pwru

Documentation

Index

• Constants
• Variables
• func AttachKprobeMulti(ctx context.Context, bar *pb.ProgressBar, kprobes []Kprobe, a2n Addr2Name) (links []link.Link, ignored int)
• func AttachKprobes(ctx context.Context, bar *pb.ProgressBar, kps []Kprobe, batch uint) (links []link.Link, ignored int)
• func GetBpfHelpers(addr2name Addr2Name) (helpers []string, err error)
• func GetFuncsByPos(funcs Funcs) map[int][]string
• func HaveAvailableFilterFunctions() bool
• func HaveBPFLinkKprobeMulti() bool
• func HaveBPFLinkTracing() bool
• func NewKprober(ctx context.Context, funcs Funcs, coll *ebpf.Collection, a2n Addr2Name, ...) *kprober
• func NewNonSkbFuncsKprober(nonSkbFuncs []string, funcs Funcs, coll *ebpf.Collection) *kprober
• func NewOutput(flags *Flags, printSkbMap, printShinfoMap, printStackMap *ebpf.Map, ...) (*output, error)
• func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error)
• func TraceTC(coll *ebpf.Collection, spec *ebpf.CollectionSpec, opts *ebpf.CollectionOptions, ...) *tracing
• func TraceXDP(coll *ebpf.Collection, spec *ebpf.CollectionSpec, opts *ebpf.CollectionOptions, ...) *tracing
• func TrackSkb(coll *ebpf.Collection, haveFexit, trackSkbClone bool) *skbTracker
• type Addr2Name
• type BpfProgName2Addr
• type Event
• type FilterCfg
  • func GetConfig(flags *Flags) (cfg FilterCfg, err error)
• type Flags
  • func (f *Flags) Parse()
  • func (f *Flags) PrintHelp()
  • func (f *Flags) SetFlags()
• type Funcs
  • func GetFuncs(pattern string, spec *btf.Spec, kmods []string, kprobeMulti bool) (Funcs, error)
• type Kprobe
• type Meta
• type StackData
• type Tuple

Constants

const (
	OutputMetaMask uint8 = 1 << iota
	OutputTupleMask
	OutputSkbMask
	OutputShinfoMask
	OutputStackMask
	OutputCallerMask
)

const (
	IsSetMask uint8 = 1 << iota
	TrackSkbMask
	TrackSkbByStackidMask
	TrackXDPMask
)

const (
	MaxStackDepth = 50

	BackendKprobe      = "kprobe"
	BackendKprobeMulti = "kprobe-multi"
)

Variables

var Version string = "version unknown"

Version is the pwru version and is set at compile time via LDFLAGS-

Functions

func AttachKprobeMulti

func AttachKprobeMulti(ctx context.Context, bar *pb.ProgressBar, kprobes []Kprobe, a2n Addr2Name) (links []link.Link, ignored int)

AttachKprobeMulti attaches kprobe-multi serially.

func AttachKprobes

func AttachKprobes(ctx context.Context, bar *pb.ProgressBar, kps []Kprobe, batch uint) (links []link.Link, ignored int)

AttachKprobes attaches kprobes concurrently.

func GetBpfHelpers

func GetBpfHelpers(addr2name Addr2Name) (helpers []string, err error)

func GetFuncsByPos

func GetFuncsByPos(funcs Funcs) map[int][]string

func HaveAvailableFilterFunctions

func HaveAvailableFilterFunctions() bool

func HaveBPFLinkKprobeMulti

func HaveBPFLinkKprobeMulti() bool

Very hacky way to check whether multi-link kprobe is supported.

func HaveBPFLinkTracing

func HaveBPFLinkTracing() bool

Very hacky way to check whether tracing link is supported.

