libbpfgo

package module
v1.0.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 11, 2023 License: Apache-2.0 Imports: 13 Imported by: 35

README

libbpfgo

Documentation

Index

Constants

View Source 
const (
	// libbpf print levels
	LibbpfWarnLevel  = int(C.LIBBPF_WARN)
	LibbpfInfoLevel  = int(C.LIBBPF_INFO)
	LibbpfDebugLevel = int(C.LIBBPF_DEBUG)
)

Variables

This section is empty.

Functions

func BPFMapTypeIsSupported 

func BPFMapTypeIsSupported(mapType MapType) (bool, error)

func BPFProgramTypeIsSupported 

func BPFProgramTypeIsSupported(progType BPFProgType) (bool, error)

func GetBTFFDByID added in v1.0.0 

func GetBTFFDByID(id uint32) (int, error)

GetBTFFDByID returns a file descriptor for the BTF with the given ID.

func GetMapFDByID added in v1.0.0 

func GetMapFDByID(id uint32) (int, error)

GetMapFDByID returns a file descriptor for the map with the given ID.

func GetMapNextID added in v1.0.0 

func GetMapNextID(startId uint32) (uint32, error)

GetMapNextID retrieves the next available map ID after the given startID. It returns the next map ID and an error if one occurs during the operation.

func GetMapsIDsByName added in v1.0.0 

func GetMapsIDsByName(name string, startId *uint32) ([]uint32, error)

GetMapsIDsByName searches for maps with a specified name and collects their IDs. It starts the search from the given 'startId' and continues until no more matching maps are found. The function returns a slice of unsigned 32-bit integers representing the IDs of matching maps. If no maps with the provided 'name' are found, it returns an empty slice and no error. The 'startId' is modified and returned as the last processed map ID.

Example Usage: 

name := "myMap"          // The name of the map you want to find.
startId := uint32(0)     // The map ID to start the search from.

var mapIDs []uint32      // Initialize an empty slice to collect map IDs.
var err error            // Initialize an error variable.

// Retry mechanism in case of errors using the last processed 'startId'.
for {
    mapIDs, err = GetMapsIDsByName(name, startId)
    if err != nil {
        // Handle other errors, possibly with a retry mechanism.
        // You can use the 'startId' who contains the last processed map ID to continue the search.
    } else {
        // Successful search, use the 'mapIDs' slice containing the IDs of matching maps.
        // Update 'startId' to the last processed map ID to continue the search.
    }
}

func LibbpfVersionString 

func LibbpfVersionString() string

LibbpfVersionString returns the string representation of the libbpf version which libbpfgo is linked against

func MajorVersion 

func MajorVersion() int

MajorVersion returns the major semver version of libbpf.

func MinorVersion 

func MinorVersion() int

MinorVersion returns the minor semver version of libbpf.

func NumPossibleCPUs 

func NumPossibleCPUs() (int, error)

func SetLoggerCbs 

func SetLoggerCbs(cbs Callbacks)

SetLoggerCbs receives Callbacks type to be used to log libbpf outputs and to filter out those outputs

func SetStrictMode 

func SetStrictMode(mode LibbpfStrictMode)

SetStrictMode is no-op as of libbpf v1.0

Types

type AttachFlag 

type AttachFlag uint32
const (
	BPFFNone          AttachFlag = 0
	BPFFAllowOverride AttachFlag = C.BPF_F_ALLOW_OVERRIDE
	BPFFAllowMulti    AttachFlag = C.BPF_F_ALLOW_MULTI
	BPFFReplace       AttachFlag = C.BPF_F_REPLACE
)

