eBPF plugin

Change eBPF plugin internal organization.

22 files changed, 1385 insertions, 1030 deletions

diff --git a/collectors/ebpf.plugin/Makefile.am b/collectors/ebpf.plugin/Makefile.am
index 1327d47a69..4fb2056fd8 100644
--- a/collectors/ebpf.plugin/Makefile.am
+++ b/collectors/ebpf.plugin/Makefile.am
@@ -10,6 +10,12 @@ CLEANFILES = \
 include $(top_srcdir)/build/subst.inc
 SUFFIXES = .in
 
+userebpfconfigdir=$(configdir)/ebpf.d
+
+# Explicitly install directories to avoid permission issues due to umask
+install-exec-local:
+	$(INSTALL) -d $(DESTDIR)$(userebpfconfigdir)
+
 dist_plugins_SCRIPTS = \
     reset_netdata_trace.sh \
     $(NULL)
@@ -19,7 +25,15 @@ dist_noinst_DATA = \
     README.md \
     $(NULL)
 
+ebpfconfigdir=$(libconfigdir)/ebpf.d
 dist_libconfig_DATA = \
-    ebpf.conf \
-    ebpf_kernel_reject_list.txt \
+    ebpf.d.conf \
+    $(NULL)
+
+dist_ebpfconfig_DATA = \
+    ebpf.d/ebpf_kernel_reject_list.txt \
+    ebpf.d/cachestat.conf \
+    ebpf.d/network.conf \
+    ebpf.d/process.conf \
+    ebpf.d/sync.conf \
     $(NULL)
diff --git a/collectors/ebpf.plugin/README.md b/collectors/ebpf.plugin/README.md
index bfe3f07442..06a76473a6 100644
--- a/collectors/ebpf.plugin/README.md
+++ b/collectors/ebpf.plugin/README.md
@@ -148,6 +148,7 @@ accepts the following values: ​
 -   `return`: In the `return` mode, the eBPF collector monitors the same kernel functions as `entry`, but also creates
     new charts for the return of these functions, such as errors. Monitoring function returns can help in debugging
     software, such as failing to close file descriptors or creating zombie processes.
+-   `update every`:  Number of seconds used for eBPF to send data for Netdata.   
     
 #### Integration with `apps.plugin`
 
@@ -186,17 +187,44 @@ If you want to _disable_ the integration with `apps.plugin` along with the above
    apps = yes
 ```
 
-### `[ebpf programs]`
+#### `[ebpf programs]`
 
 The eBPF collector enables and runs the following eBPF programs by default:
 
+-   `cachestat`: Netdata's eBPF data collector creates charts about the memory page cache. When the integration with
+    [`apps.plugin`](/collectors/apps.plugin/README.md) is enabled, this collector creates charts for the whole host _and_
+    for each application.
 -   `process`: This eBPF program creates charts that show information about process creation, VFS IO, and files removed.
     When in `return` mode, it also creates charts showing errors when these operations are executed.
 -   `network viewer`: This eBPF program creates charts with information about `TCP` and `UDP` functions, including the
     bandwidth consumed by each.
 -   `sync`: Montitor calls for syscall sync(2).
 
-### `[network connections]`
+## Thread configuration
+
+You can configure each thread of the eBPF data collector by editing either the `cachestat.conf`, `process.conf`, 
+or `network.conf` files. Use [`edit-config`](/docs/configure/nodes.md) from your Netdata config directory:
+
+```bash
+cd /etc/netdata/   # Replace with your Netdata configuration directory, if not /etc/netdata/
+./edit-config ebpf.d/process.conf
+```
+
+### Configuration files
+
+The following configuration files are available:
+
+- `cachestat.conf`: Configuration for the `cachestat` thread.
+- `process.conf`: Configuration for the `process` thread.
+- `network.conf`: Configuration for the `network viewer` thread. This config file overwrites the global options and
+  also lets you specify which network the eBPF collector monitors.
+
+### Network configuration
+
+The network configuration has specific options to configure which network(s) the eBPF collector monitors. These options
+are divided in the following sections:
+
+#### `[network connections]`
 
 You can configure the information shown on `outbound` and `inbound` charts with the settings in this section. 
