {
return nil, fmt.Errorf("invalid label name %q", name)
}
if _, exists := seen[name]; exists {
return nil, fmt.Errorf("duplicate label name %q", name)
}
seen[name] = struct{}{}
normalized[i] = name
} }
return normalized, nil
}
func labelsToAttrs(labelNames []string, labels map[string]string) []attribute.KeyValue {
if len(labelNames) == 0 {
if len(labels) > 0 {
log.Printf("WARN: dropping otel metric sample due to unexpected labels: got=%v expected=none", labels)
return nil
}
return []attribute.KeyValue{}
}
attrs := make([]attribute.KeyValue, 0, len(labelNames))
for _, labelName := range labelNames {
attrs = append(attrs, attribute.String(labelName, labels[labelName]))
}
for got := range labels {
found := false
for _, expected := range labelNames {
if got == expected {
found = true
break
}
}
if !found {
log.Printf("WARN: dropping otel metric sample due to unexpected label key %q (expected=%v)", got, labelNames)
return nil
}
}
return attrs return attrs
} }
// Counter wraps an OTel Int64Counter. // Counter wraps an OTel Int64Counter.
type Counter struct { type Counter struct {
c metric.Int64Counter c metric.Int64Counter
labelNames []string
} }
// Add increments the counter by value. // Add increments the counter by value.
func (c *Counter) Add(ctx context.Context, value int64, labels map[string]string) { func (c *Counter) Add(ctx context.Context, value int64, labels map[string]string) {
attrs := labelsToAttrs(c.labelNames, labels) c.c.Add(ctx, value, metric.WithAttributes(labelsToAttrs(labels)...))
if attrs == nil {
return
}
c.c.Add(ctx, value, metric.WithAttributes(attrs...))
} }
// UpDownCounter wraps an OTel Int64UpDownCounter. // UpDownCounter wraps an OTel Int64UpDownCounter.
type UpDownCounter struct { type UpDownCounter struct {
c metric.Int64UpDownCounter c metric.Int64UpDownCounter
labelNames []string
} }
// Add adjusts the up-down counter by value. // Add adjusts the up-down counter by value.
func (u *UpDownCounter) Add(ctx context.Context, value int64, labels map[string]string) { func (u *UpDownCounter) Add(ctx context.Context, value int64, labels map[string]string) {
attrs := labelsToAttrs(u.labelNames, labels) u.c.Add(ctx, value, metric.WithAttributes(labelsToAttrs(labels)...))
if attrs == nil {
return
}
u.c.Add(ctx, value, metric.WithAttributes(attrs...))
} }
// Int64Gauge wraps an OTel Int64Gauge. // Int64Gauge wraps an OTel Int64Gauge.
type Int64Gauge struct { type Int64Gauge struct {
g metric.Int64Gauge g metric.Int64Gauge
labelNames []string
} }
// Record sets the gauge to value. // Record sets the gauge to value.
func (g *Int64Gauge) Record(ctx context.Context, value int64, labels map[string]string) { func (g *Int64Gauge) Record(ctx context.Context, value int64, labels map[string]string) {
attrs := labelsToAttrs(g.labelNames, labels) g.g.Record(ctx, value, metric.WithAttributes(labelsToAttrs(labels)...))
if attrs == nil {
return
}
g.g.Record(ctx, value, metric.WithAttributes(attrs...))
} }
// Float64Gauge wraps an OTel Float64Gauge. // Float64Gauge wraps an OTel Float64Gauge.
type Float64Gauge struct { type Float64Gauge struct {
g metric.Float64Gauge g metric.Float64Gauge
labelNames []string
} }
// Record sets the gauge to value. // Record sets the gauge to value.
func (g *Float64Gauge) Record(ctx context.Context, value float64, labels map[string]string) { func (g *Float64Gauge) Record(ctx context.Context, value float64, labels map[string]string) {
attrs := labelsToAttrs(g.labelNames, labels) g.g.Record(ctx, value, metric.WithAttributes(labelsToAttrs(labels)...))
if attrs == nil {
return
}
g.g.Record(ctx, value, metric.WithAttributes(attrs...))
} }
// Histogram wraps an OTel Float64Histogram. // Histogram wraps an OTel Float64Histogram.
type Histogram struct { type Histogram struct {
h metric.Float64Histogram h metric.Float64Histogram
labelNames []string
} }
// Record observes value in the histogram. // Record observes value in the histogram.
func (h *Histogram) Record(ctx context.Context, value float64, labels map[string]string) { func (h *Histogram) Record(ctx context.Context, value float64, labels map[string]string) {
attrs := labelsToAttrs(h.labelNames, labels) h.h.Record(ctx, value, metric.WithAttributes(labelsToAttrs(labels)...))
if attrs == nil {
return
}
h.h.Record(ctx, value, metric.WithAttributes(attrs...))
} }

44
internal/observability/otel/backend_test.go
View File

@@ -55,10 +55,7 @@ func TestOtelBackendCounter(t *testing.T) {
b := newInMemoryBackend(t) b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
c, err := b.NewCounter("gerbil_test_counter_total", "test counter", "result") c := b.NewCounter("gerbil_test_counter_total", "test counter", "result")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
// Should not panic // Should not panic
c.Add(context.Background(), 1, map[string]string{"result": "ok"}) c.Add(context.Background(), 1, map[string]string{"result": "ok"})
c.Add(context.Background(), 5, nil) c.Add(context.Background(), 5, nil)
@@ -68,10 +65,7 @@ func TestOtelBackendUpDownCounter(t *testing.T) {
b := newInMemoryBackend(t) b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
u, err := b.NewUpDownCounter("gerbil_test_updown", "test updown", "state") u := b.NewUpDownCounter("gerbil_test_updown", "test updown", "state")
if err != nil {
t.Fatalf("NewUpDownCounter returned error: %v", err)
}
u.Add(context.Background(), 3, map[string]string{"state": "active"}) u.Add(context.Background(), 3, map[string]string{"state": "active"})
u.Add(context.Background(), -1, map[string]string{"state": "active"}) u.Add(context.Background(), -1, map[string]string{"state": "active"})
} }
@@ -80,10 +74,7 @@ func TestOtelBackendInt64Gauge(t *testing.T) {
b := newInMemoryBackend(t) b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
g, err := b.NewInt64Gauge("gerbil_test_int_gauge", "test gauge") g := b.NewInt64Gauge("gerbil_test_int_gauge", "test gauge")
if err != nil {
t.Fatalf("NewInt64Gauge returned error: %v", err)
}
g.Record(context.Background(), 42, nil) g.Record(context.Background(), 42, nil)
} }
@@ -91,10 +82,7 @@ func TestOtelBackendFloat64Gauge(t *testing.T) {
b := newInMemoryBackend(t) b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
g, err := b.NewFloat64Gauge("gerbil_test_float_gauge", "test float gauge") g := b.NewFloat64Gauge("gerbil_test_float_gauge", "test float gauge")
if err != nil {
t.Fatalf("NewFloat64Gauge returned error: %v", err)
}
g.Record(context.Background(), 3.14, nil) g.Record(context.Background(), 3.14, nil)
} }
@@ -102,11 +90,8 @@ func TestOtelBackendHistogram(t *testing.T) {
b := newInMemoryBackend(t) b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
h, err := b.NewHistogram("gerbil_test_duration_seconds", "test histogram", h := b.NewHistogram("gerbil_test_duration_seconds", "test histogram",
[]float64{0.1, 0.5, 1.0}, "method") []float64{0.1, 0.5, 1.0}, "method")
if err != nil {
t.Fatalf("NewHistogram returned error: %v", err)
}
h.Record(context.Background(), 0.3, map[string]string{"method": "GET"}) h.Record(context.Background(), 0.3, map[string]string{"method": "GET"})
} }
@@ -154,22 +139,3 @@ func TestOtelBackendDeploymentEnvironment(t *testing.T) {
} }
defer b.Shutdown(context.Background()) //nolint:errcheck defer b.Shutdown(context.Background()) //nolint:errcheck
} }
func TestOtelBackendRejectsInvalidLabelNames(t *testing.T) {
b := newInMemoryBackend(t)
defer b.Shutdown(context.Background()) //nolint:errcheck
t.Run("duplicate labels", func(t *testing.T) {
_, err := b.NewCounter("gerbil_test_invalid_labels_total", "test counter", "result", "result")
if err == nil {
t.Fatal("expected error for duplicate label names")
}
})
t.Run("invalid label name", func(t *testing.T) {
_, err := b.NewHistogram("gerbil_test_invalid_histogram", "test histogram", []float64{0.1, 1.0}, "status-code")
if err == nil {
t.Fatal("expected error for invalid label name")
}
})
}

22
internal/observability/otel/exporter.go
View File

@@ -3,8 +3,6 @@ package otel
import ( import (
"context" "context"
"fmt" "fmt"
"net/url"
"strings"
"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc" "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc"
"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp" "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"
@@ -13,10 +11,6 @@ import (
// newExporter creates the appropriate OTLP exporter based on cfg.Protocol. // newExporter creates the appropriate OTLP exporter based on cfg.Protocol.
func newExporter(ctx context.Context, cfg Config) (sdkmetric.Exporter, error) { func newExporter(ctx context.Context, cfg Config) (sdkmetric.Exporter, error) {
if strings.TrimSpace(cfg.Endpoint) == "" {
return nil, fmt.Errorf("otel: cfg.Endpoint is empty")
}
switch cfg.Protocol { switch cfg.Protocol {
case "grpc", "": case "grpc", "":
return newGRPCExporter(ctx, cfg) return newGRPCExporter(ctx, cfg)
@@ -42,20 +36,8 @@ func newGRPCExporter(ctx context.Context, cfg Config) (sdkmetric.Exporter, error
} }
func newHTTPExporter(ctx context.Context, cfg Config) (sdkmetric.Exporter, error) { func newHTTPExporter(ctx context.Context, cfg Config) (sdkmetric.Exporter, error) {
endpoint := strings.TrimSpace(cfg.Endpoint) opts := []otlpmetrichttp.Option{
otlpmetrichttp.WithEndpoint(cfg.Endpoint),
opts := make([]otlpmetrichttp.Option, 0, 3)
if strings.Contains(endpoint, "://") {
parsed, err := url.Parse(endpoint)
if err != nil {
return nil, fmt.Errorf("otlp http exporter: parse endpoint URL %q: %w", endpoint, err)
}
opts = append(opts, otlpmetrichttp.WithEndpointURL(parsed.String()))
} else {
opts = append(opts,
otlpmetrichttp.WithEndpoint(endpoint),
otlpmetrichttp.WithURLPath("/v1/metrics"),
)
} }
if cfg.Insecure { if cfg.Insecure {
opts = append(opts, otlpmetrichttp.WithInsecure()) opts = append(opts, otlpmetrichttp.WithInsecure())

6
internal/observability/otel/resource.go
View File

@@ -3,7 +3,7 @@ package otel
import ( import (
"go.opentelemetry.io/otel/attribute" "go.opentelemetry.io/otel/attribute"
"go.opentelemetry.io/otel/sdk/resource" "go.opentelemetry.io/otel/sdk/resource"
semconv "go.opentelemetry.io/otel/semconv/v1.18.0" semconv "go.opentelemetry.io/otel/semconv/v1.40.0"
) )
// newResource builds an OTel resource for the Gerbil service. // newResource builds an OTel resource for the Gerbil service.
@@ -15,11 +15,11 @@ func newResource(serviceName, serviceVersion, deploymentEnv string) (*resource.R
attrs = append(attrs, semconv.ServiceVersion(serviceVersion)) attrs = append(attrs, semconv.ServiceVersion(serviceVersion))
} }
if deploymentEnv != "" { if deploymentEnv != "" {
attrs = append(attrs, semconv.DeploymentEnvironment(deploymentEnv)) attrs = append(attrs, semconv.DeploymentEnvironmentName(deploymentEnv))
} }
return resource.Merge( return resource.Merge(
resource.Default(), resource.Default(),
resource.NewSchemaless(attrs...), resource.NewWithAttributes(semconv.SchemaURL, attrs...),
) )
} }

