README
¶
PureGoBpf is an all Go implementation for interacting with some of the Linux kernel's eBPF features. So far, PureGoBpf is focused on cls_bpf use cases so if you want to use it for other eBPF use cases there will be work to do. However, the map implementation is generic so it should work for other use cases.
You may also want to take a look at the GoBpf (https://github.com/iovisor/gobpf) project for another approach to interacting with eBPF that uses C Go.
Testing
Root permissions are required to run the tests because the tests load eBPF programs. Also, you will need to increase the locked memory limit in order to create the test map.
ulimit -l unlimited
Documentation
¶
Index ¶
- func BpfCreateMap(mapType uint32, keySize uint32, valueSize uint32, maxEntries uint32, ...) (int, error)
- func BpfLoadProg(file string, sections []string, sectionNameToFd map[string]int, ...) (error, error)
- func BpfMapDeleteElem(fd int, key MapKey) (bool, error)
- func BpfMapGetNextKey(fd int, key MapKey, result MapKey) (bool, error)
- func BpfMapLookupElem(fd int, key MapKey, entry MapEntry) (bool, error)
- func BpfMapUpdateElem(fd int, key MapKey, entry MapEntry, flags uint32) (bool, error)
- func BpfObjPin(fd int, pathname string) error
- func BpfObjUnpin(fd int) error
- func BpfPrintInsns(file string, section string) (string, error)
- type MapEntry
- type MapKey
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BpfCreateMap ¶
func BpfLoadProg ¶
func BpfLoadProg(file string, sections []string, sectionNameToFd map[string]int, mapNameToFd map[string]int) (error, error)
BpfLoadProg loads the BPF programs identified by section names from the passed ELF filename and creates any required BPF maps. On success, it returns a map from section name to Fd and a map from BPF map name to Fd and two nil error values. On failure, it returns two nils and one of two errors. The first error contains the BPF verifier failure (if any) and the second error contains the error result from the syscall or other.
func BpfMapGetNextKey ¶
BpfMapGetNextKey gets the next key after 'key' and stores it in 'result'. It returns true if there are more keys in the map, false if this is the last key or if there is an error.
func BpfMapUpdateElem ¶
BpfMapUpdateElem updates the position key in map fd with entry.
Source Files