type BPFAttachType 

type BPFAttachType uint32
const (
	BPFAttachTypeCgroupInetIngress          BPFAttachType = C.BPF_CGROUP_INET_INGRESS
	BPFAttachTypeCgroupInetEgress           BPFAttachType = C.BPF_CGROUP_INET_EGRESS
	BPFAttachTypeCgroupInetSockCreate       BPFAttachType = C.BPF_CGROUP_INET_SOCK_CREATE
	BPFAttachTypeCgroupSockOps              BPFAttachType = C.BPF_CGROUP_SOCK_OPS
	BPFAttachTypeSKSKBStreamParser          BPFAttachType = C.BPF_SK_SKB_STREAM_PARSER
	BPFAttachTypeSKSKBStreamVerdict         BPFAttachType = C.BPF_SK_SKB_STREAM_VERDICT
	BPFAttachTypeCgroupDevice               BPFAttachType = C.BPF_CGROUP_DEVICE
	BPFAttachTypeSKMSGVerdict               BPFAttachType = C.BPF_SK_MSG_VERDICT
	BPFAttachTypeCgroupInet4Bind            BPFAttachType = C.BPF_CGROUP_INET4_BIND
	BPFAttachTypeCgroupInet6Bind            BPFAttachType = C.BPF_CGROUP_INET6_BIND
	BPFAttachTypeCgroupInet4Connect         BPFAttachType = C.BPF_CGROUP_INET4_CONNECT
	BPFAttachTypeCgroupInet6Connect         BPFAttachType = C.BPF_CGROUP_INET6_CONNECT
	BPFAttachTypeCgroupInet4PostBind        BPFAttachType = C.BPF_CGROUP_INET4_POST_BIND
	BPFAttachTypeCgroupInet6PostBind        BPFAttachType = C.BPF_CGROUP_INET6_POST_BIND
	BPFAttachTypeCgroupUDP4SendMsg          BPFAttachType = C.BPF_CGROUP_UDP4_SENDMSG
	BPFAttachTypeCgroupUDP6SendMsg          BPFAttachType = C.BPF_CGROUP_UDP6_SENDMSG
	BPFAttachTypeLircMode2                  BPFAttachType = C.BPF_LIRC_MODE2
	BPFAttachTypeFlowDissector              BPFAttachType = C.BPF_FLOW_DISSECTOR
	BPFAttachTypeCgroupSysctl               BPFAttachType = C.BPF_CGROUP_SYSCTL
	BPFAttachTypeCgroupUDP4RecvMsg          BPFAttachType = C.BPF_CGROUP_UDP4_RECVMSG
	BPFAttachTypeCgroupUDP6RecvMsg          BPFAttachType = C.BPF_CGROUP_UDP6_RECVMSG
	BPFAttachTypeCgroupGetSockOpt           BPFAttachType = C.BPF_CGROUP_GETSOCKOPT
	BPFAttachTypeCgroupSetSockOpt           BPFAttachType = C.BPF_CGROUP_SETSOCKOPT
	BPFAttachTypeTraceRawTP                 BPFAttachType = C.BPF_TRACE_RAW_TP
	BPFAttachTypeTraceFentry                BPFAttachType = C.BPF_TRACE_FENTRY
	BPFAttachTypeTraceFexit                 BPFAttachType = C.BPF_TRACE_FEXIT
	BPFAttachTypeModifyReturn               BPFAttachType = C.BPF_MODIFY_RETURN
	BPFAttachTypeLSMMac                     BPFAttachType = C.BPF_LSM_MAC
	BPFAttachTypeTraceIter                  BPFAttachType = C.BPF_TRACE_ITER
	BPFAttachTypeCgroupInet4GetPeerName     BPFAttachType = C.BPF_CGROUP_INET4_GETPEERNAME
	BPFAttachTypeCgroupInet6GetPeerName     BPFAttachType = C.BPF_CGROUP_INET6_GETPEERNAME
	BPFAttachTypeCgroupInet4GetSockName     BPFAttachType = C.BPF_CGROUP_INET4_GETSOCKNAME
	BPFAttachTypeCgroupInet6GetSockName     BPFAttachType = C.BPF_CGROUP_INET6_GETSOCKNAME
	BPFAttachTypeXDPDevMap                  BPFAttachType = C.BPF_XDP_DEVMAP
	BPFAttachTypeCgroupInetSockRelease      BPFAttachType = C.BPF_CGROUP_INET_SOCK_RELEASE
	BPFAttachTypeXDPCPUMap                  BPFAttachType = C.BPF_XDP_CPUMAP
	BPFAttachTypeSKLookup                   BPFAttachType = C.BPF_SK_LOOKUP
	BPFAttachTypeXDP                        BPFAttachType = C.BPF_XDP
	BPFAttachTypeSKSKBVerdict               BPFAttachType = C.BPF_SK_SKB_VERDICT
	BPFAttachTypeSKReusePortSelect          BPFAttachType = C.BPF_SK_REUSEPORT_SELECT
	BPFAttachTypeSKReusePortSelectorMigrate BPFAttachType = C.BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
	BPFAttachTypePerfEvent                  BPFAttachType = C.BPF_PERF_EVENT
	BPFAttachTypeTraceKprobeMulti           BPFAttachType = C.BPF_TRACE_KPROBE_MULTI
)

func (BPFAttachType) Name added in v1.0.0 

func (t BPFAttachType) Name() string

func (BPFAttachType) String added in v1.0.0 

func (t BPFAttachType) String() string

type BPFCgroupIterOrder 

type BPFCgroupIterOrder uint32
const (
	BPFIterOrderUnspec BPFCgroupIterOrder = iota
	BPFIterSelfOnly
	BPFIterDescendantsPre
	BPFIterDescendantsPost
	BPFIterAncestorsUp
)
type BPFLink struct {
	// contains filtered or unexported fields
}

func (*BPFLink) Destroy 

func (l *BPFLink) Destroy() error

func (*BPFLink) DestroyLegacy 

func (l *BPFLink) DestroyLegacy(linkType LinkType) error

func (*BPFLink) FileDescriptor 

func (l *BPFLink) FileDescriptor() int

func (*BPFLink) GetFd deprecated 

func (l *BPFLink) GetFd() int

Deprecated: use BPFLink.FileDescriptor() instead.

func (*BPFLink) Pin 

func (l *BPFLink) Pin(pinPath string) error

func (*BPFLink) Reader 

func (l *BPFLink) Reader() (*BPFLinkReader, error)

func (*BPFLink) Unpin 

func (l *BPFLink) Unpin() error

type BPFLinkReader 

type BPFLinkReader struct {
	// contains filtered or unexported fields
}

BPFLinkReader read data from a BPF link

func (*BPFLinkReader) Close 

func (i *BPFLinkReader) Close() error

func (*BPFLinkReader) Read 

func (i *BPFLinkReader) Read(p []byte) (n int, err error)

type BPFMap 

type BPFMap struct {
	// contains filtered or unexported fields
}

BPFMap is a wrapper around a libbpf bpf_map.

func (*BPFMap) Autocreate added in v1.0.0 

func (m *BPFMap) Autocreate() bool

func (*BPFMap) BTFKeyTypeID added in v1.0.0 

func (m *BPFMap) BTFKeyTypeID() uint32

func (*BPFMap) BTFValueTypeID added in v1.0.0 

func (m *BPFMap) BTFValueTypeID() uint32

func (*BPFMap) DeleteKey 

func (m *BPFMap) DeleteKey(key unsafe.Pointer) error

DeleteKey removes a specified key and its associated value from the BPFMap.

This function accepts an unsafe.Pointer that references the key to be removed from the map. All basic types, and structs are supported as keys.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

func (*BPFMap) DeleteKeyBatch 

func (m *BPFMap) DeleteKeyBatch(keys unsafe.Pointer, count uint32) error

DeleteKeyBatch allows for batch deletion of multiple elements in the map.

