pwru

Documentation

Index

• Constants
• Variables
• func GetFuncsByPos(funcs Funcs) map[int][]string
• func HaveBPFLinkKprobeMulti() bool
• func NewOutput(flags *Flags, printSkbMap *ebpf.Map, printStackMap *ebpf.Map, ...) (*output, error)
• type Addr2Name
  • func GetAddrs(funcs Funcs, all bool) (Addr2Name, error)
• type Event
• type FilterCfg
  • func GetConfig(flags *Flags) (cfg FilterCfg, err error)
• type Flags
  • func (f *Flags) Parse()
  • func (f *Flags) SetFlags()
• type Funcs
  • func GetFuncs(pattern string, spec *btf.Spec, kmods []string, kprobeMulti bool) (Funcs, error)
• type KProbeMaps
• type KProbeMapsWithOutputSKB
• type KProbeObjects
• type KProbePrograms
• type Meta
• type StackData
• type Tuple

Constants

const (
	MaxStackDepth = 50

	BackendKprobe      = "kprobe"
	BackendKprobeMulti = "kprobe-multi"
)

Variables

var Version string = "version unknown"

Version is the pwru version and is set at compile time via LDFLAGS-

Functions

func GetFuncsByPos

func GetFuncsByPos(funcs Funcs) map[int][]string

func HaveBPFLinkKprobeMulti

func HaveBPFLinkKprobeMulti() bool

Very hacky way to check whether multi-link kprobe is supported.

func NewOutput

func NewOutput(flags *Flags, printSkbMap *ebpf.Map, printStackMap *ebpf.Map,
	addr2Name Addr2Name, kprobeMulti bool, btfSpec *btf.Spec) (*output, error)

Types

type Addr2Name

type Addr2Name struct {
	Addr2NameMap   map[uint64]*ksym
	Addr2NameSlice []*ksym
}

func GetAddrs

func GetAddrs(funcs Funcs, all bool) (Addr2Name, error)

type Event

type Event struct {
	PID          uint32
	Type         uint32
	Addr         uint64
	SAddr        uint64
	Timestamp    uint64
	PrintSkbId   uint64
	Meta         Meta
	Tuple        Tuple
	PrintStackId int64
	ParamSecond  uint64
	CPU          uint32
}

type FilterCfg

type FilterCfg struct {
	FilterNetns   uint32
	FilterMark    uint32
	FilterIfindex uint32

	// TODO: if there are more options later, then you can consider using a bit map
	OutputRelativeTS uint8
	OutputMeta       uint8
	OutputTuple      uint8
	OutputSkb        uint8
	OutputStack      uint8

	IsSet    byte
	TrackSkb byte
}

func GetConfig

func GetConfig(flags *Flags) (cfg FilterCfg, err error)

type Flags

type Flags struct {
	ShowVersion bool

	KernelBTF string

	FilterNetns    string
	FilterMark     uint32
	FilterFunc     string
	FilterTrackSkb bool
	FilterIfname   string
	FilterPcap     string

	OutputTS         string
	OutputMeta       bool
	OutputTuple      bool
	OutputSkb        bool
	OutputStack      bool
	OutputLimitLines uint64
	OutputFile       string

	KMods    []string
	AllKMods bool

	ReadyFile string

	Backend string
}

func (*Flags) Parse

func (f *Flags) Parse()

func (*Flags) SetFlags

func (f *Flags) SetFlags()

type Funcs

type Funcs map[string]int

func GetFuncs

func GetFuncs(pattern string, spec *btf.Spec, kmods []string, kprobeMulti bool) (Funcs, error)

type KProbeMaps

type KProbeMaps interface {
	GetEvents() *ebpf.Map
	GetPrintStackMap() *ebpf.Map
}

type KProbeMapsWithOutputSKB

type KProbeMapsWithOutputSKB interface {
	KProbeMaps
	GetPrintSkbMap() *ebpf.Map
}

type KProbeObjects

type KProbeObjects interface {
	KProbeMaps
	KProbePrograms
	Close() error
}

type KProbePrograms

type KProbePrograms interface {
	GetKprobeSkb1() *ebpf.Program
	GetKprobeSkb2() *ebpf.Program
	GetKprobeSkb3() *ebpf.Program
	GetKprobeSkb4() *ebpf.Program
	GetKprobeSkb5() *ebpf.Program
	GetKprobeSkbLifetimeTermination() *ebpf.Program
}

type Meta

type Meta struct {
	Netns   uint32
	Mark    uint32
	Ifindex uint32
	Len     uint32
	MTU     uint32
	Proto   uint16
	Pad     uint16
}

type StackData

type StackData struct {
	IPs [MaxStackDepth]uint64
}

type Tuple

type Tuple struct {
	Saddr   [16]byte
	Daddr   [16]byte
	Sport   uint16
	Dport   uint16
	L3Proto uint16
	L4Proto uint8
	Pad     uint8
}