183
internal/observability/prometheus/backend.go
View File

@@ -7,7 +7,6 @@ package prometheus
import ( import (
"context" "context"
"log"
"net/http" "net/http"
"github.com/prometheus/client_golang/prometheus" "github.com/prometheus/client_golang/prometheus"
@@ -31,10 +30,9 @@ type Config struct {
// in the backend-specific instrument types that implement the observability // in the backend-specific instrument types that implement the observability
// instrument interfaces. // instrument interfaces.
type Backend struct { type Backend struct {
cfg Config cfg Config
registry *prometheus.Registry registry *prometheus.Registry
handler http.Handler handler http.Handler
droppedSamplesCounter prometheus.Counter
} }
// New creates and initialises a Prometheus backend. // New creates and initialises a Prometheus backend.
@@ -50,11 +48,6 @@ func New(cfg Config) (*Backend, error) {
} }
registry := prometheus.NewRegistry() registry := prometheus.NewRegistry()
droppedSamplesCounter := prometheus.NewCounter(prometheus.CounterOpts{
Name: "gerbil_dropped_metric_samples_total",
Help: "Total number of metric samples dropped due to invalid labels or unsupported label sets",
})
registry.MustRegister(droppedSamplesCounter)
// Include Go and process metrics by default. // Include Go and process metrics by default.
includeGo := cfg.IncludeGoMetrics == nil || *cfg.IncludeGoMetrics includeGo := cfg.IncludeGoMetrics == nil || *cfg.IncludeGoMetrics
@@ -69,7 +62,7 @@ func New(cfg Config) (*Backend, error) {
EnableOpenMetrics: false, EnableOpenMetrics: false,
}) })
return &Backend{cfg: cfg, registry: registry, handler: handler, droppedSamplesCounter: droppedSamplesCounter}, nil return &Backend{cfg: cfg, registry: registry, handler: handler}, nil
} }
// HTTPHandler returns the Prometheus /metrics HTTP handler. // HTTPHandler returns the Prometheus /metrics HTTP handler.
@@ -85,107 +78,60 @@ func (b *Backend) Shutdown(_ context.Context) error {
} }
// NewCounter creates a Prometheus CounterVec registered on the backend's registry. // NewCounter creates a Prometheus CounterVec registered on the backend's registry.
func (b *Backend) NewCounter(name, desc string, labelNames ...string) (*Counter, error) { func (b *Backend) NewCounter(name, desc string, labelNames ...string) *Counter {
vec := prometheus.NewCounterVec(prometheus.CounterOpts{ vec := prometheus.NewCounterVec(prometheus.CounterOpts{
Name: name, Name: name,
Help: desc, Help: desc,
}, labelNames) }, labelNames)
if err := b.registry.Register(vec); err != nil { b.registry.MustRegister(vec)
if are, ok := err.(prometheus.AlreadyRegisteredError); ok { return &Counter{vec: vec}
existing, ok := are.ExistingCollector.(*prometheus.CounterVec)
if !ok {
return nil, err
}
return &Counter{vec: existing, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
}
return nil, err
}
return &Counter{vec: vec, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
} }
// NewUpDownCounter creates a Prometheus GaugeVec (Prometheus gauges are // NewUpDownCounter creates a Prometheus GaugeVec (Prometheus gauges are
// bidirectional) registered on the backend's registry. // bidirectional) registered on the backend's registry.
func (b *Backend) NewUpDownCounter(name, desc string, labelNames ...string) (*UpDownCounter, error) { func (b *Backend) NewUpDownCounter(name, desc string, labelNames ...string) *UpDownCounter {
vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{ vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{
Name: name, Name: name,
Help: desc, Help: desc,
}, labelNames) }, labelNames)
if err := b.registry.Register(vec); err != nil { b.registry.MustRegister(vec)
if are, ok := err.(prometheus.AlreadyRegisteredError); ok { return &UpDownCounter{vec: vec}
existing, ok := are.ExistingCollector.(*prometheus.GaugeVec)
if !ok {
return nil, err
}
return &UpDownCounter{vec: existing, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
}
return nil, err
}
return &UpDownCounter{vec: vec, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
} }
// NewInt64Gauge creates a Prometheus GaugeVec registered on the backend's registry. // NewInt64Gauge creates a Prometheus GaugeVec registered on the backend's registry.
func (b *Backend) NewInt64Gauge(name, desc string, labelNames ...string) (*Int64Gauge, error) { func (b *Backend) NewInt64Gauge(name, desc string, labelNames ...string) *Int64Gauge {
vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{ vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{
Name: name, Name: name,
Help: desc, Help: desc,
}, labelNames) }, labelNames)
if err := b.registry.Register(vec); err != nil { b.registry.MustRegister(vec)
if are, ok := err.(prometheus.AlreadyRegisteredError); ok { return &Int64Gauge{vec: vec}
existing, ok := are.ExistingCollector.(*prometheus.GaugeVec)
if !ok {
return nil, err
}
return &Int64Gauge{vec: existing, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
}
return nil, err
}
return &Int64Gauge{vec: vec, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
} }
// NewFloat64Gauge creates a Prometheus GaugeVec registered on the backend's registry. // NewFloat64Gauge creates a Prometheus GaugeVec registered on the backend's registry.
func (b *Backend) NewFloat64Gauge(name, desc string, labelNames ...string) (*Float64Gauge, error) { func (b *Backend) NewFloat64Gauge(name, desc string, labelNames ...string) *Float64Gauge {
vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{ vec := prometheus.NewGaugeVec(prometheus.GaugeOpts{
Name: name, Name: name,
Help: desc, Help: desc,
}, labelNames) }, labelNames)
if err := b.registry.Register(vec); err != nil { b.registry.MustRegister(vec)
if are, ok := err.(prometheus.AlreadyRegisteredError); ok { return &Float64Gauge{vec: vec}
existing, ok := are.ExistingCollector.(*prometheus.GaugeVec)
if !ok {
return nil, err
}
return &Float64Gauge{vec: existing, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
}
return nil, err
}
return &Float64Gauge{vec: vec, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
} }
// NewHistogram creates a Prometheus HistogramVec registered on the backend's registry. // NewHistogram creates a Prometheus HistogramVec registered on the backend's registry.
func (b *Backend) NewHistogram(name, desc string, buckets []float64, labelNames ...string) (*Histogram, error) { func (b *Backend) NewHistogram(name, desc string, buckets []float64, labelNames ...string) *Histogram {
vec := prometheus.NewHistogramVec(prometheus.HistogramOpts{ vec := prometheus.NewHistogramVec(prometheus.HistogramOpts{
Name: name, Name: name,
Help: desc, Help: desc,
Buckets: buckets, Buckets: buckets,
}, labelNames) }, labelNames)
if err := b.registry.Register(vec); err != nil { b.registry.MustRegister(vec)
if are, ok := err.(prometheus.AlreadyRegisteredError); ok { return &Histogram{vec: vec}
existing, ok := are.ExistingCollector.(*prometheus.HistogramVec)
if !ok {
return nil, err
}
return &Histogram{vec: existing, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
}
return nil, err
}
return &Histogram{vec: vec, labelNames: append([]string(nil), labelNames...), droppedSamplesCounter: b.droppedSamplesCounter}, nil
} }
// Counter is a native Prometheus counter instrument. // Counter is a native Prometheus counter instrument.
type Counter struct { type Counter struct {
vec *prometheus.CounterVec vec *prometheus.CounterVec
labelNames []string
droppedSamplesCounter prometheus.Counter
} }
// Add increments the counter by value for the given labels. // Add increments the counter by value for the given labels.
@@ -193,118 +139,47 @@ type Counter struct {
// value must be non-negative. Negative values are ignored. // value must be non-negative. Negative values are ignored.
func (c *Counter) Add(_ context.Context, value int64, labels map[string]string) { func (c *Counter) Add(_ context.Context, value int64, labels map[string]string) {
if value < 0 { if value < 0 {
log.Printf("WARN: counter add called with negative value=%d labels=%v expected_labels=%v", value, labels, c.labelNames)
return return
} }
normalized, ok := normalizeLabels(c.labelNames, labels, c.droppedSamplesCounter) c.vec.With(prometheus.Labels(labels)).Add(float64(value))
if !ok {
return
}
defer guardMetricPanic("counter", c.labelNames, labels)
c.vec.With(normalized).Add(float64(value))
} }
// UpDownCounter is a native Prometheus gauge used as a bidirectional counter. // UpDownCounter is a native Prometheus gauge used as a bidirectional counter.
type UpDownCounter struct { type UpDownCounter struct {
vec *prometheus.GaugeVec vec *prometheus.GaugeVec
labelNames []string
droppedSamplesCounter prometheus.Counter
} }
// Add adjusts the gauge by value for the given labels. // Add adjusts the gauge by value for the given labels.
func (u *UpDownCounter) Add(_ context.Context, value int64, labels map[string]string) { func (u *UpDownCounter) Add(_ context.Context, value int64, labels map[string]string) {
normalized, ok := normalizeLabels(u.labelNames, labels, u.droppedSamplesCounter) u.vec.With(prometheus.Labels(labels)).Add(float64(value))
if !ok {
return
}
defer guardMetricPanic("updown", u.labelNames, labels)
u.vec.With(normalized).Add(float64(value))
} }
// Int64Gauge is a native Prometheus gauge recording integer snapshot values. // Int64Gauge is a native Prometheus gauge recording integer snapshot values.
type Int64Gauge struct { type Int64Gauge struct {
vec *prometheus.GaugeVec vec *prometheus.GaugeVec
labelNames []string
droppedSamplesCounter prometheus.Counter
} }
// Record sets the gauge to value for the given labels. // Record sets the gauge to value for the given labels.
func (g *Int64Gauge) Record(_ context.Context, value int64, labels map[string]string) { func (g *Int64Gauge) Record(_ context.Context, value int64, labels map[string]string) {
normalized, ok := normalizeLabels(g.labelNames, labels, g.droppedSamplesCounter) g.vec.With(prometheus.Labels(labels)).Set(float64(value))
if !ok {
return
}
defer guardMetricPanic("int64-gauge", g.labelNames, labels)
g.vec.With(normalized).Set(float64(value))
} }
// Float64Gauge is a native Prometheus gauge recording float snapshot values. // Float64Gauge is a native Prometheus gauge recording float snapshot values.
type Float64Gauge struct { type Float64Gauge struct {
vec *prometheus.GaugeVec vec *prometheus.GaugeVec
labelNames []string
droppedSamplesCounter prometheus.Counter
} }
// Record sets the gauge to value for the given labels. // Record sets the gauge to value for the given labels.
func (g *Float64Gauge) Record(_ context.Context, value float64, labels map[string]string) { func (g *Float64Gauge) Record(_ context.Context, value float64, labels map[string]string) {
normalized, ok := normalizeLabels(g.labelNames, labels, g.droppedSamplesCounter) g.vec.With(prometheus.Labels(labels)).Set(value)
if !ok {
return
}
defer guardMetricPanic("float64-gauge", g.labelNames, labels)
g.vec.With(normalized).Set(value)
} }
// Histogram is a native Prometheus histogram instrument. // Histogram is a native Prometheus histogram instrument.
type Histogram struct { type Histogram struct {
vec *prometheus.HistogramVec vec *prometheus.HistogramVec
labelNames []string
droppedSamplesCounter prometheus.Counter
} }
// Record observes value for the given labels. // Record observes value for the given labels.
func (h *Histogram) Record(_ context.Context, value float64, labels map[string]string) { func (h *Histogram) Record(_ context.Context, value float64, labels map[string]string) {
normalized, ok := normalizeLabels(h.labelNames, labels, h.droppedSamplesCounter) h.vec.With(prometheus.Labels(labels)).Observe(value)
if !ok {
return
}
defer guardMetricPanic("histogram", h.labelNames, labels)
h.vec.With(normalized).Observe(value)
}
func normalizeLabels(labelNames []string, labels map[string]string, droppedSamplesCounter prometheus.Counter) (prometheus.Labels, bool) {
if len(labelNames) == 0 {
if len(labels) > 0 {
if droppedSamplesCounter != nil {
droppedSamplesCounter.Inc()
}
log.Printf("WARN: dropping metric sample due to unexpected labels: got=%v expected=none", labels)
return nil, false
}
return nil, true
}
normalized := make(prometheus.Labels, len(labelNames))
for _, name := range labelNames {
normalized[name] = ""
}
for k, v := range labels {
if _, ok := normalized[k]; !ok {
if droppedSamplesCounter != nil {
droppedSamplesCounter.Inc()
}
log.Printf("WARN: dropping metric sample due to unexpected label key %q (expected=%v)", k, labelNames)
return nil, false
}
normalized[k] = v
}
return normalized, true
}
func guardMetricPanic(kind string, expected []string, labels map[string]string) {
if recovered := recover(); recovered != nil {
log.Printf("WARN: dropped %s metric sample due to label panic: expected=%v got=%v err=%v", kind, expected, labels, recovered)
}
} }