 
diff --git a/collectors/ebpf.plugin/ebpf.c b/collectors/ebpf.plugin/ebpf.c
index 99a426786b..26dacfd3e7 100644
--- a/collectors/ebpf.plugin/ebpf.c
+++ b/collectors/ebpf.plugin/ebpf.c
@@ -52,8 +52,6 @@ void netdata_cleanup_and_exit(int ret)
  *****************************************************************/
 
 char *ebpf_plugin_dir = PLUGINS_DIR;
-char *ebpf_user_config_dir = CONFIG_DIR;
-char *ebpf_stock_config_dir = LIBCONFIG_DIR;
 static char *ebpf_configured_log_dir = LOG_DIR;
 
 char *ebpf_algorithms[] = {"absolute", "incremental"};
@@ -107,58 +105,6 @@ ebpf_network_viewer_options_t network_viewer_opt;
  *****************************************************************/
 
 /**
- * Cleanup publish syscall
- *
- * @param nps list of structures to clean
- */
-void ebpf_cleanup_publish_syscall(netdata_publish_syscall_t *nps)
-{
-    while (nps) {
-        freez(nps->algorithm);
-        nps = nps->next;
-    }
-}
-
-/**
- * Clean port Structure
- *
- * Clean the allocated list.
- *
- * @param clean the list that will be cleaned
- */
-void clean_port_structure(ebpf_network_viewer_port_list_t **clean)
-{
-    ebpf_network_viewer_port_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_port_list_t *next = move->next;
-        freez(move->value);
-        freez(move);
-
-        move = next;
-    }
-    *clean = NULL;
-}
-
-/**
- * Clean IP structure
- *
- * Clean the allocated list.
- *
- * @param clean the list that will be cleaned
- */
-static void clean_ip_structure(ebpf_network_viewer_ip_list_t **clean)
-{
-    ebpf_network_viewer_ip_list_t *move = *clean;
-    while (move) {
-        ebpf_network_viewer_ip_list_t *next = move->next;
-        freez(move);
-
-        move = next;
-    }
-    *clean = NULL;
-}
-
-/**
  * Clean Loaded Events
  *
  * This function cleans the events previous loaded on Linux.
@@ -426,15 +372,17 @@ void ebpf_create_global_dimension(void *ptr, int end)
 /**
  *  Call write_chart_cmd to create the charts
  *
- * @param type    chart type
- * @param id      chart id
- * @param units   axis label
- * @param family  group name used to attach the chart on dashaboard
- * @param order   order number of the specified chart
- * @param context chart context
- * @param ncd     a pointer to a function called to create dimensions
- * @param move    a pointer for a structure that has the dimensions
- * @param end     number of dimensions for the chart created
+ * @param type      chart type
+ * @param id        chart id
+ * @param title     chart title
+ * @param units     axis label
+ * @param family    group name used to attach the chart on dashaboard
+ * @param context   chart context
+ * @param charttype chart type
+ * @param order     order number of the specified chart
+ * @param ncd       a pointer to a function called to create dimensions
+ * @param move      a pointer for a structure that has the dimensions
+ * @param end       number of dimensions for the chart created
  */
 void ebpf_create_chart(char *type,
                        char *id,
@@ -442,12 +390,13 @@ void ebpf_create_chart(char *type,
                        char *units,
                        char *family,
                        char *context,
+                       char *charttype,
                        int order,
                        void (*ncd)(void *, int),
                        void *move,
                        int end)
 {
-    ebpf_write_chart_cmd(type, id, title, units, family, "line", context, order);
+    ebpf_write_chart_cmd(type, id, title, units, family, charttype, context, order);
 
     ncd(move, end);
 }
@@ -459,15 +408,16 @@ void ebpf_create_chart(char *type,
  * @param title  the value displayed on vertical axis.
  * @param units  the value displayed on vertical axis.
  * @param family Submenu that the chart will be attached on dashboard.
+ * @param charttype chart type
  * @param order  the chart order
  * @param algorithm the algorithm used by dimension
  * @param root   structure used to create the dimensions.