`count` number of keys will be deleted from the map. Passing an argument that greater than the number of keys in the map will cause the function to delete fewer keys than requested. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) FileDescriptor 

func (m *BPFMap) FileDescriptor() int

func (*BPFMap) GetFd deprecated 

func (m *BPFMap) GetFd() int

Deprecated: use BPFMap.FileDescriptor() instead.

func (*BPFMap) GetMaxEntries deprecated 

func (m *BPFMap) GetMaxEntries() uint32

Deprecated: use BPFMap.MaxEntries() instead.

func (*BPFMap) GetModule deprecated 

func (m *BPFMap) GetModule() *Module

Deprecated: use BPFMap.Module() instead.

func (*BPFMap) GetName deprecated 

func (m *BPFMap) GetName() string

Deprecated: use BPFMap.Name() instead.

func (*BPFMap) GetPinPath deprecated 

func (m *BPFMap) GetPinPath() string

Deprecated: use BPFMap.PinPath() instead.

func (*BPFMap) GetValue 

func (m *BPFMap) GetValue(key unsafe.Pointer) ([]byte, error)

GetValue retrieves the value associated with a given key in the BPFMap.

This function accepts an unsafe.Pointer to the key value to be searched in the map, and it returns the corresponding value as a slice of bytes. All basic types, and structs are supported as keys.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

For example:

key := []byte{'a', 'b', 'c'} keyPtr := unsafe.Pointer(&key[0]) bpfmap.GetValue(keyPtr)

func (*BPFMap) GetValueAndDeleteBatch 

func (m *BPFMap) GetValueAndDeleteBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, error)

GetValueAndDeleteBatch allows for batch lookup and deletion of elements where each element is deleted after being retrieved from the map.

The first argument, keys, is a pointer to an array or slice of keys which will be populated with the keys returned from this operation. It returns the associated values as a slice of slices of bytes.

This API allows for batch lookups and deletion of multiple keys, potentially in steps over multiple iterations. For example, you provide the last key seen (or nil) for the startKey, and the first key to start the next iteration with in nextKey. Once the first iteration is complete you can provide the last key seen in the previous iteration as the startKey for the next iteration and repeat until nextKey is nil.

The last argument, count, is the number of keys to lookup and delete. The kernel will update it with the count of the elements that were retrieved and deleted.

The API can return partial results even though an -1 is returned. In this case, errno will be set to `ENOENT` and the values slice and count will be filled in with the elements that were read. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) GetValueBatch 

func (m *BPFMap) GetValueBatch(keys unsafe.Pointer, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, error)

GetValueBatch allows for batch lookups of multiple keys from the map.

The first argument, keys, is a pointer to an array or slice of keys which will be populated with the keys returned from this operation. It returns the associated values as a slice of slices of bytes.

This API allows for batch lookups of multiple keys, potentially in steps over multiple iterations. For example, you provide the last key seen (or nil) for the startKey, and the first key to start the next iteration with in nextKey. Once the first iteration is complete you can provide the last key seen in the previous iteration as the startKey for the next iteration and repeat until nextKey is nil.

The last argument, count, is the number of keys to lookup. The kernel will update it with the count of the elements that were retrieved.

The API can return partial results even though an -1 is returned. In this case, errno will be set to `ENOENT` and the values slice and count will be filled in with the elements that were read. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) GetValueFlags 

func (m *BPFMap) GetValueFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

func (*BPFMap) GetValueReadInto deprecated 

func (m *BPFMap) GetValueReadInto(key unsafe.Pointer, value *[]byte) error

Deprecated: use BPFMap.GetValue() or BPFMap.GetValueFlags() instead, since they already calculate the value size for per-cpu maps.

func (*BPFMap) IfIndex added in v1.0.0 

func (m *BPFMap) IfIndex() uint32

func (*BPFMap) InitialValue added in v1.0.0 

func (m *BPFMap) InitialValue() ([]byte, error)

func (*BPFMap) InnerMapInfo added in v1.0.0 

func (m *BPFMap) InnerMapInfo() (*BPFMapInfo, error)

InnerMap retrieves the inner map prototype information associated with a BPFMap that represents a map of maps.

NOTE: It must be called before the module is loaded, since it is a prototype destroyed right after the outer map is created.

Reference: https://lore.kernel.org/bpf/20200429002739.48006-4-andriin@fb.com/

func (*BPFMap) IsPinned 

func (m *BPFMap) IsPinned() bool

func (*BPFMap) Iterator 

func (m *BPFMap) Iterator() *BPFMapIterator

func (*BPFMap) KeySize 

func (m *BPFMap) KeySize() int

func (*BPFMap) MapExtra added in v1.0.0 

func (m *BPFMap) MapExtra() uint64

func (*BPFMap) MapFlags added in v1.0.0 

func (m *BPFMap) MapFlags() MapFlag

func (*BPFMap) MaxEntries added in v1.0.0 

func (m *BPFMap) MaxEntries() uint32

MaxEntries returns the capacity of the BPFMap.

For ring and perf buffer types, this returns the capacity in bytes.

func (*BPFMap) Module added in v1.0.0 

func (m *BPFMap) Module() *Module

func (*BPFMap) Name 

func (m *BPFMap) Name() string

func (*BPFMap) Pin 

func (m *BPFMap) Pin(pinPath string) error

func (*BPFMap) PinPath 

func (m *BPFMap) PinPath() string

func (*BPFMap) Resize deprecated 

func (m *BPFMap) Resize(maxEntries uint32) error

Deprecated: use BPFMap.SetMaxEntries() instead.

func (*BPFMap) ReuseFD added in v1.0.0 

func (m *BPFMap) ReuseFD(fd int) error

ReuseFD associates the BPFMap instance with the provided map file descriptor.

This function is useful for reusing a map that was previously created by a different process. By passing the file descriptor of the existing map, the current BPFMap instance becomes linked to that map.