78
internal/observability/prometheus/backend_test.go
View File

@@ -36,10 +36,7 @@ func TestPrometheusBackendShutdown(t *testing.T) {
func TestPrometheusBackendCounter(t *testing.T) { func TestPrometheusBackendCounter(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
c, err := b.NewCounter("test_counter_total", "A test counter", "result") c := b.NewCounter("test_counter_total", "A test counter", "result")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
c.Add(context.Background(), 3, map[string]string{"result": "ok"}) c.Add(context.Background(), 3, map[string]string{"result": "ok"})
body := scrapeMetrics(t, b) body := scrapeMetrics(t, b)
@@ -48,10 +45,7 @@ func TestPrometheusBackendCounter(t *testing.T) {
func TestPrometheusBackendUpDownCounter(t *testing.T) { func TestPrometheusBackendUpDownCounter(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
u, err := b.NewUpDownCounter("test_gauge_total", "A test up-down counter", "state") u := b.NewUpDownCounter("test_gauge_total", "A test up-down counter", "state")
if err != nil {
t.Fatalf("NewUpDownCounter returned error: %v", err)
}
u.Add(context.Background(), 5, map[string]string{"state": "active"}) u.Add(context.Background(), 5, map[string]string{"state": "active"})
u.Add(context.Background(), -2, map[string]string{"state": "active"}) u.Add(context.Background(), -2, map[string]string{"state": "active"})
@@ -61,10 +55,7 @@ func TestPrometheusBackendUpDownCounter(t *testing.T) {
func TestPrometheusBackendInt64Gauge(t *testing.T) { func TestPrometheusBackendInt64Gauge(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
g, err := b.NewInt64Gauge("test_int_gauge", "An integer gauge", "ifname") g := b.NewInt64Gauge("test_int_gauge", "An integer gauge", "ifname")
if err != nil {
t.Fatalf("NewInt64Gauge returned error: %v", err)
}
g.Record(context.Background(), 42, map[string]string{"ifname": "wg0"}) g.Record(context.Background(), 42, map[string]string{"ifname": "wg0"})
body := scrapeMetrics(t, b) body := scrapeMetrics(t, b)
@@ -73,10 +64,7 @@ func TestPrometheusBackendInt64Gauge(t *testing.T) {
func TestPrometheusBackendFloat64Gauge(t *testing.T) { func TestPrometheusBackendFloat64Gauge(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
g, err := b.NewFloat64Gauge("test_float_gauge", "A float gauge", "cert") g := b.NewFloat64Gauge("test_float_gauge", "A float gauge", "cert")
if err != nil {
t.Fatalf("NewFloat64Gauge returned error: %v", err)
}
g.Record(context.Background(), 7.5, map[string]string{"cert": "example.com"}) g.Record(context.Background(), 7.5, map[string]string{"cert": "example.com"})
body := scrapeMetrics(t, b) body := scrapeMetrics(t, b)
@@ -86,10 +74,7 @@ func TestPrometheusBackendFloat64Gauge(t *testing.T) {
func TestPrometheusBackendHistogram(t *testing.T) { func TestPrometheusBackendHistogram(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
buckets := []float64{0.1, 0.5, 1.0, 5.0} buckets := []float64{0.1, 0.5, 1.0, 5.0}
h, err := b.NewHistogram("test_duration_seconds", "A test histogram", buckets, "method") h := b.NewHistogram("test_duration_seconds", "A test histogram", buckets, "method")
if err != nil {
t.Fatalf("NewHistogram returned error: %v", err)
}
h.Record(context.Background(), 0.3, map[string]string{"method": "GET"}) h.Record(context.Background(), 0.3, map[string]string{"method": "GET"})
body := scrapeMetrics(t, b) body := scrapeMetrics(t, b)
@@ -100,10 +85,7 @@ func TestPrometheusBackendHistogram(t *testing.T) {
func TestPrometheusBackendMultipleLabels(t *testing.T) { func TestPrometheusBackendMultipleLabels(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
c, err := b.NewCounter("multi_label_total", "Multi-label counter", "method", "route", "status_code") c := b.NewCounter("multi_label_total", "Multi-label counter", "method", "route", "status_code")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
c.Add(context.Background(), 1, map[string]string{ c.Add(context.Background(), 1, map[string]string{
"method": "POST", "method": "POST",
"route": "/api/peers", "route": "/api/peers",
@@ -140,29 +122,23 @@ func TestPrometheusBackendNoGoMetrics(t *testing.T) {
func TestPrometheusBackendNilLabels(t *testing.T) { func TestPrometheusBackendNilLabels(t *testing.T) {
// Adding with nil labels should not panic (treated as empty map). // Adding with nil labels should not panic (treated as empty map).
b := newTestBackend(t) b := newTestBackend(t)
c, err := b.NewCounter("nil_labels_total", "counter with no labels") c := b.NewCounter("nil_labels_total", "counter with no labels")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
// nil labels with no label names declared should be safe // nil labels with no label names declared should be safe
c.Add(context.Background(), 1, nil) c.Add(context.Background(), 1, nil)
} }
func TestPrometheusBackendConcurrentAdd(t *testing.T) { func TestPrometheusBackendConcurrentAdd(t *testing.T) {
b := newTestBackend(t) b := newTestBackend(t)
c, err := b.NewCounter("concurrent_total", "concurrent counter", "worker") c := b.NewCounter("concurrent_total", "concurrent counter", "worker")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
done := make(chan struct{}) done := make(chan struct{})
for i := 0; i < 10; i++ { for i := 0; i < 10; i++ {
go func() { go func(_ int) {
for j := 0; j < 100; j++ { for j := 0; j < 100; j++ {
c.Add(context.Background(), 1, map[string]string{"worker": "w"}) c.Add(context.Background(), 1, map[string]string{"worker": "w"})
} }
done <- struct{}{} done <- struct{}{}
}() }(i)
} }
for i := 0; i < 10; i++ { for i := 0; i < 10; i++ {
<-done <-done
@@ -172,40 +148,6 @@ func TestPrometheusBackendConcurrentAdd(t *testing.T) {
assertMetricPresent(t, body, `concurrent_total{worker="w"} 1000`) assertMetricPresent(t, body, `concurrent_total{worker="w"} 1000`)
} }
func TestPrometheusBackendAlreadyRegisteredCounter(t *testing.T) {
b := newTestBackend(t)
c1, err := b.NewCounter("dupe_counter_total", "duplicate counter", "result")
if err != nil {
t.Fatalf("first NewCounter returned error: %v", err)
}
c2, err := b.NewCounter("dupe_counter_total", "duplicate counter", "result")
if err != nil {
t.Fatalf("second NewCounter returned error: %v", err)
}
c1.Add(context.Background(), 1, map[string]string{"result": "ok"})
c2.Add(context.Background(), 2, map[string]string{"result": "ok"})
body := scrapeMetrics(t, b)
assertMetricPresent(t, body, `dupe_counter_total{result="ok"} 3`)
}
func TestPrometheusBackendInvalidLabelsNoPanic(t *testing.T) {
b := newTestBackend(t)
c, err := b.NewCounter("invalid_labels_total", "invalid labels test", "result")
if err != nil {
t.Fatalf("NewCounter returned error: %v", err)
}
// Extra label key should be dropped and must not panic.
c.Add(context.Background(), 5, map[string]string{"result": "ok", "unexpected": "x"})
body := scrapeMetrics(t, b)
if strings.Contains(body, `invalid_labels_total{result="ok"}`) {
t.Error("invalid label sample should have been dropped")
}
}
// --- helpers --- // --- helpers ---
func scrapeMetrics(t *testing.T, b *obsprom.Backend) string { func scrapeMetrics(t *testing.T, b *obsprom.Backend) string {