  */
-void ebpf_create_charts_on_apps(char *id, char *title, char *units, char *family, int order,
+void ebpf_create_charts_on_apps(char *id, char *title, char *units, char *family, char *charttype, int order,
                                 char *algorithm, struct target *root)
 {
     struct target *w;
-    ebpf_write_chart_cmd(NETDATA_APPS_FAMILY, id, title, units, family, "stacked", NULL, order);
+    ebpf_write_chart_cmd(NETDATA_APPS_FAMILY, id, title, units, family, charttype, NULL, order);
 
     for (w = root; w; w = w->next) {
         if (unlikely(w->exposed))
@@ -641,87 +591,6 @@ void ebpf_print_help()
  *****************************************************************/
 
 /**
- * Is ip inside the range
- *
- * Check if the ip is inside a IP range
- *
- * @param rfirst    the first ip address of the range
- * @param rlast     the last ip address of the range
- * @param cmpfirst  the first ip to compare
- * @param cmplast   the last ip to compare
- * @param family    the IP family
- *
- * @return It returns 1 if the IP is inside the range and 0 otherwise
- */
-static int is_ip_inside_range(union netdata_ip_t *rfirst, union netdata_ip_t *rlast,
-                              union netdata_ip_t *cmpfirst, union netdata_ip_t *cmplast, int family)
-{
-    if (family == AF_INET) {
-        if (ntohl(rfirst->addr32[0]) <= ntohl(cmpfirst->addr32[0]) &&
-            ntohl(rlast->addr32[0]) >= ntohl(cmplast->addr32[0]))
-            return 1;
-    } else {
-        if (memcmp(rfirst->addr8, cmpfirst->addr8, sizeof(union netdata_ip_t)) <= 0 &&
-            memcmp(rlast->addr8, cmplast->addr8, sizeof(union netdata_ip_t)) >= 0) {
-            return 1;
-        }
-
-    }
-    return 0;
-}
-
-
-/**
- * Fill IP list
- *
- * @param out a pointer to the link list.
- * @param in the structure that will be linked.
- */
-static inline void fill_ip_list(ebpf_network_viewer_ip_list_t **out, ebpf_network_viewer_ip_list_t *in, char *table)
-{
-#ifndef NETDATA_INTERNAL_CHECKS
-    UNUSED(table);
-#endif
-    if (likely(*out)) {
-        ebpf_network_viewer_ip_list_t *move = *out, *store = *out;
-        while (move) {
-            if (in->ver == move->ver && is_ip_inside_range(&move->first, &move->last, &in->first, &in->last, in->ver)) {
-                info("The range/value (%s) is inside the range/value (%s) already inserted, it will be ignored.",
-                     in->value, move->value);
-                freez(in->value);
-                freez(in);
-                return;
-            }
-            store = move;
-            move = move->next;
-        }
-
-        store->next = in;
-    } else {
-        *out = in;
-    }
-
-#ifdef NETDATA_INTERNAL_CHECKS
-    char first[512], last[512];
-    if (in->ver == AF_INET) {
-        if (inet_ntop(AF_INET, in->first.addr8, first, INET_ADDRSTRLEN) &&
-            inet_ntop(AF_INET, in->last.addr8, last, INET_ADDRSTRLEN))
-            info("Adding values %s - %s to %s IP list \"%s\" used on network viewer",
-                 first, last,
-                 (*out == network_viewer_opt.included_ips)?"included":"excluded",
-                 table);
-    } else {
-        if (inet_ntop(AF_INET6, in->first.addr8, first, INET6_ADDRSTRLEN) &&
-            inet_ntop(AF_INET6, in->last.addr8, last, INET6_ADDRSTRLEN))
-            info("Adding values %s - %s to %s IP list \"%s\" used on network viewer",
-                 first, last,
-                 (*out == network_viewer_opt.included_ips)?"included":"excluded",
-                 table);
-    }
-#endif
-}
-
-/**
  *  Read Local Ports
  *
  *  Parse /proc/net/{tcp,udp} and get the ports Linux is listening.
@@ -872,789 +741,26 @@ void fill_ebpf_data(ebpf_data_t *ef)
  */
 static inline void how_to_load(char *ptr)
 {
-    if (!strcasecmp(ptr, "return"))
+    if (!strcasecmp(ptr, EBPF_CFG_LOAD_MODE_RETURN))
         ebpf_set_thread_mode(MODE_RETURN);
-    else if (!strcasecmp(ptr, "entry"))
+    else if (!strcasecmp(ptr, EBPF_CFG_LOAD_MODE_DEFAULT))
         ebpf_set_thread_mode(MODE_ENTRY);
     else
         error("the option %s for \"ebpf load mode\" is not a valid option.", ptr);
 }
 
 /**
- * Fill Port list
- *
- * @param out a pointer to the link list.
