Function dnsWorker

daemon/dns/ebpfhook.go:254–291

(id int, channel chan []byte, exitChannel chan struct{})

}

func dnsWorker(id int, channel chan []byte, exitChannel chan struct{}) {

	log.Debug("[eBPF DNS] worker initialized #%d", id)
	var event nameLookupEvent
	var ip net.IP

	for data := range channel {
		select {
		case <-exitChannel:
			goto Exit
			//	case data := <-channel:
		default:
			event = nameLookupEvent{}
			if len(data) > 0 {
				log.Trace("(%d) [eBPF DNS]: LookupEvent %d %x %x %x", id, len(data), data[:4], data[4:20], data[20:])
			}
			err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event)
			if err != nil {
				log.Warning("(%d) [eBPF DNS]: Failed to decode ebpf nameLookupEvent: %s\n", id, err)
				continue
			}
			// Convert C string (null-terminated) to Go string
			host := string(event.Host[:bytes.IndexByte(event.Host[:], 0)])
			// 2 -> AF_INET (ipv4)
			if event.AddrType == 2 {
				ip = net.IP(event.IP[:4])
			} else {
				ip = net.IP(event.IP[:])
			}

			log.Debug("(%d) [eBPF DNS]: Tracking Resolved Message: %s -> %s\n", id, host, ip.String())
			Track(ip.String(), host)
		}
	}

Exit:
	log.Debug("[eBPF DNS] worker #%d closed", id)
}