287
main.go
View File

@@ -3,7 +3,6 @@ package main
import ( import (
"bytes" "bytes"
"context" "context"
"crypto/tls"
"encoding/json" "encoding/json"
"errors" "errors"
"flag" "flag"
@@ -12,12 +11,10 @@ import (
"log" "log"
"net" "net"
"net/http" "net/http"
"net/http/httputil"
_ "net/http/pprof" _ "net/http/pprof"
"os" "os"
"os/exec" "os/exec"
"os/signal" "os/signal"
"path/filepath"
"runtime" "runtime"
"runtime/pprof" "runtime/pprof"
"strconv" "strconv"
@@ -49,7 +46,6 @@ var (
doTrafficShaping bool doTrafficShaping bool
bandwidthLimit string bandwidthLimit string
ifbName string // IFB device name for ingress traffic shaping ifbName string // IFB device name for ingress traffic shaping
disableFirewall bool
) )
type WgConfig struct { type WgConfig struct {
@@ -106,144 +102,6 @@ type UpdateDestinationsRequest struct {
Destinations []relay.PeerDestination `json:"destinations"` Destinations []relay.PeerDestination `json:"destinations"`
} }
// pangolinDestHeader carries the downstream host:port (reachable over the
// WireGuard interface) that a /router request should be rewritten to,
// optionally prefixed with a scheme (e.g. "https://100.96.128.1:443"). It is
// stripped before the request is forwarded.
const pangolinDestHeader = "p-dest-header"
// pangolinHostHeader optionally carries the Host header value that should be
// sent to the destination, when it differs from pangolinDestHeader (e.g. the
// target's configured IP/hostname rather than the WireGuard routing
// address). It is stripped before the request is forwarded. When absent,
// the destination from pangolinDestHeader is used as the Host header, same
// as before.
const pangolinHostHeader = "p-dest-host-header"
// splitDestHeader separates an optional "scheme://" prefix from a
// pangolinDestHeader value, defaulting to "http" when none is present.
func splitDestHeader(dest string) (scheme, host string) {
if s, rest, ok := strings.Cut(dest, "://"); ok {
return s, rest
}
return "http", dest
}
// hostname strips an optional ":port" suffix from a host header value.
func hostname(hostport string) string {
if h, _, err := net.SplitHostPort(hostport); err == nil {
return h
}
return hostport
}
// routerSNIContextKey carries the TLS ServerName (SNI) that
// routerTransport's DialTLSContext should present, since we dial the
// WireGuard destination IP but the remote end typically terminates TLS
// based on the original hostname (pangolinHostHeader), not that IP.
type routerSNIContextKey struct{}
// routerTransport is routerProxy's RoundTripper. It mirrors
// http.DefaultTransport except for TLS dials, where it sets the SNI from
// routerSNIContextKey instead of letting it default to the dial address
// (the WireGuard IP), which the destination's TLS termination won't have a
// matching certificate/route for.
var routerTransport = &http.Transport{
Proxy: http.ProxyFromEnvironment,
DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
serverName := hostname(addr)
if sni, ok := ctx.Value(routerSNIContextKey{}).(string); ok && sni != "" {
serverName = sni
}
dialer := &tls.Dialer{Config: &tls.Config{ServerName: serverName}}
return dialer.DialContext(ctx, network, addr)
},
}
// logDebugRequest dumps a request's destination, headers, and body at debug
// level for troubleshooting (e.g. verifying an auth header made it through
// the proxy chain intact). It reads and restores req.Body so the request can
// still be sent afterward. Header values (including secrets like API keys)
// are logged as-is - only intended to be enabled for local troubleshooting.
func logDebugRequest(label string, req *http.Request) {
var headerLines strings.Builder
for name, values := range req.Header {
for _, v := range values {
fmt.Fprintf(&headerLines, "\n %s: %s", name, v)
}
}
body := []byte("<empty>")
if req.Body != nil {
data, err := io.ReadAll(req.Body)
req.Body.Close()
if err != nil {
logger.Error("%s: failed to read body for logging: %v", label, err)
} else {
body = data
}
req.Body = io.NopCloser(bytes.NewReader(data))
}
logger.Debug("%s: %s %s://%s%s headers:%s\nbody: %s", label, req.Method, req.URL.Scheme, req.Host, req.URL.RequestURI(), headerLines.String(), body)
}
// routerProxy forwards /router/* requests from the Pangolin AI gateway to a
// destination on the WireGuard network, as named by pangolinDestHeader.
// Used for proxying AI chat completion requests (incl. streaming) to
// providers reachable only from a site.
var routerProxy = &httputil.ReverseProxy{
Rewrite: func(pr *httputil.ProxyRequest) {
scheme, dest := splitDestHeader(pr.In.Header.Get(pangolinDestHeader))
pr.Out.URL.Scheme = scheme
pr.Out.URL.Host = dest
pr.Out.URL.Path = strings.TrimPrefix(pr.In.URL.Path, "/router")
if !strings.HasPrefix(pr.Out.URL.Path, "/") {
pr.Out.URL.Path = "/" + pr.Out.URL.Path
}
pr.Out.URL.RawPath = ""
pr.Out.Host = dest
if hostOverride := pr.In.Header.Get(pangolinHostHeader); hostOverride != "" {
pr.Out.Host = hostOverride
ctx := context.WithValue(pr.Out.Context(), routerSNIContextKey{}, hostname(hostOverride))
pr.Out = pr.Out.WithContext(ctx)
}
pr.Out.Header.Del(pangolinDestHeader)
pr.Out.Header.Del(pangolinHostHeader)
logger.Debug("Router proxy: %s %s -> %s (Host: %s)", pr.In.Method, pr.In.URL.Path, pr.Out.URL.String(), pr.Out.Host)
logDebugRequest("Router outbound request", pr.Out)
},
Transport: routerTransport,
// Flush written bytes to the client immediately rather than buffering,
// which is required for SSE-based streaming chat completions.
FlushInterval: -1,
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
logger.Error("Router proxy error for %s: %v", r.URL.Path, err)
http.Error(w, "Bad gateway", http.StatusBadGateway)
},
}
func handleRouter(w http.ResponseWriter, r *http.Request) {
dest := r.Header.Get(pangolinDestHeader)
hostOverride := r.Header.Get(pangolinHostHeader)
logger.Debug("Router request received: %s %s dest=%s host=%s remote=%s", r.Method, r.URL.Path, dest, hostOverride, r.RemoteAddr)
if dest == "" {
http.Error(w, fmt.Sprintf("Missing %s header", pangolinDestHeader), http.StatusBadRequest)
return
}
_, host := splitDestHeader(dest)
if _, _, err := net.SplitHostPort(host); err != nil {
http.Error(w, "Invalid destination", http.StatusBadRequest)
return
}
routerProxy.ServeHTTP(w, r)
}
// httpMetricsMiddleware wraps HTTP handlers with metrics tracking // httpMetricsMiddleware wraps HTTP handlers with metrics tracking
func httpMetricsMiddleware(endpoint string, handler http.HandlerFunc) http.HandlerFunc { func httpMetricsMiddleware(endpoint string, handler http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) { return func(w http.ResponseWriter, r *http.Request) {
@@ -273,16 +131,6 @@ func (w *responseWriterWrapper) WriteHeader(statusCode int) {
w.ResponseWriter.WriteHeader(statusCode) w.ResponseWriter.WriteHeader(statusCode)
} }
// Unwrap exposes the underlying ResponseWriter so http.ResponseController
// (used by httputil.ReverseProxy's streaming Flush, and by Hijack/Push
// callers) can see through this wrapper to the real http.Flusher etc.
// Without this, ReverseProxy's flushes on /router/* silently no-op and
// streamed responses (e.g. SSE) get buffered until the response completes
// instead of being forwarded incrementally.
func (w *responseWriterWrapper) Unwrap() http.ResponseWriter {
return w.ResponseWriter
}
func parseLogLevel(level string) logger.LogLevel { func parseLogLevel(level string) logger.LogLevel {
switch strings.ToUpper(level) { switch strings.ToUpper(level) {
case "DEBUG": case "DEBUG":
@@ -301,6 +149,8 @@ func parseLogLevel(level string) logger.LogLevel {
} }
func main() { func main() {
go monitorMemory(1024 * 1024 * 512) // trigger if memory usage exceeds 512MB
var ( var (
err error err error
wgconfig WgConfig wgconfig WgConfig
@@ -325,7 +175,6 @@ func main() {
otelMetricsEndpoint string otelMetricsEndpoint string
otelMetricsInsecure bool otelMetricsInsecure bool
otelMetricsExportInterval time.Duration otelMetricsExportInterval time.Duration
otelMetricsTimeout time.Duration
) )
interfaceName = os.Getenv("INTERFACE") interfaceName = os.Getenv("INTERFACE")
@@ -346,7 +195,6 @@ func main() {
proxyProtocolStr := os.Getenv("PROXY_PROTOCOL") proxyProtocolStr := os.Getenv("PROXY_PROTOCOL")
doTrafficShapingStr := os.Getenv("DO_TRAFFIC_SHAPING") doTrafficShapingStr := os.Getenv("DO_TRAFFIC_SHAPING")
bandwidthLimitStr := os.Getenv("BANDWIDTH_LIMIT") bandwidthLimitStr := os.Getenv("BANDWIDTH_LIMIT")
disableFirewallStr := os.Getenv("DISABLE_FIREWALL")
// Read metrics env vars (defaults applied by DefaultMetricsConfig; these override defaults). // Read metrics env vars (defaults applied by DefaultMetricsConfig; these override defaults).
metricsEnabled = true // default metricsEnabled = true // default
@@ -381,14 +229,6 @@ func main() {
log.Printf("WARN: invalid OTEL_METRICS_EXPORT_INTERVAL=%q: %v", v, err2) log.Printf("WARN: invalid OTEL_METRICS_EXPORT_INTERVAL=%q: %v", v, err2)
} }
} }
otelMetricsTimeout = 10 * time.Second // default
if v := os.Getenv("OTEL_METRICS_TIMEOUT"); v != "" {
if d, err2 := time.ParseDuration(v); err2 == nil {
otelMetricsTimeout = d
} else {
log.Printf("WARN: invalid OTEL_METRICS_TIMEOUT=%q: %v", v, err2)
}
}
if interfaceName == "" { if interfaceName == "" {
flag.StringVar(&interfaceName, "interface", "wg0", "Name of the WireGuard interface") flag.StringVar(&interfaceName, "interface", "wg0", "Name of the WireGuard interface")
@@ -467,13 +307,6 @@ func main() {
flag.BoolVar(&doTrafficShaping, "do-traffic-shaping", false, "Whether to set up traffic shaping rules for peers (requires tc command and root privileges)") flag.BoolVar(&doTrafficShaping, "do-traffic-shaping", false, "Whether to set up traffic shaping rules for peers (requires tc command and root privileges)")
} }
if disableFirewallStr != "" {
disableFirewall = strings.ToLower(disableFirewallStr) == "true"
}
if disableFirewallStr == "" {
flag.BoolVar(&disableFirewall, "disable-firewall", false, "Disable WireGuard firewall rules to allow all inbound traffic on the interface")
}
if bandwidthLimitStr != "" { if bandwidthLimitStr != "" {
bandwidthLimit = bandwidthLimitStr bandwidthLimit = bandwidthLimitStr
} }
@@ -489,19 +322,9 @@ func main() {
flag.StringVar(&otelMetricsEndpoint, "otel-metrics-endpoint", otelMetricsEndpoint, "OTLP collector endpoint (e.g. localhost:4317)") flag.StringVar(&otelMetricsEndpoint, "otel-metrics-endpoint", otelMetricsEndpoint, "OTLP collector endpoint (e.g. localhost:4317)")
flag.BoolVar(&otelMetricsInsecure, "otel-metrics-insecure", otelMetricsInsecure, "Disable TLS for OTLP connection") flag.BoolVar(&otelMetricsInsecure, "otel-metrics-insecure", otelMetricsInsecure, "Disable TLS for OTLP connection")
flag.DurationVar(&otelMetricsExportInterval, "otel-metrics-export-interval", otelMetricsExportInterval, "Interval between OTLP metric pushes") flag.DurationVar(&otelMetricsExportInterval, "otel-metrics-export-interval", otelMetricsExportInterval, "Interval between OTLP metric pushes")
flag.DurationVar(&otelMetricsTimeout, "otel-metrics-timeout", otelMetricsTimeout, "Timeout for OTLP exporter setup")