- * @param in the structure that will be linked.
- */
-static inline void fill_port_list(ebpf_network_viewer_port_list_t **out, ebpf_network_viewer_port_list_t *in)
-{
-    if (likely(*out)) {
-        ebpf_network_viewer_port_list_t *move = *out, *store = *out;
-        uint16_t first = ntohs(in->first);
-        uint16_t last = ntohs(in->last);
-        while (move) {
-            uint16_t cmp_first = ntohs(move->first);
-            uint16_t cmp_last = ntohs(move->last);
-            if (cmp_first <= first && first <= cmp_last  &&
-                cmp_first <= last && last <= cmp_last ) {
-                info("The range/value (%u, %u) is inside the range/value (%u, %u) already inserted, it will be ignored.",
-                     first, last, cmp_first, cmp_last);
-                freez(in->value);
-                freez(in);
-                return;
-            } else if (first <= cmp_first && cmp_first <= last  &&
-                       first <= cmp_last && cmp_last <= last) {
-                info("The range (%u, %u) is bigger than previous range (%u, %u) already inserted, the previous will be ignored.",
-                     first, last, cmp_first, cmp_last);
-                freez(move->value);
-                move->value = in->value;
-                move->first = in->first;
-                move->last = in->last;
-                freez(in);
-                return;
-            }
-
-            store = move;
-            move = move->next;
-        }
-
-        store->next = in;
-    } else {
-        *out = in;
-    }
-
-#ifdef NETDATA_INTERNAL_CHECKS
-    info("Adding values %s( %u, %u) to %s port list used on network viewer",
-         in->value, ntohs(in->first), ntohs(in->last),
-         (*out == network_viewer_opt.included_port)?"included":"excluded");
-#endif
-}
-
-/**
- * Fill port list
- *
- * Fill an allocated port list with the range given
- *
- * @param out a pointer to store the link list
- * @param range the informed range for the user.
- */
-static void parse_port_list(void **out, char *range)
-{
-    int first, last;
-    ebpf_network_viewer_port_list_t **list = (ebpf_network_viewer_port_list_t **)out;
-
-    char *copied = strdupz(range);
-    if (*range == '*' && *(range+1) == '\0') {
-        first = 1;
-        last = 65535;
-
-        clean_port_structure(list);
-        goto fillenvpl;
-    }
-
-    char *end = range;
-    //Move while I cannot find a separator
-    while (*end && *end != ':' && *end != '-') end++;
-
-    //It has a range
-    if (likely(*end)) {
-        *end++ = '\0';
-        if (*end == '!') {
-            info("The exclusion cannot be in the second part of the range, the range %s will be ignored.", copied);
-            freez(copied);
-            return;
-        }
-        last = str2i((const char *)end);
-    } else {
-        last = 0;
-    }
-
-    first = str2i((const char *)range);
-    if (first < NETDATA_MINIMUM_PORT_VALUE || first > NETDATA_MAXIMUM_PORT_VALUE) {
-        info("The first port %d of the range \"%s\" is invalid and it will be ignored!", first, copied);
-        freez(copied);
-        return;
-    }
-
-    if (!last)
-        last = first;
-
-    if (last < NETDATA_MINIMUM_PORT_VALUE || last > NETDATA_MAXIMUM_PORT_VALUE) {
-        info("The second port %d of the range \"%s\" is invalid and the whole range will be ignored!", last, copied);
-        freez(copied);
-        return;
-    }
-
-    if (first > last) {
-        info("The specified order %s is wrong, the smallest value is always the first, it will be ignored!", copied);
-        freez(copied);
-        return;
-    }
-
-    ebpf_network_viewer_port_list_t *w;
-fillenvpl:
-    w = callocz(1, sizeof(ebpf_network_viewer_port_list_t));
-    w->value = copied;
-    w->hash = simple_hash(copied);
-    w->first = (uint16_t)htons((uint16_t)first);
-    w->last = (uint16_t)htons((uint16_t)last);
-    w->cmp_first = (uint16_t)first;
-    w->cmp_last = (uint16_t)last;
-
-    fill_port_list(list, w);
-}
-
-/**
- * Parse Service List
- *
- * @param out a pointer to store the link list
- * @param service the service used to create the structure that will be linked.
