bpf

Documentation

Index

• func LoadBpf() (*ebpf.CollectionSpec, error)
• func LoadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error
• type BPF
  • func NewBPF() (*BPF, error)
  • func (b *BPF) AttachCgroups(cgroupPath string) error
  • func (b *BPF) AttachKprobes() error
  • func (b *BPF) AttachTcHooks(ifindex int, egress, ingress bool) error
  • func (b *BPF) AttachTracepoints() error
  • func (b *BPF) Close()
  • func (b *BPF) CountReport() types.CountReport
  • func (b *BPF) Load(opts Options) error
  • func (b *BPF) PullExecEvents(ctx context.Context, chanSize int) (<-chan BpfExecEventT, error)
  • func (b *BPF) PullPacketEvents(ctx context.Context, chanSize int) (<-chan BpfPacketEventT, error)
  • func (b *BPF) UpdateFlowPidMapValues(data map[*BpfFlowPidKeyT]BpfFlowPidValueT) error
• type BpfExecEventT
• type BpfFlowPidKeyT
• type BpfFlowPidValueT
• type BpfMapSpecs
• type BpfMaps
  • func (m *BpfMaps) Close() error
• type BpfObjects
  • func (o *BpfObjects) Close() error
• type BpfObjectsWithoutCgroup
• type BpfPacketEventT
• type BpfProgramSpecs
• type BpfPrograms
  • func (p *BpfPrograms) Close() error
• type BpfSpecs
• type Options
  • func NewOptions(pid uint, comm string, followForks bool, pcapFilter string) Options

Functions

func LoadBpf

func LoadBpf() (*ebpf.CollectionSpec, error)

LoadBpf returns the embedded CollectionSpec for Bpf.

func LoadBpfObjects

func LoadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error

LoadBpfObjects loads Bpf and converts it into a struct.

The following types are suitable as obj argument:

*BpfObjects
*BpfPrograms
*BpfMaps

See ebpf.CollectionSpec.LoadAndAssign documentation for details.

Types

type BPF

type BPF struct {
	// contains filtered or unexported fields
}

func NewBPF

func NewBPF() (*BPF, error)

func (*BPF) AttachCgroups

func (b *BPF) AttachCgroups(cgroupPath string) error

func (*BPF) AttachKprobes

func (b *BPF) AttachKprobes() error

func (*BPF) AttachTcHooks

func (b *BPF) AttachTcHooks(ifindex int, egress, ingress bool) error

func (*BPF) AttachTracepoints

func (b *BPF) AttachTracepoints() error

func (*BPF) Close

func (b *BPF) Close()

func (*BPF) CountReport

func (b *BPF) CountReport() types.CountReport

func (*BPF) Load

func (b *BPF) Load(opts Options) error

func (*BPF) PullExecEvents

func (b *BPF) PullExecEvents(ctx context.Context, chanSize int) (<-chan BpfExecEventT, error)

func (*BPF) PullPacketEvents

func (b *BPF) PullPacketEvents(ctx context.Context, chanSize int) (<-chan BpfPacketEventT, error)

func (*BPF) UpdateFlowPidMapValues

func (b *BPF) UpdateFlowPidMapValues(data map[*BpfFlowPidKeyT]BpfFlowPidValueT) error

type BpfExecEventT

type BpfExecEventT struct {
	Pid               uint32
	FilenameTruncated uint8
	ArgsTruncated     uint8

	ArgsSize uint32
	Filename [512]int8
	Args     [4096]int8
	// contains filtered or unexported fields
}

type BpfFlowPidKeyT

type BpfFlowPidKeyT struct {
	Saddr [4]uint32
	Sport uint16
	// contains filtered or unexported fields
}

type BpfFlowPidValueT

type BpfFlowPidValueT struct{ Pid uint32 }

type BpfMapSpecs

type BpfMapSpecs struct {
	ExecEventStack      *ebpf.MapSpec `ebpf:"exec_event_stack"`
	ExecEvents          *ebpf.MapSpec `ebpf:"exec_events"`
	FilterByKernelCount *ebpf.MapSpec `ebpf:"filter_by_kernel_count"`
	FilterPidMap        *ebpf.MapSpec `ebpf:"filter_pid_map"`
	FlowPidMap          *ebpf.MapSpec `ebpf:"flow_pid_map"`
	PacketEventStack    *ebpf.MapSpec `ebpf:"packet_event_stack"`
	PacketEvents        *ebpf.MapSpec `ebpf:"packet_events"`
	SockCookiePidMap    *ebpf.MapSpec `ebpf:"sock_cookie_pid_map"`
}