flag.Parse() flag.Parse()
// Heap profiles are dumped into the configured config directory (the same
// directory as the config file, or /var/config as a fallback for remote-config
// setups) so they land on the volume the operator actually has mounted.
heapDir := "/var/config/heap"
if configFile != "" {
heapDir = filepath.Join(filepath.Dir(configFile), "heap")
}
go monitorMemory(1024*1024*512, heapDir) // trigger if memory usage exceeds 512MB
// Derive IFB device name from the WireGuard interface name (Linux limit: 15 chars) // Derive IFB device name from the WireGuard interface name (Linux limit: 15 chars)
ifbName = "ifb_" + interfaceName ifbName = "ifb_" + interfaceName
if len(ifbName) > 15 { if len(ifbName) > 15 {
@@ -524,7 +347,6 @@ func main() {
Endpoint: otelMetricsEndpoint, Endpoint: otelMetricsEndpoint,
Insecure: otelMetricsInsecure, Insecure: otelMetricsInsecure,
ExportInterval: otelMetricsExportInterval, ExportInterval: otelMetricsExportInterval,
Timeout: otelMetricsTimeout,
}, },
ServiceName: "gerbil", ServiceName: "gerbil",
ServiceVersion: "1.0.0", ServiceVersion: "1.0.0",
@@ -579,12 +401,9 @@ func main() {
logger.Fatal("You must provide either a config file or a remote config URL, not both") logger.Fatal("You must provide either a config file or a remote config URL, not both")
} }
// clean up the remote config URL for backwards compatibility // clean up the reomte config URL for backwards compatibility
remoteConfigURL = strings.TrimRight(remoteConfigURL, "/")
remoteConfigURL = strings.TrimSuffix(remoteConfigURL, "/gerbil/get-config") remoteConfigURL = strings.TrimSuffix(remoteConfigURL, "/gerbil/get-config")
remoteConfigURL = strings.TrimSuffix(remoteConfigURL, "/gerbil/receive-bandwidth") remoteConfigURL = strings.TrimSuffix(remoteConfigURL, "/")
remoteConfigURL = strings.TrimSuffix(remoteConfigURL, "/gerbil")
remoteConfigURL = strings.TrimRight(remoteConfigURL, "/")
var key wgtypes.Key var key wgtypes.Key
// if generateAndSaveKeyTo is provided, generate a private key and save it to the file. if the file already exists, load the key from the file // if generateAndSaveKeyTo is provided, generate a private key and save it to the file. if the file already exists, load the key from the file
@@ -721,12 +540,9 @@ func main() {
http.HandleFunc("/update-destinations", httpMetricsMiddleware("update_destinations", handleUpdateDestinations)) http.HandleFunc("/update-destinations", httpMetricsMiddleware("update_destinations", handleUpdateDestinations))
http.HandleFunc("/update-local-snis", httpMetricsMiddleware("update_local_snis", handleUpdateLocalSNIs)) http.HandleFunc("/update-local-snis", httpMetricsMiddleware("update_local_snis", handleUpdateLocalSNIs))
http.HandleFunc("/healthz", httpMetricsMiddleware("healthz", handleHealthz)) http.HandleFunc("/healthz", httpMetricsMiddleware("healthz", handleHealthz))
http.HandleFunc("/router/", httpMetricsMiddleware("router", handleRouter))
// Register metrics endpoint only for Prometheus backend. // Register metrics endpoint only for Prometheus backend.
// OTel backend pushes to a collector; no /metrics endpoint needed. // OTel backend pushes to a collector; no /metrics endpoint needed.
// Note: metricsPath is registered directly without httpMetricsMiddleware to prevent infinite recursion.
// The metricsHandler must not be wrapped by the middleware, as it would observe its own observation calls.
if metricsHandler != nil { if metricsHandler != nil {
http.Handle(metricsPath, metricsHandler) http.Handle(metricsPath, metricsHandler)
logger.Info("Metrics endpoint enabled at %s", metricsPath) logger.Info("Metrics endpoint enabled at %s", metricsPath)
@@ -903,9 +719,7 @@ func ensureWireguardInterface(wgconfig WgConfig) error {
logger.Warn("Failed to ensure MSS clamping: %v", err) logger.Warn("Failed to ensure MSS clamping: %v", err)
} }
if disableFirewall { if err := ensureWireguardFirewall(); err != nil {
logger.Warn("Firewall disabled: all inbound traffic on %s will be allowed", interfaceName)
} else if err := ensureWireguardFirewall(wgconfig.IpAddress); err != nil {
logger.Warn("Failed to ensure WireGuard firewall rules: %v", err) logger.Warn("Failed to ensure WireGuard firewall rules: %v", err)
} }
@@ -1081,18 +895,11 @@ func ensureMSSClamping() error {
return nil return nil
} }
func ensureWireguardFirewall(localIpAddress string) error { func ensureWireguardFirewall() error {
// Rules to enforce: // Rules to enforce:
// 1. Allow established/related connections (responses to our outbound traffic) // 1. Allow established/related connections (responses to our outbound traffic)
// 2. Allow ICMP ping packets // 2. Allow ICMP ping packets
// 3. Allow inbound traffic to ports 80/443 on the local IP only (for Traefik) // 3. Drop all other inbound traffic from peers
// 4. Drop all other inbound traffic from peers
// Strip any CIDR suffix so we're left with just the host IP
localIp := localIpAddress
if ip, _, err := net.ParseCIDR(localIpAddress); err == nil {
localIp = ip.String()
}
// Define the rules we want to ensure exist // Define the rules we want to ensure exist
rules := [][]string{ rules := [][]string{
@@ -1112,24 +919,6 @@ func ensureWireguardFirewall(localIpAddress string) error {
"--icmp-type", "8", "--icmp-type", "8",
"-j", "ACCEPT", "-j", "ACCEPT",
}, },
// Allow inbound HTTP to the local IP only (for Traefik)
{
"-A", "INPUT",
"-i", interfaceName,
"-p", "tcp",
"--dport", "80",
"-d", localIp,
"-j", "ACCEPT",
},
// Allow inbound HTTPS to the local IP only (for Traefik)
{
"-A", "INPUT",
"-i", interfaceName,
"-p", "tcp",
"--dport", "443",
"-d", localIp,
"-j", "ACCEPT",
},
// Drop all other inbound traffic from WireGuard interface // Drop all other inbound traffic from WireGuard interface
{ {
"-A", "INPUT", "-A", "INPUT",
@@ -1373,12 +1162,10 @@ func removePeerInternal(publicKey string) error {
// Get current peer info before removing to clear relay connections and bandwidth limits // Get current peer info before removing to clear relay connections and bandwidth limits
var wgIPs []string var wgIPs []string
allowedIPsCount := 0
device, err := wgClient.Device(interfaceName) device, err := wgClient.Device(interfaceName)
if err == nil { if err == nil {
for _, peer := range device.Peers { for _, peer := range device.Peers {
if peer.PublicKey.String() == publicKey { if peer.PublicKey.String() == publicKey {
allowedIPsCount = len(peer.AllowedIPs)
// Extract WireGuard IPs from this peer's allowed IPs // Extract WireGuard IPs from this peer's allowed IPs
for _, allowedIP := range peer.AllowedIPs { for _, allowedIP := range peer.AllowedIPs {
wgIPs = append(wgIPs, allowedIP.IP.String()) wgIPs = append(wgIPs, allowedIP.IP.String())
@@ -1421,7 +1208,7 @@ func removePeerInternal(publicKey string) error {
// Record metrics // Record metrics
metrics.RecordPeersTotal(interfaceName, -1) metrics.RecordPeersTotal(interfaceName, -1)
metrics.RecordAllowedIPsCount(interfaceName, publicKey, -int64(allowedIPsCount)) metrics.RecordAllowedIPsCount(interfaceName, publicKey, -int64(len(wgIPs)))
return nil return nil
} }
@@ -1691,24 +1478,6 @@ func calculatePeerBandwidth() ([]PeerBandwidth, error) {
return peerBandwidths, nil return peerBandwidths, nil
} }
// defaultBandwidthReportBatchSize caps how many peer bandwidth readings are
// sent in a single POST. Reporting every peer in one request grows unbounded
// with fleet size and can exceed the remote server's request body limit,
// which surfaces as "413 Payload Too Large" and silently drops that whole
// report cycle. Overridable via GERBIL_BANDWIDTH_BATCH_SIZE.
const defaultBandwidthReportBatchSize = 250
var bandwidthReportBatchSize = loadBandwidthReportBatchSize()
func loadBandwidthReportBatchSize() int {
if v := os.Getenv("GERBIL_BANDWIDTH_BATCH_SIZE"); v != "" {
if n, err := strconv.Atoi(v); err == nil && n > 0 {
return n
}
}
return defaultBandwidthReportBatchSize
}
func reportPeerBandwidth(apiURL string) error { func reportPeerBandwidth(apiURL string) error {
bandwidths, err := calculatePeerBandwidth() bandwidths, err := calculatePeerBandwidth()
if err != nil { if err != nil {
@@ -1717,47 +1486,26 @@ func reportPeerBandwidth(apiURL string) error {
return fmt.Errorf("failed to calculate peer bandwidth: %v", err) return fmt.Errorf("failed to calculate peer bandwidth: %v", err)
} }
if len(bandwidths) == 0 { jsonData, err := json.Marshal(bandwidths)
return nil
}
var batchErrs []error
for start := 0; start < len(bandwidths); start += bandwidthReportBatchSize {
end := start + bandwidthReportBatchSize
if end > len(bandwidths) {
end = len(bandwidths)
}
if err := sendPeerBandwidthBatch(apiURL, bandwidths[start:end]); err != nil {
metrics.RecordBandwidthReport("error")
batchErrs = append(batchErrs, err)
continue
}
metrics.RecordBandwidthReport("success")
}
if len(batchErrs) > 0 {
return fmt.Errorf("failed to report %d bandwidth batch(es): %w", len(batchErrs), errors.Join(batchErrs...))
}
return nil
}
func sendPeerBandwidthBatch(apiURL string, batch []PeerBandwidth) error {
jsonData, err := json.Marshal(batch)
if err != nil { if err != nil {
metrics.RecordBandwidthReport("error")
return fmt.Errorf("failed to marshal bandwidth data: %v", err) return fmt.Errorf("failed to marshal bandwidth data: %v", err)
} }
resp, err := http.Post(apiURL, "application/json", bytes.NewBuffer(jsonData)) resp, err := http.Post(apiURL, "application/json", bytes.NewBuffer(jsonData))
if err != nil { if err != nil {
metrics.RecordBandwidthReport("error")
return fmt.Errorf("failed to send bandwidth data: %v", err) return fmt.Errorf("failed to send bandwidth data: %v", err)
} }
defer resp.Body.Close() defer resp.Body.Close()
if resp.StatusCode != http.StatusOK { if resp.StatusCode != http.StatusOK {
metrics.RecordBandwidthReport("error")
return fmt.Errorf("API returned non-OK status: %s", resp.Status) return fmt.Errorf("API returned non-OK status: %s", resp.Status)
} }
// Record successful bandwidth report
metrics.RecordBandwidthReport("success")
return nil return nil
} }
@@ -1786,7 +1534,7 @@ func notifyPeerChange(action, publicKey string) {
} }
} }
func monitorMemory(limit uint64, heapDir string) { func monitorMemory(limit uint64) {
var m runtime.MemStats var m runtime.MemStats
for { for {
runtime.ReadMemStats(&m) runtime.ReadMemStats(&m)
@@ -1802,9 +1550,8 @@ func monitorMemory(limit uint64, heapDir string) {
// Record memory spike metric // Record memory spike metric
metrics.RecordMemorySpike(severity) metrics.RecordMemorySpike(severity)
if err := os.MkdirAll(heapDir, 0o755); err != nil { f, err := os.Create(fmt.Sprintf("/var/config/heap/heap-spike-%d.pprof", time.Now().Unix()))
log.Println("could not create heap profile directory:", err) if err != nil {
} else if f, err := os.Create(filepath.Join(heapDir, fmt.Sprintf("heap-spike-%d.pprof", time.Now().Unix()))); err != nil {
log.Println("could not create profile:", err) log.Println("could not create profile:", err)
} else { } else {
pprof.WriteHeapProfile(f) pprof.WriteHeapProfile(f)