- */
-static void parse_service_list(void **out, char *service)
-{
-    ebpf_network_viewer_port_list_t **list = (ebpf_network_viewer_port_list_t **)out;
-    struct servent *serv = getservbyname((const char *)service, "tcp");
-    if (!serv)
-        serv = getservbyname((const char *)service, "udp");
-
-    if (!serv) {
-        info("Cannot resolv the service '%s' with protocols TCP and UDP, it will be ignored", service);
-        return;
-    }
-
-    ebpf_network_viewer_port_list_t *w = callocz(1, sizeof(ebpf_network_viewer_port_list_t));
-    w->value = strdupz(service);
-    w->hash = simple_hash(service);
-
-    w->first = w->last = (uint16_t)serv->s_port;
-
-    fill_port_list(list, w);
-}
-
-/**
- * Netmask
- *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param prefix create the netmask based in the CIDR value.
- *
- * @return
- */
-static inline in_addr_t netmask(int prefix) {
-
-    if (prefix == 0)
-        return (~((in_addr_t) - 1));
-    else
-        return (in_addr_t)(~((1 << (32 - prefix)) - 1));
-
-}
-
-/**
- * Broadcast
+ * Update interval
  *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param addr is the ip address
- * @param prefix is the CIDR value.
- *
- * @return It returns the last address of the range
+ * Update default interval with value from user
  */
-static inline in_addr_t broadcast(in_addr_t addr, int prefix)
+static void ebpf_update_interval()
 {
-    return (addr | ~netmask(prefix));
-}
-
-/**
- * Network
- *
- * Copied from iprange (https://github.com/firehol/iprange/blob/master/iprange.h)
- *
- * @param addr is the ip address
- * @param prefix is the CIDR value.
- *
- * @return It returns the first address of the range.
- */
-static inline in_addr_t ipv4_network(in_addr_t addr, int prefix)
-{
-    return (addr & netmask(prefix));
-}
-
-/**
- * IP to network long
- *
- * @param dst the vector to store the result
- * @param ip the source ip given by our users.
- * @param domain the ip domain (IPV4 or IPV6)
- * @param source the original string
- *
- * @return it returns 0 on success and -1 otherwise.
- */
-static inline int ip2nl(uint8_t *dst, char *ip, int domain, char *source)
-{
-    if (inet_pton(domain, ip, dst) <= 0) {
-        error("The address specified (%s) is invalid ", source);
-        return -1;
-    }
-
-    return 0;
-}
-
-/**
- * Get IPV6 Last Address
- *
- * @param out the address to store the last address.
- * @param in the address used to do the math.
- * @param prefix number of bits used to calculate the address
- */
-static void get_ipv6_last_addr(union netdata_ip_t *out, union netdata_ip_t *in, uint64_t prefix)
-{
-    uint64_t mask,tmp;
-    uint64_t ret[2];
-    memcpy(ret, in->addr32, sizeof(union netdata_ip_t));
-
-    if (prefix == 128) {
-        memcpy(out->addr32, in->addr32, sizeof(union netdata_ip_t));
-        return;
-    } else if (!prefix) {
-        ret[0] = ret[1] = 0xFFFFFFFFFFFFFFFF;
-        memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-        return;
-    } else if (prefix <= 64) {
-        ret[1] = 0xFFFFFFFFFFFFFFFFULL;
-
-        tmp = be64toh(ret[0]);
-        if (prefix > 0) {
-            mask = 0xFFFFFFFFFFFFFFFFULL << (64 - prefix);
-            tmp |= ~mask;
-        }
-        ret[0] = htobe64(tmp);
-    } else {
-        mask = 0xFFFFFFFFFFFFFFFFULL << (128 - prefix);
-        tmp = be64toh(ret[1]);
-        tmp |= ~mask;
-        ret[1] = htobe64(tmp);
-    }
-
-    memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-}
-
-/**
- * Calculate ipv6 first address
- *
- * @param out the address to store the first address.
