bpf

Documentation

Index

• Constants
• func CompileCbpf(expr string) (insts []bpf.Instruction, err error)
• func CompileEbpf(expr string, opts cbpfc.EBPFOpts) (insts asm.Instructions, err error)
• func InjectPcapFilter(program *ebpf.ProgramSpec, filterExpr string) (err error)
• func LoadBpf() (*ebpf.CollectionSpec, error)
• func LoadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error
• type Bpf
  • func New(ctx context.Context, progID int) (b *Bpf, err error)
  • func (b *Bpf) Attach(targetID int) (_ func(), err error)
  • func (b *Bpf) InjectPcapFilter(filter string) (err error)
  • func (b *Bpf) PollEvents(ctx context.Context) <-chan Event
• type BpfArgs
• type BpfContent
• type BpfDatum
• type BpfEvent
• type BpfMapSpecs
• type BpfMaps
  • func (m *BpfMaps) Close() error
• type BpfObjects
  • func (o *BpfObjects) Close() error
• type BpfProgramSpecs
• type BpfPrograms
  • func (p *BpfPrograms) Close() error
• type BpfSpecs
• type Event

Constants

const (
	MaxBpfInstructions = 4096

	MAXIMUM_SNAPLEN = 262144
)

Functions

func CompileCbpf

func CompileCbpf(expr string) (insts []bpf.Instruction, err error)

func CompileEbpf

func CompileEbpf(expr string, opts cbpfc.EBPFOpts) (insts asm.Instructions, err error)

func InjectPcapFilter

func InjectPcapFilter(program *ebpf.ProgramSpec, filterExpr string) (err error)

func LoadBpf

func LoadBpf() (*ebpf.CollectionSpec, error)

LoadBpf returns the embedded CollectionSpec for Bpf.

func LoadBpfObjects

func LoadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error

LoadBpfObjects loads Bpf and converts it into a struct.

The following types are suitable as obj argument:

*BpfObjects
*BpfPrograms
*BpfMaps

See ebpf.CollectionSpec.LoadAndAssign documentation for details.

Types

type Bpf

type Bpf struct {
	TargetName string
	// contains filtered or unexported fields
}

func New

func New(ctx context.Context, progID int) (b *Bpf, err error)

func (*Bpf) Attach

func (b *Bpf) Attach(targetID int) (_ func(), err error)

func (*Bpf) InjectPcapFilter

func (b *Bpf) InjectPcapFilter(filter string) (err error)

func (*Bpf) PollEvents

func (b *Bpf) PollEvents(ctx context.Context) <-chan Event

type BpfArgs

type BpfArgs struct {
	Skb uint64
	Arg [6]uint64
}

type BpfContent

type BpfContent struct {
	Skb   uint64
	Bytes [64]uint8
}

type BpfDatum

type BpfDatum struct {
	Skb     uint64
	Mark    uint32
	Payload [256]uint8
	// contains filtered or unexported fields
}

type BpfEvent

type BpfEvent struct {
	Ts   uint64
	Skb  uint64
	Pc   uint64
	By   uint64
	Type uint8
	// contains filtered or unexported fields
}

type BpfMapSpecs

type BpfMapSpecs struct {
	Argsbuf    *ebpf.MapSpec `ebpf:"argsbuf"`
	Bp2skb     *ebpf.MapSpec `ebpf:"bp2skb"`
	Contentbuf *ebpf.MapSpec `ebpf:"contentbuf"`
	Data       *ebpf.MapSpec `ebpf:"data"`
	Events     *ebpf.MapSpec `ebpf:"events"`
	Pc2param   *ebpf.MapSpec `ebpf:"pc2param"`
	Skbmatched *ebpf.MapSpec `ebpf:"skbmatched"`
}

BpfMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type BpfMaps

type BpfMaps struct {
	Argsbuf    *ebpf.Map `ebpf:"argsbuf"`
	Bp2skb     *ebpf.Map `ebpf:"bp2skb"`
	Contentbuf *ebpf.Map `ebpf:"contentbuf"`
	Data       *ebpf.Map `ebpf:"data"`
	Events     *ebpf.Map `ebpf:"events"`
	Pc2param   *ebpf.Map `ebpf:"pc2param"`
	Skbmatched *ebpf.Map `ebpf:"skbmatched"`
}

BpfMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfMaps) Close

func (m *BpfMaps) Close() error

type BpfObjects

type BpfObjects struct {
	BpfPrograms
	BpfMaps
}

BpfObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfObjects) Close

func (o *BpfObjects) Close() error

type BpfProgramSpecs

type BpfProgramSpecs struct {
	OffBpfHelper   *ebpf.ProgramSpec `ebpf:"off_bpf_helper"`
	OffTcfClassify *ebpf.ProgramSpec `ebpf:"off_tcf_classify"`
	OnBpfHelper    *ebpf.ProgramSpec `ebpf:"on_bpf_helper"`
	OnEntry        *ebpf.ProgramSpec `ebpf:"on_entry"`
	OnExit         *ebpf.ProgramSpec `ebpf:"on_exit"`
	OnTcfClassify  *ebpf.ProgramSpec `ebpf:"on_tcf_classify"`
}

BpfSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type BpfPrograms

type BpfPrograms struct {
	OffBpfHelper   *ebpf.Program `ebpf:"off_bpf_helper"`
	OffTcfClassify *ebpf.Program `ebpf:"off_tcf_classify"`
	OnBpfHelper    *ebpf.Program `ebpf:"on_bpf_helper"`
	OnEntry        *ebpf.Program `ebpf:"on_entry"`
	OnExit         *ebpf.Program `ebpf:"on_exit"`
	OnTcfClassify  *ebpf.Program `ebpf:"on_tcf_classify"`
}

BpfPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfPrograms) Close

func (p *BpfPrograms) Close() error

type BpfSpecs

type BpfSpecs struct {
	BpfProgramSpecs
	BpfMapSpecs
}

BpfSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type Event

type Event struct {
	BpfEvent
	BpfDatum
	BpfArgs
	Contents [6]BpfContent
}