224
proxy/proxy.go
View File

@@ -11,58 +11,17 @@ import (
"log" "log"
"net" "net"
"net/http" "net/http"
"os"
"strconv" "strconv"
"strings" "strings"
"sync" "sync"
"sync/atomic"
"time" "time"
"github.com/fosrl/gerbil/internal/metrics" "github.com/fosrl/gerbil/internal/metrics"
"github.com/fosrl/gerbil/logger" "github.com/fosrl/gerbil/logger"
"github.com/patrickmn/go-cache" "github.com/patrickmn/go-cache"
"golang.org/x/sync/errgroup"
) )
// defaultMaxSNIConnections caps the number of concurrent client connections
// the SNI proxy will accept. Without a cap, a burst of connections (a
// scanner sweep, a client reconnect storm) spawns unbounded goroutines each
// holding copy buffers and sockets, exhausting container memory faster than
// GC/backpressure can catch up.
// Sized conservatively since each connection now holds up to two pooled
// 32KB copy buffers once the buffer pool is actually honored (see
// bufferedReader/bufferedWriter below). Overridable via
// GERBIL_MAX_SNI_CONNECTIONS.
const defaultMaxSNIConnections = 4096
var maxSNIConnections = loadMaxSNIConnections()
func loadMaxSNIConnections() int64 {
if v := os.Getenv("GERBIL_MAX_SNI_CONNECTIONS"); v != "" {
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
return n
}
}
return defaultMaxSNIConnections
}
// defaultMaxSNIConnectionsPerIP caps concurrent connections from a single
// source IP, independent of the global maxSNIConnections budget. Without
// this, one noisy/misbehaving client (or a single scanning host) can
// consume the entire global budget and lock out every other customer
// sharing this proxy. Overridable via GERBIL_MAX_SNI_CONNECTIONS_PER_IP.
const defaultMaxSNIConnectionsPerIP = 256
var maxSNIConnectionsPerIP = loadMaxSNIConnectionsPerIP()
func loadMaxSNIConnectionsPerIP() int64 {
if v := os.Getenv("GERBIL_MAX_SNI_CONNECTIONS_PER_IP"); v != "" {
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
return n
}
}
return defaultMaxSNIConnectionsPerIP
}
// RouteRecord represents a routing configuration // RouteRecord represents a routing configuration
type RouteRecord struct { type RouteRecord struct {
Hostname string Hostname string
@@ -118,22 +77,12 @@ type SNIProxy struct {
// Buffer pool for connection piping // Buffer pool for connection piping
bufferPool *sync.Pool bufferPool *sync.Pool
// activeConnections tracks concurrent client connections so
// acceptConnections can enforce maxSNIConnections.
activeConnections atomic.Int64
// perIPConnections tracks concurrent connections per source IP (map[string]*atomic.Int64)
// so acceptConnections can enforce maxSNIConnectionsPerIP and stop one
// client from starving the rest. Entries are removed once a given IP's
// count returns to zero, so this stays bounded by currently-connected
// distinct IPs (itself bounded by maxSNIConnections) rather than growing
// with every IP ever seen.
perIPConnections sync.Map
} }
type activeTunnel struct { type activeTunnel struct {
conns []net.Conn ctx context.Context
cancel context.CancelFunc
count int // protected by activeTunnelsLock
} }
// readOnlyConn is a wrapper for io.Reader that implements net.Conn // readOnlyConn is a wrapper for io.Reader that implements net.Conn
@@ -512,46 +461,8 @@ func (p *SNIProxy) acceptConnections() {
} }
} }
if p.activeConnections.Load() >= maxSNIConnections {
logger.Debug("Max concurrent SNI connections (%d) reached, rejecting connection from %s", maxSNIConnections, conn.RemoteAddr())
metrics.RecordSNIConnection("rejected_max_connections")
conn.Close()
continue
}
remoteHost, _, err := net.SplitHostPort(conn.RemoteAddr().String())
if err != nil {
remoteHost = conn.RemoteAddr().String()
}
counterVal, _ := p.perIPConnections.LoadOrStore(remoteHost, new(atomic.Int64))
perIPCounter := counterVal.(*atomic.Int64)
if perIPCounter.Load() >= maxSNIConnectionsPerIP {
logger.Debug("Max concurrent SNI connections per IP (%d) reached for %s, rejecting connection", maxSNIConnectionsPerIP, remoteHost)
metrics.RecordSNIConnection("rejected_per_ip_limit")
conn.Close()
continue
}
perIPCounter.Add(1)
p.activeConnections.Add(1)
metrics.RecordSNIActiveConnection(1)
p.wg.Add(1) p.wg.Add(1)
go func() { go p.handleConnection(conn)
defer func() {
if perIPCounter.Add(-1) == 0 {
// Best-effort cleanup: only remove the map entry if it
// still holds this exact counter (a concurrent new
// connection from the same IP may have already bumped
// it back up via LoadOrStore, or replaced it after a
// prior race). Undercounting in that narrow race window
// just means one connection isn't rate-limited briefly,
// never unbounded growth.
p.perIPConnections.CompareAndDelete(remoteHost, counterVal)
}
}()
p.handleConnection(conn)
}()
} }
} }
@@ -599,10 +510,6 @@ func (p *SNIProxy) extractSNI(conn net.Conn) (string, io.Reader, error) {
func (p *SNIProxy) handleConnection(clientConn net.Conn) { func (p *SNIProxy) handleConnection(clientConn net.Conn) {
defer p.wg.Done() defer p.wg.Done()
defer clientConn.Close() defer clientConn.Close()
defer func() {
p.activeConnections.Add(-1)
metrics.RecordSNIActiveConnection(-1)
}()
metrics.RecordSNIConnection("accepted") metrics.RecordSNIConnection("accepted")
@@ -644,7 +551,7 @@ func (p *SNIProxy) handleConnection(clientConn net.Conn) {
logger.Debug("SNI extraction failed: %v", err) logger.Debug("SNI extraction failed: %v", err)
return return
} }
metrics.RecordProxyTLSHandshake(time.Since(clientHelloStart).Seconds()) metrics.RecordProxyTLSHandshake(hostname, time.Since(clientHelloStart).Seconds())
if hostname == "" { if hostname == "" {
log.Println("No SNI hostname found") log.Println("No SNI hostname found")
@@ -692,8 +599,8 @@ func (p *SNIProxy) handleConnection(clientConn net.Conn) {
defer targetConn.Close() defer targetConn.Close()
logger.Debug("Connected to target: %s:%d", route.TargetHost, route.TargetPort) logger.Debug("Connected to target: %s:%d", route.TargetHost, route.TargetPort)
metrics.RecordActiveProxyConnection(1) metrics.RecordActiveProxyConnection(hostname, 1)
defer metrics.RecordActiveProxyConnection(-1) defer metrics.RecordActiveProxyConnection(hostname, -1)
// Send PROXY protocol header if enabled // Send PROXY protocol header if enabled
if p.proxyProtocol { if p.proxyProtocol {
@@ -713,37 +620,32 @@ func (p *SNIProxy) handleConnection(clientConn net.Conn) {
} }
} }
// Track this tunnel by SNI // Track this tunnel by SNI using context for cancellation
p.activeTunnelsLock.Lock() p.activeTunnelsLock.Lock()
tunnel, ok := p.activeTunnels[hostname] tunnel, ok := p.activeTunnels[hostname]
if !ok { if !ok {
tunnel = &activeTunnel{} ctx, cancel := context.WithCancel(p.ctx)
tunnel = &activeTunnel{ctx: ctx, cancel: cancel}
p.activeTunnels[hostname] = tunnel p.activeTunnels[hostname] = tunnel
} }
tunnel.conns = append(tunnel.conns, actualClientConn) tunnel.count++
tunnelCtx := tunnel.ctx
p.activeTunnelsLock.Unlock() p.activeTunnelsLock.Unlock()
defer func() { defer func() {
// Remove this conn from active tunnels
p.activeTunnelsLock.Lock() p.activeTunnelsLock.Lock()
if tunnel, ok := p.activeTunnels[hostname]; ok { tunnel.count--
newConns := make([]net.Conn, 0, len(tunnel.conns)) if tunnel.count == 0 {
for _, c := range tunnel.conns { tunnel.cancel()
if c != actualClientConn { if p.activeTunnels[hostname] == tunnel {
newConns = append(newConns, c)
}
}
if len(newConns) == 0 {
delete(p.activeTunnels, hostname) delete(p.activeTunnels, hostname)
} else {
tunnel.conns = newConns
} }
} }
p.activeTunnelsLock.Unlock() p.activeTunnelsLock.Unlock()
}() }()
// Start bidirectional data transfer // Start bidirectional data transfer with tunnel-level cancellation context.
p.pipe(hostname, actualClientConn, targetConn, clientReader) p.pipe(tunnelCtx, hostname, actualClientConn, targetConn, clientReader)
} }
// getRoute retrieves routing information for a hostname // getRoute retrieves routing information for a hostname
@@ -751,7 +653,7 @@ func (p *SNIProxy) getRoute(hostname, clientAddr string) (*RouteRecord, error) {
// Check local overrides first // Check local overrides first
if _, isOverride := p.localOverrides[hostname]; isOverride { if _, isOverride := p.localOverrides[hostname]; isOverride {
logger.Debug("Local override matched for hostname: %s", hostname) logger.Debug("Local override matched for hostname: %s", hostname)
metrics.RecordProxyRouteLookup("local_override") metrics.RecordProxyRouteLookup("local_override", hostname)
return &RouteRecord{ return &RouteRecord{
Hostname: hostname, Hostname: hostname,
TargetHost: p.localProxyAddr, TargetHost: p.localProxyAddr,
@@ -764,7 +666,7 @@ func (p *SNIProxy) getRoute(hostname, clientAddr string) (*RouteRecord, error) {
_, isLocal := p.localSNIs[hostname] _, isLocal := p.localSNIs[hostname]
p.localSNIsLock.RUnlock() p.localSNIsLock.RUnlock()
if isLocal { if isLocal {
metrics.RecordProxyRouteLookup("local") metrics.RecordProxyRouteLookup("local", hostname)
return &RouteRecord{ return &RouteRecord{
Hostname: hostname, Hostname: hostname,
TargetHost: p.localProxyAddr, TargetHost: p.localProxyAddr,
@@ -775,16 +677,16 @@ func (p *SNIProxy) getRoute(hostname, clientAddr string) (*RouteRecord, error) {
// Check cache first // Check cache first
if cached, found := p.cache.Get(hostname); found { if cached, found := p.cache.Get(hostname); found {
if cached == nil { if cached == nil {
metrics.RecordProxyRouteLookup("cached_not_found") metrics.RecordProxyRouteLookup("cached_not_found", hostname)
return nil, nil // Cached negative result return nil, nil // Cached negative result
} }
logger.Debug("Cache hit for hostname: %s", hostname) logger.Debug("Cache hit for hostname: %s", hostname)
metrics.RecordProxyRouteLookup("cache_hit") metrics.RecordProxyRouteLookup("cache_hit", hostname)
return cached.(*RouteRecord), nil return cached.(*RouteRecord), nil
} }
logger.Debug("Cache miss for hostname: %s, querying API", hostname) logger.Debug("Cache miss for hostname: %s, querying API", hostname)
metrics.RecordProxyRouteLookup("cache_miss") metrics.RecordProxyRouteLookup("cache_miss", hostname)
// Query API with timeout // Query API with timeout
ctx, cancel := context.WithTimeout(p.ctx, 5*time.Second) ctx, cancel := context.WithTimeout(p.ctx, 5*time.Second)
@@ -889,79 +791,49 @@ func (p *SNIProxy) selectStickyEndpoint(clientAddr string, endpoints []string) s
return endpoints[index] return endpoints[index]
} }
// bufferedReader hides any io.WriterTo the wrapped reader implements (e.g.
// io.MultiReader, used by peekClientHello to replay the buffered
// ClientHello ahead of the raw connection). Without this, io.CopyBuffer
// bypasses the caller-supplied buffer entirely and lets WriteTo drive its
// own, uncapped allocations - defeating the point of bufferPool.
type bufferedReader struct {
io.Reader
}
// bufferedWriter hides any io.ReaderFrom the wrapped writer implements (e.g.
// *net.TCPConn's splice/sendfile fast path). Without this, io.CopyBuffer
// bypasses the caller-supplied buffer here too, so each copy allocates and
// manages its own buffer regardless of what's pooled.
type bufferedWriter struct {
io.Writer
}
// pipe handles bidirectional data transfer between connections // pipe handles bidirectional data transfer between connections
func (p *SNIProxy) pipe(hostname string, clientConn, targetConn net.Conn, clientReader io.Reader) { func (p *SNIProxy) pipe(ctx context.Context, hostname string, clientConn, targetConn net.Conn, clientReader io.Reader) {
var wg sync.WaitGroup g, gCtx := errgroup.WithContext(ctx)
wg.Add(2)
// closeOnce ensures we only close connections once // Close connections when context cancels to unblock io.Copy operations
var closeOnce sync.Once context.AfterFunc(gCtx, func() {
closeConns := func() { clientConn.Close()
closeOnce.Do(func() { targetConn.Close()
// Close both connections to unblock any pending reads })
clientConn.Close()
targetConn.Close()
})
}
// Copy data from client to target (using the buffered reader) // Copy data from client to target (using buffered reader and pooled memory).
go func() { g.Go(func() error {
defer wg.Done()
defer closeConns()
// Get buffer from pool and return when done
bufPtr := p.bufferPool.Get().(*[]byte) bufPtr := p.bufferPool.Get().(*[]byte)
defer func() { defer func() {
// Clear buffer before returning to pool to prevent data leakage
clear(*bufPtr) clear(*bufPtr)
p.bufferPool.Put(bufPtr) p.bufferPool.Put(bufPtr)
}() }()
bytesCopied, err := io.CopyBuffer(bufferedWriter{targetConn}, bufferedReader{clientReader}, *bufPtr) bytesCopied, err := io.CopyBuffer(targetConn, clientReader, *bufPtr)
metrics.RecordProxyBytesTransmitted("client_to_target", bytesCopied) metrics.RecordProxyBytesTransmitted(hostname, "client_to_target", bytesCopied)
if err != nil && err != io.EOF { if err != nil && err != io.EOF {
logger.Debug("Copy client->target error: %v", err) logger.Debug("Copy client->target error: %v", err)
} }
}() return err
})
// Copy data from target to client // Copy data from target to client
go func() { g.Go(func() error {
defer wg.Done()
defer closeConns()
// Get buffer from pool and return when done
bufPtr := p.bufferPool.Get().(*[]byte) bufPtr := p.bufferPool.Get().(*[]byte)
defer func() { defer func() {
// Clear buffer before returning to pool to prevent data leakage
clear(*bufPtr) clear(*bufPtr)
p.bufferPool.Put(bufPtr) p.bufferPool.Put(bufPtr)
}() }()
bytesCopied, err := io.CopyBuffer(bufferedWriter{clientConn}, bufferedReader{targetConn}, *bufPtr) bytesCopied, err := io.CopyBuffer(clientConn, targetConn, *bufPtr)
metrics.RecordProxyBytesTransmitted("target_to_client", bytesCopied) metrics.RecordProxyBytesTransmitted(hostname, "target_to_client", bytesCopied)
if err != nil && err != io.EOF { if err != nil && err != io.EOF {
logger.Debug("Copy target->client error: %v", err) logger.Debug("Copy target->client error: %v", err)
} }
}() return err
})
wg.Wait() _ = g.Wait()
} }
// GetCacheStats returns cache statistics // GetCacheStats returns cache statistics
@@ -997,16 +869,14 @@ func (p *SNIProxy) UpdateLocalSNIs(fullDomains []string) {
logger.Debug("Updated local SNIs, added %d, removed %d", len(newSNIs), len(removed)) logger.Debug("Updated local SNIs, added %d, removed %d", len(newSNIs), len(removed))
// Terminate tunnels for removed SNIs // Terminate tunnels for removed SNIs via context cancellation
if len(removed) > 0 { if len(removed) > 0 {
p.activeTunnelsLock.Lock() p.activeTunnelsLock.Lock()
for _, sni := range removed { for _, sni := range removed {
if tunnels, ok := p.activeTunnels[sni]; ok { if tunnel, ok := p.activeTunnels[sni]; ok {
for _, conn := range tunnels.conns { tunnel.cancel()
conn.Close()
}
delete(p.activeTunnels, sni) delete(p.activeTunnels, sni)
logger.Debug("Closed tunnels for SNI target change: %s", sni) logger.Debug("Cancelled tunnel context for SNI target change: %s", sni)
} }
} }
p.activeTunnelsLock.Unlock() p.activeTunnelsLock.Unlock()