func NewKprober

func NewKprober(ctx context.Context, funcs Funcs, coll *ebpf.Collection, a2n Addr2Name, useKprobeMulti bool, batch uint) *kprober

func NewNonSkbFuncsKprober

func NewNonSkbFuncsKprober(nonSkbFuncs []string, funcs Funcs, coll *ebpf.Collection) *kprober

func NewOutput

func NewOutput(flags *Flags, printSkbMap, printShinfoMap, printStackMap *ebpf.Map, addr2Name Addr2Name, kprobeMulti bool, btfSpec *btf.Spec) (*output, error)

func ParseKallsyms

func ParseKallsyms(funcs Funcs, all bool) (Addr2Name, BpfProgName2Addr, error)

func TraceTC

func TraceTC(coll *ebpf.Collection, spec *ebpf.CollectionSpec,
	opts *ebpf.CollectionOptions, outputSkb bool, outputShinfo bool,
	n2a BpfProgName2Addr,
) *tracing

func TraceXDP

func TraceXDP(coll *ebpf.Collection, spec *ebpf.CollectionSpec,
	opts *ebpf.CollectionOptions, outputSkb bool, outputShinfo bool,
	n2a BpfProgName2Addr,
) *tracing

func TrackSkb

func TrackSkb(coll *ebpf.Collection, haveFexit, trackSkbClone bool) *skbTracker

Types

type Addr2Name

type Addr2Name struct {
	Addr2NameMap   map[uint64]*ksym
	Addr2NameSlice []*ksym
	Name2AddrMap   map[string][]uintptr
}

type BpfProgName2Addr

type BpfProgName2Addr map[string]uint64

type Event

type Event struct {
	PID           uint32
	Type          uint32
	Addr          uint64
	CallerAddr    uint64
	SkbAddr       uint64
	Timestamp     uint64
	PrintSkbId    uint64
	PrintShinfoId uint64
	Meta          Meta
	Tuple         Tuple
	PrintStackId  int64
	ParamSecond   uint64
	ParamThird    uint64
	CPU           uint32
}

type FilterCfg

type FilterCfg struct {
	FilterNetns   uint32
	FilterMark    uint32
	FilterIfindex uint32

	OutputFlags uint8
	FilterFlags uint8
}

func GetConfig

func GetConfig(flags *Flags) (cfg FilterCfg, err error)

type Flags

type Flags struct {
	ShowVersion bool
	ShowHelp    bool

	KernelBTF string

	FilterNetns             string
	FilterMark              uint32
	FilterFunc              string
	FilterNonSkbFuncs       []string
	FilterTrackSkb          bool
	FilterTrackSkbByStackid bool
	FilterTraceTc           bool
	FilterTraceXdp          bool
	FilterTrackBpfHelpers   bool
	FilterIfname            string
	FilterPcap              string
	FilterKprobeBatch       uint

	OutputTS         string
	OutputMeta       bool
	OutputTuple      bool
	OutputSkb        bool
	OutputShinfo     bool
	OutputStack      bool
	OutputCaller     bool
	OutputLimitLines uint64
	OutputFile       string
	OutputJson       bool

	KMods    []string
	AllKMods bool

	ReadyFile string

	Backend string
}

func (*Flags) Parse

func (f *Flags) Parse()

func (*Flags) PrintHelp

func (f *Flags) PrintHelp()

func (*Flags) SetFlags

func (f *Flags) SetFlags()

type Funcs

type Funcs map[string]int

func GetFuncs

func GetFuncs(pattern string, spec *btf.Spec, kmods []string, kprobeMulti bool) (Funcs, error)

type Kprobe

type Kprobe struct {
	HookFuncs []string
	Prog      *ebpf.Program
	// contains filtered or unexported fields
}

type Meta

type Meta struct {
	Netns   uint32
	Mark    uint32
	Ifindex uint32
	Len     uint32
	MTU     uint32
	Proto   uint16
	Pad     uint16
}

type StackData

type StackData struct {
	IPs [MaxStackDepth]uint64
}

type Tuple

type Tuple struct {
	Saddr   [16]byte
	Daddr   [16]byte
	Sport   uint16
	Dport   uint16
	L3Proto uint16
	L4Proto uint8
	Pad     uint8
}