BpfMapSpecs contains maps before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type BpfMaps

type BpfMaps struct {
	ExecEventStack      *ebpf.Map `ebpf:"exec_event_stack"`
	ExecEvents          *ebpf.Map `ebpf:"exec_events"`
	FilterByKernelCount *ebpf.Map `ebpf:"filter_by_kernel_count"`
	FilterPidMap        *ebpf.Map `ebpf:"filter_pid_map"`
	FlowPidMap          *ebpf.Map `ebpf:"flow_pid_map"`
	PacketEventStack    *ebpf.Map `ebpf:"packet_event_stack"`
	PacketEvents        *ebpf.Map `ebpf:"packet_events"`
	SockCookiePidMap    *ebpf.Map `ebpf:"sock_cookie_pid_map"`
}

BpfMaps contains all maps after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfMaps) Close

func (m *BpfMaps) Close() error

type BpfObjects

type BpfObjects struct {
	BpfPrograms
	BpfMaps
}

BpfObjects contains all objects after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfObjects) Close

func (o *BpfObjects) Close() error

type BpfObjectsWithoutCgroup

type BpfObjectsWithoutCgroup struct {
	KprobeSecuritySkClassifyFlow  *ebpf.Program `ebpf:"kprobe__security_sk_classify_flow"`
	RawTracepointSchedProcessExec *ebpf.Program `ebpf:"raw_tracepoint__sched_process_exec"`
	RawTracepointSchedProcessExit *ebpf.Program `ebpf:"raw_tracepoint__sched_process_exit"`
	RawTracepointSchedProcessFork *ebpf.Program `ebpf:"raw_tracepoint__sched_process_fork"`
	TcEgress                      *ebpf.Program `ebpf:"tc_egress"`
	TcIngress                     *ebpf.Program `ebpf:"tc_ingress"`

	BpfMaps
}

type BpfPacketEventT

type BpfPacketEventT struct {
	Meta struct {
		Timestamp  uint64
		PacketType uint8

		Ifindex uint32
		Pid     uint32

		PayloadLen uint64
		PacketSize uint64
		// contains filtered or unexported fields
	}
	Payload [1500]uint8
	// contains filtered or unexported fields
}

type BpfProgramSpecs

type BpfProgramSpecs struct {
	CgroupSockCreate              *ebpf.ProgramSpec `ebpf:"cgroup__sock_create"`
	CgroupSockRelease             *ebpf.ProgramSpec `ebpf:"cgroup__sock_release"`
	KprobeSecuritySkClassifyFlow  *ebpf.ProgramSpec `ebpf:"kprobe__security_sk_classify_flow"`
	RawTracepointSchedProcessExec *ebpf.ProgramSpec `ebpf:"raw_tracepoint__sched_process_exec"`
	RawTracepointSchedProcessExit *ebpf.ProgramSpec `ebpf:"raw_tracepoint__sched_process_exit"`
	RawTracepointSchedProcessFork *ebpf.ProgramSpec `ebpf:"raw_tracepoint__sched_process_fork"`
	TcEgress                      *ebpf.ProgramSpec `ebpf:"tc_egress"`
	TcIngress                     *ebpf.ProgramSpec `ebpf:"tc_ingress"`
}

BpfSpecs contains programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type BpfPrograms

type BpfPrograms struct {
	CgroupSockCreate              *ebpf.Program `ebpf:"cgroup__sock_create"`
	CgroupSockRelease             *ebpf.Program `ebpf:"cgroup__sock_release"`
	KprobeSecuritySkClassifyFlow  *ebpf.Program `ebpf:"kprobe__security_sk_classify_flow"`
	RawTracepointSchedProcessExec *ebpf.Program `ebpf:"raw_tracepoint__sched_process_exec"`
	RawTracepointSchedProcessExit *ebpf.Program `ebpf:"raw_tracepoint__sched_process_exit"`
	RawTracepointSchedProcessFork *ebpf.Program `ebpf:"raw_tracepoint__sched_process_fork"`
	TcEgress                      *ebpf.Program `ebpf:"tc_egress"`
	TcIngress                     *ebpf.Program `ebpf:"tc_ingress"`
}

BpfPrograms contains all programs after they have been loaded into the kernel.

It can be passed to LoadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.

func (*BpfPrograms) Close

func (p *BpfPrograms) Close() error

type BpfSpecs

type BpfSpecs struct {
	BpfProgramSpecs
	BpfMapSpecs
}

BpfSpecs contains maps and programs before they are loaded into the kernel.

It can be passed ebpf.CollectionSpec.Assign.

type Options

type Options struct {
	Pid  uint32
	Comm [16]int8

	FollowForks uint8
	PcapFilter  string
	// contains filtered or unexported fields
}

func NewOptions

func NewOptions(pid uint, comm string, followForks bool, pcapFilter string) Options