359
relay/relay.go
View File

@@ -1,7 +1,6 @@
package relay package relay
import ( import (
"bufio"
"bytes" "bytes"
"context" "context"
"encoding/binary" "encoding/binary"
@@ -10,11 +9,8 @@ import (
"io" "io"
"net" "net"
"net/http" "net/http"
"os"
"runtime" "runtime"
"strconv"
"sync" "sync"
"sync/atomic"
"time" "time"
"github.com/fosrl/gerbil/internal/metrics" "github.com/fosrl/gerbil/internal/metrics"
@@ -63,31 +59,8 @@ type PeerDestination struct {
} }
type DestinationConn struct { type DestinationConn struct {
conn *net.UDPConn conn *net.UDPConn
// lastUsed is unix nanoseconds, read/written via atomic ops since it's lastUsed time.Time
// touched from packet workers and the response goroutine concurrently
// with no lock, and is also scanned for LRU eviction below.
lastUsed atomic.Int64
}
// defaultMaxUDPConnections caps the number of concurrent per-peer outbound
// UDP sockets the relay will keep open in s.connections. Without a cap, a
// burst of peer churn creates sockets faster than the 5-minute idle cleanup
// can reap them, exhausting the host's ephemeral port range or fd ulimit.
// That surfaces as "dial udp ...: resource temporarily unavailable" on every
// subsequent packet and pegs the CPU logging the flood (outage 2026-07-03,
// recurrence 2026-07-05). Overridable via GERBIL_MAX_UDP_CONNECTIONS.
const defaultMaxUDPConnections = 8192
var maxUDPConnections = loadMaxUDPConnections()
func loadMaxUDPConnections() int64 {
if v := os.Getenv("GERBIL_MAX_UDP_CONNECTIONS"); v != "" {
if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
return n
}
}
return defaultMaxUDPConnections
} }
// Type for storing WireGuard handshake information // Type for storing WireGuard handshake information
@@ -164,24 +137,6 @@ const (
WireGuardMessageTypeTransportData = 4 WireGuardMessageTypeTransportData = 4
) )
// cachedEndpointState holds the last-known endpoint fields used for change detection.
// Timestamp is intentionally excluded since it always changes.
type cachedEndpointState struct {
OlmID string
NewtID string
Token string
IP string
Port int
PublicKey string
}
// cachedEndpointEntry wraps cachedEndpointState with a timestamp so the cache
// can be expired after a short TTL even when the endpoint fields are unchanged.
type cachedEndpointEntry struct {
state cachedEndpointState
cachedAt time.Time
}
// --- End Types --- // --- End Types ---
// bufferPool allows reusing buffers to reduce allocations. // bufferPool allows reusing buffers to reduce allocations.
@@ -198,13 +153,10 @@ type UDPProxyServer struct {
conn *net.UDPConn conn *net.UDPConn
proxyMappings sync.Map // map[string]ProxyMapping where key is "ip:port" proxyMappings sync.Map // map[string]ProxyMapping where key is "ip:port"
connections sync.Map // map[string]*DestinationConn where key is destination "ip:port" connections sync.Map // map[string]*DestinationConn where key is destination "ip:port"
// connectionCount mirrors len(connections) without an O(n) sync.Map walk, privateKey wgtypes.Key
// so the cap check in getOrCreateConnection is cheap on the hot path. packetChan chan Packet
connectionCount atomic.Int64 ctx context.Context
privateKey wgtypes.Key cancel context.CancelFunc
packetChan chan Packet
ctx context.Context
cancel context.CancelFunc
// Session tracking for WireGuard peers // Session tracking for WireGuard peers
// Key format: "senderIndex:receiverIndex" // Key format: "senderIndex:receiverIndex"
@@ -220,12 +172,6 @@ type UDPProxyServer struct {
// Cache for resolved UDP addresses to avoid per-packet DNS lookups // Cache for resolved UDP addresses to avoid per-packet DNS lookups
// Key: "ip:port" string, Value: *net.UDPAddr // Key: "ip:port" string, Value: *net.UDPAddr
addrCache sync.Map addrCache sync.Map
// lastEndpointCache stores the last-known endpoint state per client (key: olmId:newtId)
// used to skip redundant HTTP notifications when nothing has changed.
lastEndpointCache sync.Map
// notifyChan is the async queue for hole-punch endpoint notifications.
// Dedicated notifier workers drain this channel and perform the HTTP call.
notifyChan chan ClientEndpoint
// ReachableAt is the URL where this server can be reached // ReachableAt is the URL where this server can be reached
ReachableAt string ReachableAt string
} }
@@ -238,7 +184,6 @@ func NewUDPProxyServer(parentCtx context.Context, addr, serverURL string, privat
serverURL: serverURL, serverURL: serverURL,
privateKey: privateKey, privateKey: privateKey,
packetChan: make(chan Packet, 50000), // Increased from 1000 to handle high throughput packetChan: make(chan Packet, 50000), // Increased from 1000 to handle high throughput
notifyChan: make(chan ClientEndpoint, 1000),
ReachableAt: reachableAt, ReachableAt: reachableAt,
ctx: ctx, ctx: ctx,
cancel: cancel, cancel: cancel,
@@ -247,15 +192,10 @@ func NewUDPProxyServer(parentCtx context.Context, addr, serverURL string, privat
// Start sets up the UDP listener, worker pool, and begins reading packets. // Start sets up the UDP listener, worker pool, and begins reading packets.
func (s *UDPProxyServer) Start() error { func (s *UDPProxyServer) Start() error {
// Fetch initial mappings asynchronously so a large (potentially 100MB+) // Fetch initial mappings.
// response does not block the UDP listener from coming up. Any packets if err := s.fetchInitialMappings(); err != nil {
// arriving for unknown mappings before the load completes will simply return fmt.Errorf("failed to fetch initial mappings: %v", err)
// log and be repopulated via the hole-punch path. }
go func() {
if err := s.fetchInitialMappings(); err != nil {
logger.Error("Failed to fetch initial mappings: %v", err)
}
}()
udpAddr, err := net.ResolveUDPAddr("udp", s.addr) udpAddr, err := net.ResolveUDPAddr("udp", s.addr)
if err != nil { if err != nil {
@@ -297,11 +237,6 @@ func (s *UDPProxyServer) Start() error {
// Start the hole punch rate limiter cleanup routine // Start the hole punch rate limiter cleanup routine
go s.cleanupHolePunchRateLimiter() go s.cleanupHolePunchRateLimiter()
// Start async endpoint notifier workers (HTTP calls off the hot path)
for i := 0; i < 5; i++ {
go s.endpointNotifierWorker()
}
return nil return nil
} }
@@ -440,43 +375,7 @@ func (s *UDPProxyServer) packetWorker() {
ClientPublicKey: msg.PublicKey, ClientPublicKey: msg.PublicKey,
} }
logger.Debug("Created endpoint from packet remoteAddr %s: IP=%s, Port=%d", packet.remoteAddr.String(), endpoint.IP, endpoint.Port) logger.Debug("Created endpoint from packet remoteAddr %s: IP=%s, Port=%d", packet.remoteAddr.String(), endpoint.IP, endpoint.Port)
s.notifyServer(endpoint)
// Check if anything meaningful changed before queuing an HTTP notification.
// The cache expires after 2.5 s so the server always receives a fresh
// timestamp within its 5-second staleness window.
const endpointCacheTTL = 2500 * time.Millisecond
cacheKey := endpoint.OlmID + ":" + endpoint.NewtID
newState := cachedEndpointState{
OlmID: endpoint.OlmID,
NewtID: endpoint.NewtID,
Token: endpoint.Token,
IP: endpoint.IP,
Port: endpoint.Port,
PublicKey: endpoint.ClientPublicKey,
}
if cached, ok := s.lastEndpointCache.Load(cacheKey); ok {
entry := cached.(cachedEndpointEntry)
if entry.state == newState && time.Since(entry.cachedAt) < endpointCacheTTL {
// Endpoint unchanged and cache still fresh - skip the HTTP call.
logger.Debug("Endpoint unchanged for %s, skipping notification", cacheKey)
metrics.RecordHolePunchEvent(relayIfname, "deduplicated")
s.clearSessionsForIP(endpoint.IP)
metrics.RecordHolePunchEvent(relayIfname, "success")
bufferPool.Put(packet.data[:1500])
continue
}
}
s.lastEndpointCache.Store(cacheKey, cachedEndpointEntry{state: newState, cachedAt: time.Now()})
// Queue the notification asynchronously so the hot path is not blocked by HTTP.
select {
case s.notifyChan <- endpoint:
case <-s.ctx.Done():
// shutting down
default:
logger.Debug("Notification queue full, dropping hole punch notification for %s:%d", endpoint.IP, endpoint.Port)
metrics.RecordHolePunchEvent(relayIfname, "queue_full")
}
s.clearSessionsForIP(endpoint.IP) // Clear sessions for this IP to allow re-establishment s.clearSessionsForIP(endpoint.IP) // Clear sessions for this IP to allow re-establishment
metrics.RecordHolePunchEvent(relayIfname, "success") metrics.RecordHolePunchEvent(relayIfname, "success")
} }
@@ -485,22 +384,6 @@ func (s *UDPProxyServer) packetWorker() {
} }
} }
// endpointNotifierWorker drains the notifyChan and performs the HTTP notification for each
// hole-punch endpoint. Running several of these keeps latency low even when the server is slow.
func (s *UDPProxyServer) endpointNotifierWorker() {
for {
select {
case endpoint, ok := <-s.notifyChan:
if !ok {
return
}
s.notifyServer(endpoint)
case <-s.ctx.Done():
return
}
}
}
// decryptMessage decrypts the message using the server's private key // decryptMessage decrypts the message using the server's private key
func (s *UDPProxyServer) decryptMessage(encMsg EncryptedHolePunchMessage) ([]byte, error) { func (s *UDPProxyServer) decryptMessage(encMsg EncryptedHolePunchMessage) ([]byte, error) {
// Parse the ephemeral public key // Parse the ephemeral public key
@@ -536,7 +419,6 @@ func (s *UDPProxyServer) decryptMessage(encMsg EncryptedHolePunchMessage) ([]byt
} }
func (s *UDPProxyServer) fetchInitialMappings() error { func (s *UDPProxyServer) fetchInitialMappings() error {
logger.Info("Requesting initial proxy mappings")
body := bytes.NewBuffer([]byte(fmt.Sprintf(`{"publicKey": "%s"}`, s.privateKey.PublicKey().String()))) body := bytes.NewBuffer([]byte(fmt.Sprintf(`{"publicKey": "%s"}`, s.privateKey.PublicKey().String())))
resp, err := http.Post(s.serverURL+"/gerbil/get-all-relays", "application/json", body) resp, err := http.Post(s.serverURL+"/gerbil/get-all-relays", "application/json", body)
if err != nil { if err != nil {
@@ -548,82 +430,24 @@ func (s *UDPProxyServer) fetchInitialMappings() error {
return fmt.Errorf("server returned non-OK status: %d, body: %s", return fmt.Errorf("server returned non-OK status: %d, body: %s",
resp.StatusCode, string(body)) resp.StatusCode, string(body))
} }
logger.Info("Received initial mappings, streaming decode") data, err := io.ReadAll(resp.Body)
// Stream-decode the response instead of buffering the entire body
// (which can be 100MB+) and then re-walking it with json.Unmarshal.
// This both lowers peak memory and lets us start populating the
// sync.Map as entries arrive.
dec := json.NewDecoder(bufio.NewReaderSize(resp.Body, 1<<20))
// Expect opening '{' of the top-level object.
tok, err := dec.Token()
if err != nil { if err != nil {
return fmt.Errorf("failed to read opening token: %v", err) return fmt.Errorf("failed to read response body: %v", err)
} }
if d, ok := tok.(json.Delim); !ok || d != '{' { logger.Info("Received initial mappings: %s", string(data))
return fmt.Errorf("expected '{' at top level, got %v", tok) var initialMappings InitialMappings
if err := json.Unmarshal(data, &initialMappings); err != nil {