NOTE: The function closes the current file descriptor associated with the BPFMap instance and replaces it with a duplicated descriptor pointing to the given fd. As a result, the instance original file descriptor becomes invalid, and all associated information is overwritten.

func (*BPFMap) SetAutocreate added in v1.0.0 

func (m *BPFMap) SetAutocreate(autocreate bool) error

Autocreate sets whether libbpf has to auto-create BPF map during BPF object load phase.

func (*BPFMap) SetInitialValue added in v1.0.0 

func (m *BPFMap) SetInitialValue(value unsafe.Pointer) error

func (*BPFMap) SetInnerMap added in v1.0.0 

func (m *BPFMap) SetInnerMap(templateMapFD int) error

SetInnerMap configures the inner map prototype for a BPFMap that represents a map of maps.

This function accepts the file descriptor of another map, which will serve as a prototype.

NOTE: It must be called before the module is loaded.

func (*BPFMap) SetKeySize added in v1.0.0 

func (m *BPFMap) SetKeySize(size uint32) error

SetKeySize sets the key size to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) SetMaxEntries added in v1.0.0 

func (m *BPFMap) SetMaxEntries(maxEntries uint32) error

SetMaxEntries sets the capacity of the BPFMap to the given maxEntries value.

This function must be called after BPF module initialization and before loading the module with BPFLoadObject, enabling customization of the map capacity.

For ring and perf buffer types, maxEntries represents the capacity in bytes.

func (*BPFMap) SetPinPath 

func (m *BPFMap) SetPinPath(pinPath string) error

func (*BPFMap) SetType 

func (m *BPFMap) SetType(mapType MapType) error

SetType assigns a specific type to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) SetValueSize 

func (m *BPFMap) SetValueSize(size uint32) error

SetValueSize sets the value size to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) Type 

func (m *BPFMap) Type() MapType

func (*BPFMap) Unpin 

func (m *BPFMap) Unpin(pinPath string) error

func (*BPFMap) Update 

func (m *BPFMap) Update(key, value unsafe.Pointer) error

Update inserts or updates value in BPFMap that corresponds to a given key.

This function accepts unsafe.Pointer references to both the key and value. All basic types, and structs are supported.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

For example:

key := 1 value := []byte{'a', 'b', 'c'} keyPtr := unsafe.Pointer(&key) valuePtr := unsafe.Pointer(&value[0]) bpfmap.Update(keyPtr, valuePtr)

func (*BPFMap) UpdateBatch 

func (m *BPFMap) UpdateBatch(keys, values unsafe.Pointer, count uint32) error

UpdateBatch updates multiple elements in the map by specified keys and their corresponding values.

The first argument, keys, is a pointer to an array or slice of keys which will be updated using the second argument, values. It returns the associated error if any occurred.

The last argument, count, is the number of keys to update. Passing an argument that greater than the number of keys in the map will cause the function to return a syscall.EPERM as an error.

func (*BPFMap) UpdateValueFlags 

func (m *BPFMap) UpdateValueFlags(key, value unsafe.Pointer, flags MapFlag) error

func (*BPFMap) ValueSize 

func (m *BPFMap) ValueSize() int

type BPFMapCreateOpts 

type BPFMapCreateOpts struct {
	BTFFD                 uint32
	BTFKeyTypeID          uint32
	BTFValueTypeID        uint32
	BTFVmlinuxValueTypeID uint32
	InnerMapFD            uint32
	MapFlags              uint32
	MapExtra              uint64
	NumaNode              uint32
	MapIfIndex            uint32
}

BPFMapCreateOpts mirrors the C structure bpf_map_create_opts.

type BPFMapInfo added in v1.0.0 

type BPFMapInfo struct {
	Type                  MapType
	ID                    uint32
	KeySize               uint32
	ValueSize             uint32
	MaxEntries            uint32
	MapFlags              uint32
	Name                  string
	IfIndex               uint32
	BTFVmlinuxValueTypeID uint32
	NetnsDev              uint64
	NetnsIno              uint64
	BTFID                 uint32
	BTFKeyTypeID          uint32
	BTFValueTypeID        uint32
	MapExtra              uint64
}

BPFMapInfo mirrors the C structure bpf_map_info.

func GetMapInfoByFD added in v1.0.0 

func GetMapInfoByFD(fd int) (*BPFMapInfo, error)

GetMapInfoByFD returns the BPFMapInfo for the map with the given file descriptor.

type BPFMapIterator 

type BPFMapIterator struct {
	// contains filtered or unexported fields
}

BPFMapIterator iterates over keys in a BPF map.

func (*BPFMapIterator) Err 

func (it *BPFMapIterator) Err() error

Err returns the last error that ocurred while table.Iter or iter.Next.

func (*BPFMapIterator) Key 

func (it *BPFMapIterator) Key() []byte

Key returns the current key value of the iterator, if the most recent call to Next returned true. The slice is valid only until the next call to Next.

func (*BPFMapIterator) Next 

func (it *BPFMapIterator) Next() bool

Next advances the iterator to the next key in the map.

type BPFMapLow added in v1.0.0 

type BPFMapLow struct {
	// contains filtered or unexported fields
}

BPFMapLow provides a low-level interface to BPF maps. Its methods follow the BPFMap naming convention.

func CreateMap 

func CreateMap(mapType MapType, mapName string, keySize, valueSize, maxEntries int, opts *BPFMapCreateOpts) (*BPFMapLow, error)

CreateMap creates a new BPF map with the given parameters.

func GetMapByID added in v1.0.0 

func GetMapByID(id uint32) (*BPFMapLow, error)

GetMapByID returns a BPFMapLow instance for the map with the given ID.

