bpf

package

Go to main page

Versions in this module

v0

v0.26.0

Oct 27, 2024

v0.25.0

Oct 19, 2024

Changes in this version

type BPF

+ func (b *BPF) PullMountEventEvents(ctx context.Context, chanSize int) (<-chan BpfMountEventT, error)

+ func (b *BPF) PullNetDeviceChangeEvents(ctx context.Context, chanSize int) (<-chan BpfNetdeviceChangeEventT, error)

+ func (b *BPF) PullNewNetDeviceEvents(ctx context.Context, chanSize int) (<-chan BpfNewNetdeviceEventT, error)

+ type BpfEnterMountBufT struct — darwin/amd64, linux/amd64, windows/amd64

+ Dest uint64

+ Fs uint64

+ Src uint64

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ EnterMountBufs *ebpf.MapSpec

+ MountEventStack *ebpf.MapSpec

+ MountEvents *ebpf.MapSpec

+ NetdeviceBufs *ebpf.MapSpec

+ NetdeviceChangeEvents *ebpf.MapSpec

+ NewNetdeviceEvents *ebpf.MapSpec

+ TidNetdeviceMap *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ EnterMountBufs *ebpf.Map

+ MountEventStack *ebpf.Map

+ MountEvents *ebpf.Map

+ NetdeviceBufs *ebpf.Map

+ NetdeviceChangeEvents *ebpf.Map

+ NewNetdeviceEvents *ebpf.Map

+ TidNetdeviceMap *ebpf.Map

+ type BpfMountEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ Dest [4096]int8

+ Fs [8]int8

+ Src [4096]int8

+ type BpfNetdeviceBufT struct — darwin/amd64, linux/amd64, windows/amd64

+ Dev uint64

+ Net uint64

+ type BpfNetdeviceChangeEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ NewDevice BpfNetdeviceT

+ OldDevice BpfNetdeviceT

+ type BpfNetdeviceT struct — darwin/amd64, linux/amd64, windows/amd64

+ Ifindex uint32

+ Name [16]int8

+ NetnsId uint32

+ type BpfNewNetdeviceEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ Dev BpfNetdeviceT

type BpfObjectsForLegacyKernel

+ KprobeDevChangeNetNamespace *ebpf.Program

+ KprobeDevChangeNetNamespaceLegacy *ebpf.Program

+ KprobeRegisterNetdevice *ebpf.Program

+ KretprobeDevChangeNetNamespace *ebpf.Program

+ KretprobeDevChangeNetNamespaceLegacy *ebpf.Program

+ KretprobeDevGetByIndex *ebpf.Program

+ KretprobeDevGetByIndexLegacy *ebpf.Program

+ KretprobeRegisterNetdevice *ebpf.Program

+ TracepointSyscallsSysEnterMount *ebpf.Program

+ TracepointSyscallsSysExitMount *ebpf.Program

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ KprobeDevChangeNetNamespace *ebpf.ProgramSpec

+ KprobeDevChangeNetNamespaceLegacy *ebpf.ProgramSpec

+ KprobeRegisterNetdevice *ebpf.ProgramSpec

+ KretprobeDevChangeNetNamespace *ebpf.ProgramSpec

+ KretprobeDevChangeNetNamespaceLegacy *ebpf.ProgramSpec

+ KretprobeDevGetByIndex *ebpf.ProgramSpec

+ KretprobeDevGetByIndexLegacy *ebpf.ProgramSpec

+ KretprobeRegisterNetdevice *ebpf.ProgramSpec

+ TracepointSyscallsSysEnterMount *ebpf.ProgramSpec

+ TracepointSyscallsSysExitMount *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ KprobeDevChangeNetNamespace *ebpf.Program

+ KprobeDevChangeNetNamespaceLegacy *ebpf.Program

+ KprobeRegisterNetdevice *ebpf.Program

+ KretprobeDevChangeNetNamespace *ebpf.Program

+ KretprobeDevChangeNetNamespaceLegacy *ebpf.Program

+ KretprobeDevGetByIndex *ebpf.Program

+ KretprobeDevGetByIndexLegacy *ebpf.Program

+ KretprobeRegisterNetdevice *ebpf.Program

+ TracepointSyscallsSysEnterMount *ebpf.Program

+ TracepointSyscallsSysExitMount *ebpf.Program

type Options

+ func (opts *Options) WithHookMount(v bool) *Options

+ func (opts *Options) WithHookNetDev(v bool) *Options

v0.24.0

Oct 4, 2024

v0.23.0

Sep 22, 2024

Changes in this version

type BPF

+ func (b *BPF) AttachGoTLSUprobeHooks(exec *link.Executable, symbol string, funcAddr uint64, retOffset uint64, ...) error