return fmt.Errorf("failed to unmarshal initial mappings: %v", err)
} }
// Store mappings in our sync.Map.
count := 0 for key, mapping := range initialMappings.Mappings {
now := time.Now() // Initialize LastUsed timestamp for initial mappings
mapping.LastUsed = time.Now()
for dec.More() { s.proxyMappings.Store(key, mapping)
keyTok, err := dec.Token()
if err != nil {
return fmt.Errorf("failed to read top-level key: %v", err)
}
key, ok := keyTok.(string)
if !ok {
return fmt.Errorf("expected string key at top level, got %T", keyTok)
}
if key != "mappings" {
// Skip unknown top-level fields without materializing them.
var skip json.RawMessage
if err := dec.Decode(&skip); err != nil {
return fmt.Errorf("failed to skip field %q: %v", key, err)
}
continue
}
// Expect opening '{' of the mappings object.
tok, err := dec.Token()
if err != nil {
return fmt.Errorf("failed to read mappings open: %v", err)
}
if d, ok := tok.(json.Delim); !ok || d != '{' {
return fmt.Errorf("expected '{' for mappings, got %v", tok)
}
for dec.More() {
mapKeyTok, err := dec.Token()
if err != nil {
return fmt.Errorf("failed to read mapping key: %v", err)
}
mapKey, ok := mapKeyTok.(string)
if !ok {
return fmt.Errorf("expected string mapping key, got %T", mapKeyTok)
}
var mapping ProxyMapping
if err := dec.Decode(&mapping); err != nil {
return fmt.Errorf("failed to decode mapping %q: %v", mapKey, err)
}
mapping.LastUsed = now
s.proxyMappings.Store(mapKey, mapping)
count++
}
// Consume closing '}' of mappings object.
if _, err := dec.Token(); err != nil {
return fmt.Errorf("failed to read mappings close: %v", err)
}
} }
metrics.RecordProxyInitialMappings(relayIfname, int64(len(initialMappings.Mappings)))
metrics.RecordProxyInitialMappings(relayIfname, int64(count)) metrics.RecordProxyMapping(relayIfname, int64(len(initialMappings.Mappings)))
metrics.RecordProxyMapping(relayIfname, int64(count)) logger.Info("Loaded %d initial proxy mappings", len(initialMappings.Mappings))
logger.Info("Loaded %d initial proxy mappings", count)
return nil return nil
} }
@@ -891,17 +715,10 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
// Check if we have an existing connection // Check if we have an existing connection
if conn, ok := s.connections.Load(key); ok { if conn, ok := s.connections.Load(key); ok {
destConn := conn.(*DestinationConn) destConn := conn.(*DestinationConn)
destConn.lastUsed.Store(time.Now().UnixNano()) destConn.lastUsed = time.Now()
return destConn.conn, nil return destConn.conn, nil
} }
// Enforce a hard cap on concurrent sockets so a burst of peer churn can't
// exhaust the host's ephemeral ports/fds. Evict the least-recently-used
// connection to make room instead of growing unbounded.
if s.connectionCount.Load() >= maxUDPConnections {
s.evictLRUConnection()
}
// Create new connection // Create new connection
newConn, err := net.DialUDP("udp", nil, destAddr) newConn, err := net.DialUDP("udp", nil, destAddr)
if err != nil { if err != nil {
@@ -909,17 +726,11 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
return nil, fmt.Errorf("failed to create UDP connection: %v", err) return nil, fmt.Errorf("failed to create UDP connection: %v", err)
} }
destConn := &DestinationConn{conn: newConn} // Store the new connection
destConn.lastUsed.Store(time.Now().UnixNano()) s.connections.Store(key, &DestinationConn{
conn: newConn,
// Store the new connection. If another goroutine raced us and already lastUsed: time.Now(),
// created one for this key, close ours and use theirs instead. })
if existing, loaded := s.connections.LoadOrStore(key, destConn); loaded {
newConn.Close()
return existing.(*DestinationConn).conn, nil
}
s.connectionCount.Add(1)
metrics.RecordUDPConnection(relayIfname, 1)
// Start a goroutine to handle responses // Start a goroutine to handle responses
go s.handleResponses(newConn, destAddr, remoteAddr) go s.handleResponses(newConn, destAddr, remoteAddr)
@@ -927,33 +738,6 @@ func (s *UDPProxyServer) getOrCreateConnection(destAddr *net.UDPAddr, remoteAddr
return newConn, nil return newConn, nil
} }
// evictLRUConnection closes and removes the least-recently-used destination
// connection so a new one can be created under the concurrent connection cap.
func (s *UDPProxyServer) evictLRUConnection() {
var oldestKey interface{}
var oldestConn *DestinationConn
var oldestTime int64
s.connections.Range(func(key, value interface{}) bool {
destConn := value.(*DestinationConn)
lu := destConn.lastUsed.Load()
if oldestKey == nil || lu < oldestTime {
oldestKey = key
oldestConn = destConn
oldestTime = lu
}
return true
})
if oldestKey != nil {
s.connections.Delete(oldestKey)
oldestConn.conn.Close()
s.connectionCount.Add(-1)
metrics.RecordUDPConnection(relayIfname, -1)
metrics.RecordProxyCleanupRemoved(relayIfname, "conn_evicted", 1)
}
}
func (s *UDPProxyServer) handleResponses(conn *net.UDPConn, destAddr *net.UDPAddr, remoteAddr *net.UDPAddr) { func (s *UDPProxyServer) handleResponses(conn *net.UDPConn, destAddr *net.UDPAddr, remoteAddr *net.UDPAddr) {
buffer := make([]byte, 1500) buffer := make([]byte, 1500)
for { for {
@@ -1005,32 +789,22 @@ func (s *UDPProxyServer) handleResponses(conn *net.UDPConn, destAddr *net.UDPAdd
// Add a cleanup method to periodically remove idle connections // Add a cleanup method to periodically remove idle connections
func (s *UDPProxyServer) cleanupIdleConnections() { func (s *UDPProxyServer) cleanupIdleConnections() {
// Ticker interval and idle threshold were previously 5min/10min, meaning ticker := time.NewTicker(5 * time.Minute)
// a socket could sit open for up to 15 minutes after going idle. Under a
// reconnect/churn burst that lag is enough to exhaust ephemeral ports
// before cleanup catches up, so both are tightened here.
ticker := time.NewTicker(1 * time.Minute)
defer ticker.Stop() defer ticker.Stop()
for { for {
select { select {
case <-ticker.C: case <-ticker.C:
cleanupStart := time.Now() cleanupStart := time.Now()
now := time.Now().UnixNano() now := time.Now()
removed := int64(0)
s.connections.Range(func(key, value interface{}) bool { s.connections.Range(func(key, value interface{}) bool {
destConn := value.(*DestinationConn) destConn := value.(*DestinationConn)
if now-destConn.lastUsed.Load() > int64(5*time.Minute) { if now.Sub(destConn.lastUsed) > 10*time.Minute {
destConn.conn.Close() destConn.conn.Close()
s.connections.Delete(key) s.connections.Delete(key)
removed++ metrics.RecordProxyCleanupRemoved(relayIfname, "conn", 1)
} }
return true return true
}) })
if removed > 0 {
s.connectionCount.Add(-removed)
metrics.RecordUDPConnection(relayIfname, -removed)
metrics.RecordProxyCleanupRemoved(relayIfname, "conn", removed)
}
metrics.RecordProxyIdleCleanupDuration(relayIfname, "conn", time.Since(cleanupStart).Seconds()) metrics.RecordProxyIdleCleanupDuration(relayIfname, "conn", time.Since(cleanupStart).Seconds())
case <-s.ctx.Done(): case <-s.ctx.Done():
return return
@@ -1192,10 +966,6 @@ func (s *UDPProxyServer) clearConnectionsForWGIP(wgIP string) {
for _, key := range keysToDelete { for _, key := range keysToDelete {
s.connections.Delete(key) s.connections.Delete(key)
} }
if len(keysToDelete) > 0 {
s.connectionCount.Add(-int64(len(keysToDelete)))
metrics.RecordUDPConnection(relayIfname, -int64(len(keysToDelete)))
}
logger.Info("Cleared %d connections for WG IP: %s", len(keysToDelete), wgIP) logger.Info("Cleared %d connections for WG IP: %s", len(keysToDelete), wgIP)
} }
@@ -1393,56 +1163,33 @@ func (s *UDPProxyServer) trackCommunicationPattern(fromAddr, toAddr *net.UDPAddr
// tryRebuildSession attempts to rebuild a WireGuard session from communication patterns // tryRebuildSession attempts to rebuild a WireGuard session from communication patterns
func (s *UDPProxyServer) tryRebuildSession(pattern *CommunicationPattern) { func (s *UDPProxyServer) tryRebuildSession(pattern *CommunicationPattern) {
// Require both indices and a minimum amount of bidirectional traffic
if pattern.ClientIndex == 0 || pattern.DestIndex == 0 || pattern.PacketCount < 4 {
return
}
// Check if we have bidirectional communication within a reasonable time window // Check if we have bidirectional communication within a reasonable time window
timeDiff := pattern.LastFromClient.Sub(pattern.LastFromDest) timeDiff := pattern.LastFromClient.Sub(pattern.LastFromDest)
if timeDiff < 0 { if timeDiff < 0 {
timeDiff = -timeDiff timeDiff = -timeDiff
} }
if timeDiff >= 30*time.Second {
return
}
sessionKey := fmt.Sprintf("%d:%d", pattern.DestIndex, pattern.ClientIndex) // Only rebuild if we have recent bidirectional communication and both indices
destStr := pattern.ToDestination.String() if timeDiff < 30*time.Second && pattern.ClientIndex != 0 && pattern.DestIndex != 0 && pattern.PacketCount >= 4 {
// Create session mapping: client's index maps to destination
sessionKey := fmt.Sprintf("%d:%d", pattern.DestIndex, pattern.ClientIndex)
// Fast path: if a matching session already exists, just refresh LastSeen and bail out. // Check if we already have this session
// This prevents log spam and repeated work for every packet of an established flow. session := &WireGuardSession{
if existing, ok := s.wgSessions.Load(sessionKey); ok { ReceiverIndex: pattern.DestIndex,
sess := existing.(*WireGuardSession) SenderIndex: pattern.ClientIndex,
if da := sess.GetDestAddr(); da != nil && da.String() == destStr { DestAddr: pattern.ToDestination,
sess.UpdateLastSeen() LastSeen: time.Now(),
// Make sure the receiver-index fast-path is populated so future packets
// don't keep falling back to broadcast + pattern tracking.
if _, indexed := s.sessionsByReceiverIndex.Load(pattern.ClientIndex); !indexed {
s.sessionsByReceiverIndex.Store(pattern.ClientIndex, sess)
}
return
} }
if _, loaded := s.wgSessions.LoadOrStore(sessionKey, session); loaded {
s.wgSessions.Store(sessionKey, session)
} else {
metrics.RecordSession(relayIfname, 1)
metrics.RecordSessionRebuilt(relayIfname)
}
logger.Info("Rebuilt WireGuard session from communication pattern: %s -> %s (packets: %d)",
sessionKey, pattern.ToDestination.String(), pattern.PacketCount)
} }
// Create or replace the session mapping
session := &WireGuardSession{
ReceiverIndex: pattern.DestIndex,
SenderIndex: pattern.ClientIndex,
DestAddr: pattern.ToDestination,
LastSeen: time.Now(),
}
if _, loaded := s.wgSessions.LoadOrStore(sessionKey, session); loaded {
s.wgSessions.Store(sessionKey, session)
} else {
metrics.RecordSession(relayIfname, 1)
metrics.RecordSessionRebuilt(relayIfname)
}
// Index by client receiver index so the transport-data fast path can find it.
s.sessionsByReceiverIndex.Store(pattern.ClientIndex, session)
logger.Info("Rebuilt WireGuard session from communication pattern: %s -> %s (packets: %d)",
sessionKey, destStr, pattern.PacketCount)
} }
// cleanupIdleCommunicationPatterns periodically removes idle communication patterns // cleanupIdleCommunicationPatterns periodically removes idle communication patterns