func (*BPFMapLow) DeleteKey added in v1.0.0 

func (m *BPFMapLow) DeleteKey(key unsafe.Pointer) error

func (*BPFMapLow) DeleteKeyBatch added in v1.0.0 

func (m *BPFMapLow) DeleteKeyBatch(keys unsafe.Pointer, count uint32) error

func (*BPFMapLow) FileDescriptor added in v1.0.0 

func (m *BPFMapLow) FileDescriptor() int

func (*BPFMapLow) GetValue added in v1.0.0 

func (m *BPFMapLow) GetValue(key unsafe.Pointer) ([]byte, error)

func (*BPFMapLow) GetValueAndDeleteBatch added in v1.0.0 

func (m *BPFMapLow) GetValueAndDeleteBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, error)

func (*BPFMapLow) GetValueBatch added in v1.0.0 

func (m *BPFMapLow) GetValueBatch(keys unsafe.Pointer, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, error)

func (*BPFMapLow) GetValueFlags added in v1.0.0 

func (m *BPFMapLow) GetValueFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

func (*BPFMapLow) Iterator added in v1.0.0 

func (m *BPFMapLow) Iterator() *BPFMapIterator

func (*BPFMapLow) KeySize added in v1.0.0 

func (m *BPFMapLow) KeySize() int

func (*BPFMapLow) MaxEntries added in v1.0.0 

func (m *BPFMapLow) MaxEntries() uint32

func (*BPFMapLow) Name added in v1.0.0 

func (m *BPFMapLow) Name() string

func (*BPFMapLow) ReuseFD added in v1.0.0 

func (m *BPFMapLow) ReuseFD(fd int) error

func (*BPFMapLow) Type added in v1.0.0 

func (m *BPFMapLow) Type() MapType

func (*BPFMapLow) Update added in v1.0.0 

func (m *BPFMapLow) Update(key, value unsafe.Pointer) error

func (*BPFMapLow) UpdateBatch added in v1.0.0 

func (m *BPFMapLow) UpdateBatch(keys, values unsafe.Pointer, count uint32) error

func (*BPFMapLow) UpdateValueFlags added in v1.0.0 

func (m *BPFMapLow) UpdateValueFlags(key, value unsafe.Pointer, flags MapFlag) error

func (*BPFMapLow) ValueSize added in v1.0.0 

func (m *BPFMapLow) ValueSize() int

type BPFObjectIterator 

type BPFObjectIterator struct {
	// contains filtered or unexported fields
}

BPFObjectProgramIterator iterates over programs and maps in a BPF object

func (*BPFObjectIterator) NextMap 

func (it *BPFObjectIterator) NextMap() *BPFMap

func (*BPFObjectIterator) NextProgram 

func (it *BPFObjectIterator) NextProgram() *BPFProg

type BPFProg 

type BPFProg struct {
	// contains filtered or unexported fields
}

func (*BPFProg) AttachCgroup 

func (p *BPFProg) AttachCgroup(cgroupV2DirPath string) (*BPFLink, error)

AttachCgroup attaches the BPFProg to a cgroup described by given fd.

func (*BPFProg) AttachCgroupLegacy 

func (p *BPFProg) AttachCgroupLegacy(cgroupV2DirPath string, attachType BPFAttachType) (*BPFLink, error)

AttachCgroupLegacy attaches the BPFProg to a cgroup described by the given fd. It first tries to use the most recent attachment method and, if that does not work, instead of failing, it tries the legacy way: to attach the cgroup eBPF program without previously creating a link. This allows attaching cgroup eBPF ingress/egress in older kernels. Note: the first attempt error message is filtered out inside libbpf_print_fn() as it is actually a feature probe attempt as well.

Related kernel commit: https://github.com/torvalds/linux/commit/af6eea57437a

func (*BPFProg) AttachGeneric 

func (p *BPFProg) AttachGeneric() (*BPFLink, error)

AttachGeneric is used to attach the BPF program using autodetection for the attach target. You can specify the destination in BPF code via the SEC() such as `SEC("fentry/some_kernel_func")`

func (*BPFProg) AttachGenericFD 

func (p *BPFProg) AttachGenericFD(targetFd int, attachType BPFAttachType, flags AttachFlag) error

AttachGenericFD attaches the BPFProgram to a targetFd at the specified attachType hook.

func (*BPFProg) AttachIter 

func (p *BPFProg) AttachIter(opts IterOpts) (*BPFLink, error)

func (*BPFProg) AttachKprobe 

func (p *BPFProg) AttachKprobe(kp string) (*BPFLink, error)

this API should be used for kernels > 4.17

func (*BPFProg) AttachKretprobe 

func (p *BPFProg) AttachKretprobe(kp string) (*BPFLink, error)

this API should be used for kernels > 4.17

func (*BPFProg) AttachLSM 

func (p *BPFProg) AttachLSM() (*BPFLink, error)

func (*BPFProg) AttachNetns 

func (p *BPFProg) AttachNetns(networkNamespacePath string) (*BPFLink, error)

func (*BPFProg) AttachPerfEvent 

func (p *BPFProg) AttachPerfEvent(fd int) (*BPFLink, error)

func (*BPFProg) AttachRawTracepoint 

func (p *BPFProg) AttachRawTracepoint(tpEvent string) (*BPFLink, error)

func (*BPFProg) AttachTracepoint 

func (p *BPFProg) AttachTracepoint(category, name string) (*BPFLink, error)

func (*BPFProg) AttachURetprobe 

func (p *BPFProg) AttachURetprobe(pid int, path string, offset uint32) (*BPFLink, error)

AttachURetprobe attaches the BPFProgram to exit of the symbol in the library or binary at 'path' which can be relative or absolute. A pid can be provided to attach to, or -1 can be specified to attach to all processes

func (*BPFProg) AttachUprobe 

func (p *BPFProg) AttachUprobe(pid int, path string, offset uint32) (*BPFLink, error)

AttachUprobe attaches the BPFProgram to entry of the symbol in the library or binary at 'path' which can be relative or absolute. A pid can be provided to attach to, or -1 can be specified to attach to all processes

func (*BPFProg) AttachXDP 

func (p *BPFProg) AttachXDP(deviceName string) (*BPFLink, error)

func (*BPFProg) DetachCgroupLegacy 

func (p *BPFProg) DetachCgroupLegacy(cgroupV2DirPath string, attachType BPFAttachType) error