+ func (b *BPF) PullGoKeyLogEvents(ctx context.Context, chanSize int) (<-chan BpfGoKeylogEventT, error)

+ type BpfGoKeylogBufT struct — darwin/amd64, linux/amd64, windows/amd64

+ LabelLenPtr uint64

+ LabelPtr uint64

+ RandomLenPtr uint64

+ RandomPtr uint64

+ SecretLenPtr uint64

+ SecretPtr uint64

+ type BpfGoKeylogEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ ClientRandom [32]int8

+ ClientRandomLen uint8

+ Label [32]int8

+ LabelLen uint8

+ Secret [64]int8

+ SecretLen uint8

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ GoKeylogBufStorage *ebpf.MapSpec

+ GoKeylogEvents *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ GoKeylogBufStorage *ebpf.Map

+ GoKeylogEvents *ebpf.Map

type BpfObjectsForLegacyKernel

+ UprobeGoBuiltinTlsWriteKeyLog *ebpf.Program

+ UprobeGoBuiltinTlsWriteKeyLogRet *ebpf.Program

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ UprobeGoBuiltinTlsWriteKeyLog *ebpf.ProgramSpec

+ UprobeGoBuiltinTlsWriteKeyLogRet *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ UprobeGoBuiltinTlsWriteKeyLog *ebpf.Program

+ UprobeGoBuiltinTlsWriteKeyLogRet *ebpf.Program

v0.22.0

Sep 13, 2024

v0.21.0

Aug 25, 2024

v0.20.0

Aug 17, 2024

v0.19.0

Aug 10, 2024

Changes in this version

type BpfGconfigT — darwin/amd64, linux/amd64, windows/amd64

+ HaveFilter uint8

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ FilterMntnsMap *ebpf.MapSpec

+ FilterNetnsMap *ebpf.MapSpec

+ FilterPidnsMap *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ FilterMntnsMap *ebpf.Map

+ FilterNetnsMap *ebpf.Map

+ FilterPidnsMap *ebpf.Map

type Options

+ func (opts *Options) WithComm(comm string) *Options

+ func (opts *Options) WithFollowFork(v bool) *Options

+ func (opts *Options) WithKernelTypes(spec *btf.Spec) *Options

+ func (opts *Options) WithMaxPayloadSize(n uint32) *Options

+ func (opts *Options) WithMntNsIds(ids []uint32) *Options

+ func (opts *Options) WithNetNsIds(ids []uint32) *Options

+ func (opts *Options) WithPcapFilter(pcapFilter string) *Options

+ func (opts *Options) WithPidNsIds(ids []uint32) *Options

+ func (opts *Options) WithPids(pids []uint) *Options

v0.18.0

Aug 10, 2024

Changes in this version

type BpfProcessMetaT — darwin/amd64, linux/amd64, windows/amd64

+ PidnsId uint32

+ Ppid uint32

v0.17.0

Jul 20, 2024

Changes in this version

type BpfObjects — darwin/amd64, linux/amd64, windows/amd64

+ func (b *BpfObjects) FromLegacy(o *BpfObjectsForLegacyKernel)

+ type BpfObjectsForLegacyKernel struct

+ KprobeNfNatManipPkt *ebpf.Program

+ KprobeNfNatPacket *ebpf.Program

+ KprobeSecuritySkClassifyFlow *ebpf.Program

+ KprobeTcpSendmsg *ebpf.Program

+ KprobeUdpSendSkb *ebpf.Program

+ KprobeUdpSendmsg *ebpf.Program

+ RawTracepointSchedProcessExec *ebpf.Program

+ RawTracepointSchedProcessExit *ebpf.Program

+ RawTracepointSchedProcessFork *ebpf.Program

+ TcEgress *ebpf.Program

+ TcIngress *ebpf.Program

v0.16.0

Jul 6, 2024

Changes in this version

+ type BpfGconfigT struct — darwin/amd64, linux/amd64, windows/amd64

+ FilterComm [16]int8

+ FilterCommEnable uint8

+ FilterFollowForks uint8

+ FilterMntnsId uint32

+ FilterNetnsId uint32

+ FilterPid uint32

+ FilterPidnsId uint32

+ MaxPayloadSize uint32

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ ConfigMap *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ ConfigMap *ebpf.Map

type Options

+ KernelTypes *btf.Spec

v0.15.0

Jun 29, 2024

Changes in this version

type BPF

+ func (b *BPF) PullExitEvents(ctx context.Context, chanSize int) (<-chan BpfExitEventT, error)