- * @param in the address used to do the math.
- * @param prefix number of bits used to calculate the address
- */
-static void get_ipv6_first_addr(union netdata_ip_t *out, union netdata_ip_t *in, uint64_t prefix)
-{
-    uint64_t mask,tmp;
-    uint64_t ret[2];
-
-    memcpy(ret, in->addr32, sizeof(union netdata_ip_t));
-
-    if (prefix == 128) {
-        memcpy(out->addr32, in->addr32, sizeof(union netdata_ip_t));
-        return;
-    } else if (!prefix) {
-        ret[0] = ret[1] = 0;
-        memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-        return;
-    } else if (prefix <= 64) {
-        ret[1] = 0ULL;
-
-        tmp = be64toh(ret[0]);
-        if (prefix > 0) {
-            mask = 0xFFFFFFFFFFFFFFFFULL << (64 - prefix);
-            tmp &= mask;
-        }
-        ret[0] = htobe64(tmp);
-    } else {
-        mask = 0xFFFFFFFFFFFFFFFFULL << (128 - prefix);
-        tmp = be64toh(ret[1]);
-        tmp &= mask;
-        ret[1] = htobe64(tmp);
-    }
-
-    memcpy(out->addr32, ret, sizeof(union netdata_ip_t));
-}
-
-/**
- * Parse IP List
- *
- * Parse IP list and link it.
- *
- * @param out a pointer to store the link list
- * @param ip the value given as parameter
- */
-static void parse_ip_list(void **out, char *ip)
-{
-    ebpf_network_viewer_ip_list_t **list = (ebpf_network_viewer_ip_list_t **)out;
-
-    char *ipdup = strdupz(ip);
-    union netdata_ip_t first = { };
-    union netdata_ip_t last = { };
-    char *is_ipv6;
-    if (*ip == '*' && *(ip+1) == '\0') {
-        memset(first.addr8, 0, sizeof(first.addr8));
-        memset(last.addr8, 0xFF, sizeof(last.addr8));
-
-        is_ipv6 = ip;
-
-        clean_ip_structure(list);
-        goto storethisip;
-    }
-
-    char *end = ip;
-    // Move while I cannot find a separator
-    while (*end && *end != '/' && *end != '-') end++;
-
-    // We will use only the classic IPV6 for while, but we could consider the base 85 in a near future
-    // https://tools.ietf.org/html/rfc1924
-    is_ipv6 = strchr(ip, ':');
-
-    int select;
-    if (*end && !is_ipv6) { // IPV4 range
-        select = (*end == '/') ? 0 : 1;
-        *end++ = '\0';
-        if (*end == '!') {
-            info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-            goto cleanipdup;
-        }
-
-        if (!select) { // CIDR
-            select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = (int) str2i(end);
-            if (select < NETDATA_MINIMUM_IPV4_CIDR || select > NETDATA_MAXIMUM_IPV4_CIDR) {
-                info("The specified CIDR %s is not valid, the IP %s will be ignored.", end, ip);
-                goto cleanipdup;
-            }
-
-            last.addr32[0] = htonl(broadcast(ntohl(first.addr32[0]), select));
-            // This was added to remove
-            // https://app.codacy.com/manual/netdata/netdata/pullRequest?prid=5810941&bid=19021977
-            UNUSED(last.addr32[0]);
-
-            uint32_t ipv4_test = htonl(ipv4_network(ntohl(first.addr32[0]), select));
-            if (first.addr32[0] != ipv4_test) {
-                first.addr32[0] = ipv4_test;
-                struct in_addr ipv4_convert;
-                ipv4_convert.s_addr = ipv4_test;
-                char ipv4_msg[INET_ADDRSTRLEN];
-                if(inet_ntop(AF_INET, &ipv4_convert, ipv4_msg, INET_ADDRSTRLEN))
-                    info("The network value of CIDR %s was updated for %s .", ipdup, ipv4_msg);
-            }
-        } else { // Range
-            select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = ip2nl(last.addr8, end, AF_INET, ipdup);
-            if (select)
-                goto cleanipdup;
-        }
-
-        if (htonl(first.addr32[0]) > htonl(last.addr32[0])) {
-            info("The specified range %s is invalid, the second address is smallest than the first, it will be ignored.",
-                 ipdup);