DetachCgroupLegacy detaches the BPFProg from a cgroup described by the given fd. This is needed because in legacy attachment there is no BPFLink, just a fake one (kernel did not support it, nor libbpf). This function should be called by the (*BPFLink)->Destroy() function, since BPFLink is emulated (so users don´t need to distinguish between regular and legacy cgroup detachments).

func (*BPFProg) DetachGenericFD 

func (p *BPFProg) DetachGenericFD(targetFd int, attachType BPFAttachType) error

DetachGenericFD detaches the BPFProgram associated with the targetFd at the hook specified by attachType.

func (*BPFProg) FileDescriptor 

func (p *BPFProg) FileDescriptor() int

func (*BPFProg) GetFd deprecated 

func (p *BPFProg) GetFd() int

Deprecated: use BPFProg.FileDescriptor() instead.

func (*BPFProg) GetModule 

func (p *BPFProg) GetModule() *Module

func (*BPFProg) GetName deprecated 

func (p *BPFProg) GetName() string

Deprecated: use BPFProg.Name() instead.

func (*BPFProg) GetPinPath deprecated 

func (p *BPFProg) GetPinPath() string

Deprecated: use BPFProg.PinPath() instead.

func (*BPFProg) GetSectionName deprecated 

func (p *BPFProg) GetSectionName() string

Deprecated: use BPFProg.SectionName() instead.

func (*BPFProg) GetType 

func (p *BPFProg) GetType() BPFProgType

func (*BPFProg) Name 

func (p *BPFProg) Name() string

func (*BPFProg) Pin 

func (p *BPFProg) Pin(path string) error

func (*BPFProg) PinPath 

func (p *BPFProg) PinPath() string

func (*BPFProg) SectionName 

func (p *BPFProg) SectionName() string

func (*BPFProg) SetAttachTarget 

func (p *BPFProg) SetAttachTarget(attachProgFD int, attachFuncName string) error

SetAttachTarget can be used to specify the program and/or function to attach the BPF program to. To attach to a kernel function specify attachProgFD as 0

func (*BPFProg) SetAttachType 

func (p *BPFProg) SetAttachType(attachType BPFAttachType)

TODO: fix API to return error

func (*BPFProg) SetAutoload 

func (p *BPFProg) SetAutoload(autoload bool) error

func (*BPFProg) SetProgramType 

func (p *BPFProg) SetProgramType(progType BPFProgType)

TODO: fix API to return error

func (*BPFProg) Unpin 

func (p *BPFProg) Unpin(path string) error

type BPFProgType 

type BPFProgType uint32

BPFProgType is an enum as defined in https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/bpf.h 

const (
	BPFProgTypeUnspec                BPFProgType = C.BPF_PROG_TYPE_UNSPEC
	BPFProgTypeSocketFilter          BPFProgType = C.BPF_PROG_TYPE_SOCKET_FILTER
	BPFProgTypeKprobe                BPFProgType = C.BPF_PROG_TYPE_KPROBE
	BPFProgTypeSchedCls              BPFProgType = C.BPF_PROG_TYPE_SCHED_CLS
	BPFProgTypeSchedAct              BPFProgType = C.BPF_PROG_TYPE_SCHED_ACT
	BPFProgTypeTracepoint            BPFProgType = C.BPF_PROG_TYPE_TRACEPOINT
	BPFProgTypeXdp                   BPFProgType = C.BPF_PROG_TYPE_XDP
	BPFProgTypePerfEvent             BPFProgType = C.BPF_PROG_TYPE_PERF_EVENT
	BPFProgTypeCgroupSkb             BPFProgType = C.BPF_PROG_TYPE_CGROUP_SKB
	BPFProgTypeCgroupSock            BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCK
	BPFProgTypeLwtIn                 BPFProgType = C.BPF_PROG_TYPE_LWT_IN
	BPFProgTypeLwtOut                BPFProgType = C.BPF_PROG_TYPE_LWT_OUT
	BPFProgTypeLwtXmit               BPFProgType = C.BPF_PROG_TYPE_LWT_XMIT
	BPFProgTypeSockOps               BPFProgType = C.BPF_PROG_TYPE_SOCK_OPS
	BPFProgTypeSkSkb                 BPFProgType = C.BPF_PROG_TYPE_SK_SKB
	BPFProgTypeCgroupDevice          BPFProgType = C.BPF_PROG_TYPE_CGROUP_DEVICE
	BPFProgTypeSkMsg                 BPFProgType = C.BPF_PROG_TYPE_SK_MSG
	BPFProgTypeRawTracepoint         BPFProgType = C.BPF_PROG_TYPE_RAW_TRACEPOINT
	BPFProgTypeCgroupSockAddr        BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCK_ADDR
	BPFProgTypeLwtSeg6Local          BPFProgType = C.BPF_PROG_TYPE_LWT_SEG6LOCAL
	BPFProgTypeLircMode2             BPFProgType = C.BPF_PROG_TYPE_LIRC_MODE2
	BPFProgTypeSkReuseport           BPFProgType = C.BPF_PROG_TYPE_SK_REUSEPORT
	BPFProgTypeFlowDissector         BPFProgType = C.BPF_PROG_TYPE_FLOW_DISSECTOR
	BPFProgTypeCgroupSysctl          BPFProgType = C.BPF_PROG_TYPE_CGROUP_SYSCTL
	BPFProgTypeRawTracepointWritable BPFProgType = C.BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE
	BPFProgTypeCgroupSockopt         BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCKOPT
	BPFProgTypeTracing               BPFProgType = C.BPF_PROG_TYPE_TRACING
	BPFProgTypeStructOps             BPFProgType = C.BPF_PROG_TYPE_STRUCT_OPS
	BPFProgTypeExt                   BPFProgType = C.BPF_PROG_TYPE_EXT
	BPFProgTypeLsm                   BPFProgType = C.BPF_PROG_TYPE_LSM
	BPFProgTypeSkLookup              BPFProgType = C.BPF_PROG_TYPE_SK_LOOKUP
	BPFProgTypeSyscall               BPFProgType = C.BPF_PROG_TYPE_SYSCALL
)

func (BPFProgType) Name added in v1.0.0 

func (t BPFProgType) Name() string

func (BPFProgType) String 

func (t BPFProgType) String() string

func (BPFProgType) Value deprecated 

func (t BPFProgType) Value() uint64

Deprecated: Convert type directly instead.