+ type BpfExitEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ Pid uint32

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ ExitEvents *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ ExitEvents *ebpf.Map

+ type BpfPacketEventWithPayloadT struct

+ Payload []byte

v0.14.0

Jun 16, 2024

v0.13.0

Jun 16, 2024

v0.12.0

Jun 15, 2024

Changes in this version

type BpfObjectsWithoutCgroup

+ KprobeTcpSendmsg *ebpf.Program

+ KprobeUdpSendSkb *ebpf.Program

+ KprobeUdpSendmsg *ebpf.Program

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ KprobeTcpSendmsg *ebpf.ProgramSpec

+ KprobeUdpSendSkb *ebpf.ProgramSpec

+ KprobeUdpSendmsg *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ KprobeTcpSendmsg *ebpf.Program

+ KprobeUdpSendSkb *ebpf.Program

+ KprobeUdpSendmsg *ebpf.Program

v0.11.0

Jun 11, 2024

v0.10.0

Jun 9, 2024

Changes in this version

type BpfExecEventT — darwin/amd64, linux/amd64, windows/amd64

+ Meta BpfProcessMetaT

+ type BpfPacketEventMetaT struct — darwin/amd64, linux/amd64, windows/amd64

+ Ifindex uint32

+ PacketSize uint64

+ PacketType uint8

+ PayloadLen uint64

+ Process BpfProcessMetaT

+ Timestamp uint64

+ type BpfProcessMetaT struct — darwin/amd64, linux/amd64, windows/amd64

+ CgroupName [128]int8

+ MntnsId uint32

+ NetnsId uint32

+ Pid uint32

v0.9.0

May 29, 2024

Changes in this version

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ NatFlowMap *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ NatFlowMap *ebpf.Map

+ type BpfNatFlowT struct — darwin/amd64, linux/amd64, windows/amd64

+ Daddr [2]uint64

+ Dport uint16

+ Saddr [2]uint64

+ Sport uint16

type BpfObjectsWithoutCgroup

+ KprobeNfNatManipPkt *ebpf.Program

+ KprobeNfNatPacket *ebpf.Program

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ KprobeNfNatManipPkt *ebpf.ProgramSpec

+ KprobeNfNatPacket *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ KprobeNfNatManipPkt *ebpf.Program

+ KprobeNfNatPacket *ebpf.Program

v0.8.0

May 24, 2024

v0.7.0

May 18, 2024

Changes in this version

type BPF

+ func (b *BPF) CountReport() types.CountReport

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ FilterByKernelCount *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ FilterByKernelCount *ebpf.Map

v0.6.0

May 17, 2024

Changes in this version

type BPF

+ func (b *BPF) AttachCgroups(cgroupPath string) error

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ SockCookiePidMap *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ SockCookiePidMap *ebpf.Map

+ type BpfObjectsWithoutCgroup struct

+ KprobeSecuritySkClassifyFlow *ebpf.Program

+ RawTracepointSchedProcessExec *ebpf.Program

+ RawTracepointSchedProcessExit *ebpf.Program

+ RawTracepointSchedProcessFork *ebpf.Program

+ TcEgress *ebpf.Program

+ TcIngress *ebpf.Program

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ CgroupSockCreate *ebpf.ProgramSpec

+ CgroupSockRelease *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ CgroupSockCreate *ebpf.Program

+ CgroupSockRelease *ebpf.Program

v0.5.2

May 10, 2024

Changes in this version

type BPF

+ func (b *BPF) UpdateFlowPidMapValues(data map[*BpfFlowPidKeyT]BpfFlowPidValueT) error

v0.5.1

May 7, 2024

v0.5.0

May 7, 2024

v0.4.0

May 5, 2024

v0.3.0

May 3, 2024

Changes in this version

type BpfProgramSpecs — darwin/amd64, linux/amd64, windows/amd64

+ RawTracepointSchedProcessExec *ebpf.ProgramSpec

+ RawTracepointSchedProcessExit *ebpf.ProgramSpec

+ RawTracepointSchedProcessFork *ebpf.ProgramSpec

type BpfPrograms — darwin/amd64, linux/amd64, windows/amd64

+ RawTracepointSchedProcessExec *ebpf.Program

+ RawTracepointSchedProcessExit *ebpf.Program

+ RawTracepointSchedProcessFork *ebpf.Program

v0.2.1

Apr 29, 2024

v0.2.0

Apr 28, 2024

Changes in this version

type BPF

+ func (b *BPF) PullExecEvents(ctx context.Context) (<-chan BpfExecEventT, error)