-            goto cleanipdup;
-        }
-    } else if (is_ipv6) { // IPV6
-        if (!*end) { // Unique
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            memcpy(last.addr8, first.addr8, sizeof(first.addr8));
-        } else if (*end == '-') {
-            *end++ = 0x00;
-            if (*end == '!') {
-                info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-                goto cleanipdup;
-            }
-
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            select = ip2nl(last.addr8, end, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-        } else { // CIDR
-            *end++ = 0x00;
-            if (*end == '!') {
-                info("The exclusion cannot be in the second part of the range %s, it will be ignored.", ipdup);
-                goto cleanipdup;
-            }
-
-            select = str2i(end);
-            if (select < 0 || select > 128) {
-                info("The CIDR %s is not valid, the address %s will be ignored.", end, ip);
-                goto cleanipdup;
-            }
-
-            uint64_t prefix = (uint64_t)select;
-            select = ip2nl(first.addr8, ip, AF_INET6, ipdup);
-            if (select)
-                goto cleanipdup;
-
-            get_ipv6_last_addr(&last, &first, prefix);
-
-            union netdata_ip_t ipv6_test;
-            get_ipv6_first_addr(&ipv6_test, &first, prefix);
-
-            if (memcmp(first.addr8, ipv6_test.addr8, sizeof(union netdata_ip_t)) != 0) {
-                memcpy(first.addr8, ipv6_test.addr8, sizeof(union netdata_ip_t));
-
-                struct in6_addr ipv6_convert;
-                memcpy(ipv6_convert.s6_addr,  ipv6_test.addr8, sizeof(union netdata_ip_t));
-
-                char ipv6_msg[INET6_ADDRSTRLEN];
-                if(inet_ntop(AF_INET6, &ipv6_convert, ipv6_msg, INET6_ADDRSTRLEN))
-                    info("The network value of CIDR %s was updated for %s .", ipdup, ipv6_msg);
-            }
-        }
-
-        if ((be64toh(*(uint64_t *)&first.addr32[2]) > be64toh(*(uint64_t *)&last.addr32[2]) &&
-            !memcmp(first.addr32, last.addr32, 2*sizeof(uint32_t))) ||
-            (be64toh(*(uint64_t *)&first.addr32) > be64toh(*(uint64_t *)&last.addr32)) ) {
-            info("The specified range %s is invalid, the second address is smallest than the first, it will be ignored.",
-                 ipdup);
-            goto cleanipdup;
-        }
-    } else { // Unique ip
-        select = ip2nl(first.addr8, ip, AF_INET, ipdup);
-        if (select)
-            goto cleanipdup;
-
-        memcpy(last.addr8, first.addr8, sizeof(first.addr8));
-    }
-
-    ebpf_network_viewer_ip_list_t *store;
-
-storethisip:
-    store = callocz(1, sizeof(ebpf_network_viewer_ip_list_t));
-    store->value = ipdup;
-    store->hash = simple_hash(ipdup);
-    store->ver = (uint8_t)(!is_ipv6)?AF_INET:AF_INET6;
-    memcpy(store->first.addr8, first.addr8, sizeof(first.addr8));
-    memcpy(store->last.addr8, last.addr8, sizeof(last.addr8));
-
-    fill_ip_list(list, store, "socket");
-    return;
-
-cleanipdup:
-    freez(ipdup);
-}
-
-/**
- * Parse IP Range
- *
- * Parse the IP ranges given and create Network Viewer IP Structure
- *
- * @param ptr  is a pointer with the text to parse.
- */
-static void parse_ips(char *ptr)
-{
-    // No value
-    if (unlikely(!ptr))
-        return;
-
-    while (likely(ptr)) {
-        // Move forward until next valid character
-        while (isspace(*ptr)) ptr++;
-
-        // No valid value found
-        if (unlikely(!*ptr))
-            return;
-
-        // Find space that ends the list
-        char *end = strchr(ptr, ' ');
-        if (end) {
-            *end++ = '\0';
-        }
-
-        int neg = 0;
-        if (*ptr == '!') {
-            neg++;
-            ptr++;
-        }
-
-        if (isascii(*ptr)) { // Par