type Callbacks 

type Callbacks struct {
	Log        func(level int, msg string)
	LogFilters []func(libLevel int, msg string) bool
}

Callbacks stores the callbacks to be used by libbpfgo

type IterOpts 

type IterOpts struct {
	MapFd           int
	CgroupIterOrder BPFCgroupIterOrder
	CgroupFd        int
	CgroupId        uint64
	Tid             int
	Pid             int
	PidFd           int
}

type LibbpfStrictMode 

type LibbpfStrictMode uint32

LibbpfStrictMode is an enum as defined in https://github.com/libbpf/libbpf/blob/2cd2d03f63242c048a896179398c68d2dbefe3d6/src/libbpf_legacy.h#L23 

const (
	LibbpfStrictModeAll               LibbpfStrictMode = C.LIBBPF_STRICT_ALL
	LibbpfStrictModeNone              LibbpfStrictMode = C.LIBBPF_STRICT_NONE
	LibbpfStrictModeCleanPtrs         LibbpfStrictMode = C.LIBBPF_STRICT_CLEAN_PTRS
	LibbpfStrictModeDirectErrs        LibbpfStrictMode = C.LIBBPF_STRICT_DIRECT_ERRS
	LibbpfStrictModeSecName           LibbpfStrictMode = C.LIBBPF_STRICT_SEC_NAME
	LibbpfStrictModeNoObjectList      LibbpfStrictMode = C.LIBBPF_STRICT_NO_OBJECT_LIST
	LibbpfStrictModeAutoRlimitMemlock LibbpfStrictMode = C.LIBBPF_STRICT_AUTO_RLIMIT_MEMLOCK
	LibbpfStrictModeMapDefinitions    LibbpfStrictMode = C.LIBBPF_STRICT_MAP_DEFINITIONS
)

func (LibbpfStrictMode) String 

func (b LibbpfStrictMode) String() (str string)

type LinkType 

type LinkType int
const (
	Tracepoint LinkType = iota
	RawTracepoint
	Kprobe
	Kretprobe
	LSM
	PerfEvent
	Uprobe
	Uretprobe
	Tracing
	XDP
	Cgroup
	CgroupLegacy
	Netns
	Iter
)

type MapFlag 

type MapFlag uint32
const (
	MapFlagUpdateAny     MapFlag = iota // create new element or update existing
	MapFlagUpdateNoExist                // create new element if it didn't exist
	MapFlagUpdateExist                  // update existing element
	MapFlagFLock                        // spin_lock-ed map_lookup/map_update
)

type MapType 

type MapType uint32
const (
	MapTypeUnspec              MapType = C.BPF_MAP_TYPE_UNSPEC
	MapTypeHash                MapType = C.BPF_MAP_TYPE_HASH
	MapTypeArray               MapType = C.BPF_MAP_TYPE_ARRAY
	MapTypeProgArray           MapType = C.BPF_MAP_TYPE_PROG_ARRAY
	MapTypePerfEventArray      MapType = C.BPF_MAP_TYPE_PERF_EVENT_ARRAY
	MapTypePerCPUHash          MapType = C.BPF_MAP_TYPE_PERCPU_HASH
	MapTypePerCPUArray         MapType = C.BPF_MAP_TYPE_PERCPU_ARRAY
	MapTypeStackTrace          MapType = C.BPF_MAP_TYPE_STACK_TRACE
	MapTypeCgroupArray         MapType = C.BPF_MAP_TYPE_CGROUP_ARRAY
	MapTypeLRUHash             MapType = C.BPF_MAP_TYPE_LRU_HASH
	MapTypeLRUPerCPUHash       MapType = C.BPF_MAP_TYPE_LRU_PERCPU_HASH
	MapTypeLPMTrie             MapType = C.BPF_MAP_TYPE_LPM_TRIE
	MapTypeArrayOfMaps         MapType = C.BPF_MAP_TYPE_ARRAY_OF_MAPS
	MapTypeHashOfMaps          MapType = C.BPF_MAP_TYPE_HASH_OF_MAPS
	MapTypeDevMap              MapType = C.BPF_MAP_TYPE_DEVMAP
	MapTypeSockMap             MapType = C.BPF_MAP_TYPE_SOCKMAP
	MapTypeCPUMap              MapType = C.BPF_MAP_TYPE_CPUMAP
	MapTypeXSKMap              MapType = C.BPF_MAP_TYPE_XSKMAP
	MapTypeSockHash            MapType = C.BPF_MAP_TYPE_SOCKHASH
	MapTypeCgroupStorage       MapType = C.BPF_MAP_TYPE_CGROUP_STORAGE
	MapTypeReusePortSockArray  MapType = C.BPF_MAP_TYPE_REUSEPORT_SOCKARRAY
	MapTypePerCPUCgroupStorage MapType = C.BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE
	MapTypeQueue               MapType = C.BPF_MAP_TYPE_QUEUE
	MapTypeStack               MapType = C.BPF_MAP_TYPE_STACK
	MapTypeSKStorage           MapType = C.BPF_MAP_TYPE_SK_STORAGE
	MapTypeDevmapHash          MapType = C.BPF_MAP_TYPE_DEVMAP_HASH
	MapTypeStructOps           MapType = C.BPF_MAP_TYPE_STRUCT_OPS
	MapTypeRingbuf             MapType = C.BPF_MAP_TYPE_RINGBUF
	MapTypeInodeStorage        MapType = C.BPF_MAP_TYPE_INODE_STORAGE
	MapTypeTaskStorage         MapType = C.BPF_MAP_TYPE_TASK_STORAGE
	MapTypeBloomFilter         MapType = C.BPF_MAP_TYPE_BLOOM_FILTER
)

func (MapType) Name added in v1.0.0 

func (t MapType) Name() string

func (MapType) String 

func (t MapType) String() string

type Module 

type Module struct {
	// contains filtered or unexported fields
}

func NewModuleFromBuffer 

func NewModuleFromBuffer(bpfObjBuff []byte, bpfObjName string) (*Module, error)

func NewModuleFromBufferArgs 

func NewModuleFromBufferArgs(args NewModuleArgs) (*Module, error)

func NewModuleFromFile 

func NewModuleFromFile(bpfObjPath string) (*Module, error)

func NewModuleFromFileArgs 

func NewModuleFromFileArgs(args NewModuleArgs) (*Module, error)

func (*Module) BPFLoadObject 

func (m *Module) BPFLoadObject() error

func (*Module) Close 

func (m *Module) Close()

func (*Module) GetMap 

func (m *Module) GetMap(mapName string) (*BPFMap, error)

func (*Module) GetProgram 

func (m *Module) GetProgram(progName string) (*BPFProg, error)

func (*Module) InitGlobalVariable 

func (m *Module) InitGlobalVariable(name string, value interface{}) error

InitGlobalVariable sets global variables (defined in .data or .rodata) in bpf code. It must be called before the BPF object is loaded.

func (*Module) InitPerfBuf 

func (m *Module) InitPerfBuf(mapName string, eventsChan chan []byte, lostChan chan uint64, pageCnt int) (*PerfBuffer, error)

func (*Module) InitRingBuf 

func (m *Module) InitRingBuf(mapName string, eventsChan chan []byte) (*RingBuffer, error)

func (*Module) Iterator 

func (m *Module) Iterator() *BPFObjectIterator

func (*Module) TcHookInit 

func (m *Module) TcHookInit() *TcHook

type NewModuleArgs 

type NewModuleArgs struct {
	KConfigFilePath string
	BTFObjPath      string
	BPFObjName      string
	BPFObjPath      string
	BPFObjBuff      []byte
	SkipMemlockBump bool
}

type PerfBuffer 

type PerfBuffer struct {
	// contains filtered or unexported fields
}

func (*PerfBuffer) Close 

func (pb *PerfBuffer) Close()

func (*PerfBuffer) Poll 

func (pb *PerfBuffer) Poll(timeout int)

Poll will wait until timeout in milliseconds to gather data from the perf buffer.

func (*PerfBuffer) Start deprecated 

func (pb *PerfBuffer) Start()

Deprecated: use PerfBuffer.Poll() instead.

func (*PerfBuffer) Stop 

func (pb *PerfBuffer) Stop()

type RingBuffer 

type RingBuffer struct {
	// contains filtered or unexported fields
}

func (*RingBuffer) Close 

func (rb *RingBuffer) Close()

func (*RingBuffer) Poll 

func (rb *RingBuffer) Poll(timeout int)

Poll will wait until timeout in milliseconds to gather data from the ring buffer.

func (*RingBuffer) Start deprecated 

func (rb *RingBuffer) Start()

Deprecated: use RingBuffer.Poll() instead.

func (*RingBuffer) Stop 

func (rb *RingBuffer) Stop()

type Symbol 

type Symbol struct {
	// contains filtered or unexported fields
}

type TcAttachPoint 

type TcAttachPoint uint32
const (
	BPFTcIngress       TcAttachPoint = C.BPF_TC_INGRESS
	BPFTcEgress        TcAttachPoint = C.BPF_TC_EGRESS
	BPFTcIngressEgress TcAttachPoint = C.BPF_TC_INGRESS | C.BPF_TC_EGRESS
	BPFTcCustom        TcAttachPoint = C.BPF_TC_CUSTOM
)

type TcFlags 

type TcFlags uint32
const (
	BpfTcFReplace TcFlags = C.BPF_TC_F_REPLACE
)

type TcHook 

type TcHook struct {
	// contains filtered or unexported fields
}

func (*TcHook) Attach 

func (hook *TcHook) Attach(tcOpts *TcOpts) error

func (*TcHook) Create 

func (hook *TcHook) Create() error

func (*TcHook) Destroy 

func (hook *TcHook) Destroy() error

func (*TcHook) Detach 

func (hook *TcHook) Detach(tcOpts *TcOpts) error

func (*TcHook) GetInterfaceIndex 

func (hook *TcHook) GetInterfaceIndex() int

func (*TcHook) Query 

func (hook *TcHook) Query(tcOpts *TcOpts) error

func (*TcHook) SetAttachPoint 

func (hook *TcHook) SetAttachPoint(attachPoint TcAttachPoint)

func (*TcHook) SetInterfaceByIndex 

func (hook *TcHook) SetInterfaceByIndex(ifaceIdx int)

func (*TcHook) SetInterfaceByName 

func (hook *TcHook) SetInterfaceByName(ifaceName string) error

func (*TcHook) SetParent 

func (hook *TcHook) SetParent(a int, b int)

type TcOpts 

type TcOpts struct {
	ProgFd   int
	Flags    TcFlags
	ProgId   uint
	Handle   uint
	Priority uint
}

Source Files

View all Source files

Directories

Path Synopsis
helpers module
selftest
attachgenericfd Module
global-variable Module
iter Module
iterators Module
log-callbacks Module
map-pin-info Module
map-update Module
perfbuffers Module
tracing Module
tracing-by-offset Module
uprobe Module

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.