pwru

Documentation

Index

• Constants
• Variables
• func ConfigBPFMap(flags *Flags, cfgMap *ebpf.Map)
• func NewOutput(flags *Flags, printSkbMap *ebpf.Map, printStackMap *ebpf.Map, ...) *output
• type Addr2Name
  • func GetAddrs(funcs Funcs, all bool) (Addr2Name, error)
• type Event
• type FilterCfg
• type Flags
  • func (f *Flags) SetFlags()
• type Funcs
  • func GetFuncs(pattern string, spec *btf.Spec, kmods []string) (Funcs, error)
• type Meta
• type StackData
• type Tuple

Constants

const (
	MaxStackDepth = 50
)

Variables

var Version string = "version unknown"

Version is the pwru version and is set at compile time via LDFLAGS-

Functions

func ConfigBPFMap

func ConfigBPFMap(flags *Flags, cfgMap *ebpf.Map)

func NewOutput

func NewOutput(flags *Flags, printSkbMap *ebpf.Map, printStackMap *ebpf.Map, addr2Name Addr2Name) *output

Types

type Addr2Name

type Addr2Name struct {
	Addr2NameMap   map[uint64]*ksym
	Addr2NameSlice []*ksym
}

func GetAddrs

func GetAddrs(funcs Funcs, all bool) (Addr2Name, error)

type Event

type Event struct {
	PID          uint32
	Type         uint32
	Addr         uint64
	SAddr        uint64
	Timestamp    uint64
	PrintSkbId   uint64
	Meta         Meta
	Tuple        Tuple
	PrintStackId int64
}

type FilterCfg

type FilterCfg struct {
	FilterNetns uint32
	FilterMark  uint32

	//Filter l3
	FilterIPv6  uint8
	FilterSrcIP [16]byte
	FilterDstIP [16]byte

	//Filter l4
	FilterProto   uint8
	FilterSrcPort uint16
	FilterDstPort uint16

	//TODO: if there are more options later, then you can consider using a bit map
	OutputRelativeTS uint8
	OutputMeta       uint8
	OutputTuple      uint8
	OutputSkb        uint8
	OutputStack      uint8

	Pad byte
}

type Flags

type Flags struct {
	ShowVersion bool

	KernelBTF string

	FilterNetns   uint32
	FilterMark    uint32
	FilterFunc    string
	FilterProto   string
	FilterSrcIP   string
	FilterDstIP   string
	FilterSrcPort uint16
	FilterDstPort uint16

	OutputRelativeTS bool
	OutputMeta       bool
	OutputTuple      bool
	OutputSkb        bool
	OutputStack      bool
	OutputLimitLines uint64

	PerCPUBuffer int
	KMods        []string
}

func (*Flags) SetFlags

func (f *Flags) SetFlags()

type Funcs

type Funcs map[string]int

func GetFuncs

func GetFuncs(pattern string, spec *btf.Spec, kmods []string) (Funcs, error)

type Meta

type Meta struct {
	Netns   uint32
	Mark    uint32
	Ifindex uint32
	Len     uint32
	MTU     uint32
	Proto   uint16
	Pad     uint16
}

type StackData

type StackData struct {
	IPs [MaxStackDepth]uint64
}

type Tuple

type Tuple struct {
	Saddr   [16]byte
	Daddr   [16]byte
	Sport   uint16
	Dport   uint16
	L3Proto uint16
	L4Proto uint8
	Pad     uint8
}