+ func (b *BPF) PullPacketEvents(ctx context.Context) (<-chan BpfPacketEventT, error)

type BpfMapSpecs — darwin/amd64, linux/amd64, windows/amd64

+ ExecEventStack *ebpf.MapSpec

+ PacketEventStack *ebpf.MapSpec

type BpfMaps — darwin/amd64, linux/amd64, windows/amd64

+ ExecEventStack *ebpf.Map

+ PacketEventStack *ebpf.Map

v0.1.0

Apr 27, 2024

Changes in this version

+ func LoadBpf() (*ebpf.CollectionSpec, error) — darwin/amd64, linux/amd64, windows/amd64

+ func LoadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error — darwin/amd64, linux/amd64, windows/amd64

+ type BPF struct

+ func NewBPF() (*BPF, error)

+ func (b *BPF) AttachKprobes() error

+ func (b *BPF) AttachTcHooks(ifindex int) error

+ func (b *BPF) AttachTracepoints() error

+ func (b *BPF) Close()

+ func (b *BPF) Load(opts Options) error

+ func (b *BPF) NewExecEventReader() (*ringbuf.Reader, error)

+ func (b *BPF) NewPacketEventReader() (*perf.Reader, error)

+ type BpfExecEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ Args [4096]int8

+ ArgsSize uint32

+ ArgsTruncated uint8

+ Filename [512]int8

+ FilenameTruncated uint8

+ Pid uint32

+ type BpfFlowPidKeyT struct — darwin/amd64, linux/amd64, windows/amd64

+ Saddr [4]uint32

+ Sport uint16

+ type BpfFlowPidValueT struct — darwin/amd64, linux/amd64, windows/amd64

+ Comm [16]int8

+ Pid uint32

+ TtyName [64]int8

+ type BpfMapSpecs struct — darwin/amd64, linux/amd64, windows/amd64

+ BpfStack *ebpf.MapSpec

+ ExecEvents *ebpf.MapSpec

+ FilterPidMap *ebpf.MapSpec

+ FlowPidMap *ebpf.MapSpec

+ PacketEvents *ebpf.MapSpec

+ type BpfMaps struct — darwin/amd64, linux/amd64, windows/amd64

+ BpfStack *ebpf.Map

+ ExecEvents *ebpf.Map

+ FilterPidMap *ebpf.Map

+ FlowPidMap *ebpf.Map

+ PacketEvents *ebpf.Map

+ func (m *BpfMaps) Close() error

+ type BpfObjects struct — darwin/amd64, linux/amd64, windows/amd64

+ func (o *BpfObjects) Close() error

+ type BpfPacketEventT struct — darwin/amd64, linux/amd64, windows/amd64

+ Meta struct{ ... }

+ Payload [1500]uint8

+ type BpfProgramSpecs struct — darwin/amd64, linux/amd64, windows/amd64

+ KprobeSecuritySkClassifyFlow *ebpf.ProgramSpec

+ TcEgress *ebpf.ProgramSpec

+ TcIngress *ebpf.ProgramSpec

+ TracepointSchedSchedProcessExec *ebpf.ProgramSpec

+ TracepointSyscallsSysExitClone *ebpf.ProgramSpec

+ TracepointSyscallsSysExitClone3 *ebpf.ProgramSpec

+ TracepointSyscallsSysExitFork *ebpf.ProgramSpec

+ TracepointSyscallsSysExitVfork *ebpf.ProgramSpec

+ type BpfPrograms struct — darwin/amd64, linux/amd64, windows/amd64

+ KprobeSecuritySkClassifyFlow *ebpf.Program

+ TcEgress *ebpf.Program

+ TcIngress *ebpf.Program

+ TracepointSchedSchedProcessExec *ebpf.Program

+ TracepointSyscallsSysExitClone *ebpf.Program

+ TracepointSyscallsSysExitClone3 *ebpf.Program

+ TracepointSyscallsSysExitFork *ebpf.Program

+ TracepointSyscallsSysExitVfork *ebpf.Program

+ func (p *BpfPrograms) Close() error

+ type BpfSpecs struct — darwin/amd64, linux/amd64, windows/amd64

+ type Options struct

+ Comm [16]int8

+ FollowForks uint8

+ PcapFilter string

+ Pid uint32

+ func NewOptions(pid uint, comm string, followForks bool, pcapFilter string) Options

v0.1.0-dev.1

Apr 27, 2024

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL