From b48135deac642302fe25a1770dbfc89c5406a9cf Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 20 Aug 2023 09:46:13 +0000 Subject: [PATCH 01/20] update docs --- README.md | 238 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 238 insertions(+) diff --git a/README.md b/README.md index 02ef647..aa76cbf 100644 --- a/README.md +++ b/README.md @@ -12,3 +12,241 @@ https://mozillazg.com/tag/libbpf.html ``` $ vagrant up ``` + +## Program Types + ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | ++=========================================+======================================+=========================+===========+===========+ +| `BPF_PROG_TYPE_CGROUP_DEVICE` | `BPF_CGROUP_DEVICE` | `cgroup/dev` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_CGROUP_SKB` | | `cgroup/skb` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET_EGRESS` | `cgroup_skb/egress` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET_INGRESS` | `cgroup_skb/ingress` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_CGROUP_SOCKOPT` | `BPF_CGROUP_GETSOCKOPT` | `cgroup/getsockopt` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_SETSOCKOPT` | `cgroup/setsockopt` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` | `BPF_CGROUP_INET4_BIND` | `cgroup/bind4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET4_CONNECT` | `cgroup/connect4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET4_GETPEERNAME` | `cgroup/getpeername4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET4_GETSOCKNAME` | `cgroup/getsockname4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET6_BIND` | `cgroup/bind6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET6_CONNECT` | `cgroup/connect6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET6_GETPEERNAME` | `cgroup/getpeername6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET6_GETSOCKNAME` | `cgroup/getsockname6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_UDP4_RECVMSG` | `cgroup/recvmsg4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_UDP4_SENDMSG` | `cgroup/sendmsg4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_UDP6_RECVMSG` | `cgroup/recvmsg6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_UDP6_SENDMSG` | `cgroup/sendmsg6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_CGROUP_SOCK` | `BPF_CGROUP_INET4_POST_BIND` | `cgroup/post_bind4` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET6_POST_BIND` | `cgroup/post_bind6` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET_SOCK_CREATE` | `cgroup/sock_create` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `cgroup/sock` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_CGROUP_INET_SOCK_RELEASE` | `cgroup/sock_release` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_CGROUP_SYSCTL` | `BPF_CGROUP_SYSCTL` | `cgroup/sysctl` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_EXT` | | `freplace+`[^1] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_FLOW_DISSECTOR` | `BPF_FLOW_DISSECTOR` | `flow_dissector` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_KPROBE` | | `kprobe+`[^2] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `kretprobe+`[^3] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `ksyscall+`[^4] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | > `kretsyscall+`[^5] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `uprobe+`[^6] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `uprobe.s+`[^7] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `uretprobe+`[^8] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `uretprobe.s+`[^9] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `usdt+`[^10] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_TRACE_KPROBE_MULTI` | `kprobe.multi+`[^11] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `kretprobe.multi+`[^12] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LIRC_MODE2` | `BPF_LIRC_MODE2` | `lirc_mode2` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LSM` | `BPF_LSM_CGROUP` | `lsm_cgroup+` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_LSM_MAC` | `lsm+`[^13] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `lsm.s+`[^14] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LWT_IN` | | `lwt_in` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LWT_OUT` | | `lwt_out` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LWT_SEG6LOCAL` | | `lwt_seg6local` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_LWT_XMIT` | | `lwt_xmit` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_PERF_EVENT` | | `perf_event` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE` | | `raw_tp.w+`[^15] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `raw_tracepoint.w+` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_RAW_TRACEPOINT` | | `raw_tp+`[^16] |[e12] [e13]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `raw_tracepoint+` |[e12] [e13]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SCHED_ACT` | | `action` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SCHED_CLS` | | `classifier` |[e21] [e25]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `tc` |[e21] [e25]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SK_LOOKUP` | `BPF_SK_LOOKUP` | `sk_lookup` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SK_MSG` | `BPF_SK_MSG_VERDICT` | `sk_msg` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SK_REUSEPORT` | `BPF_SK_REUSEPORT_SELECT_OR_MIGRATE` | `sk_reuseport/migrate` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_SK_REUSEPORT_SELECT` | `sk_reuseport` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SK_SKB` | | `sk_skb` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_SK_SKB_STREAM_PARSER` | `sk_skb/stream_parser` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_SK_SKB_STREAM_VERDICT` | `sk_skb/stream_verdict` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SOCKET_FILTER` | | `socket` |[e18] [e19] | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SOCK_OPS` | `BPF_CGROUP_SOCK_OPS` | `sockops` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_STRUCT_OPS` | | `struct_ops+` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_SYSCALL` | | `syscall` | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_TRACEPOINT` | | `tp+`[^17] | [e04] [e07] [e14]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `tracepoint+`[^18] | [e04] [e07] [e14] | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_TRACING` | `BPF_MODIFY_RETURN` | `fmod_ret+`[^19] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `fmod_ret.s+`[^20] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_TRACE_FENTRY` | `fentry+`[^21] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `fentry.s+`[^22] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_TRACE_FEXIT` | `fexit+`[^23] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `fexit.s+`[^24] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_TRACE_ITER` | `iter+`[^25] | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `iter.s+`[^26] | | Yes | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_TRACE_RAW_TP` | `tp_btf+`[^27] |[e16] [e17]| | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| `BPF_PROG_TYPE_XDP` | `BPF_XDP_CPUMAP` | `xdp.frags/cpumap` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `xdp/cpumap` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_XDP_DEVMAP` | `xdp.frags/devmap` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `xdp/devmap` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | `BPF_XDP` | `xdp.frags` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ +| | | `xdp` | | | ++-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ + +**Footnotes** + +[^1]: The `fentry` attach format is `fentry[.s]/`. + +[^2]: The `kprobe` attach format is `kprobe/[+]`. Valid characters for `function` are `a-zA-Z0-9_.` and `offset` must be a valid non-negative integer. + +[^3]: The `kprobe` attach format is `kprobe/[+]`. Valid characters for `function` are `a-zA-Z0-9_.` and `offset` must be a valid non-negative integer. + +[^4]: The `ksyscall` attach format is `ksyscall/`. + +[^5]: The `ksyscall` attach format is `ksyscall/`. + +[^6]: The `uprobe` attach format is `uprobe[.s]/:[+]`. + +[^7]: The `uprobe` attach format is `uprobe[.s]/:[+]`. + +[^8]: The `uprobe` attach format is `uprobe[.s]/:[+]`. + +[^9]: The `uprobe` attach format is `uprobe[.s]/:[+]`. + +[^10]: The `usdt` attach format is `usdt/::`. + +[^11]: The `kprobe.multi` attach format is `kprobe.multi/` where `pattern` supports `*` and `?` wildcards. Valid characters for pattern are `a-zA-Z0-9_.*?`. + +[^12]: The `kprobe.multi` attach format is `kprobe.multi/` where `pattern` supports `*` and `?` wildcards. Valid characters for pattern are `a-zA-Z0-9_.*?`. + +[^13]: The `lsm` attachment format is `lsm[.s]/`. + +[^14]: The `lsm` attachment format is `lsm[.s]/`. + +[^15]: The `raw_tp` attach format is `raw_tracepoint[.w]/`. + +[^16]: The `raw_tp` attach format is `raw_tracepoint[.w]/`. + +[^17]: The `tracepoint` attach format is `tracepoint//`. + +[^18]: The `tracepoint` attach format is `tracepoint//`. + +[^19]: The `fentry` attach format is `fentry[.s]/`. + +[^20]: The `fentry` attach format is `fentry[.s]/`. + +[^21]: The `fentry` attach format is `fentry[.s]/`. + +[^22]: The `fentry` attach format is `fentry[.s]/`. + +[^23]: The `fentry` attach format is `fentry[.s]/`. + +[^24]: The `fentry` attach format is `fentry[.s]/`. + +[^25]: The `iter` attach format is `iter[.s]/`. + +[^26]: The `iter` attach format is `iter[.s]/`. + +[^27]: The `fentry` attach format is `fentry[.s]/`. + +[e04]: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint +[e07]: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args +[e12]: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args +[e13]: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch +[e14]: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch +[e16]: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args +[e17]: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch +[e18]: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse +[e19]: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse +[e20]: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load +[e21]: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes +[e25]: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access + From 465135ed48e48d805d6f2ac085e149b70ed74e53 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 20 Aug 2023 10:12:10 +0000 Subject: [PATCH 02/20] update README --- README.md | 252 ----------------------------------------------------- README.rst | 225 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 225 insertions(+), 252 deletions(-) delete mode 100644 README.md create mode 100644 README.rst diff --git a/README.md b/README.md deleted file mode 100644 index aa76cbf..0000000 --- a/README.md +++ /dev/null @@ -1,252 +0,0 @@ -# hello-libbpfgo - -[![Build examples](https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master)](https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml) - -Examples for libbpf and libbpfgo. - -https://mozillazg.com/tag/libbpf.html - - -## setup develop env - -``` -$ vagrant up -``` - -## Program Types - -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | -+=========================================+======================================+=========================+===========+===========+ -| `BPF_PROG_TYPE_CGROUP_DEVICE` | `BPF_CGROUP_DEVICE` | `cgroup/dev` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_CGROUP_SKB` | | `cgroup/skb` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET_EGRESS` | `cgroup_skb/egress` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET_INGRESS` | `cgroup_skb/ingress` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_CGROUP_SOCKOPT` | `BPF_CGROUP_GETSOCKOPT` | `cgroup/getsockopt` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_SETSOCKOPT` | `cgroup/setsockopt` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_CGROUP_SOCK_ADDR` | `BPF_CGROUP_INET4_BIND` | `cgroup/bind4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET4_CONNECT` | `cgroup/connect4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET4_GETPEERNAME` | `cgroup/getpeername4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET4_GETSOCKNAME` | `cgroup/getsockname4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET6_BIND` | `cgroup/bind6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET6_CONNECT` | `cgroup/connect6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET6_GETPEERNAME` | `cgroup/getpeername6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET6_GETSOCKNAME` | `cgroup/getsockname6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_UDP4_RECVMSG` | `cgroup/recvmsg4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_UDP4_SENDMSG` | `cgroup/sendmsg4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_UDP6_RECVMSG` | `cgroup/recvmsg6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_UDP6_SENDMSG` | `cgroup/sendmsg6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_CGROUP_SOCK` | `BPF_CGROUP_INET4_POST_BIND` | `cgroup/post_bind4` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET6_POST_BIND` | `cgroup/post_bind6` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET_SOCK_CREATE` | `cgroup/sock_create` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `cgroup/sock` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_CGROUP_INET_SOCK_RELEASE` | `cgroup/sock_release` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_CGROUP_SYSCTL` | `BPF_CGROUP_SYSCTL` | `cgroup/sysctl` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_EXT` | | `freplace+`[^1] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_FLOW_DISSECTOR` | `BPF_FLOW_DISSECTOR` | `flow_dissector` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_KPROBE` | | `kprobe+`[^2] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `kretprobe+`[^3] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `ksyscall+`[^4] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | > `kretsyscall+`[^5] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `uprobe+`[^6] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `uprobe.s+`[^7] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `uretprobe+`[^8] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `uretprobe.s+`[^9] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `usdt+`[^10] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_TRACE_KPROBE_MULTI` | `kprobe.multi+`[^11] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `kretprobe.multi+`[^12] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LIRC_MODE2` | `BPF_LIRC_MODE2` | `lirc_mode2` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LSM` | `BPF_LSM_CGROUP` | `lsm_cgroup+` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_LSM_MAC` | `lsm+`[^13] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `lsm.s+`[^14] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LWT_IN` | | `lwt_in` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LWT_OUT` | | `lwt_out` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LWT_SEG6LOCAL` | | `lwt_seg6local` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_LWT_XMIT` | | `lwt_xmit` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_PERF_EVENT` | | `perf_event` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE` | | `raw_tp.w+`[^15] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `raw_tracepoint.w+` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_RAW_TRACEPOINT` | | `raw_tp+`[^16] |[e12] [e13]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `raw_tracepoint+` |[e12] [e13]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SCHED_ACT` | | `action` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SCHED_CLS` | | `classifier` |[e21] [e25]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `tc` |[e21] [e25]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SK_LOOKUP` | `BPF_SK_LOOKUP` | `sk_lookup` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SK_MSG` | `BPF_SK_MSG_VERDICT` | `sk_msg` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SK_REUSEPORT` | `BPF_SK_REUSEPORT_SELECT_OR_MIGRATE` | `sk_reuseport/migrate` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_SK_REUSEPORT_SELECT` | `sk_reuseport` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SK_SKB` | | `sk_skb` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_SK_SKB_STREAM_PARSER` | `sk_skb/stream_parser` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_SK_SKB_STREAM_VERDICT` | `sk_skb/stream_verdict` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SOCKET_FILTER` | | `socket` |[e18] [e19] | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SOCK_OPS` | `BPF_CGROUP_SOCK_OPS` | `sockops` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_STRUCT_OPS` | | `struct_ops+` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_SYSCALL` | | `syscall` | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_TRACEPOINT` | | `tp+`[^17] | [e04] [e07] [e14]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `tracepoint+`[^18] | [e04] [e07] [e14] | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_TRACING` | `BPF_MODIFY_RETURN` | `fmod_ret+`[^19] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `fmod_ret.s+`[^20] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_TRACE_FENTRY` | `fentry+`[^21] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `fentry.s+`[^22] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_TRACE_FEXIT` | `fexit+`[^23] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `fexit.s+`[^24] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_TRACE_ITER` | `iter+`[^25] | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `iter.s+`[^26] | | Yes | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_TRACE_RAW_TP` | `tp_btf+`[^27] |[e16] [e17]| | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| `BPF_PROG_TYPE_XDP` | `BPF_XDP_CPUMAP` | `xdp.frags/cpumap` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `xdp/cpumap` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_XDP_DEVMAP` | `xdp.frags/devmap` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `xdp/devmap` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | `BPF_XDP` | `xdp.frags` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ -| | | `xdp` | | | -+-----------------------------------------+--------------------------------------+-------------------------+-----------+-----------+ - -**Footnotes** - -[^1]: The `fentry` attach format is `fentry[.s]/`. - -[^2]: The `kprobe` attach format is `kprobe/[+]`. Valid characters for `function` are `a-zA-Z0-9_.` and `offset` must be a valid non-negative integer. - -[^3]: The `kprobe` attach format is `kprobe/[+]`. Valid characters for `function` are `a-zA-Z0-9_.` and `offset` must be a valid non-negative integer. - -[^4]: The `ksyscall` attach format is `ksyscall/`. - -[^5]: The `ksyscall` attach format is `ksyscall/`. - -[^6]: The `uprobe` attach format is `uprobe[.s]/:[+]`. - -[^7]: The `uprobe` attach format is `uprobe[.s]/:[+]`. - -[^8]: The `uprobe` attach format is `uprobe[.s]/:[+]`. - -[^9]: The `uprobe` attach format is `uprobe[.s]/:[+]`. - -[^10]: The `usdt` attach format is `usdt/::`. - -[^11]: The `kprobe.multi` attach format is `kprobe.multi/` where `pattern` supports `*` and `?` wildcards. Valid characters for pattern are `a-zA-Z0-9_.*?`. - -[^12]: The `kprobe.multi` attach format is `kprobe.multi/` where `pattern` supports `*` and `?` wildcards. Valid characters for pattern are `a-zA-Z0-9_.*?`. - -[^13]: The `lsm` attachment format is `lsm[.s]/`. - -[^14]: The `lsm` attachment format is `lsm[.s]/`. - -[^15]: The `raw_tp` attach format is `raw_tracepoint[.w]/`. - -[^16]: The `raw_tp` attach format is `raw_tracepoint[.w]/`. - -[^17]: The `tracepoint` attach format is `tracepoint//`. - -[^18]: The `tracepoint` attach format is `tracepoint//`. - -[^19]: The `fentry` attach format is `fentry[.s]/`. - -[^20]: The `fentry` attach format is `fentry[.s]/`. - -[^21]: The `fentry` attach format is `fentry[.s]/`. - -[^22]: The `fentry` attach format is `fentry[.s]/`. - -[^23]: The `fentry` attach format is `fentry[.s]/`. - -[^24]: The `fentry` attach format is `fentry[.s]/`. - -[^25]: The `iter` attach format is `iter[.s]/`. - -[^26]: The `iter` attach format is `iter[.s]/`. - -[^27]: The `fentry` attach format is `fentry[.s]/`. - -[e04]: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint -[e07]: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args -[e12]: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args -[e13]: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch -[e14]: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch -[e16]: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args -[e17]: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch -[e18]: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse -[e19]: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse -[e20]: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load -[e21]: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes -[e25]: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access - diff --git a/README.rst b/README.rst new file mode 100644 index 0000000..541a2b1 --- /dev/null +++ b/README.rst @@ -0,0 +1,225 @@ +hello-libbpfgo +================== + +|Build examples| + + +Examples for libbpf, `aquasecurity/libbpfgo `__ and `cilium/ebpf `__. + +https://mozillazg.com/tag/libbpf.html + + +setup develop env +-------------------- + +.. code-block:: shell + + $ vagrant up + + +Program Types +------------------ + + + ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | ++===========================================+========================================+==================================+===========+===========+ +| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``cgroup/sock`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``kretprobe+`` [#kprobe]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``ksyscall+`` [#ksyscall]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``kretsyscall+`` [#ksyscall]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``uprobe+`` [#uprobe]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``uprobe.s+`` [#uprobe]_ | | Yes | ++ + +----------------------------------+-----------+-----------+ +| | | ``uretprobe+`` [#uprobe]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``uretprobe.s+`` [#uprobe]_ | | Yes | ++ + +----------------------------------+-----------+-----------+ +| | | ``usdt+`` [#usdt]_ | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``kretprobe.multi+`` [#kpmulti]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``lsm.s+`` [#lsm]_ | | Yes | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``raw_tracepoint.w+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ |`e12`_ `e13`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``raw_tracepoint+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` |`e21`_ `e25`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``tc`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` |`e18`_ `e19`_ `e20`_ | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | Yes | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ |`e04`_ `e07`_ `e14`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``tracepoint+`` [#tp]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``fmod_ret.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``fentry.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``fexit.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``iter.s+`` [#iter]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ |`e16`_ `e17`_ | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ +| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``xdp/cpumap`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``xdp/devmap`` | | | ++ +----------------------------------------+----------------------------------+-----------+-----------+ +| | ``BPF_XDP`` | ``xdp.frags`` | | | ++ + +----------------------------------+-----------+-----------+ +| | | ``xdp`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ + + +.. rubric:: Footnotes + +.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/``. +.. [#kprobe] The ``kprobe`` attach format is ``kprobe/[+]``. Valid + characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid + non-negative integer. +.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/``. +.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/:[+]``. +.. [#usdt] The ``usdt`` attach format is ``usdt/::``. +.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/`` where ``pattern`` + supports ``*`` and ``?`` wildcards. Valid characters for pattern are + ``a-zA-Z0-9_.*?``. +.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/``. +.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/``. +.. [#tp] The ``tracepoint`` attach format is ``tracepoint//``. +.. [#iter] The ``iter`` attach format is ``iter[.s]/``. + + +.. |Build examples| image:: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master + :target: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml + +.. _e04: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint +.. _e07: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args +.. _e12: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args +.. _e13: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch +.. _e14: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch +.. _e16: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args +.. _e17: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch +.. _e18: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse +.. _e19: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse +.. _e20: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load +.. _e21: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes +.. _e25: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access + From 93cb4b33748a251d98655e8a240d81e8615d4cc8 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 20 Aug 2023 10:28:48 +0000 Subject: [PATCH 03/20] fix table --- README.rst | 358 ++++++++++++++++++++++++++--------------------------- 1 file changed, 178 insertions(+), 180 deletions(-) diff --git a/README.rst b/README.rst index 541a2b1..b1653df 100644 --- a/README.rst +++ b/README.rst @@ -22,174 +22,172 @@ Program Types -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | -+===========================================+========================================+==================================+===========+===========+ -| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``cgroup/sock`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``kretprobe+`` [#kprobe]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``ksyscall+`` [#ksyscall]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``kretsyscall+`` [#ksyscall]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``uprobe+`` [#uprobe]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``uprobe.s+`` [#uprobe]_ | | Yes | -+ + +----------------------------------+-----------+-----------+ -| | | ``uretprobe+`` [#uprobe]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``uretprobe.s+`` [#uprobe]_ | | Yes | -+ + +----------------------------------+-----------+-----------+ -| | | ``usdt+`` [#usdt]_ | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``kretprobe.multi+`` [#kpmulti]_ | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``lsm.s+`` [#lsm]_ | | Yes | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``raw_tracepoint.w+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ |`e12`_ `e13`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``raw_tracepoint+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` |`e21`_ `e25`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``tc`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` |`e18`_ `e19`_ `e20`_ | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | Yes | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ |`e04`_ `e07`_ `e14`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``tracepoint+`` [#tp]_ | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``fmod_ret.s+`` [#fentry]_ | | Yes | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``fentry.s+`` [#fentry]_ | | Yes | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``fexit.s+`` [#fentry]_ | | Yes | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``iter.s+`` [#iter]_ | | Yes | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ |`e16`_ `e17`_ | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ -| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``xdp/cpumap`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``xdp/devmap`` | | | -+ +----------------------------------------+----------------------------------+-----------+-----------+ -| | ``BPF_XDP`` | ``xdp.frags`` | | | -+ + +----------------------------------+-----------+-----------+ -| | | ``xdp`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------+-----------+ - - -.. rubric:: Footnotes ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | ++===========================================+========================================+==================================+=======================+===========+ +| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``cgroup/sock`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``kretprobe+`` [#kprobe]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``ksyscall+`` [#ksyscall]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``kretsyscall+`` [#ksyscall]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``uprobe+`` [#uprobe]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``uprobe.s+`` [#uprobe]_ | | Yes | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``uretprobe+`` [#uprobe]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``uretprobe.s+`` [#uprobe]_ | | Yes | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``usdt+`` [#usdt]_ | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``kretprobe.multi+`` [#kpmulti]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``lsm.s+`` [#lsm]_ | | Yes | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``raw_tracepoint.w+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ |`12`_ `13`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``raw_tracepoint+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` |`21`_ `25`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``tc`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` |`18`_ `19`_ `20`_ | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | Yes | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ |`04`_ `07`_ `14`_ | | ++ + +----------------------------------+ +-----------+ +| | | ``tracepoint+`` [#tp]_ | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``fmod_ret.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``fentry.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``fexit.s+`` [#fentry]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``iter.s+`` [#iter]_ | | Yes | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ |`16`_ `17`_ | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ +| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``xdp/cpumap`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``xdp/devmap`` | | | ++ +----------------------------------------+----------------------------------+-----------------------+-----------+ +| | ``BPF_XDP`` | ``xdp.frags`` | | | ++ + +----------------------------------+-----------------------+-----------+ +| | | ``xdp`` | | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ + .. [#fentry] The ``fentry`` attach format is ``fentry[.s]/``. .. [#kprobe] The ``kprobe`` attach format is ``kprobe/[+]``. Valid @@ -210,16 +208,16 @@ Program Types .. |Build examples| image:: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master :target: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml -.. _e04: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint -.. _e07: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args -.. _e12: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args -.. _e13: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch -.. _e14: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch -.. _e16: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args -.. _e17: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch -.. _e18: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse -.. _e19: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse -.. _e20: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load -.. _e21: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes -.. _e25: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access +.. _04: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint +.. _07: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args +.. _12: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args +.. _13: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch +.. _14: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch +.. _16: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args +.. _17: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch +.. _18: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse +.. _19: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse +.. _20: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load +.. _21: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes +.. _25: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access From ecd7b56b6c87524786e29421ec6a3358ff959def Mon Sep 17 00:00:00 2001 From: mozillazg Date: Mon, 21 Aug 2023 15:24:37 +0000 Subject: [PATCH 04/20] add 26-lsm-path_chmod --- 26-lsm-path_chmod/Makefile | 1 + 26-lsm-path_chmod/README.md | 20 ++++ 26-lsm-path_chmod/cilium-ebpf/Makefile | 1 + 26-lsm-path_chmod/cilium-ebpf/README.md | 20 ++++ 26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.go | 115 +++++++++++++++++++++ 26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 4784 bytes 26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.go | 115 +++++++++++++++++++++ 26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o | Bin 0 -> 4784 bytes 26-lsm-path_chmod/cilium-ebpf/main.go | 36 +++++++ 26-lsm-path_chmod/main.bpf.c | 21 ++++ 26-lsm-path_chmod/main.go | 34 ++++++ 11 files changed, 363 insertions(+) create mode 120000 26-lsm-path_chmod/Makefile create mode 100644 26-lsm-path_chmod/README.md create mode 120000 26-lsm-path_chmod/cilium-ebpf/Makefile create mode 100644 26-lsm-path_chmod/cilium-ebpf/README.md create mode 100644 26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.go create mode 100644 26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o create mode 100644 26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.go create mode 100644 26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o create mode 100644 26-lsm-path_chmod/cilium-ebpf/main.go create mode 100644 26-lsm-path_chmod/main.bpf.c create mode 100644 26-lsm-path_chmod/main.go diff --git a/26-lsm-path_chmod/Makefile b/26-lsm-path_chmod/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/26-lsm-path_chmod/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/26-lsm-path_chmod/README.md b/26-lsm-path_chmod/README.md new file mode 100644 index 0000000..c5fe283 --- /dev/null +++ b/26-lsm-path_chmod/README.md @@ -0,0 +1,20 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run + +touch /tmp/a.txt +chmod 600 /tmp/a.txt + +$ make cat +``` diff --git a/26-lsm-path_chmod/cilium-ebpf/Makefile b/26-lsm-path_chmod/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/26-lsm-path_chmod/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/26-lsm-path_chmod/cilium-ebpf/README.md b/26-lsm-path_chmod/cilium-ebpf/README.md new file mode 100644 index 0000000..c5fe283 --- /dev/null +++ b/26-lsm-path_chmod/cilium-ebpf/README.md @@ -0,0 +1,20 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run + +touch /tmp/a.txt +chmod 600 /tmp/a.txt + +$ make cat +``` diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.go b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..ff60f45 --- /dev/null +++ b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,115 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + LsmPathChmod *ebpf.ProgramSpec `ebpf:"lsm_path_chmod"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { +} + +func (m *bpfMaps) Close() error { + return _BpfClose() +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + LsmPathChmod *ebpf.Program `ebpf:"lsm_path_chmod"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.LsmPathChmod, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..d1abb7140b01c692a0cf1b3744bacc7cfa6e3eb3 GIT binary patch literal 4784 zcmbtXO^h5@5q{m{tP^|v6Y_%t0UGCrUB}GYi7}2%$as@=9O00~1VlK{?w#rNG~3fN z+dq!Yk60lh5h0`?K;i^Z#K8xIIDjmH#4Zw?Ad(M3;>Lm^1SAIzNPqw>-&e2RY)=zQ zNR(8szN%MM@2}pQo-Zt%JLCJF8Ix!J23#|YdjR&0MC)j~$4svu6>P5U7kTqO)z{x< z?K@%L+S=N@7TEsht$9`bgDWSuHfb8iecC$gydZJc*YC8t#_xCWSB{&T*|R?BzuE8) z)W0}j=Vz0l)qJ!N|AjY3zUupx-fV?Kc7MLPCzS0e%U5 z3z&2j%<%&7_rZI?9q^C9oWlnAr(n!ovi}13Zs0Y@SHSN8-hliy_+6MS@o&Ko>T+HK zJ_g)@{1f;+u_VVfKLFgAuk66z6rwHjphTuwC|Id*nj}~-LfIZ zz{fj+Nwb?`9uiwX@;;xOW|}I}h%Y!|?Mi zZ^yF7yhU2$eID{IaECfp!u&cFa~o}l{UVw>1)|YB@bSI^^>%CbUQ`^w{tZoV2k^HP zV-4Q76~7huWyPpL@2c(>O&zeCw_H6QKIrZ6TUS2{3Fl-%PqA^u2?$^FPH=#jS2PCG z7X5bs<9KUB3))`0$2!0q$MkN8YHR;1YzM8~V@_4SB4^iLF z>9gLr79l1B0Q;YUJZ!CgtQaZ$f#!KH@JKQD-_;3IR8Z$=1O5^kV$`eug8Cl;{;Fa; zyZ+a?IUtVBx_0&O5V6+7xtjgM@OW8cn5I+fBXnoWF@FdZcb4S;7|lt6#{ZeF6+Uve z9#;D=A&EQGIU$h5D?SD5b)EYnJM|nm*6*P{LL2a((a4ZBnysIx-&xp@vh{O5N*eQoO6L1j&CWU|G5*z^7Nc$bp@!e6 z;lFR=9o`s^qOxxWS!sH4R_0es0+<$qkoHi17OBqF)b?DvJvWGwti3c^Zg&|GOh(KU zWnOj5fI-0_wzI)!&5@HwO#td;(I5^U3Fa5igpWOaejz-+aQg8XdL0hzBp^dN&7Ly7 za5;@G7LY}}inbpWeTY$%W4ZuzgGjPr&q}MO!|qBRFQaETLQ^cEDHCyBE_zWJLGSjH zw8zeBsh8v&qB2!hBp0)|7jPReVs}_&Wmt@oj2Xi>v5mdPzlQ_Ur`ihE`hXT2o5XsQ!j%?UM!&Rj-GYO15h*@3Be+dNpr%FIFc&3W*!Toeg8C8OnWS>;)9Eqn|MacqA0yMAkZ zv-Wnr+l>x9*<$1f|3z?a`qSrO42LIuf~e2qo3xo{Q@yT2GMApn6nBKWp2igW>pA(U zQqR?C=!*^gLPH-l^tFc0@$30tYUn>`=o=0FdP9Gsq5o@A_okgb?e8}2lFw{AkJI-2 zGiTaVZg7LzX?kf8M!jB+SAY9HO?pcvm?nM#alOlE$+U|r1Ce?I-JqDx|4lqgJ}NppaPB=v2fw9cOjKOLRksB>>tyeDgtCg)GQ z*3fBF^6)uL+VyWM$89}+H>`Di?1X=nhpgh^ukZxb{ZsTb*6n=voK?g+XYILtcl&n$ zwvT|D`vVhc&u^@hmx!;Y8^^`(hwXFV8^!-o;{!;>^Hn3&<7vM^{9fm`2_O2ozckLy m@gEp&os)B0gEC2b-S~}jo!IXlVw(M$X7B3?o}bLS9seJZ06(z+ literal 0 HcmV?d00001 diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.go b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.go new file mode 100644 index 0000000..865f5c9 --- /dev/null +++ b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.go @@ -0,0 +1,115 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + LsmPathChmod *ebpf.ProgramSpec `ebpf:"lsm_path_chmod"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { +} + +func (m *bpfMaps) Close() error { + return _BpfClose() +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + LsmPathChmod *ebpf.Program `ebpf:"lsm_path_chmod"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.LsmPathChmod, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..256e42c514eb28459770da11b445353ca1b9a066 GIT binary patch literal 4784 zcmbVPTWl0n7(Tmgr9u(#iik3zVvDc^L_`o-3Pp)kD=HBm9HzTdcGB6|?OeEciH(s& zV@xn=;*%g6!-FwCXh<}%HPI(E;XxDMti~7-9(*uSqNaY|ng493L-oNwd(Qv;-}(P@ zzsx?fF}NMg{>(yp7CcpS$_-V^pB7h zqrI%KzKcPOS5lUKXi}X@P4$}SO0C|gS~o@N?!f_d>})|TmV&S0&9tap2&IasQ%@dr zJ3Gq?+oX6dG+oPLLlqy$;B+`Tem>*aU#3N=Pl2%(s4JkscXdFsPPEfL0eu{a1EQQn zVwr{X9?~U9Wuy<0SkDB~CrG+(RQ5UWQlv59ub{6*ngIR=dKobW^d0m%Bo63DsP#x? z;4{#-A&mk53cUeoLI!<1FdIA%wGn9yn0t*_VF2@h?<5br02pG%sg|a8=RA;WfbnZ* z-}?Z%=n1)3eC7j_H$Hm+%v{*O=)PW$I-)N3j^Pc#R{@_8%sqHA#Rb+` zMiMD5F$i1W8sKs9qcVL2EZ#Tmr&o)<*CAO*Ur7w-oA&px@zec>sX1zj8T%PHu#ZNr zHvrm<{Wth57ydjj_ql~M1q|uD0ohzQ!_;d{@u}G|PJE$9?{>_}v4{%07b) zt*@}VVN+P&ml=MSX4Cku)A%{0e#+o;8T>~E>&q8!udbr$#5Gk9VpVm6I6SO8KtHP6 z^u7-=*S&KUUQ-vRMQF3T>!d4c|oI^ z>eTidm66aLMoFWIEE+-&dni`TX6PPJqnIM4JI@i>z8fe#G=k*T zb;`DxCmYriA@>`>eoJRFy4W%*H7A7Yw%xn8?X@4;^;p0C@ZQ0G+eTnI6T1I;IGR!^ z%#KV3sY1G{&^g!|w>C8Egq2#0#z03+1?qs~D<^K$y$Wbuxf|-1+^TB2LDdWPt7Icb zvr%Z<(6QtBDp|XMg~(fDifWAzn~@`Laa@d7CYT;hK(WD4$+i7 z;)a3i+gQWy75ZcVt+FET3AZt#?$Zui^%gt4d)*Z)szvhX_004V~C)1QCuXk4Kb%!Di(0 z9vF`5+}rsH(;vTQur8cCje_qV&8xZtPiit^Ev;cneq;lpA>rp{vBmJKw`g48#k=!D@;8W zJTPhmiGpy=En^{sZS&*Vl#`oXI73({-&7E=_36oqzs=23ZJY? zGxbc8gmAPJt_E8_D&Hqu3EC$!-z%)ke5L^E+R6kX?B$>_plR>R+0C3ima~uM?BhB6 z{hU3Kvrp&jb259razc4fV#FRV&@L%zh#!+-< z&W>R-o^zTNizFnwziA6isD+=73olT6qNplNe~ak^c@QZ-N94bi_=Pkeygk{Di8uUH z;AV^eS>i2}Qy7nb)fdE*pDn&qzOyG$PN5(7SiXJ!EovK>;w3zW)RLbiKEJN{`Kux# R@54&YO8k*ljVZ{-{{z88Kt=!n literal 0 HcmV?d00001 diff --git a/26-lsm-path_chmod/cilium-ebpf/main.go b/26-lsm-path_chmod/cilium-ebpf/main.go new file mode 100644 index 0000000..417213a --- /dev/null +++ b/26-lsm-path_chmod/cilium-ebpf/main.go @@ -0,0 +1,36 @@ +package main + +import ( + "log" + "time" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/rlimit" +) + +// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS bpf ../main.bpf.c -- -I../ -I../output + +func main() { + if err := rlimit.RemoveMemlock(); err != nil { + log.Fatal(err) + } + + objs := bpfObjects{} + if err := loadBpfObjects(&objs, nil); err != nil { + log.Fatal(err) + } + defer objs.Close() + + tp, err := link.AttachLSM(link.LSMOptions{ + Program: objs.LsmPathChmod, + }) + if err != nil { + log.Println(err) + return + } + defer tp.Close() + + log.Println("Waiting for events...") + time.Sleep(time.Minute * 1024) +} diff --git a/26-lsm-path_chmod/main.bpf.c b/26-lsm-path_chmod/main.bpf.c new file mode 100644 index 0000000..f53b49c --- /dev/null +++ b/26-lsm-path_chmod/main.bpf.c @@ -0,0 +1,21 @@ +#include "vmlinux.h" + +#include +#include +#include + + +SEC("lsm/path_chmod") +int lsm_path_chmod(struct path *path) { + char path_str[32]; + struct qstr dname; + + dname = BPF_CORE_READ(path, dentry, d_name); + bpf_probe_read_kernel_str(&path_str, sizeof(path_str), dname.name); + + bpf_printk("chmod %s", path_str); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/26-lsm-path_chmod/main.go b/26-lsm-path_chmod/main.go new file mode 100644 index 0000000..7640889 --- /dev/null +++ b/26-lsm-path_chmod/main.go @@ -0,0 +1,34 @@ +package main + +import ( + "log" + "time" + + bpf "github.com/aquasecurity/libbpfgo" +) + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + + if err := bpfModule.BPFLoadObject(); err != nil { + log.Println(err) + return + } + prog, err := bpfModule.GetProgram("lsm_path_chmod") + if err != nil { + log.Println(err) + return + } + + if _, err := prog.AttachLSM(); err != nil { + log.Println(err) + return + } + + log.Println("waiting for events") + time.Sleep(time.Minute * 1024) +} From c2fec7a6f94d6c9a70bae2306af5b119b43cb63f Mon Sep 17 00:00:00 2001 From: mozillazg Date: Tue, 22 Aug 2023 00:42:43 +0000 Subject: [PATCH 05/20] 26: update docs --- 26-lsm-path_chmod/README.md | 6 ++++++ 26-lsm-path_chmod/cilium-ebpf/README.md | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/26-lsm-path_chmod/README.md b/26-lsm-path_chmod/README.md index c5fe283..284dc80 100644 --- a/26-lsm-path_chmod/README.md +++ b/26-lsm-path_chmod/README.md @@ -1,5 +1,11 @@ +## Ensure that BPF LSM is enabled + +... + + + ## Usage build: diff --git a/26-lsm-path_chmod/cilium-ebpf/README.md b/26-lsm-path_chmod/cilium-ebpf/README.md index c5fe283..284dc80 100644 --- a/26-lsm-path_chmod/cilium-ebpf/README.md +++ b/26-lsm-path_chmod/cilium-ebpf/README.md @@ -1,5 +1,11 @@ +## Ensure that BPF LSM is enabled + +... + + + ## Usage build: From 2f6f95f148026fb106646dd3f0f3cd8ef264faca Mon Sep 17 00:00:00 2001 From: mozillazg Date: Wed, 23 Aug 2023 01:25:26 +0000 Subject: [PATCH 06/20] 26: fix the path is empth --- 26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o | Bin 4784 -> 4832 bytes 26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o | Bin 4784 -> 4832 bytes 26-lsm-path_chmod/main.bpf.c | 2 +- 3 files changed, 1 insertion(+), 1 deletion(-) diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfeb.o index d1abb7140b01c692a0cf1b3744bacc7cfa6e3eb3..cec19d1d0919ae4a6c50d83e091adf67617d0aef 100644 GIT binary patch literal 4832 zcmb_fO^h5@5q{lcuN}P3nj{1h3^XP`>tJT>#291aFl%SmL~`(INkj~XcJEB@PUD`Q z+3p_4izQfzAi)ixpd1h)ASAdT`GPDYkXIl?E)kZJ13wa4DYxVhi%TLDY5Bf-^=5k- z3>QkOS6|hus`pp#P0u&y&d>Y4XGY|icYrH~Q4he>%c8Zk-D@Uq1cG<39TjP&9<%c1 z16J*oEU8jauQ;@6Iw-R!CP zZ`S++^)L3@@oX}*n(wZg$E`{ICT^(54^*C8IB(kBUcVDORG7DZEc>$G_D#HQ40*=~ zsQcDP;py&if-Rc&+6~#@4<+I>jVA478D5s8hfgOtP zq7Pyjw*meG_N3-1Nkb$`9@!>*;_y#)Mz za0~4Al>6i`{JbA+$Fj%VE3NT<3i%;$i#k@q{5lnLA8m;JIhqd&M5B4&<6Va;H3a-C z#R2fIHNpMBzg3Jic)wSSTJrv=nB%#5%GJ}wei%Nl>ONA4yEq&3G-G&rO7Jy2mjE$; z(-=%s^tS;<@z#bGw7pjE9jJOYr0e6-qS;=n&!G=myT8kJF~7f8*YOG9{W=!MCOv3{ zjKw)H9dkcq?fxU%{yu8Zu%1BvY0dcv@YCBq(m5?H8qA+tz?@%(Jml<$L7{)S@izuPOO_!iU|+JIT7#Hd04CG|f7 z{6ocfKK-9?b3hy$eilGHPOSBCo|q1xF9KcH7^Z2_sC|U)Y&qudpyIxg{8!MN6lnZE z>003cg{|h8>i@N5Nc*Un+{kzV6fj)W;9P2jJ)3gDy?gD}gk_tVmX}xDzBA+&85L|v&}5QnT7dqVe!Jb>G5=jgQCob?J{7V;8C`Rf@>xK zb+V`z2d5?S?1ja-aB*(-$!U5V4(wo%A)OALGM#WajaCZCB3?z?jfyVBAj&Z<0J=dW zS-)eY)zg0aavm?Er$0bbETJhAaa}GtQ5ivRcayZk&f!ug$vMQ(jBOM~Z1;y*85V;i zW5%#F|7IImM!k7FL&_t1&rUO&&cz zTA(Omjq-MPWX6hCT>^6@N=;Pudr2E+Ngn4iQrt0vIO`a1Qk*F4aFF+x;xNZh;pI5b;xxozO+U;E zB|>Q@Uyu9CQnEB0LcQ`Rn_9Cha+?Q>xIBH(eSIE0EVn^IPT`xB2bm`AI4ff8NEnXa zpe9Yrz0x%EzErGpwRZ%C9p_P*^s@r@kkwxdVL`3&P_HZ(J(g~Lo7@L*pf3tPY{ z-vZ;qO&&o0P`O76@4EaL(Z&x@(js_Cf7kh7I-S0O>JUPFl-d6xzAyQa_nhhwLYL51 z`>$HPfgi*Ze9XV2{SZRmLkoZD=Xk$ReGTtEb*`g2pMB6dclV}G0ON;Kh(Bn2r12vz z#If%IyMAlEQ+pq_2v77F@h6T$`D0d9V6XeL=QO@q-RxW#{pK;1dY(;n;Hnv;r!>J` zp{~D36YQ^!#ZQ=Ou2xN7sOgt#`kw@R(5Qo+@;zX<#Pir=in67H_({4{g%wL0|z^{b9Ylk+F$t#W#` zMreMJ4j{QV7E0^f&Gqo4SruBv~%_D4?mn7pJ4 z>z_60_QCDne%PJ`*VhLVY42?-<%Q*!o7*23zYn%`@EzjsMwd{4mhpT6N!57T?-U=< x8N_+e&(&8oex|>5Ue0|T4&yY%`H^aMF}B~`|IjZ%_-CMhzs+~m;KXSE{{_`)L8Jfx literal 4784 zcmbtXO^h5@5q{m{tP^|v6Y_%t0UGCrUB}GYi7}2%$as@=9O00~1VlK{?w#rNG~3fN z+dq!Yk60lh5h0`?K;i^Z#K8xIIDjmH#4Zw?Ad(M3;>Lm^1SAIzNPqw>-&e2RY)=zQ zNR(8szN%MM@2}pQo-Zt%JLCJF8Ix!J23#|YdjR&0MC)j~$4svu6>P5U7kTqO)z{x< z?K@%L+S=N@7TEsht$9`bgDWSuHfb8iecC$gydZJc*YC8t#_xCWSB{&T*|R?BzuE8) z)W0}j=Vz0l)qJ!N|AjY3zUupx-fV?Kc7MLPCzS0e%U5 z3z&2j%<%&7_rZI?9q^C9oWlnAr(n!ovi}13Zs0Y@SHSN8-hliy_+6MS@o&Ko>T+HK zJ_g)@{1f;+u_VVfKLFgAuk66z6rwHjphTuwC|Id*nj}~-LfIZ zz{fj+Nwb?`9uiwX@;;xOW|}I}h%Y!|?Mi zZ^yF7yhU2$eID{IaECfp!u&cFa~o}l{UVw>1)|YB@bSI^^>%CbUQ`^w{tZoV2k^HP zV-4Q76~7huWyPpL@2c(>O&zeCw_H6QKIrZ6TUS2{3Fl-%PqA^u2?$^FPH=#jS2PCG z7X5bs<9KUB3))`0$2!0q$MkN8YHR;1YzM8~V@_4SB4^iLF z>9gLr79l1B0Q;YUJZ!CgtQaZ$f#!KH@JKQD-_;3IR8Z$=1O5^kV$`eug8Cl;{;Fa; zyZ+a?IUtVBx_0&O5V6+7xtjgM@OW8cn5I+fBXnoWF@FdZcb4S;7|lt6#{ZeF6+Uve z9#;D=A&EQGIU$h5D?SD5b)EYnJM|nm*6*P{LL2a((a4ZBnysIx-&xp@vh{O5N*eQoO6L1j&CWU|G5*z^7Nc$bp@!e6 z;lFR=9o`s^qOxxWS!sH4R_0es0+<$qkoHi17OBqF)b?DvJvWGwti3c^Zg&|GOh(KU zWnOj5fI-0_wzI)!&5@HwO#td;(I5^U3Fa5igpWOaejz-+aQg8XdL0hzBp^dN&7Ly7 za5;@G7LY}}inbpWeTY$%W4ZuzgGjPr&q}MO!|qBRFQaETLQ^cEDHCyBE_zWJLGSjH zw8zeBsh8v&qB2!hBp0)|7jPReVs}_&Wmt@oj2Xi>v5mdPzlQ_Ur`ihE`hXT2o5XsQ!j%?UM!&Rj-GYO15h*@3Be+dNpr%FIFc&3W*!Toeg8C8OnWS>;)9Eqn|MacqA0yMAkZ zv-Wnr+l>x9*<$1f|3z?a`qSrO42LIuf~e2qo3xo{Q@yT2GMApn6nBKWp2igW>pA(U zQqR?C=!*^gLPH-l^tFc0@$30tYUn>`=o=0FdP9Gsq5o@A_okgb?e8}2lFw{AkJI-2 zGiTaVZg7LzX?kf8M!jB+SAY9HO?pcvm?nM#alOlE$+U|r1Ce?I-JqDx|4lqgJ}NppaPB=v2fw9cOjKOLRksB>>tyeDgtCg)GQ z*3fBF^6)uL+VyWM$89}+H>`Di?1X=nhpgh^ukZxb{ZsTb*6n=voK?g+XYILtcl&n$ zwvT|D`vVhc&u^@hmx!;Y8^^`(hwXFV8^!-o;{!;>^Hn3&<7vM^{9fm`2_O2ozckLy m@gEp&os)B0gEC2b-S~}jo!IXlVw(M$X7B3?o}bLS9seJZ06(z+ diff --git a/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o b/26-lsm-path_chmod/cilium-ebpf/bpf_bpfel.o index 256e42c514eb28459770da11b445353ca1b9a066..e9e92a6bb3f809e5b73b2f98b4b561162e882f93 100644 GIT binary patch literal 4832 zcmbVPU2Ggz6+XMMYbUkiG$jy9DbqAfo#Jeg)`ZXySSNKtrIc8v6$Bn86Fz!F7*x2gj50im{lpf5;yK@k!t76{Roib(LlkAy7oRvw6WDMFRZ_uYH$W-^WP zz|r1&zw@1Q?*Gs1H|NitX*L?-q#^IgZOySFZ%p0BZ3EjfDHC$NDKZXy?Lljwdd!wL z-n8WyD%;%J+H!v12EB@O9lVEf?Z=y2C}c|GZ~T;+$k=@%HxYLuusY*+0lN6LkgbYT z{n<{{--Dh0InrLVR~6Q`9mI{$vh+ifa^0%(eJ#%}oRhHI>vz1zb9w!r4cV)PKf#-6 z&xjHtP1NZoufguM)r7Vu>Bd<0<6+A;$a$cU$WLrT`8g!iGs3~1MjAt+oJFeE3AK5i z1}jYthCYZJ*+BU_q#a0wX*Uu(@-7PYaUJ;IC_j$0 z0sLQ-pCD!jp+5yI==65rS->{%PT)@guLJJ^J_fu2O!+i34Eho9#{t)Y4=9#Vkt4vL zB@a9c3~_TLb54LI&!y6PUd7xeDOs;$>hrzpnywo++;ZKY+4L z#Y(fX=bQBVVI`I>x@YA_;6DnzO%j6oNA30$`H-dLXYl!mV)YrJ&o%ISl>dcd5Be{G zA>$uL_G`r)!*3OHFa2II+H=x;$RP~*W5DlNA9KWApFlUCzwKvMhrW*>c}RcL7~P-p zFX;H0{=#g0SW?_r--ClY8{{8lrUD-m%LB4cxiON!9?~Q*Wc)E?dx24vSzD6(nW=yu zWz3`Sd0e?CD*m&;2b4bv3>kj{+4B`2lGDsoFnCkvm*I2Jktjb|!7asK(>kA2-Sx8r zp8aw{m97c086|VYT!X7LqHl+geM2$lp90m4{aXNsEhVoi<{o@a{f_|uK=D!FH!W_k zaC;iC`7|<>9p@YZ|3%esV9%Ws>0pNM1ybb(}h4Ker{LEd&v-BC|{{oV@ ztvZUPizhyT?C!!&G{cP52r`12^+RID^z zT~M3!d#DyWr;gL$PXV`8N6~B}Q)!-7fF|5^BaD3=aS(UDU^ZgdX90PpxHo=c{dUd+ zJ14*$^ieS$yu%s8`~2q`^96Ny8#-dmlsu;#{ccwHGs?5gKil{*QtwvqtqOj>g3Up2 zPfpTLS3HxIX&$enQOAqZLc-#TuuSrvKM0DhZ(c{LhbtGO;8 z{^I=Hv(xmL@oZx#eL5XHAsv4?3088Hd9;eW8{}OSgCIk<0O*DyPWv5OT0QB9m$GOX zmi_=)zJ#oZjq7sW35o!E*o~78jpb4&&e%jLcT5yo4EtqT`1v4CS)*Ub2e=_K1lFsJ z(lC;466b}#l=!B9X>_HK!61t+%POWvOy@ZwKZ#N?LnA1keoB0wd3kJ>2>GyMVK>OY z%`Gm@UGTs3+*jxQ7cMN!`@Xm#n~s`(8%iv!4napF8C@j{UK$S2D25HPusftNqE%Oc zTn-WmiheH+L7U2>%(N7BWDupDI9-wQIJxD=^!t~}f!i)wSn5)kbqIqb zSqiY8rn==a4Y9pv&E~|$_6J#iDe^Nk|@2HN# z$ScU{Px~nBZ>hdUy=})qJNw7}@bP2c?Hy_VA@Jd(AlzKiht$ZncOyAF;5~#h*Qk6n z@EUirjgQ-1WLw4GnfbguFzlawYG~s#u)9*vCP@fKOyLT#R6LUnEeWK5z<3>gzR~E8>LqH=Kf!`n8(AQPXeM^v#<7eodcnTN6C% zf4HVk+~1T|!JD>~MM>+_3ujtX?sdSDRG{4I^&MFqldJhtQF9ls9lZt=1c28d^J8_(Oi9?yF37Vl~N ttx7!iSUuj{p69muFs-YrDRxa+t-den^Vfx2-G`A6YW#O?HN(6f|34AfF}NMg{>(yp7CcpS$_-V^pB7h zqrI%KzKcPOS5lUKXi}X@P4$}SO0C|gS~o@N?!f_d>})|TmV&S0&9tap2&IasQ%@dr zJ3Gq?+oX6dG+oPLLlqy$;B+`Tem>*aU#3N=Pl2%(s4JkscXdFsPPEfL0eu{a1EQQn zVwr{X9?~U9Wuy<0SkDB~CrG+(RQ5UWQlv59ub{6*ngIR=dKobW^d0m%Bo63DsP#x? z;4{#-A&mk53cUeoLI!<1FdIA%wGn9yn0t*_VF2@h?<5br02pG%sg|a8=RA;WfbnZ* z-}?Z%=n1)3eC7j_H$Hm+%v{*O=)PW$I-)N3j^Pc#R{@_8%sqHA#Rb+` zMiMD5F$i1W8sKs9qcVL2EZ#Tmr&o)<*CAO*Ur7w-oA&px@zec>sX1zj8T%PHu#ZNr zHvrm<{Wth57ydjj_ql~M1q|uD0ohzQ!_;d{@u}G|PJE$9?{>_}v4{%07b) zt*@}VVN+P&ml=MSX4Cku)A%{0e#+o;8T>~E>&q8!udbr$#5Gk9VpVm6I6SO8KtHP6 z^u7-=*S&KUUQ-vRMQF3T>!d4c|oI^ z>eTidm66aLMoFWIEE+-&dni`TX6PPJqnIM4JI@i>z8fe#G=k*T zb;`DxCmYriA@>`>eoJRFy4W%*H7A7Yw%xn8?X@4;^;p0C@ZQ0G+eTnI6T1I;IGR!^ z%#KV3sY1G{&^g!|w>C8Egq2#0#z03+1?qs~D<^K$y$Wbuxf|-1+^TB2LDdWPt7Icb zvr%Z<(6QtBDp|XMg~(fDifWAzn~@`Laa@d7CYT;hK(WD4$+i7 z;)a3i+gQWy75ZcVt+FET3AZt#?$Zui^%gt4d)*Z)szvhX_004V~C)1QCuXk4Kb%!Di(0 z9vF`5+}rsH(;vTQur8cCje_qV&8xZtPiit^Ev;cneq;lpA>rp{vBmJKw`g48#k=!D@;8W zJTPhmiGpy=En^{sZS&*Vl#`oXI73({-&7E=_36oqzs=23ZJY? zGxbc8gmAPJt_E8_D&Hqu3EC$!-z%)ke5L^E+R6kX?B$>_plR>R+0C3ima~uM?BhB6 z{hU3Kvrp&jb259razc4fV#FRV&@L%zh#!+-< z&W>R-o^zTNizFnwziA6isD+=73olT6qNplNe~ak^c@QZ-N94bi_=Pkeygk{Di8uUH z;AV^eS>i2}Qy7nb)fdE*pDn&qzOyG$PN5(7SiXJ!EovK>;w3zW)RLbiKEJN{`Kux# R@54&YO8k*ljVZ{-{{z88Kt=!n diff --git a/26-lsm-path_chmod/main.bpf.c b/26-lsm-path_chmod/main.bpf.c index f53b49c..8841c80 100644 --- a/26-lsm-path_chmod/main.bpf.c +++ b/26-lsm-path_chmod/main.bpf.c @@ -6,7 +6,7 @@ SEC("lsm/path_chmod") -int lsm_path_chmod(struct path *path) { +int BPF_PROG(lsm_path_chmod, struct path *path) { char path_str[32]; struct qstr dname; From b69530c32cd55fdc3afa13353e8f1654d41c0a54 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Tue, 29 Aug 2023 15:25:02 +0000 Subject: [PATCH 07/20] update docs --- README.rst | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/README.rst b/README.rst index b1653df..c1b31bf 100644 --- a/README.rst +++ b/README.rst @@ -103,7 +103,7 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ | | | +| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ |`26`_ | | + + +----------------------------------+-----------------------+-----------+ | | | ``lsm.s+`` [#lsm]_ | | Yes | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ @@ -208,16 +208,18 @@ Program Types .. |Build examples| image:: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master :target: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml -.. _04: https://github.com/mozillazg/hello-libbpfgo/tree/master/04-tracepoint -.. _07: https://github.com/mozillazg/hello-libbpfgo/tree/master/07-tracepoint-args -.. _12: https://github.com/mozillazg/hello-libbpfgo/tree/master/12-raw-tracepoint-args -.. _13: https://github.com/mozillazg/hello-libbpfgo/tree/master/13-raw-tracepoint-args-sched_switch -.. _14: https://github.com/mozillazg/hello-libbpfgo/tree/master/14-tracepoint-args-sched_switch -.. _16: https://github.com/mozillazg/hello-libbpfgo/tree/master/16-btf-raw-tracepoint-args -.. _17: https://github.com/mozillazg/hello-libbpfgo/tree/master/17-btf-raw-tracepoint-args-sched_switch -.. _18: https://github.com/mozillazg/hello-libbpfgo/tree/master/18-socket-filter-capture-icmp-traffic-kernel-parse -.. _19: https://github.com/mozillazg/hello-libbpfgo/tree/master/19-socket-filter-capture-icmp-traffic-userspace-parse -.. _20: https://github.com/mozillazg/hello-libbpfgo/tree/master/20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load -.. _21: https://github.com/mozillazg/hello-libbpfgo/tree/master/21-tc-parse-packet-with-bpf_skb_load_bytes -.. _25: https://github.com/mozillazg/hello-libbpfgo/tree/master/25-tc-parse-packet-with-direct-memory-access +.. _04: 04-tracepoint +.. _07: 07-tracepoint-args +.. _12: 12-raw-tracepoint-args +.. _13: 13-raw-tracepoint-args-sched_switch +.. _14: 14-tracepoint-args-sched_switch +.. _16: 16-btf-raw-tracepoint-args +.. _17: 17-btf-raw-tracepoint-args-sched_switch +.. _18: 18-socket-filter-capture-icmp-traffic-kernel-parse +.. _19: 19-socket-filter-capture-icmp-traffic-userspace-parse +.. _20: 20-socket-filter-capture-icmp-traffic-kernel-parse-without-llvm-load +.. _21: 21-tc-parse-packet-with-bpf_skb_load_bytes +.. _25: 25-tc-parse-packet-with-direct-memory-access +.. _26: 26-lsm-path_chmod + From 691030b64fa1a4942abd8be2a519e30cfcbb0164 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Fri, 8 Sep 2023 01:26:58 +0000 Subject: [PATCH 08/20] add 27-attach-tracepoint-with-syscall --- 27-attach-tracepoint-with-syscall/.gitignore | 2 + 27-attach-tracepoint-with-syscall/Makefile | 128 ++++++++++ 27-attach-tracepoint-with-syscall/README.md | 15 ++ 27-attach-tracepoint-with-syscall/bpf_insn.h | 234 +++++++++++++++++++ 27-attach-tracepoint-with-syscall/main.bpf.c | 16 ++ 27-attach-tracepoint-with-syscall/main.c | 153 ++++++++++++ 6 files changed, 548 insertions(+) create mode 100644 27-attach-tracepoint-with-syscall/.gitignore create mode 100644 27-attach-tracepoint-with-syscall/Makefile create mode 100644 27-attach-tracepoint-with-syscall/README.md create mode 100644 27-attach-tracepoint-with-syscall/bpf_insn.h create mode 100644 27-attach-tracepoint-with-syscall/main.bpf.c create mode 100644 27-attach-tracepoint-with-syscall/main.c diff --git a/27-attach-tracepoint-with-syscall/.gitignore b/27-attach-tracepoint-with-syscall/.gitignore new file mode 100644 index 0000000..b74312c --- /dev/null +++ b/27-attach-tracepoint-with-syscall/.gitignore @@ -0,0 +1,2 @@ +test.c +test diff --git a/27-attach-tracepoint-with-syscall/Makefile b/27-attach-tracepoint-with-syscall/Makefile new file mode 100644 index 0000000..53b6951 --- /dev/null +++ b/27-attach-tracepoint-with-syscall/Makefile @@ -0,0 +1,128 @@ +OUTPUT = ./output +LIBBPF = ../libbpf + +LIBBPF_SRC = $(abspath $(LIBBPF)/src) +LIBBPF_OBJ = $(abspath $(OUTPUT)/libbpf.a) + +CC = gcc +CLANG = clang + +ARCH := $(shell uname -m) +ARCH := $(subst x86_64,amd64,$(ARCH)) +GOARCH := $(ARCH) + +BPFTOOL = $(shell which bpftool || /bin/false) +BTFFILE = /sys/kernel/btf/vmlinux +DBGVMLINUX = /usr/lib/debug/boot/vmlinux-$(shell uname -r) +GIT = $(shell which git || /bin/false) +VMLINUXH = vmlinux.h + +# libbpf + +LIBBPF_OBJDIR = $(abspath ./$(OUTPUT)/libbpf) +LIBBPF_DESTDIR = $(abspath ./$(OUTPUT)) + +CFLAGS = -ggdb -gdwarf -O2 -Wall -fpie -Wno-unused-variable -Wno-unused-function +LDFLAGS = + +BPF_CFLAGS_STATIC = "-I$(abspath $(OUTPUT))" +BPF_LDFLAGS_STATIC = "-lelf -lz $(LIBBPF_OBJ)" + +CGO_CFLAGS_STATIC = "-I$(abspath $(OUTPUT))" +CGO_LDFLAGS_STATIC = "-lelf -lz $(LIBBPF_OBJ)" +CGO_EXTLDFLAGS_STATIC = '-w -extldflags "-static"' + +CGO_CFGLAGS_DYN = "-I. -I/usr/include/" +CGO_LDFLAGS_DYN = "-lelf -lz -lbpf" +CGO_EXTLDFLAGS_DYN = '-w' + +## program + +.PHONY: $(PROGRAM) +.PHONY: $(PROGRAM).bpf.c + +PROGRAM = main + +all: + $(MAKE) -C . $(PROGRAM) + +# vmlinux header file + +.PHONY: vmlinuxh +vmlinuxh: $(VMLINUXH) + +$(VMLINUXH): $(OUTPUT) +ifeq ($(wildcard $(BPFTOOL)),) + @echo "ERROR: could not find bpftool" + @exit 1 +endif + @if [ -f $(DBGVMLINUX) ]; then \ + echo "INFO: found dbg kernel, generating $(VMLINUXH) from $(DBGVMLINUX)"; \ + $(BPFTOOL) btf dump file $(DBGVMLINUX) format c > $(VMLINUXH); \ + fi + @if [ ! -f $(BTFFILE) ] && [ ! -f $(DBGVMLINUX) ]; then \ + echo "ERROR: kernel does not seem to support BTF"; \ + exit 1; \ + fi + @if [ ! -f $(VMLINUXH) ]; then \ + echo "INFO: generating $(VMLINUXH) from $(BTFFILE)"; \ + $(BPFTOOL) btf dump file $(BTFFILE) format c > $(VMLINUXH); \ + fi + +# static libbpf generation for the git submodule + +.PHONY: libbpf +libbpf: $(LIBBPF_OBJ) + +$(LIBBPF_OBJ): $(LIBBPF_SRC) $(wildcard $(LIBBPF_SRC)/*.[ch]) | $(OUTPUT)/libbpf + CC="$(CC)" CFLAGS="$(CFLAGS)" LD_FLAGS="$(LDFLAGS)" \ + $(MAKE) -C $(LIBBPF_SRC) \ + BUILD_STATIC_ONLY=1 \ + OBJDIR=$(LIBBPF_OBJDIR) \ + DESTDIR=$(LIBBPF_DESTDIR) \ + INCLUDEDIR= LIBDIR= UAPIDIR= prefix= libdir= install + $(MAKE) -C $(LIBBPF_SRC) UAPIDIR=$(LIBBPF_DESTDIR) install_uapi_headers + +$(LIBBPF_SRC): +ifeq ($(wildcard $@), ) + echo "INFO: updating submodule 'libbpf'" + $(GIT) submodule update --init --recursive +endif + +# output dir + +$(OUTPUT): + mkdir -p $(OUTPUT) + +$(OUTPUT)/libbpf: + mkdir -p $(OUTPUT)/libbpf + +## program bpf dependency + +$(PROGRAM).bpf.o: $(PROGRAM).bpf.c | vmlinuxh + $(CLANG) $(CFLAGS) -target bpf -D__TARGET_ARCH_x86 -I. -I$(OUTPUT) -c $< -o $@ + +## GO example + +.PHONY: $(PROGRAM) + +$(PROGRAM): libbpf | $(PROGRAM).bpf.o + gcc ./main.c -o main + +.PHONE: run +run: + sudo ./main + +.PHONE: cat +cat: + sudo cat /sys/kernel/debug/tracing/trace_pipe + +## clean + +.PHONY: clean +clean: + $(MAKE) -C $(LIBBPF_SRC) clean + rm -rf $(OUTPUT) + rm -rf $(VMLINUXH) + rm -rf $(PROGRAM) $(PROGRAM)-*static $(PROGRAM)-*dynamic + rm -rf $(PROGRAM).bpf.o $(PROGRAM).o diff --git a/27-attach-tracepoint-with-syscall/README.md b/27-attach-tracepoint-with-syscall/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/27-attach-tracepoint-with-syscall/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/27-attach-tracepoint-with-syscall/bpf_insn.h b/27-attach-tracepoint-with-syscall/bpf_insn.h new file mode 100644 index 0000000..cbd8f7d --- /dev/null +++ b/27-attach-tracepoint-with-syscall/bpf_insn.h @@ -0,0 +1,234 @@ +/* copy from https://github.com/torvalds/linux/blob/master/samples/bpf/bpf_insn.h */ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* eBPF instruction mini library */ +#ifndef __BPF_INSN_H +#define __BPF_INSN_H + +struct bpf_insn; + +/* ALU ops on registers, bpf_add|sub|...: dst_reg += src_reg */ + +#define BPF_ALU64_REG(OP, DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_OP(OP) | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +#define BPF_ALU32_REG(OP, DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_OP(OP) | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +/* ALU ops on immediates, bpf_add|sub|...: dst_reg += imm32 */ + +#define BPF_ALU64_IMM(OP, DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +#define BPF_ALU32_IMM(OP, DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +/* Short form of mov, dst_reg = src_reg */ + +#define BPF_MOV64_REG(DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_MOV | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +#define BPF_MOV32_REG(DST, SRC) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_MOV | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = 0 }) + +/* Short form of mov, dst_reg = imm32 */ + +#define BPF_MOV64_IMM(DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU64 | BPF_MOV | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +#define BPF_MOV32_IMM(DST, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ALU | BPF_MOV | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +/* BPF_LD_IMM64 macro encodes single 'load 64-bit immediate' insn */ +#define BPF_LD_IMM64(DST, IMM) \ + BPF_LD_IMM64_RAW(DST, 0, IMM) + +#define BPF_LD_IMM64_RAW(DST, SRC, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_LD | BPF_DW | BPF_IMM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = 0, \ + .imm = (__u32) (IMM) }), \ + ((struct bpf_insn) { \ + .code = 0, /* zero is reserved opcode */ \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ + .imm = ((__u64) (IMM)) >> 32 }) + +#ifndef BPF_PSEUDO_MAP_FD +# define BPF_PSEUDO_MAP_FD 1 +#endif + +/* pseudo BPF_LD_IMM64 insn used to refer to process-local map_fd */ +#define BPF_LD_MAP_FD(DST, MAP_FD) \ + BPF_LD_IMM64_RAW(DST, BPF_PSEUDO_MAP_FD, MAP_FD) + + +/* Direct packet access, R0 = *(uint *) (skb->data + imm32) */ + +#define BPF_LD_ABS(SIZE, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_LD | BPF_SIZE(SIZE) | BPF_ABS, \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ + .imm = IMM }) + +/* Memory load, dst_reg = *(uint *) (src_reg + off16) */ + +#define BPF_LDX_MEM(SIZE, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +/* Memory store, *(uint *) (dst_reg + off16) = src_reg */ + +#define BPF_STX_MEM(SIZE, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +/* + * Atomic operations: + * + * BPF_ADD *(uint *) (dst_reg + off16) += src_reg + * BPF_AND *(uint *) (dst_reg + off16) &= src_reg + * BPF_OR *(uint *) (dst_reg + off16) |= src_reg + * BPF_XOR *(uint *) (dst_reg + off16) ^= src_reg + * BPF_ADD | BPF_FETCH src_reg = atomic_fetch_add(dst_reg + off16, src_reg); + * BPF_AND | BPF_FETCH src_reg = atomic_fetch_and(dst_reg + off16, src_reg); + * BPF_OR | BPF_FETCH src_reg = atomic_fetch_or(dst_reg + off16, src_reg); + * BPF_XOR | BPF_FETCH src_reg = atomic_fetch_xor(dst_reg + off16, src_reg); + * BPF_XCHG src_reg = atomic_xchg(dst_reg + off16, src_reg) + * BPF_CMPXCHG r0 = atomic_cmpxchg(dst_reg + off16, r0, src_reg) + */ + +#define BPF_ATOMIC_OP(SIZE, OP, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_STX | BPF_SIZE(SIZE) | BPF_ATOMIC, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = OP }) + +/* Legacy alias */ +#define BPF_STX_XADD(SIZE, DST, SRC, OFF) BPF_ATOMIC_OP(SIZE, BPF_ADD, DST, SRC, OFF) + +/* Memory store, *(uint *) (dst_reg + off16) = imm32 */ + +#define BPF_ST_MEM(SIZE, DST, OFF, IMM) \ + ((struct bpf_insn) { \ + .code = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = OFF, \ + .imm = IMM }) + +/* Conditional jumps against registers, if (dst_reg 'op' src_reg) goto pc + off16 */ + +#define BPF_JMP_REG(OP, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_JMP | BPF_OP(OP) | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +/* Like BPF_JMP_REG, but with 32-bit wide operands for comparison. */ + +#define BPF_JMP32_REG(OP, DST, SRC, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_JMP32 | BPF_OP(OP) | BPF_X, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = 0 }) + +/* Conditional jumps against immediates, if (dst_reg 'op' imm32) goto pc + off16 */ + +#define BPF_JMP_IMM(OP, DST, IMM, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_JMP | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = OFF, \ + .imm = IMM }) + +/* Like BPF_JMP_IMM, but with 32-bit wide operands for comparison. */ + +#define BPF_JMP32_IMM(OP, DST, IMM, OFF) \ + ((struct bpf_insn) { \ + .code = BPF_JMP32 | BPF_OP(OP) | BPF_K, \ + .dst_reg = DST, \ + .src_reg = 0, \ + .off = OFF, \ + .imm = IMM }) + +/* Raw code statement block */ + +#define BPF_RAW_INSN(CODE, DST, SRC, OFF, IMM) \ + ((struct bpf_insn) { \ + .code = CODE, \ + .dst_reg = DST, \ + .src_reg = SRC, \ + .off = OFF, \ + .imm = IMM }) + +/* Program exit */ + +#define BPF_EXIT_INSN() \ + ((struct bpf_insn) { \ + .code = BPF_JMP | BPF_EXIT, \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ + .imm = 0 }) + +#endif diff --git a/27-attach-tracepoint-with-syscall/main.bpf.c b/27-attach-tracepoint-with-syscall/main.bpf.c new file mode 100644 index 0000000..ed920d5 --- /dev/null +++ b/27-attach-tracepoint-with-syscall/main.bpf.c @@ -0,0 +1,16 @@ +#include "vmlinux.h" + +#include +#include +#include + + +SEC("tracepoint/syscalls/sys_enter_openat") +int tracepoint_openat(struct trace_event_raw_sys_enter *ctx) { + char fmt[] = "hello world:\n"; + bpf_trace_printk(fmt, sizeof(fmt)); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/27-attach-tracepoint-with-syscall/main.c b/27-attach-tracepoint-with-syscall/main.c new file mode 100644 index 0000000..5dd407c --- /dev/null +++ b/27-attach-tracepoint-with-syscall/main.c @@ -0,0 +1,153 @@ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "./bpf_insn.h" + + +#define ptr_to_u64(x) ((uint64_t)x) +#define LOG_BUF_SIZE 0x1000 + +char bpf_log_buf[LOG_BUF_SIZE]; + + +int bpf(enum bpf_cmd cmd, union bpf_attr *attr, unsigned int size) { + return syscall(__NR_bpf, cmd, attr, size); +} + +int bpf_prog_load(enum bpf_prog_type type, const struct bpf_insn* insns, int insn_cnt, const char* license) { + union bpf_attr attr = { + .prog_type = type, + .insns = ptr_to_u64(insns), + .insn_cnt = insn_cnt, + .license = ptr_to_u64(license), + .log_buf = ptr_to_u64(bpf_log_buf), + .log_size = LOG_BUF_SIZE, + .log_level = 2, + }; + + return bpf(BPF_PROG_LOAD, &attr, sizeof(attr)); +} + +static int perf_event_open(struct perf_event_attr *evt_attr, pid_t pid, int cpu, int group_fd, unsigned long flags) { + int ret = syscall(__NR_perf_event_open, evt_attr, pid, cpu, group_fd, flags); + return ret; +} + +static int create_link(int prog_fd, int target_fd) { + union bpf_attr attr; + memset(&attr, 0, sizeof(attr)); + + attr.link_create.prog_fd = prog_fd; + attr.link_create.target_fd = target_fd; + attr.link_create.attach_type = BPF_PERF_EVENT; + attr.link_create.flags = 0; + + return bpf(BPF_LINK_CREATE, &attr, sizeof(attr)); +} + +int open_perf_event(int prog_fd, int event_id) { + struct perf_event_attr attr = {}; + memset(&attr, 0, sizeof(attr)); + + attr.type = PERF_TYPE_TRACEPOINT; + attr.sample_type = PERF_SAMPLE_RAW; + attr.sample_period = 1; + attr.wakeup_events = 1; + attr.config = event_id; + + return perf_event_open(&attr, -1, 0, -1, PERF_FLAG_FD_CLOEXEC); +} + +int attach_tracepoint(int prog_fd, int perf_fd) { + // attach via link + int link_fd = create_link(prog_fd, perf_fd); + if (link_fd < 0) { + perror("create link error"); + return -1; + } + + // ioctl(perf_fd, PERF_EVENT_IOC_RESET, 0); + ioctl(perf_fd, PERF_EVENT_IOC_ENABLE, 0); + // attach without link + // if(ioctl(perf_fd, PERF_EVENT_IOC_SET_BPF, prog_fd) < 0) { + // perror("ioctl event set bpf error"); + // return -1; + // } + + return link_fd; +} + + +// got via +// * `llvm-objdump-12 -S main.bpf.o` +// or +// 1. `bpftool prog load ./main.bpf.o /sys/fs/bpf/hello` +// 2. `bpftool prog dump xlated id XX` +struct bpf_insn bpf_prog[] = { + BPF_MOV64_IMM(BPF_REG_1, 10), // r1 = 10 + + // char fmt[] = "hello world:\n"; + BPF_STX_MEM(BPF_H, BPF_REG_10, BPF_REG_1, -4), // *(u16 *)(r10 - 4) = r1 + BPF_MOV64_IMM(BPF_REG_1, 979659890), // r1 = 979659890 + BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_1, -8), // *(u32 *)(r10 - 8) = r1 + BPF_LD_IMM64(BPF_REG_1, 0x6f77206f6c6c6568), // r1 = 0x6f77206f6c6c6568 + BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -16), // *(u64 *)(r10 - 16) = r1 + BPF_MOV64_REG(BPF_REG_1, 10), // r1 = 10 + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -16), // r1 += -16 + + // bpf_trace_printk(fmt, sizeof(fmt)); + BPF_MOV64_IMM(BPF_REG_2, 14), // r2 = 14 + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_trace_printk), // call bpf_trace_printk#-66304 + + // return 0; + BPF_MOV64_IMM(BPF_REG_0, 0), // r0 = 0 + BPF_EXIT_INSN(), // exit +}; + +int main(void){ + int prog_fd, perf_fd, link_fd; + + // load + prog_fd = bpf_prog_load(BPF_PROG_TYPE_TRACEPOINT, bpf_prog, sizeof(bpf_prog)/sizeof(bpf_prog[0]), "GPL"); + printf("%s\n", bpf_log_buf); + if (prog_fd < 0) { + perror("bpf load prog failed"); + exit(-1); + } + + // open perf event + // from /sys/kernel/debug/tracing/events/syscalls/sys_enter_execve/id + int exec_id = 721; + perf_fd = open_perf_event(prog_fd, exec_id); + if (perf_fd < 0) { + perror("perf event open error"); + exit(-1); + } + + // attach + link_fd = attach_tracepoint(prog_fd, perf_fd); + if (link_fd < 0) { + perror("bpf attach prog failed"); + exit(-1); + } + + + printf("you can get the message via `sudo cat /sys/kernel/debug/tracing/trace_pipe`\n"); + + // hold on + getchar(); + + close(prog_fd); + close(perf_fd); + close(link_fd); + + return 0; +} From 3e0de84af7dcd2252d1681cedf607de83e415189 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Fri, 8 Sep 2023 15:09:40 +0000 Subject: [PATCH 09/20] 27: improve comment --- 27-attach-tracepoint-with-syscall/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/27-attach-tracepoint-with-syscall/main.c b/27-attach-tracepoint-with-syscall/main.c index 5dd407c..54fba23 100644 --- a/27-attach-tracepoint-with-syscall/main.c +++ b/27-attach-tracepoint-with-syscall/main.c @@ -107,7 +107,7 @@ struct bpf_insn bpf_prog[] = { BPF_MOV64_IMM(BPF_REG_2, 14), // r2 = 14 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_trace_printk), // call bpf_trace_printk#-66304 - // return 0; + // return 0; BPF_MOV64_IMM(BPF_REG_0, 0), // r0 = 0 BPF_EXIT_INSN(), // exit }; From 9773a55aff1ca74710bbfc1917c7549870fdf20e Mon Sep 17 00:00:00 2001 From: mozillazg Date: Tue, 26 Sep 2023 03:39:23 +0000 Subject: [PATCH 10/20] 27: add cilium/ebpf example --- 27-attach-tracepoint-with-syscall/README.md | 3 + .../cilium-ebpf/Makefile | 120 ++++++++++++++++++ .../cilium-ebpf/README.md | 15 +++ .../cilium-ebpf/main.go | 68 ++++++++++ 27-attach-tracepoint-with-syscall/main.bpf.c | 4 +- 5 files changed, 208 insertions(+), 2 deletions(-) create mode 100644 27-attach-tracepoint-with-syscall/cilium-ebpf/Makefile create mode 100644 27-attach-tracepoint-with-syscall/cilium-ebpf/README.md create mode 100644 27-attach-tracepoint-with-syscall/cilium-ebpf/main.go diff --git a/27-attach-tracepoint-with-syscall/README.md b/27-attach-tracepoint-with-syscall/README.md index 1adac9e..ad92a09 100644 --- a/27-attach-tracepoint-with-syscall/README.md +++ b/27-attach-tracepoint-with-syscall/README.md @@ -1,5 +1,8 @@ +Tracepoint using eBPF assembler and syscall without C eBPF codes. + + ## Usage build: diff --git a/27-attach-tracepoint-with-syscall/cilium-ebpf/Makefile b/27-attach-tracepoint-with-syscall/cilium-ebpf/Makefile new file mode 100644 index 0000000..e8c27d4 --- /dev/null +++ b/27-attach-tracepoint-with-syscall/cilium-ebpf/Makefile @@ -0,0 +1,120 @@ +OUTPUT = ../output +LIBBPF = ../../libbpf + +LIBBPF_SRC = $(abspath $(LIBBPF)/src) +LIBBPF_OBJ = $(abspath $(OUTPUT)/libbpf.a) + +CC = gcc +CLANG = clang + +ARCH := $(shell uname -m) +ARCH := $(subst x86_64,amd64,$(ARCH)) +GOARCH := $(ARCH) + +BPFTOOL = $(shell which bpftool || /bin/false) +BTFFILE = /sys/kernel/btf/vmlinux +DBGVMLINUX = /usr/lib/debug/boot/vmlinux-$(shell uname -r) +GIT = $(shell which git || /bin/false) +VMLINUXH = $(abspath ../vmlinux.h) + +# libbpf + +LIBBPF_OBJDIR = $(abspath ./$(OUTPUT)/libbpf) +LIBBPF_DESTDIR = $(abspath ./$(OUTPUT)) + +CFLAGS = -ggdb -gdwarf -O2 -Wall -fpie -Wno-unused-variable -Wno-unused-function +LDFLAGS = + +## program + +.PHONY: $(PROGRAM) +.PHONY: $(PROGRAM).bpf.c + +PROGRAM = main + +all: + $(MAKE) -C . $(PROGRAM) + +# vmlinux header file + +.PHONY: vmlinuxh +vmlinuxh: $(VMLINUXH) + +$(VMLINUXH): $(OUTPUT) +ifeq ($(wildcard $(BPFTOOL)),) + @echo "ERROR: could not find bpftool" + @exit 1 +endif + @if [ -f $(DBGVMLINUX) ]; then \ + echo "INFO: found dbg kernel, generating $(VMLINUXH) from $(DBGVMLINUX)"; \ + $(BPFTOOL) btf dump file $(DBGVMLINUX) format c > $(VMLINUXH); \ + fi + @if [ ! -f $(BTFFILE) ] && [ ! -f $(DBGVMLINUX) ]; then \ + echo "ERROR: kernel does not seem to support BTF"; \ + exit 1; \ + fi + @if [ ! -f $(VMLINUXH) ]; then \ + echo "INFO: generating $(VMLINUXH) from $(BTFFILE)"; \ + $(BPFTOOL) btf dump file $(BTFFILE) format c > $(VMLINUXH); \ + fi + +# static libbpf generation for the git submodule + +.PHONY: libbpf +libbpf: $(LIBBPF_OBJ) + +$(LIBBPF_OBJ): $(LIBBPF_SRC) $(wildcard $(LIBBPF_SRC)/*.[ch]) | $(OUTPUT)/libbpf + CC="$(CC)" CFLAGS="$(CFLAGS)" LD_FLAGS="$(LDFLAGS)" \ + $(MAKE) -C $(LIBBPF_SRC) \ + BUILD_STATIC_ONLY=1 \ + OBJDIR=$(LIBBPF_OBJDIR) \ + DESTDIR=$(LIBBPF_DESTDIR) \ + INCLUDEDIR= LIBDIR= UAPIDIR= prefix= libdir= install + $(MAKE) -C $(LIBBPF_SRC) UAPIDIR=$(LIBBPF_DESTDIR) install_uapi_headers + +$(LIBBPF_SRC): +ifeq ($(wildcard $@), ) + echo "INFO: updating submodule 'libbpf'" + $(GIT) submodule update --init --recursive +endif + +# output dir + +$(OUTPUT): + mkdir -p $(OUTPUT) + +$(OUTPUT)/libbpf: + mkdir -p $(OUTPUT)/libbpf + +## program bpf dependency + + +BPF_CFLAGS = -target bpf -D__TARGET_ARCH_x86 + +generate: libbpf ../$(PROGRAM).bpf.c | vmlinuxh + BPF_CLANG="$(CLANG)" BPF_CFLAGS="$(BPF_CFLAGS)" go generate -x ./... + +## GO example + +.PHONY: $(PROGRAM) + +$(PROGRAM): + go build -o main ./... + +.PHONE: run +run: + sudo ./main + +.PHONE: cat +cat: + sudo cat /sys/kernel/debug/tracing/trace_pipe + +## clean + +.PHONY: clean +clean: + $(MAKE) -C $(LIBBPF_SRC) clean + rm -rf $(OUTPUT) + rm -rf $(VMLINUXH) + rm -rf $(PROGRAM) $(PROGRAM)-*static $(PROGRAM)-*dynamic + rm -rf $(PROGRAM).bpf.o $(PROGRAM).o diff --git a/27-attach-tracepoint-with-syscall/cilium-ebpf/README.md b/27-attach-tracepoint-with-syscall/cilium-ebpf/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/27-attach-tracepoint-with-syscall/cilium-ebpf/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/27-attach-tracepoint-with-syscall/cilium-ebpf/main.go b/27-attach-tracepoint-with-syscall/cilium-ebpf/main.go new file mode 100644 index 0000000..03b82c5 --- /dev/null +++ b/27-attach-tracepoint-with-syscall/cilium-ebpf/main.go @@ -0,0 +1,68 @@ +package main + +import ( + "errors" + "log" + "time" + + "github.com/cilium/ebpf" + "github.com/cilium/ebpf/asm" + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/rlimit" +) + +func main() { + if err := rlimit.RemoveMemlock(); err != nil { + log.Fatal(err) + } + + var progSpec = &ebpf.ProgramSpec{ + Name: "hello_world", + Type: ebpf.TracePoint, + License: "GPL", + } + progSpec.Instructions = asm.Instructions{ + asm.Mov.Imm(asm.R1, 10), + + // char fmt[] = "hello world:\n"; + asm.StoreMem(asm.R10, -4, asm.R1, asm.Half), + asm.Mov.Imm(asm.R1, 979659890), + asm.StoreMem(asm.R10, -8, asm.R1, asm.Word), + asm.LoadImm(asm.R1, 0x6f77206f6c6c6568, asm.DWord), + asm.StoreMem(asm.R10, -16, asm.R1, asm.DWord), + asm.Mov.Reg(asm.R1, 10), + asm.ALUOp.Imm(asm.Add, asm.R1, -16), + + // bpf_trace_printk(fmt, sizeof(fmt)); + asm.Mov.Imm(asm.R2, 14), + asm.FnTracePrintk.Call(), + + // return 0; + asm.Mov.Imm(asm.R0, 0), + asm.Return(), + } + + prog, err := ebpf.NewProgram(progSpec) + if err != nil { + var ve *ebpf.VerifierError + if errors.As(err, &ve) { + // Using %+v will print the whole verifier error, not just the last + // few lines. + log.Printf("Verifier error: %+v\n", ve) + } + log.Printf("creating ebpf program: %+v", err) + return + } + defer prog.Close() + + tp, err := link.Tracepoint("syscalls", "sys_enter_execve", prog, nil) + if err != nil { + log.Printf("opening tracepoint: %+v", err) + return + } + defer tp.Close() + + log.Println("you can get the message via `sudo cat /sys/kernel/debug/tracing/trace_pipe`") + time.Sleep(time.Minute) + +} diff --git a/27-attach-tracepoint-with-syscall/main.bpf.c b/27-attach-tracepoint-with-syscall/main.bpf.c index ed920d5..4f5db70 100644 --- a/27-attach-tracepoint-with-syscall/main.bpf.c +++ b/27-attach-tracepoint-with-syscall/main.bpf.c @@ -5,8 +5,8 @@ #include -SEC("tracepoint/syscalls/sys_enter_openat") -int tracepoint_openat(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_execve") +int tracepoint_execve(struct trace_event_raw_sys_enter *ctx) { char fmt[] = "hello world:\n"; bpf_trace_printk(fmt, sizeof(fmt)); From 08e0b899c164c1c05a7724953c2ead8888a55e20 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Tue, 26 Sep 2023 03:39:30 +0000 Subject: [PATCH 11/20] update docs --- README.rst | 70 +++++++++++++++++++++--------------------------------- 1 file changed, 27 insertions(+), 43 deletions(-) diff --git a/README.rst b/README.rst index c1b31bf..8a20942 100644 --- a/README.rst +++ b/README.rst @@ -73,39 +73,39 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` [#fentry]_ | | | +| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` [#kprobe]_ | | | +| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``kretprobe+`` [#kprobe]_ | | | +| | | ``kretprobe+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``ksyscall+`` [#ksyscall]_ | | | +| | | ``ksyscall+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``kretsyscall+`` [#ksyscall]_ | | | +| | | ``kretsyscall+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``uprobe+`` [#uprobe]_ | | | +| | | ``uprobe+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``uprobe.s+`` [#uprobe]_ | | Yes | +| | | ``uprobe.s+`` | | Yes | + + +----------------------------------+-----------------------+-----------+ -| | | ``uretprobe+`` [#uprobe]_ | | | +| | | ``uretprobe+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``uretprobe.s+`` [#uprobe]_ | | Yes | +| | | ``uretprobe.s+`` | | Yes | + + +----------------------------------+-----------------------+-----------+ -| | | ``usdt+`` [#usdt]_ | | | +| | | ``usdt+`` | | | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` [#kpmulti]_ | | | +| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``kretprobe.multi+`` [#kpmulti]_ | | | +| | | ``kretprobe.multi+`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_LSM_MAC`` | ``lsm+`` [#lsm]_ |`26`_ | | +| | ``BPF_LSM_MAC`` | ``lsm+`` |`26`_ | | + + +----------------------------------+-----------------------+-----------+ -| | | ``lsm.s+`` [#lsm]_ | | Yes | +| | | ``lsm.s+`` | | Yes | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ @@ -117,11 +117,11 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` [#rawtp]_ | | | +| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` | | | + + +----------------------------------+-----------------------+-----------+ | | | ``raw_tracepoint.w+`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` [#rawtp]_ |`12`_ `13`_ | | +| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` |`12`_ `13`_ | | + + +----------------------------------+ +-----------+ | | | ``raw_tracepoint+`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ @@ -153,27 +153,27 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | Yes | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` [#tp]_ |`04`_ `07`_ `14`_ | | +| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` |`04`_ `07`_ `14`_ | | + + +----------------------------------+ +-----------+ -| | | ``tracepoint+`` [#tp]_ | | | +| | | ``tracepoint+`` | | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` [#fentry]_ | | | +| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``fmod_ret.s+`` [#fentry]_ | | Yes | +| | | ``fmod_ret.s+`` | | Yes | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_FENTRY`` | ``fentry+`` [#fentry]_ | | | +| | ``BPF_TRACE_FENTRY`` | ``fentry+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``fentry.s+`` [#fentry]_ | | Yes | +| | | ``fentry.s+`` | | Yes | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_FEXIT`` | ``fexit+`` [#fentry]_ | | | +| | ``BPF_TRACE_FEXIT`` | ``fexit+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``fexit.s+`` [#fentry]_ | | Yes | +| | | ``fexit.s+`` | | Yes | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_ITER`` | ``iter+`` [#iter]_ | | | +| | ``BPF_TRACE_ITER`` | ``iter+`` | | | + + +----------------------------------+-----------------------+-----------+ -| | | ``iter.s+`` [#iter]_ | | Yes | +| | | ``iter.s+`` | | Yes | + +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` [#fentry]_ |`16`_ `17`_ | | +| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` |`16`_ `17`_ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ | ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | | + + +----------------------------------+-----------------------+-----------+ @@ -189,22 +189,6 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -.. [#fentry] The ``fentry`` attach format is ``fentry[.s]/``. -.. [#kprobe] The ``kprobe`` attach format is ``kprobe/[+]``. Valid - characters for ``function`` are ``a-zA-Z0-9_.`` and ``offset`` must be a valid - non-negative integer. -.. [#ksyscall] The ``ksyscall`` attach format is ``ksyscall/``. -.. [#uprobe] The ``uprobe`` attach format is ``uprobe[.s]/:[+]``. -.. [#usdt] The ``usdt`` attach format is ``usdt/::``. -.. [#kpmulti] The ``kprobe.multi`` attach format is ``kprobe.multi/`` where ``pattern`` - supports ``*`` and ``?`` wildcards. Valid characters for pattern are - ``a-zA-Z0-9_.*?``. -.. [#lsm] The ``lsm`` attachment format is ``lsm[.s]/``. -.. [#rawtp] The ``raw_tp`` attach format is ``raw_tracepoint[.w]/``. -.. [#tp] The ``tracepoint`` attach format is ``tracepoint//``. -.. [#iter] The ``iter`` attach format is ``iter[.s]/``. - - .. |Build examples| image:: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master :target: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml From 64750723e7cd16be1b600a56a0957cb2c20f0469 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 19 Nov 2023 09:10:24 +0000 Subject: [PATCH 12/20] 21: improve code with bpf_skb_pull_data --- 21-tc-parse-packet-with-bpf_skb_load_bytes/main.bpf.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/21-tc-parse-packet-with-bpf_skb_load_bytes/main.bpf.c b/21-tc-parse-packet-with-bpf_skb_load_bytes/main.bpf.c index b5e27c9..bc896ee 100644 --- a/21-tc-parse-packet-with-bpf_skb_load_bytes/main.bpf.c +++ b/21-tc-parse-packet-with-bpf_skb_load_bytes/main.bpf.c @@ -9,8 +9,8 @@ #define ETH_HLEN 14 /* Total octets in header. */ #define TC_ACT_UNSPEC -1 -#define TC_ACT_SHOT 2 -#define TC_ACT_SHOT 2 +#define TC_ACT_OK 0 +#define TC_ACT_SHOT 2 #define DATA_LEN 1024 struct payload_t { @@ -26,6 +26,8 @@ struct { SEC("tc") int handle_ingress(struct __sk_buff *skb) { + bpf_skb_pull_data(skb, 0); + u16 h_proto; if (bpf_skb_load_bytes(skb, offsetof(struct ethhdr, h_proto), &h_proto, sizeof(h_proto)) < 0) From 0857c17642c08f49561ff9cb981ae7c30b95e7ef Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 19 Nov 2023 12:57:36 +0000 Subject: [PATCH 13/20] 25: send data to userspace via bpf_perf_event_output --- .../README.md | 1 - .../cilium-ebpf/README.md | 1 - .../cilium-ebpf/bpf_bpfeb.go | 8 +-- .../cilium-ebpf/bpf_bpfeb.o | Bin 6120 -> 4712 bytes .../cilium-ebpf/bpf_bpfel.go | 8 +-- .../cilium-ebpf/bpf_bpfel.o | Bin 6128 -> 4712 bytes .../cilium-ebpf/main.go | 45 ++++++++++++- .../main.bpf.c | 63 ++++++++++-------- .../main.go | 42 +++++++++++- go.mod | 1 + go.sum | 9 +++ 11 files changed, 133 insertions(+), 45 deletions(-) diff --git a/25-tc-parse-packet-with-direct-memory-access/README.md b/25-tc-parse-packet-with-direct-memory-access/README.md index 633e033..ca081ef 100644 --- a/25-tc-parse-packet-with-direct-memory-access/README.md +++ b/25-tc-parse-packet-with-direct-memory-access/README.md @@ -18,5 +18,4 @@ $ printf 'HTTP/1.1 200 OK\nContent-Length: 0\n\n' |nc -l 9090 & $ curl http://127.0.0.1:9090 -$ make cat ``` diff --git a/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/README.md b/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/README.md index 633e033..ca081ef 100644 --- a/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/README.md +++ b/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/README.md @@ -18,5 +18,4 @@ $ printf 'HTTP/1.1 200 OK\nContent-Length: 0\n\n' |nc -l 9090 & $ curl http://127.0.0.1:9090 -$ make cat ``` diff --git a/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.go b/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.go index e4afdec..f9b07fe 100644 --- a/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.go +++ b/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.go @@ -12,8 +12,6 @@ import ( "github.com/cilium/ebpf" ) -type bpfPayloadT struct{ Data [1024]int8 } - // loadBpf returns the embedded CollectionSpec for bpf. func loadBpf() (*ebpf.CollectionSpec, error) { reader := bytes.NewReader(_BpfBytes) @@ -62,7 +60,7 @@ type bpfProgramSpecs struct { // // It can be passed ebpf.CollectionSpec.Assign. type bpfMapSpecs struct { - TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` + Events *ebpf.MapSpec `ebpf:"events"` } // bpfObjects contains all objects after they have been loaded into the kernel. @@ -84,12 +82,12 @@ func (o *bpfObjects) Close() error { // // It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. type bpfMaps struct { - TmpMap *ebpf.Map `ebpf:"tmp_map"` + Events *ebpf.Map `ebpf:"events"` } func (m *bpfMaps) Close() error { return _BpfClose( - m.TmpMap, + m.Events, ) } diff --git a/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.o b/25-tc-parse-packet-with-direct-memory-access/cilium-ebpf/bpf_bpfeb.o index c37469e7b54dc48710b4a016d23078aed54633ab..deaf5cbe98ff05342021e89058f1d8c05d9220e3 100644 GIT binary patch literal 4712 zcmb_fO^h5z6@D|bo5l9}2M8of0#s~Bc7i<~|73~(ma&cF1Qxt0KoQr5DP zT_Ojb$2gk0b(3J6K&`h_y&)^35 zV+N1FkLrYB5=NKJ;cbvlAeI9E3EFwI9cZMBXv7MQnILYUJ!fzeyk+nR+%tF+eBIzJ z@aGM_4gS>>>*;>eUdmJ zH^FZkyaoOjgKvYskz%G&{)0A+v?`1@W$-32YY^j3Q2$YLys)Z)YldREt7 z;4R=2z_8J2KWDH4Cn4@+12!KArp*X=i5mji34B#&34tIhD)lT0w7u3d@ZI$E;iwFO zkfkoTDS>hQJqrDb8E+r(ni-F(23p?#YY^W-9jTnM$H=f~x1bvHTrkG>lvRE;wr%^C|z(U+~Fh>yux<#FIFe$C(p zZ03MxFsCN)DTCX<=#v?&wFmrBgI(aK4gMT3?`+!iftg!kob}3*!2{q=8|(vr#^3+I#rXRlb#K6CYgwRC0if@Mjv9y-!@)~(q6yd$f&H*`|y ztU7)Y!zb=r%fn7bJja)?pIF*sU`Ksf89J~Y*kS1UT?wNg30i?CtDfy!VdTUJkP1o5 z&9tzAr5i+UvMz9gS!}r-*Ka%5B;!fTN)@eT>Dh5lplEq^9J_64+lj3|mgBd@w?o&0 zwqp-mZ(Sm15G0P}hR4MVTDGUrSUERV&SjQi5G6*dA){LZ2SX%rVh=)Db0f#%(z|hB z#ZEU)0h47}!(&Hf=*Mo?ciM^>?s&nPg={i!!#PgE?<)Pd!z}Jg+~?B#wujlKS->Kt ze)7ni)DG8bhX=On*OtRhttASy8n|usxSk!Bt~R8yU0^eUnqn$LPqG0YPMw|l#s z(w1&V&1Ny((CW1#^&!QY2s*QI5)E64azkjVYF=dnRn-^9zNycl`K$`mBWKhzi;I^p zEnTvf&M(4L9X_o5AW=yx6dg+39*V_@VmI(531YNFr<(g2*z2BdC@gBn&SM20P$cmYX>%GVP>I)liC__;AYmcHs4EWKT5A!?#BT>{R9RsXaRbJg!5B;@ z_6Oma7VN6kO9DThJyAbVuU50fP*S=I>nH2l9VMhjinMApfo)-!90n-zn>5=jKy-xX@o%Z|QWQf1x1r=;(O6cJ7c`;#^Cl7CBz++|pAu z3g+Q1JTB>>t$E(+z|vQu+s&P5_~Z4d;i6CMW$^WZ<|eExoI6*yp1`>OFJe+mJ&b?T zWU(6=DDYg(2>(mGm48-$Sr{CbG4c0f=AW-Us#(vZjHi-5ZW)x10Nu;KZmjb2r7E*0 zUM|Sg87du5!A|^Ezk~Arynga>&T!W!QlaGKl!STvPeIPrWZrUm%SapG(`Z?KvivbG z7twfS-i3BA8s$E4{`}0w$^5DREZV*No9H7cH2UYROGx?})%tt+kF=GP>frRxelzFC puLo}~=ye(6)J1>yTsK0t?yN7LzfVG0>^F9Mer$lBIT}9p|1Z?GMKAyW literal 6120 zcmb_gU2Ggz6+XNEY1*bCAqk{~(wn3SyJ@^xr>UEtrroA(XeFbVG$rZ}jK{lUd+_eg zWM&-4lomr1Q64G0Xi9pwJD)GiyJOUDP*?t!~>{w)oW<>lqK>BIJsyH)DCr;O!h zPUYf=j_*w+*71)D=zN3>|8A)X=Y zmux<@KgD@&*%1ro`424^H*i}Ai9>h3{rs!TSBV$z;1ly>9P?jIf>)e#uO3@^-;tr^IN)Q9V`p>pfF72|NQKH2>C zjB+;Fnr#?0Ht>5CT|>(gzys(F^v|NR&KJ<1M86IF61rmpqx^uapXThN;8TceAb){= z3Z46An?)x!=r1a6K)$4S9P(R=7a+f{_yXi>iZ4N4RJ;WFs}$QMys6kg{$6nd@{fwg zA^(cL5ldcx{5v|2CmkPVqP-+h*t&pnnz^zq0;Iz!Si*AAl&$C^nF6w?p56 zJ^`l90%X2kp|iz7=MU23*lc9(6SY-(0rF$ivFZ5^LH`X~c=#y;zd~a)su~0cp85Y6 z^bYFS)W1fIBBBjcrPm-gK>h>;P95@B4$k700gT+0Su>xq3zPD^V$kx}h|w```5dG{ z$2pW=Q4C%_uNb*6e-D`U4RqER@#E0{0CGF}7&_bC=;P4;NcVUb@atR{8U^S3nT~A* zenas#;NPkpx5~A=wPI)ULcOZecRpwBpR6D)DyJ-nbGZNpw|GtmDxr{AS|_z(8k#9GDRh9362i8#)~$B#e!wDaT>&phUw zczWzH$C254_d?I-Y&Z6&x?aoBRKGP&A}u#@r8(_JlFWym%y{#1+HKEz(s9o?UN?z+ zFP5YeIvqDeq)T}q_(JJ)2QxZl&5;TLhoNl{aCycxp zu~L#W{Y(oRSo%TaC-VX~n8l7i>33V+8OdbQbW%lgLZ;n#TA*mQ-8lAJcJ)|gOS*38 zJ5Wrz9lt#9?wWT!!2}MZ7eO_EjAbwGnlsGJ{*@xM73Vk;9@dT#JbSr{r+F4Awb>5TZmSi=5>w!``J@->xqk5e z-X7Am4?UPwo!NTWJTW$Q{Md|qq992%3L_CPziZBP$i8DfY zE(fRTOeaA%t{kWzs8_4mg2;?5x%$Ba*Slj{bNH~StG&@5F6O$|8uzjmxpPkTtL6#f z_*bUP@}nnIHAAMdvO;Xt>@xeP{h+gFh23W-dxtVe`rr}UO*9AUweX-?Z++%Xg zv1?ylZ3Yc*FoPchGLZ(;>dbbWm|Y5W-*^u>?I4($4IQuTbt*gc6}H>#^jp=H1#MNg zs@)(nh8mjioXB%q_)SM$uU*-xHt7#;cb248+UoB7E_4E$ugOmG>=&@AZEAn;x$cg5 zTeo8M&s1RCiw}&bt7kbRFNo9jn_f5eq=rq#k}<|wc@vSv0qRx%ioh4e zHr!bFr7is${R;3`(DA`8{Sq?!3Vjk7Um~mHZ4s^X8}zqC&g=l8JvjfQP52d~E&077 zXZhEP$#LF7D=7y`+kPE?A0JANkEguvo47dhc8;$$<5|w}Q2AwC*g1YC$9el($Z^`g zto%KZ-)#jypYr|*k;}Ycd^g7rfWMxzKMsz0IKQ>8f?rX70q{=nt2vJOm^N$wCy^!c z^(lwiwi0q;$KMh83)WN8{SOS|f=~NKIzI4-$h*9pPAmVm$Ti$DOS*myCna6~z)vwX z?JuhRKcuvli{bn{&+Kx5oR!{C?=_I**OX%|f<2Z0t$ZA^g4~}|9x8uR`OA>7@B5c> ztc~{lyjgvCn}$g_HRGyRT3=7Uq62zpgT0on(%}vyo3I6qlZ}-w165&Syzg%C{2Yw}A1mjmB@@Ua3PFYvIy7Yh7*fnO-_iv@nEz^@eeQh~F=bNegveDj=d zxjZkNclm+B_-KJYm+@O}y;*9BcP5cqa>;lrbSzOG?l$)-k*Ob=6TOZWZjD?DYtV+Wd77U=r{7`yle)YK3RR_{rSbZk^e=E wp_S`+&?o!4<^6|)KYpyusOQlh!nUX6ulqRSmI%gGdxHJKmk$9lSd; zo|&~{euPyOi5DO|1c@h%6rc}KMeqosv-nJNag$PoV#9+ z((=HO&z$d^d(OFc&OP_e`b+0#Ul<-55=%q!PubM0Rb=9UOmSJC+jk-A1p$r5$5N*>|Q*sxC;3p z#cPmS?mf(7eF2Ae;&B4(AlFYI&w^QJ(s?kk1Lp1#SHYJQ*C6YP*C0EJ*CAIGZ$Q4H z_%7sE6>|~aRO|qMPjMCab;UJc)_WIt4ftnjcTku+imSlCR$K%At>QJ{Hx;h~-&MQ; z{1?S{f!|ilV*Uqs4D0~!zO2Uk|6%R5Wd|>yiX1wsVhL0QrfbtD)hi zAeMB#2Z2{~KKfU|Bpd%VfPJ~iK8M*~Bn<6FDdiggJ0NdB;%|&c@aq`ByS&QNeFOM? zkf4!oDaJZSzN47)eixWM&Gr0Hu>*WdaRvCN>R$z}gPHS1@GoHh03>^r^cc7X{w3_7 zosZ!0Mvl!*#`%7)V?0BDQv814KdT=F*Yfs&A5?*A>Pmco57571{9q2v6Y2=(;Lh+| zlI~ON0FMEKcG~myzx*G8KYGU0@^N6+iS(pmuJbT3=W@Vh#Z}-bV7_AwYdWR40bEtw z#+H3daRB_H;?DxlDqaMhQ;f4dG_SY|{AtA@@KwbTa1EI2jKOw))_{30(|#R1oj0r9 z6SR&Yc!)d!<}mqe?ziV4Fr8+hLz*uRzX2rXyf|P#WUP7ol{}s;D(wL*L70i_K7aAz z^OxOEzI5fBJAZlZoa;)q8vC;7uexdQIbW8&PS4MwzwC!uikNiKUFbEN((yxy7c!pTx^d#CNRTU8J+M~zz%z)FAX~+vT5wC z|C(5t)!p1sUy!z!wgrZI$4k?oAq_9{%)|A=hJ;=mxUe?8ZqQkk#P3F#?*{QR(uwL` z$DqD(s&AaKo^h09YBiAA-L8)*vNZF$v8)7%@AB1KY2>DUE6o9m<+{D&$D|jgK`Znd z4lCU3L@O?;$-4EXxQMXjn8y~kbWzepzFOGmV6}M_@RCwF`Sg^OkCw|vyIv5M7vg5Q zE)Hlp3L4H~vpT%CbH&B#o7Jwjy#%HO9|gk*p8X1^ zZEh+Wx7UT)Yc!HnQVO&UpNzuBRZe~cCFeUy8ugO8FAYDm>;9|rG7 zE>aEbfFsqpR{FoLI^cUz%M1>iB^CX)@he}TY3O^+*C-#r8yMmi?Ul_r$JNf?Bl`yO zys7rrRPwEuBew6Z`d0>YW}O6E;;O1vfuufH&}#*qWwAv6HLE~Uzh2PS3;L~szERMB zSJ3Yk^tTFnzqeuM{EzAO(vA9LK|fv4XAAn(g1+niQ7LEswM@#1-zm?`zfh*4AMV1( zB|o&~PG`C6nkzAA4V-AihSIzwt3mV@y zD0oI4ALTzr15}LX|B6K$-9OF&P^U0hP~}tbVgD6rV=TAWb3&Chvh}ldIS-rtJ)cM9 z&pExfA5@Pag67*i82)DTM(jBQFH2|mv^@0>k5 zpj`N7zxkf${rP_0@137LUpq8>xU-`}GUMx#YQXXnT_U%DzR^(c@}1>E_J7VtGk&E@RKQj z195`2W%JRWCeE{DQ!M3mH|#tdH*}|Kj0)V!&`ayCr}O`q8j)_;uVa3W$BbQyty(x9 z^STxd=GOkdmzwW-<(!<4Yx(TRu>9z~4m%bD@58`s>o`Fwok)9DPaW8nm=+b9?AcJy zki}HMu6`+l3vHiBSr60ppkf@q=yBW@vjnz5G^C-6`5XdHD@Wurzz|#Y7y~X=?0W72 zO0dDvUtIovq1QF8JM3$%XCM8xt|i+=h0a0GiXnvEk&C{bI>5m?!_gG1MFOh z%LJOixEIm${Iy)9sTel-s^Sv*mlcnq|Bm7r^gmEMi~e=RbLcN9zJmTYin)ll6dT|_ zDlP%Pt9TUnZ@{b2W`M7%-k{FjS6l*SzPaX6;2Vl(fSGjaXMuYa&jBx2d#PKvsD4KE zP-E6~?Hqbuy-=^y3c?q&KFrK$`0KkLIDi57z$?sM6Zn(pAzjmovCgiqE9Sgsfem^-J6}~yeqJ%} zrSGeM379p;F+Yd)L+Cf6A3>u$j5dn)Q|KW*58?9j6leFG{7P->VS7{Y2H@YTA3Lt) z9ktPq0&4S0yondcpP~Fz3hfoNi+f@%ZC3r?6&vttz!3W^A-J3W08SqHwYl5{Y#0RD zrc_N3wx@GvmfK8iIxrMLq8Ma7divS$_hz%M9%5qL~-6?j}R9{3$EDy{=J z6gPk)#R2dsV1s!>wCsFlfX}G@Jg^EhBH43~^?NNX?qvnw4zv%!(ep87&xE}}`*)ju z3zZPYFX97RA6YBfu=tHc9Ov<4#~y#idHTq+hn(Zjj2v;46+>5j z*Eoq(+{Bggq#H>x9ePsrrsb4dYkE?5Pdi>CiF_}Xq#inTH^fMB)fsD!k4w#KNLWoA z8&r3rs+??kO^;ro-TFA6Gbq~2o;>4|oGUZ2}!(C6rffIWZaSHq|doo@NrW_RxPmjyYGs}fhag+`@@rKP*YW@K<^$D>l*UMy~}yMCiM7LFIoVj!mizhbs4b|n9tIW-w`69Fx=Qv{? z)(#7~Pw=G79xPIP~e(9@4cB9LTE9tlw{rjEo#Rdi=2f1@`p=GtkUTUm?TDJQ$Dd4f3p`6;vf=m{0ffa#xKA+~C^m|fJ~ z>FilykJ`z2Xl6^>Ol>u$!=Zj|8+hOC#nwK?R@25DyY_|EW*~Ti8QcuWL^_yOXSUCJ-&S@Bq|_QSa~J}^dI zILkgcBTmgPdyUwWA~qRI#yHmelZY%1P_O(i!q}Ha`nAWemfzx)a~bU`zA4vUF!I?L-`%>J7}9ur~c#}c(oUj)R%lG_}W*}w^zn{!TUAd4us1d z(t}2RQ~4fX{>S$(oCReRtsm_yazP2v$lp?a4w(M`RL{F813A7e#~;h_;T(TH$CupGE5*b+ zok%hAYQ=-c4;M*t-+Af7I{T0=)@rBfj{UarC)%Fq7yuuHMZDb-cMSb>-S#@J3?Do= z=*Z21jpd|ykG0?tLr`jX=O{8>HZ_nXCW3`!X-ucN-C^B>MF zAn(in6Z1O8e^Y-XtF_e~^?BbD(B)j{CO4MbuJzpEZ)DtKmcO;B+5X 0 { + log.Printf("lost %d events", record.LostSamples) + continue + } + parseEvent(record.RawSample) + } log.Println("bye bye") } diff --git a/25-tc-parse-packet-with-direct-memory-access/main.bpf.c b/25-tc-parse-packet-with-direct-memory-access/main.bpf.c index ddc088a..86eb69a 100644 --- a/25-tc-parse-packet-with-direct-memory-access/main.bpf.c +++ b/25-tc-parse-packet-with-direct-memory-access/main.bpf.c @@ -9,20 +9,17 @@ #define ETH_HLEN 14 /* Total octets in header. */ #define TC_ACT_UNSPEC -1 -#define TC_ACT_SHOT 2 -#define TC_ACT_SHOT 2 +#define TC_ACT_OK 0 +#define TC_ACT_SHOT 2 -#define DATA_LEN 1024 -struct payload_t { - char data[DATA_LEN]; +struct event_t { }; struct { - __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); - __type(key, u32); - __type(value, struct payload_t); - __uint(max_entries, 1); -} tmp_map SEC(".maps"); + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(u32)); +} events SEC(".maps"); SEC("tc") int handle_ingress(struct __sk_buff *skb) { @@ -31,39 +28,47 @@ int handle_ingress(struct __sk_buff *skb) { struct iphdr *ip_hdr = data + ETH_HLEN; if ((void *)ip_hdr + sizeof(struct iphdr) > data_end) { - return TC_ACT_UNSPEC; + return TC_ACT_OK; } if (ip_hdr->protocol != IPPROTO_TCP) { // not tcp - return TC_ACT_UNSPEC; + return TC_ACT_OK; } struct tcphdr *tcp_hdr = (void *)ip_hdr + sizeof(struct iphdr); if ((void *)tcp_hdr + sizeof(struct tcphdr) > data_end) { - return TC_ACT_UNSPEC; + return TC_ACT_OK; } if (tcp_hdr->dest != bpf_htons(9090)) // not 9090 port - return TC_ACT_UNSPEC; - if (tcp_hdr->psh == 0) // no payload - return TC_ACT_UNSPEC; + return TC_ACT_OK; + // if (tcp_hdr->psh == 0) // no payload + // return TC_ACT_OK; + + struct event_t event = {}; + + u64 flags = BPF_F_CURRENT_CPU; + u64 save_size = (u64)(skb->len); + flags |= save_size << 32; + bpf_perf_event_output(skb, &events, flags, &event, sizeof(event)); // parse tcp payload - char *raw_payload = (void *)tcp_hdr + tcp_hdr->doff * 4;; - unsigned raw_payload_size = bpf_htons(ip_hdr->tot_len) - (tcp_hdr->doff * 4) - sizeof(struct iphdr); - if ((void *)raw_payload + raw_payload_size > data_end) { - return TC_ACT_UNSPEC; - } + // char *raw_payload = (void *)tcp_hdr + tcp_hdr->doff * 4;; + // unsigned raw_payload_size = bpf_htons(ip_hdr->tot_len) - (tcp_hdr->doff * 4) - sizeof(struct iphdr); + // if ((void *)raw_payload + raw_payload_size > data_end) { + // return TC_ACT_OK; + // } - u32 id = 0; - struct payload_t *payload = bpf_map_lookup_elem(&tmp_map, &id); - if (!payload) - return TC_ACT_UNSPEC; + // u32 id = 0; + // struct payload_t *payload = bpf_map_lookup_elem(&tmp_map, &id); + // if (!payload) + // return TC_ACT_OK; - bpf_probe_read_kernel(&payload->data, sizeof(payload->data), raw_payload); + // __builtin_memset(payload->data, 0, sizeof(payload->data)); + // bpf_probe_read_kernel(&payload->data, sizeof(payload->data), raw_payload); - char fmt[] = "payload:\n%s"; - bpf_trace_printk(fmt, sizeof(fmt), payload->data); + // char fmt[] = "payload:\n%s"; + // bpf_trace_printk(fmt, sizeof(fmt), payload->data); - return TC_ACT_UNSPEC; + return TC_ACT_OK; } char _license[] SEC("license") = "GPL"; diff --git a/25-tc-parse-packet-with-direct-memory-access/main.go b/25-tc-parse-packet-with-direct-memory-access/main.go index 56aae2a..2942d76 100644 --- a/25-tc-parse-packet-with-direct-memory-access/main.go +++ b/25-tc-parse-packet-with-direct-memory-access/main.go @@ -7,8 +7,22 @@ import ( "syscall" bpf "github.com/aquasecurity/libbpfgo" + "github.com/google/gopacket" + "github.com/google/gopacket/layers" ) +func parseEvent(data []byte) { + // Decode a packet + packet := gopacket.NewPacket(data, layers.LayerTypeEthernet, gopacket.Default) + // Get the TCP layer from this packet + if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil { + log.Println("This is a TCP packet!") + // Get actual TCP data from this layer + tcp, _ := tcpLayer.(*layers.TCP) + log.Printf("From src port %d to dst port %d", tcp.SrcPort, tcp.DstPort) + } +} + func main() { bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") if err != nil { @@ -28,6 +42,7 @@ func main() { hook.SetAttachPoint(bpf.BPFTcIngress) err = hook.Create() if err != nil { + log.Println(err) if errno, ok := err.(syscall.Errno); ok && errno != syscall.EEXIST { log.Fatalf("tc hook create: %v", err) } @@ -46,12 +61,33 @@ func main() { log.Fatal(err) } + eventsChannel := make(chan []byte) + lostChannel := make(chan uint64) + pb, err := bpfModule.InitPerfBuf("events", eventsChannel, lostChannel, 1024) + if err != nil { + return + } ctx, stop := signal.NotifyContext( context.Background(), syscall.SIGINT, syscall.SIGTERM, ) - defer stop() + pb.Start() + defer func() { + pb.Stop() + pb.Close() + stop() + }() log.Println("...") - <-ctx.Done() - log.Println("bye bye") +loop: + for { + select { + case data := <-eventsChannel: + parseEvent(data) + case n := <-lostChannel: + log.Printf("lost %d events", n) + case <-ctx.Done(): + break loop + } + } + log.Println("bye bye~") } diff --git a/go.mod b/go.mod index 0eec76e..7116114 100644 --- a/go.mod +++ b/go.mod @@ -12,6 +12,7 @@ require ( require ( github.com/google/go-cmp v0.5.9 // indirect + github.com/google/gopacket v1.1.19 // indirect github.com/josharian/native v1.1.0 // indirect github.com/mdlayher/netlink v1.6.0 // indirect github.com/mdlayher/socket v0.1.1 // indirect diff --git a/go.sum b/go.sum index 17d1443..a607dd4 100644 --- a/go.sum +++ b/go.sum @@ -23,6 +23,8 @@ github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8= +github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo= github.com/josharian/native v0.0.0-20200817173448-b6b71def0850/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w= github.com/josharian/native v1.0.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w= github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA= @@ -67,11 +69,15 @@ github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTE github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2 h1:Jvc7gsqn21cJHCmAWx0LiimpP18LZmUxkT5Mp7EZ1mI= golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc= +golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= @@ -86,6 +92,7 @@ golang.org/x/net v0.0.0-20210928044308-7d9f5e0b762b/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.10.0 h1:X2//UzNDwYmtCLn7To6G58Wr6f5ahEAQgKNzv9Y951M= golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c h1:5KslGYwFpkhGh+Q16bwMP3cOontH8FOep7tGV86Y7SQ= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -121,6 +128,8 @@ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From cbb1354699e6568b2c6acd8ab00a527237329cd9 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 26 Nov 2023 05:42:08 +0000 Subject: [PATCH 14/20] 28: add 28-kprobe-hello --- 28-kprobe-hello/Makefile | 1 + 28-kprobe-hello/README.md | 15 + 28-kprobe-hello/cilium-ebpf/Makefile | 1 + 28-kprobe-hello/cilium-ebpf/README.md | 15 + 28-kprobe-hello/cilium-ebpf/bpf_bpfeb.go | 131 +++++++++ 28-kprobe-hello/cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 6352 bytes 28-kprobe-hello/cilium-ebpf/bpf_bpfel.go | 131 +++++++++ 28-kprobe-hello/cilium-ebpf/bpf_bpfel.o | Bin 0 -> 6352 bytes 28-kprobe-hello/cilium-ebpf/main.go | 75 +++++ 28-kprobe-hello/common.h | 5 + 28-kprobe-hello/main.bpf.c | 67 +++++ 28-kprobe-hello/main.go | 91 +++++++ README.rst | 331 ++++++++++++----------- 13 files changed, 698 insertions(+), 165 deletions(-) create mode 120000 28-kprobe-hello/Makefile create mode 100644 28-kprobe-hello/README.md create mode 120000 28-kprobe-hello/cilium-ebpf/Makefile create mode 100644 28-kprobe-hello/cilium-ebpf/README.md create mode 100644 28-kprobe-hello/cilium-ebpf/bpf_bpfeb.go create mode 100644 28-kprobe-hello/cilium-ebpf/bpf_bpfeb.o create mode 100644 28-kprobe-hello/cilium-ebpf/bpf_bpfel.go create mode 100644 28-kprobe-hello/cilium-ebpf/bpf_bpfel.o create mode 100644 28-kprobe-hello/cilium-ebpf/main.go create mode 100644 28-kprobe-hello/common.h create mode 100644 28-kprobe-hello/main.bpf.c create mode 100644 28-kprobe-hello/main.go diff --git a/28-kprobe-hello/Makefile b/28-kprobe-hello/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/28-kprobe-hello/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/28-kprobe-hello/README.md b/28-kprobe-hello/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/28-kprobe-hello/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/28-kprobe-hello/cilium-ebpf/Makefile b/28-kprobe-hello/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/28-kprobe-hello/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/28-kprobe-hello/cilium-ebpf/README.md b/28-kprobe-hello/cilium-ebpf/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/28-kprobe-hello/cilium-ebpf/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/28-kprobe-hello/cilium-ebpf/bpf_bpfeb.go b/28-kprobe-hello/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..f834d05 --- /dev/null +++ b/28-kprobe-hello/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + KprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kretprobe__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + KprobeDoSysOpenat2 *ebpf.Program `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.Program `ebpf:"kretprobe__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.KprobeDoSysOpenat2, + p.KretprobeDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/28-kprobe-hello/cilium-ebpf/bpf_bpfeb.o b/28-kprobe-hello/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..b8d2430d3dfa22b9072499f8c7cac4091e650379 GIT binary patch literal 6352 zcmb`LZD?Fs8ONVHlWyb7HtE`~-SuT}Marafr_&eL+OBolHQf}d9nyYi7vW|ybCV32 zncU1voNRY-)G8JBLxmL!3L9}@3%(T`+t7tJm>w+JtzIj=(#hAgh##P(SPB`GI}L&b`J|>^*KadCoewTHYIfB z2kQ?w2fC_yUv)+Gp6XrIW!0|g9o1W^H&vHZZ>U~Zy{6h$ZK+18GpZA+msE4AW2#xz zW2za|l&Y_~M|D_rP?ZJqUVFg$4So>qC@ihL#g64KGZ6V#mey9;(RG^{(sk@S$+<+^ z(fa!O+RANTaIo`?sBLF{@%Y*b=k&*~lZp3iT&=U;)Z6Y$dvA4)D`R$Oe|3+{!sPMu zc2;~($D6n@Qku3I8qh`x0FS} zZDmpLHDyuob!AcT4P{aAlCmiHrm`sbma-`Lj>_1#5#o0E7*W?LV7^3&V ze@cBBhK}U}$WNm)H02G$KMMOGjMFjL5G)IO7Pb@ChK*`FkHSBz{to!(b*!9~g-u$9 zGMANk?our_e(oE?FcEO@k9-*avb7p5z~2VT!oCLE4r{}{341@R3wwnJg7g?n>Lmne zH%qKP&gMQo!uc8_Z_h(99EAkoFdiq5X%~zWkBPrRS=g)EH}8GCZ|>uJsLx}#3Hu@J zqcBcyz}U~iex!aI`ZM*r&|er|n*5deS?I6TZ$p2hei!;%VJ2Ur#$pswCEp6rQmqu$X*OJ> zg?zagQlklmAvb}Y%E(TIPoKo-d8hby)Z3@==iE&~ zpm_~22yxBc1;J#qRBn{2K_#pdqD2hg>607VCcztMcX1?dT!PPMHqKLzzh(CO^>LK( z_ujG(AKy5M;WHh{I|%z6nJX%nG2?9e63$K!XPEFSL`C-f7~{_1rIb53*7*~ji7}TQ zi!sMzoZOyG-h`I_hp2_~(`z~0R<`50ZaCo+y@Z3r!#Ud5URTRQqN`lKqWl`J1YlVU z{qA$U1j@fpNW5-5Z_M*1<|%7rneRrvDTim0&O3>-{FhulX3CSFC%VITteo;iqGjf` z^0$co#JuFRr}Ic+FmLjmqO0+imt%}$kMGw!-sJCzR(L-5V$9_$%5UO0=6Nd*;C)#I z^Jy7hx8$JVfzw0}xZGEsC6BMBy>|w_mj&Z4FR9axw~EreJI%eY7YN6PO(5QBKbb-Pu2?+BaTq5CLULQ^=Se$d+?M5M;U{9u{l&{C9F81r zJAB>YC5L%@@%Fn8-*tG!;njYYWr?*Xe|N;$cj7Y+kAY+J=Wk0N&p3>4OJDglhi^E1 z)8RV~FFSnC;rk9h=;y?s!+RV~Ieg6FF^4ZXJmc_HaBO`O__mn!*fBh`^D#;{!d8RQ zwXmE%eeq11K`)r*6v7cGx6X9Ayif`9#bOOt*w|5pt4hW<4)<@r$F@HA&wnf1{_XgX#cA7wh^eoxh^^1Szm=`(Uzg~O@2Fxgo*CzM zAKMt{wpR@da!fqM_b-Qnt>%AAD`lWOe;a4VKa4!SQ`qstji*QN8%q2*o(n(TKc73c z-E4o{&K1Ln2`Kl^eQ}ESKQgy|PS(9GMe)b3tdiX~TNoej7&7_Wyh$3qp_%ufT*r>v H_P^(U9U592 literal 0 HcmV?d00001 diff --git a/28-kprobe-hello/cilium-ebpf/bpf_bpfel.go b/28-kprobe-hello/cilium-ebpf/bpf_bpfel.go new file mode 100644 index 0000000..c87c501 --- /dev/null +++ b/28-kprobe-hello/cilium-ebpf/bpf_bpfel.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + KprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kretprobe__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + KprobeDoSysOpenat2 *ebpf.Program `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.Program `ebpf:"kretprobe__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.KprobeDoSysOpenat2, + p.KretprobeDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/28-kprobe-hello/cilium-ebpf/bpf_bpfel.o b/28-kprobe-hello/cilium-ebpf/bpf_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..b6644e4dbeb27a9ad9315f1e2e321ceb60025b6a GIT binary patch literal 6352 zcmbtYU1(g#6&}fQtoT=U>{xOCu1hd0No(3tyAMSww8WGa429x{P*li+X%i5AsUJez@0&TZ zx|(cEN)I~sJKvczzh~~;S$%8Z%&E?f4&|gn{YR}b=T)j_*Q%X2W?pSWF6@#=w%X9C%O%z8hz^){fLchTPBHR0=&S^@7x zY+7!1DU*NJM-_Eb3V$fL*lUf|`Mq!Eo$lv-jKgo2@$72x5nF%PBhMMbkK=rM5O@>g zqp;q0po<&Gl-jl7oI$SJ5Ug!7p7c7b$U2yHV`T{2G3)mFip|q*mSP>X0X4tdVxoJD zF~8elqHPEByDcU6MbK}MdX{?koh*4=x*T_7r99w z+=mqIn+wp7v%k4z{r3f~|4E)5I-_3uSBL7ATDQ!?^WM_W znDun5##x3Cc@4?e)KM81qB^@_K4EG1qrlIIElWezxe1Rf6peK8y*&zhGnCQ~-3HA= zpN4LSE~x+8yjS4;^32JIca2FT@ZiX8b)c%o2$gc2@u&)9C_d zVRJq5&~HO|q%1(c2i*u=g1!ueY~6u}s|T|)_4!+~UY}sJl}W*@IYF@~<|z-!P?LMcCm(#}JFCiVjG7h*2~e{f*dp z*uNEf0rv02UV{C57moq|!NtRV%f-X~lZ%J_7Z;CN-*NG<|LWpl|INk2{=17ulK$c1 zVZYS{Vl)T}NyBh{$X!V10-rkA>^HNrTWtgHCY=b%TS zN1%t*cukGZ!8!!ZsrZX3?pOGd6y{WMPSs1QSW+`_X)=VbR8xhznkZ{DQ?IFdeeD2M zp)seXYw^r@6o$o_u%6VznHuKQI4tgio;Q0in>|?3rD}G(HjynTtX|N*flR#-Hw%qG zW)bX1Uwy&63LsKs<{3o6mxKA-OTjTyWY#%ol#1|X4CzBp;bhbZ3(YvjqS;hTmWr7^ zTP4aO4&fgi7aTtx965YU<-UX^vv(%#X;HEAbO%666Z~BtI-i z7@DjpM_rzonQqqFjamj-ng}v`QOBj2S>?LLrRwB(6BuFHW+N;bU!i(y!S+X3s9d^{ zh)p0MPki7JI!f&n~rd^K$* zc$K;=u7>ob(&y$PaB=C=RqyD8Jd}TaUvFe?~ry=UXUqJOJnU_yip0fP;My_E#7%YRkxQoPrb zzYOgy;;c;ZP2d^fi@+`Tu;)@d1KywFo4`kfqc;hjwA^hY{x`m%)`F+e+_%wJ&S4V5luu2{e z-eumC`fh(+gpd9oq3*|#b@p@pq0n{iwwo$BZ|wDETq(DD0c1z2ofR3=Uih~w-VCh- zf@8oPsrGX+)}8P(J^)gff65o2+s#{LsJ#ckT#|kWyo+XRv2uJU#W@PDFU6JrL^zh$ z)W4D9jK7`Y-QWkH6vnfSr%52>+`_IuS3U+G#qpY@ExzFKOCG=K@f#jr^7tK(FME8& z<7N`@x$*UIQYjvIoaaiqd@#j1f1WF@oP5gTJXg}?7d?L2<2+Z=@wYsF+v9gVe$V6g zJ>JbhLR|iOJ)ZG+zsCnX&htOr-jv5Lq&SCiCBo)J7L%O;~mmt!TfKN^K|u{pZ_Op*MCm-jXO7`nO1$re*mLh{|nN8 zP6GM=0-m3K|NM@ye?JFf42HP+maW!zydOrp`j@1>zut^Z%Ls_?WBDsmf5Z(~D*5dV z!QXEFH`>gfajrSH{``MTyZ-O-pDmC#BoCI^bHv$1enZ;zzbyTaNqw$A`||tmgKyoL o2Qz>LXiM_4|796ket)ckDDj49VlT@Cd0(Nh9@ozG-%BUtzoJG&#sB~S literal 0 HcmV?d00001 diff --git a/28-kprobe-hello/cilium-ebpf/main.go b/28-kprobe-hello/cilium-ebpf/main.go new file mode 100644 index 0000000..428c36c --- /dev/null +++ b/28-kprobe-hello/cilium-ebpf/main.go @@ -0,0 +1,75 @@ +package main + +import ( + "bytes" + "encoding/binary" + "errors" + "log" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/ringbuf" + "github.com/cilium/ebpf/rlimit" + "golang.org/x/sys/unix" +) + +// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS bpf ../main.bpf.c -- -I../ -I../output + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func main() { + if err := rlimit.RemoveMemlock(); err != nil { + log.Fatal(err) + } + + objs := bpfObjects{} + if err := loadBpfObjects(&objs, nil); err != nil { + log.Fatal(err) + } + defer objs.Close() + + kp, err := link.Kprobe("do_sys_openat2", objs.KprobeDoSysOpenat2, nil) + if err != nil { + log.Println(err) + return + } + defer kp.Close() + krp, err := link.Kretprobe("do_sys_openat2", objs.KretprobeDoSysOpenat2, nil) + if err != nil { + log.Println(err) + return + } + defer krp.Close() + + reader, err := ringbuf.NewReader(objs.Events) + if err != nil { + log.Println(err) + return + } + defer reader.Close() + + log.Println("Waiting for events...") + + for { + record, err := reader.Read() + if err != nil { + if errors.Is(err, ringbuf.ErrClosed) { + log.Println("Received signal, exiting...") + return + } + log.Printf("reading from reader: %s", err) + continue + } + var event Event + if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + + } +} diff --git a/28-kprobe-hello/common.h b/28-kprobe-hello/common.h new file mode 100644 index 0000000..fbc150b --- /dev/null +++ b/28-kprobe-hello/common.h @@ -0,0 +1,5 @@ +struct event { + u64 pid; + long long ret; + char filename[256]; +}; diff --git a/28-kprobe-hello/main.bpf.c b/28-kprobe-hello/main.bpf.c new file mode 100644 index 0000000..c89792b --- /dev/null +++ b/28-kprobe-hello/main.bpf.c @@ -0,0 +1,67 @@ +#include "vmlinux.h" + +#include "common.h" +#include +#include +#include + +/* BPF ringbuf map */ +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024 /* 256 KB */); +} events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 10240); + __type(key, pid_t); + __type(value, struct event); +} tmp_map SEC(".maps"); + +SEC("kprobe/do_sys_openat2") +int kprobe__do_sys_openat2(struct pt_regs *ctx) { + struct event e = {0} ; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + e.pid = bpf_get_current_pid_tgid() >> 32; + + char *fn_ptr; + fn_ptr = (char *)PT_REGS_PARM2_CORE(ctx); + bpf_core_read_user_str(&e.filename, sizeof(e.filename), fn_ptr); + + bpf_map_update_elem(&tmp_map, &tid, &e, BPF_NOEXIST); + + return 0; +} + +SEC("kretprobe/do_sys_openat2") +int kretprobe__do_sys_openat2(struct pt_regs *ctx) { + struct event *e; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + struct event *tmp; + tmp = bpf_map_lookup_elem(&tmp_map, &tid); + if (!tmp) { + return 0; + } + + e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); + if (!e) { + return 0; + } + + e->ret = (long)PT_REGS_RC_CORE(ctx); + e->pid = tmp->pid; + __builtin_memcpy(&e->filename, tmp->filename, sizeof(e->filename)); + + + bpf_ringbuf_submit(e, 0); + + bpf_map_delete_elem(&tmp_map, &tid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/28-kprobe-hello/main.go b/28-kprobe-hello/main.go new file mode 100644 index 0000000..4839ecd --- /dev/null +++ b/28-kprobe-hello/main.go @@ -0,0 +1,91 @@ +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "log" + + bpf "github.com/aquasecurity/libbpfgo" + "golang.org/x/sys/unix" +) + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func goString(s []byte) string { + return string(bytes.Split(s, []byte("\x00"))[0]) +} + +func resizeMap(module *bpf.Module, name string, size uint32) error { + m, err := module.GetMap(name) + if err != nil { + return err + } + + if err = m.Resize(size); err != nil { + return err + } + + if actual := m.GetMaxEntries(); actual != size { + return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual) + } + + return nil +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + if err := resizeMap(bpfModule, "events", 8192); err != nil { + panic(err) + } + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog1, err := bpfModule.GetProgram("kprobe__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog1.AttachKprobe("do_sys_openat2"); err != nil { + panic(err) + } + prog2, err := bpfModule.GetProgram("kretprobe__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog2.AttachKretprobe("do_sys_openat2"); err != nil { + panic(err) + } + + eventsChannel := make(chan []byte) + pb, err := bpfModule.InitRingBuf("events", eventsChannel) + if err != nil { + panic(err) + } + + pb.Start() + defer func() { + pb.Stop() + pb.Close() + }() + + for { + select { + case data := <-eventsChannel: + var event Event + if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + } + } +} diff --git a/README.rst b/README.rst index 8a20942..8a923ad 100644 --- a/README.rst +++ b/README.rst @@ -22,171 +22,171 @@ Program Types -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| Program Type | Attach Type | ELF Section Name | Examples | Sleepable | -+===========================================+========================================+==================================+=======================+===========+ -| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``cgroup/sock`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``kretprobe+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``ksyscall+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``kretsyscall+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``uprobe+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``uprobe.s+`` | | Yes | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``uretprobe+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``uretprobe.s+`` | | Yes | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``usdt+`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``kretprobe.multi+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_LSM_MAC`` | ``lsm+`` |`26`_ | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``lsm.s+`` | | Yes | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``raw_tracepoint.w+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` |`12`_ `13`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``raw_tracepoint+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` |`21`_ `25`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``tc`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` |`18`_ `19`_ `20`_ | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | Yes | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` |`04`_ `07`_ `14`_ | | -+ + +----------------------------------+ +-----------+ -| | | ``tracepoint+`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``fmod_ret.s+`` | | Yes | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_FENTRY`` | ``fentry+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``fentry.s+`` | | Yes | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_FEXIT`` | ``fexit+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``fexit.s+`` | | Yes | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_ITER`` | ``iter+`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``iter.s+`` | | Yes | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` |`16`_ `17`_ | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ -| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``xdp/cpumap`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``xdp/devmap`` | | | -+ +----------------------------------------+----------------------------------+-----------------------+-----------+ -| | ``BPF_XDP`` | ``xdp.frags`` | | | -+ + +----------------------------------+-----------------------+-----------+ -| | | ``xdp`` | | | -+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+-----------+ ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| Program Type | Attach Type | ELF Section Name | Examples | ++===========================================+========================================+==================================+=======================+ +| ``BPF_PROG_TYPE_CGROUP_DEVICE`` | ``BPF_CGROUP_DEVICE`` | ``cgroup/dev`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_CGROUP_SKB`` | | ``cgroup/skb`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET_EGRESS`` | ``cgroup_skb/egress`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET_INGRESS`` | ``cgroup_skb/ingress`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_CGROUP_SOCKOPT`` | ``BPF_CGROUP_GETSOCKOPT`` | ``cgroup/getsockopt`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_SETSOCKOPT`` | ``cgroup/setsockopt`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK_ADDR`` | ``BPF_CGROUP_INET4_BIND`` | ``cgroup/bind4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET4_CONNECT`` | ``cgroup/connect4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET4_GETPEERNAME`` | ``cgroup/getpeername4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET4_GETSOCKNAME`` | ``cgroup/getsockname4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET6_BIND`` | ``cgroup/bind6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET6_CONNECT`` | ``cgroup/connect6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET6_GETPEERNAME`` | ``cgroup/getpeername6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET6_GETSOCKNAME`` | ``cgroup/getsockname6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_UDP4_RECVMSG`` | ``cgroup/recvmsg4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_UDP4_SENDMSG`` | ``cgroup/sendmsg4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_UDP6_RECVMSG`` | ``cgroup/recvmsg6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_UDP6_SENDMSG`` | ``cgroup/sendmsg6`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_CGROUP_SOCK`` | ``BPF_CGROUP_INET4_POST_BIND`` | ``cgroup/post_bind4`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET6_POST_BIND`` | ``cgroup/post_bind6`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET_SOCK_CREATE`` | ``cgroup/sock_create`` | | ++ + +----------------------------------+-----------------------+ +| | | ``cgroup/sock`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_CGROUP_INET_SOCK_RELEASE`` | ``cgroup/sock_release`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_CGROUP_SYSCTL`` | ``BPF_CGROUP_SYSCTL`` | ``cgroup/sysctl`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_EXT`` | | ``freplace+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` |`28`_ | ++ + +----------------------------------+-----------------------+ +| | | ``kretprobe+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``ksyscall+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``kretsyscall+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``uprobe+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``uprobe.s+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``uretprobe+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``uretprobe.s+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``usdt+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_TRACE_KPROBE_MULTI`` | ``kprobe.multi+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``kretprobe.multi+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LIRC_MODE2`` | ``BPF_LIRC_MODE2`` | ``lirc_mode2`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LSM`` | ``BPF_LSM_CGROUP`` | ``lsm_cgroup+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_LSM_MAC`` | ``lsm+`` |`26`_ | ++ + +----------------------------------+-----------------------+ +| | | ``lsm.s+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LWT_IN`` | | ``lwt_in`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LWT_OUT`` | | ``lwt_out`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LWT_SEG6LOCAL`` | | ``lwt_seg6local`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_LWT_XMIT`` | | ``lwt_xmit`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_PERF_EVENT`` | | ``perf_event`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE`` | | ``raw_tp.w+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``raw_tracepoint.w+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_RAW_TRACEPOINT`` | | ``raw_tp+`` |`12`_ `13`_ | ++ + +----------------------------------+ + +| | | ``raw_tracepoint+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SCHED_ACT`` | | ``action`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SCHED_CLS`` | | ``classifier`` |`21`_ `25`_ | ++ + +----------------------------------+ + +| | | ``tc`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SK_LOOKUP`` | ``BPF_SK_LOOKUP`` | ``sk_lookup`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SK_MSG`` | ``BPF_SK_MSG_VERDICT`` | ``sk_msg`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SK_REUSEPORT`` | ``BPF_SK_REUSEPORT_SELECT_OR_MIGRATE`` | ``sk_reuseport/migrate`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_SK_REUSEPORT_SELECT`` | ``sk_reuseport`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SK_SKB`` | | ``sk_skb`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_SK_SKB_STREAM_PARSER`` | ``sk_skb/stream_parser`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_SK_SKB_STREAM_VERDICT`` | ``sk_skb/stream_verdict`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SOCKET_FILTER`` | | ``socket`` |`18`_ `19`_ `20`_ | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SOCK_OPS`` | ``BPF_CGROUP_SOCK_OPS`` | ``sockops`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_STRUCT_OPS`` | | ``struct_ops+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_SYSCALL`` | | ``syscall`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_TRACEPOINT`` | | ``tp+`` |`04`_ `07`_ `14`_ | ++ + +----------------------------------+ + +| | | ``tracepoint+`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_TRACING`` | ``BPF_MODIFY_RETURN`` | ``fmod_ret+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``fmod_ret.s+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_TRACE_FENTRY`` | ``fentry+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``fentry.s+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_TRACE_FEXIT`` | ``fexit+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``fexit.s+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_TRACE_ITER`` | ``iter+`` | | ++ + +----------------------------------+-----------------------+ +| | | ``iter.s+`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_TRACE_RAW_TP`` | ``tp_btf+`` |`16`_ `17`_ | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ +| ``BPF_PROG_TYPE_XDP`` | ``BPF_XDP_CPUMAP`` | ``xdp.frags/cpumap`` | | ++ + +----------------------------------+-----------------------+ +| | | ``xdp/cpumap`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_XDP_DEVMAP`` | ``xdp.frags/devmap`` | | ++ + +----------------------------------+-----------------------+ +| | | ``xdp/devmap`` | | ++ +----------------------------------------+----------------------------------+-----------------------+ +| | ``BPF_XDP`` | ``xdp.frags`` | | ++ + +----------------------------------+-----------------------+ +| | | ``xdp`` | | ++-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ .. |Build examples| image:: https://github.com/mozillazg/hello-libbpfgo/actions/workflows/build.yml/badge.svg?branch=master @@ -205,5 +205,6 @@ Program Types .. _21: 21-tc-parse-packet-with-bpf_skb_load_bytes .. _25: 25-tc-parse-packet-with-direct-memory-access .. _26: 26-lsm-path_chmod +.. _28: 28-kprobe-hello From 78915e173eadf9b768580cfe19a9a1eda5dc0d1b Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 26 Nov 2023 06:17:22 +0000 Subject: [PATCH 15/20] 29: add 29-kprobe-hello-with-macro --- 29-kprobe-hello-with-macro/Makefile | 1 + 29-kprobe-hello-with-macro/README.md | 15 ++ .../cilium-ebpf/Makefile | 1 + .../cilium-ebpf/README.md | 15 ++ .../cilium-ebpf/bpf_bpfeb.go | 131 ++++++++++++++++++ .../cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 5976 bytes .../cilium-ebpf/bpf_bpfel.go | 131 ++++++++++++++++++ .../cilium-ebpf/bpf_bpfel.o | Bin 0 -> 5976 bytes .../cilium-ebpf/main.go | 75 ++++++++++ 29-kprobe-hello-with-macro/common.h | 5 + 29-kprobe-hello-with-macro/main.bpf.c | 65 +++++++++ 29-kprobe-hello-with-macro/main.go | 91 ++++++++++++ 12 files changed, 530 insertions(+) create mode 120000 29-kprobe-hello-with-macro/Makefile create mode 100644 29-kprobe-hello-with-macro/README.md create mode 120000 29-kprobe-hello-with-macro/cilium-ebpf/Makefile create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/README.md create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.go create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.o create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.go create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.o create mode 100644 29-kprobe-hello-with-macro/cilium-ebpf/main.go create mode 100644 29-kprobe-hello-with-macro/common.h create mode 100644 29-kprobe-hello-with-macro/main.bpf.c create mode 100644 29-kprobe-hello-with-macro/main.go diff --git a/29-kprobe-hello-with-macro/Makefile b/29-kprobe-hello-with-macro/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/29-kprobe-hello-with-macro/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/29-kprobe-hello-with-macro/README.md b/29-kprobe-hello-with-macro/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/29-kprobe-hello-with-macro/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/Makefile b/29-kprobe-hello-with-macro/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/29-kprobe-hello-with-macro/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/README.md b/29-kprobe-hello-with-macro/cilium-ebpf/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/29-kprobe-hello-with-macro/cilium-ebpf/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.go b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..f834d05 --- /dev/null +++ b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + KprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kretprobe__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + KprobeDoSysOpenat2 *ebpf.Program `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.Program `ebpf:"kretprobe__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.KprobeDoSysOpenat2, + p.KretprobeDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.o b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..a1745d3a8fb1a25dad12ef34e664f8e133db28f7 GIT binary patch literal 5976 zcmb_geQ0D?6+ds1HS0%r)9r`x`>m8^vSeqoAGT?=VH(XgrNJGy`6DaJ%Vg#yd1Stv zd9%)JDh^m71(g*o1pLE@6$6Sc3MPV*DHIGsVZkCnL{{*RpcV3;K}zE9oO|x%z4bI-l!&ATuA<hw&I%NUBwl}WktyW@$V>KRBS0W6f25zic^Y{iW$W*#kAs( z;-F$u(N*kI>{UFe$bfzC?l69pJEBv$<=wYfvHXinh}?zc-ECIZ-_Jc!52Eeu?a`{s z%%Szi89Vc;>*o#caoKP8t@WprBTMk@KFP+|xL-|+?&!LSRiQ+$C^o-98CGpxx#hjL znIBwd@9lV8^>@~%*qi8)Df$d!+)ww>yNdj{>AbHzLi9ZIg&vY~Yd*>hT%R~_*$KEH zxH)gfAh@gkg5ah;jzMr)5%UGXO+6ih;Ax#N2tKA<5Imz?5PVX(Ao!GWLGU@{g5VY9 zg5VA1g5WLXg5ZnF1;Otq7X)8YE(pG?To8Okxghvm<$~aA$_2sO$_2qUlna92Q!WU; zsaz2JzH&kEE#-pX+sXyOca#e@A2o$ua14Tdzs<+bp`Bm^U{C$Tz18u^Jg>T zCeZ)b|LwbyU!R%QwMN9!EzfR3jR4&Rb;H|ba~F4}v0FFf1CSGDx58a;(irbx{m>kq zg$7_ZK9To9Gz5JZ`UyxHa{d%Lv>u3zYutCS@lf1@KJPi&C&^};ABVpr1tK~P{R!1& z8C~l^*smd1Eaz~peBfsw+%gdSS^F#RBr+Qs(Ksvccb&8N87Rs zQ-d@caFA@`WOpIB)tm$#Ft&XNa>RJzWgY(rj~}ih*RT7k*5WK&5UcxXJcL>fQ-9dG zZd_w-E_^--A6}Q+M-3oWPzuTOp1E=3nVa4V&wX~(o4A=7^*joj6`zXPhUb^UYT(z% zzXh#El_2l&jCsFW@(Z4!GR8wx^+TEo3VtbD^r`;%Rd{k=FV%wClAm`A<cYI)lCynNZKHEUkEg51N)YQ7k= z4nBn>QWsOHi^XhEN=;X0QaL_CcO-Modp>jH`p9VV=zs$*yX9x{18%Nds)a7^+C6X2 zs^4887p)dn>$%XC19g4(X?J1pOYX;INRHYKgFLKBA^lk2oApC4SFcu49aD|jAfN0v zQ~VVC;C{THJ3Q=Oxoo`ID_5@iIQDGbtJnOhhjfzX{FKddz^w(h{qjt5-_$?g+EHDU z!=Qd%y^_y{zULSGV)C38b-+D`4WRc2>zhZ8Q8%k%ZhQ3>nLf*Ch?7IW-$t`G0F8kAp&l8cFV_! z$#11|TIYS7(qJ@*-wAPH82KO$dac=oVN*0LB&soc-gG@Egh9zG`o&zOiA639+mjz~ z#d)9FGVQzcN2+7Y;v}Cc~tG_+98Zr2y%X@=2Hr%RwK(uzYSb{w>$=f zIB!CBpkIaHZgOIGc7pE<`(ARPfvCW*;=u^#v7rcO|Fm)&KVx_Td52ivsTfY$oJAeKPV^#=uNZFgmAxTn zZk%W0HKK3xJ`m65y^Op&`@%k!`5t!7I5g9eI{%+UKj!fk?2i6*G1*uAll?_jXM#}<4ekaK=eoCo3I>r-4^pTGY(H_iMHY0$Zea) zHx2LX7iVyw?)YYKF6!K9{b5i1%Gi(ZaVO&6;RYktKGbf)qIS-!({AGdip6oTFFK14 zH`GU(){g5zQ}B<)Pi(>daKv9Gq2qZ^z}{mGirohJxsh1*xlhJ;2At>WIG=CSzw1>U z*LYobb=>j|@RJbbGyt7rS^f#={Jmf~uNNJkit$Q}w_^NGj4#JH=NFCNj`4djem};y z4{|w{NIZTIMEAqL`vZI^#>ZlOGREg(yb1$n;~O!)8RJ_qzH^ZC`zX4< z#AD!*^GI~+d#d-$gQqDK`i+oMRlkrLnYfl>qMvi-6^`3OKDknb!mXm0&F8E5T#LNt z@fi?irzury76mmBjgO36@~-^5yZh)XoipiN`0;C924!A+1e^Rnv@~MGe)l%&nKxA9 z`b3*NaB5)Pa``(o;+T%;QPuv=*!DBXf0!@tq3C?Bw{1Ux!tZo$Y3Vy%@1&}|K>icK z?$gd^JO5YLG3(1cjbVAO0XxmkXTvuk$E`o7GX{aYzI|WX`MmxR#IA4igNa-BeS!V= zlG2VpbN+ktxcOT;f!B{VyFS|{Aa;J#2l|OVV>rocL|e3e84Mh^|0SJd_iz2|`n-R> zzmHk}0emBHON<-r^wIVCUa)b~9S>1@Hw>3Q1^N7WEpE~E`^$Uda_%h|igssoey47B aFq-cejIw|o+{e=`)i;4W$L4L<@B0_V$QE4y literal 0 HcmV?d00001 diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.go b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.go new file mode 100644 index 0000000..c87c501 --- /dev/null +++ b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + KprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"kretprobe__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + KprobeDoSysOpenat2 *ebpf.Program `ebpf:"kprobe__do_sys_openat2"` + KretprobeDoSysOpenat2 *ebpf.Program `ebpf:"kretprobe__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.KprobeDoSysOpenat2, + p.KretprobeDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.o b/29-kprobe-hello-with-macro/cilium-ebpf/bpf_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..c745db09afb9502fa86907f8ceffe0345c724d00 GIT binary patch literal 5976 zcmbtYZ)jv!6+g))-E_0v&8FQp-TLRPlx4DHXS2IeQ*FaEnl)vEJ8ttKE6UrOnU`e9 z{A1?LI=53XV1+HHtf&z1gR84FplDDq5tO7*FbIVOiv$r_!4E-O$Tx$O#^1U3+?kix zX;nPryx;lVbMC$8o_pV)$yX+(E_ZfxkdqGjC$*SsC0c&CWv7gpqT`6vk1iOtCY>6m z_V&4{VLAXV& z%EB#bRTpkit0mzUwYnwTqE@$sThwYlNHnBAq;!q}svFUXv2Lh|}lxC!pO>h>Nof zA#w{bKhVeaG-Gu2!TC5;=AsY5=J8U{vrx#f!?-v<%+4d+YURMV(U_wyB0hJb>FDI= z*9A*^jsrg~wrmZv&J(y?hGL>FzTdgp{ZN)P^dvL|orXRJU4niQ3hCijiZUkkJOZ4z zc1I5|1%2Tl?|4Z#uLCh|IcANIqK)hAT48s2pj^8Lp)6dxUT6yXGV~$n67(BTuJb1J z+fc|c-g`Fz%ue3N??JJit`*>2=m(%IuRz&OL4P9l67c6@ZvuZQHV^tMu~V>rE%p-Z z--^8n`&Ad;N%WeFhy6Pj5Bv8n9`@@l9@V(#;$i>6#l!xii--Le7mq^y)y2d9n~R72 zcNY))Efh#z&_xA8NuxTuyyklSrNH?#FR9` z7wpApTo6mofTJ59Mc#iSyl=e6EFSbzh(WB0`3N^c%rLoPNWTBe=U6;$01ieV)eR4KR#t4ifu*5@9JL8TbveM^mxT~rA|n#<*bqACPb``8E~ z`C2PhbMwU@>*Y(ud2^wbm03^~S`0MZRQXy!VWI37@VY36ekGW%Qsu%&p(D^s(2F!% zrrA2I3(#SzJVljJ!rLTMr)-_7Im+g!RLRZzXv>u;Q>D4Q!Z6h`RjUURp-fn(#d4)I z8~A><uNRVHOPZh!%8g^dZwUW;639thQI86(zr~iy)c(WYr>F0 z%w$?6X%VW}bU~ z8a)?ra^7PnoTtrZ47ZAZZDLyL@8aWoI%H2D+^*WlN~*&N=S!u7!ueOpa&d=6>0cv(LK*h|x(yZ3m096`}4iYqnI5&oTFb=M=XXnQ3rePvu+GgLM zt>yAzuILwnLZ+-S$+)vvcU->J+H4^gCa@PSIk$IN>{|Q1!!Uk6 zmkEm1fRdl=9J>_JCh^Rwx3*!VNT@148$d1ttXt9foAz`ch@ zV1F9gJ!5^$zYgvH0ug^(Gk*m-ki~N@!h69J!v6$(C{HvT;R*232=4_?33ubCh4&!G z?vSV~+$4+3E#X($|020V6v+r{DzX*Qx4dgBUZ-PI(O>{fLkAg1?|1tdC ze+I|A-2W}+JNV`kjxZye!h5^m-zC}>?$*mSi0(UoGn~hGEYbbv_TQlIf09G?mH4i( zL+*<*;<;|@Zj)1_*?dFwN5)x~d`=_i1WqdF%;K3V(G6gKWc(e;^AWUjyc5@tzX?we ze}P&-X^ilhVPW9!)dUlW<7rC`=iXdf7U%yF_JD=QWB+P|^LSek&RGpXSva1@c$x`> zIS=jTbN(A>V{yD}X_GI-`0W_K6XUBfz8T~9V*GxL@5Z=U1lnAF{0v}m>*0Go%K09T z^2r#ViSdOPugAFCKR4fU%)b)j>oL9+eEw#^SJ`X@pKFolJU#6}UPg&%*d8>i_P_n4Lcf0q=x%Pn$Xpx5Qc+17zpd(T9hxW=rJ->Al& zGS_!s_?$%L7a;G~-<=oNr}bp9Ek6VB@3xes&Ff5`H3iK7*m#|;zia3JbG4h_oiq1b za|65nj(-bAyZIMnf?)~d-^lzta{b->qiEy#<9l#l3Kg#x$3}(U5$*c#NJlrn>*MBk zd|LWD?r?yUg**}K5YH!#n0D)5mIb=`dHo#ch7-5>ogH5j!f1qlbVH`({ErVcqV3SsehIJyZOWFMe +#include +#include + +/* BPF ringbuf map */ +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024 /* 256 KB */); +} events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 10240); + __type(key, pid_t); + __type(value, struct event); +} tmp_map SEC(".maps"); + +SEC("kprobe/do_sys_openat2") +int BPF_KPROBE(kprobe__do_sys_openat2, int dfd, const char *filename) { + struct event e = {0} ; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + e.pid = bpf_get_current_pid_tgid() >> 32; + + bpf_core_read_user_str(&e.filename, sizeof(e.filename), filename); + + bpf_map_update_elem(&tmp_map, &tid, &e, BPF_NOEXIST); + + return 0; +} + +SEC("kretprobe/do_sys_openat2") +int BPF_KRETPROBE(kretprobe__do_sys_openat2, long ret) { + struct event *e; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + struct event *tmp; + tmp = bpf_map_lookup_elem(&tmp_map, &tid); + if (!tmp) { + return 0; + } + + e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); + if (!e) { + return 0; + } + + e->ret = ret; + e->pid = tmp->pid; + __builtin_memcpy(&e->filename, tmp->filename, sizeof(e->filename)); + + + bpf_ringbuf_submit(e, 0); + + bpf_map_delete_elem(&tmp_map, &tid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/29-kprobe-hello-with-macro/main.go b/29-kprobe-hello-with-macro/main.go new file mode 100644 index 0000000..4839ecd --- /dev/null +++ b/29-kprobe-hello-with-macro/main.go @@ -0,0 +1,91 @@ +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "log" + + bpf "github.com/aquasecurity/libbpfgo" + "golang.org/x/sys/unix" +) + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func goString(s []byte) string { + return string(bytes.Split(s, []byte("\x00"))[0]) +} + +func resizeMap(module *bpf.Module, name string, size uint32) error { + m, err := module.GetMap(name) + if err != nil { + return err + } + + if err = m.Resize(size); err != nil { + return err + } + + if actual := m.GetMaxEntries(); actual != size { + return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual) + } + + return nil +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + if err := resizeMap(bpfModule, "events", 8192); err != nil { + panic(err) + } + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog1, err := bpfModule.GetProgram("kprobe__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog1.AttachKprobe("do_sys_openat2"); err != nil { + panic(err) + } + prog2, err := bpfModule.GetProgram("kretprobe__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog2.AttachKretprobe("do_sys_openat2"); err != nil { + panic(err) + } + + eventsChannel := make(chan []byte) + pb, err := bpfModule.InitRingBuf("events", eventsChannel) + if err != nil { + panic(err) + } + + pb.Start() + defer func() { + pb.Stop() + pb.Close() + }() + + for { + select { + case data := <-eventsChannel: + var event Event + if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + } + } +} From d5f74b5b2743b25f2fb355c760712cd2bb402fd6 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 26 Nov 2023 08:14:11 +0000 Subject: [PATCH 16/20] 30: add 30-ksyscall-hello --- 30-ksyscall-hello/Makefile | 1 + 30-ksyscall-hello/README.md | 15 ++++++ 30-ksyscall-hello/common.h | 5 ++ 30-ksyscall-hello/main.bpf.c | 68 +++++++++++++++++++++++++++ 30-ksyscall-hello/main.go | 91 ++++++++++++++++++++++++++++++++++++ 5 files changed, 180 insertions(+) create mode 120000 30-ksyscall-hello/Makefile create mode 100644 30-ksyscall-hello/README.md create mode 100644 30-ksyscall-hello/common.h create mode 100644 30-ksyscall-hello/main.bpf.c create mode 100644 30-ksyscall-hello/main.go diff --git a/30-ksyscall-hello/Makefile b/30-ksyscall-hello/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/30-ksyscall-hello/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/30-ksyscall-hello/README.md b/30-ksyscall-hello/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/30-ksyscall-hello/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/30-ksyscall-hello/common.h b/30-ksyscall-hello/common.h new file mode 100644 index 0000000..fbc150b --- /dev/null +++ b/30-ksyscall-hello/common.h @@ -0,0 +1,5 @@ +struct event { + u64 pid; + long long ret; + char filename[256]; +}; diff --git a/30-ksyscall-hello/main.bpf.c b/30-ksyscall-hello/main.bpf.c new file mode 100644 index 0000000..417f991 --- /dev/null +++ b/30-ksyscall-hello/main.bpf.c @@ -0,0 +1,68 @@ +#include "vmlinux.h" + +#include "common.h" +#include +#include +#include + +/* BPF ringbuf map */ +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024 /* 256 KB */); +} events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 10240); + __type(key, pid_t); + __type(value, struct event); +} tmp_map SEC(".maps"); + +SEC("ksyscall/openat") +int ksyscall__openat(struct pt_regs *ctx) { + struct event e = {0} ; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + e.pid = bpf_get_current_pid_tgid() >> 32; + + struct pt_regs *regs = (struct pt_regs *)PT_REGS_PARM1_CORE(ctx); + char *fn_ptr; + fn_ptr = (char *)PT_REGS_PARM2_CORE(regs); + bpf_core_read_user_str(&e.filename, sizeof(e.filename), fn_ptr); + + bpf_map_update_elem(&tmp_map, &tid, &e, BPF_NOEXIST); + + return 0; +} + +SEC("kretsyscall/openat") +int kretsyscall__openat(struct pt_regs *ctx) { + struct event *e; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + struct event *tmp; + tmp = bpf_map_lookup_elem(&tmp_map, &tid); + if (!tmp) { + return 0; + } + + e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); + if (!e) { + return 0; + } + + e->ret = (long)PT_REGS_RC_CORE(ctx); + e->pid = tmp->pid; + __builtin_memcpy(&e->filename, tmp->filename, sizeof(e->filename)); + + + bpf_ringbuf_submit(e, 0); + + bpf_map_delete_elem(&tmp_map, &tid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/30-ksyscall-hello/main.go b/30-ksyscall-hello/main.go new file mode 100644 index 0000000..dd4cf06 --- /dev/null +++ b/30-ksyscall-hello/main.go @@ -0,0 +1,91 @@ +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "log" + + bpf "github.com/aquasecurity/libbpfgo" + "golang.org/x/sys/unix" +) + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func goString(s []byte) string { + return string(bytes.Split(s, []byte("\x00"))[0]) +} + +func resizeMap(module *bpf.Module, name string, size uint32) error { + m, err := module.GetMap(name) + if err != nil { + return err + } + + if err = m.Resize(size); err != nil { + return err + } + + if actual := m.GetMaxEntries(); actual != size { + return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual) + } + + return nil +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + if err := resizeMap(bpfModule, "events", 8192); err != nil { + panic(err) + } + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog1, err := bpfModule.GetProgram("ksyscall__openat") + if err != nil { + panic(err) + } + if _, err := prog1.AttachGeneric(); err != nil { + panic(err) + } + prog2, err := bpfModule.GetProgram("kretsyscall__openat") + if err != nil { + panic(err) + } + if _, err := prog2.AttachGeneric(); err != nil { + panic(err) + } + + eventsChannel := make(chan []byte) + pb, err := bpfModule.InitRingBuf("events", eventsChannel) + if err != nil { + panic(err) + } + + pb.Start() + defer func() { + pb.Stop() + pb.Close() + }() + + for { + select { + case data := <-eventsChannel: + var event Event + if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + } + } +} From 138878bd8f7095457404e7e1efc9ca99618929ed Mon Sep 17 00:00:00 2001 From: mozillazg Date: Sun, 26 Nov 2023 08:21:47 +0000 Subject: [PATCH 17/20] 31: add 31-ksyscall-hello-with-macro --- 31-ksyscall-hello-with-macro/Makefile | 1 + 31-ksyscall-hello-with-macro/README.md | 15 ++++ 31-ksyscall-hello-with-macro/common.h | 5 ++ 31-ksyscall-hello-with-macro/main.bpf.c | 65 ++++++++++++++++++ 31-ksyscall-hello-with-macro/main.go | 91 +++++++++++++++++++++++++ README.rst | 11 +-- 6 files changed, 184 insertions(+), 4 deletions(-) create mode 120000 31-ksyscall-hello-with-macro/Makefile create mode 100644 31-ksyscall-hello-with-macro/README.md create mode 100644 31-ksyscall-hello-with-macro/common.h create mode 100644 31-ksyscall-hello-with-macro/main.bpf.c create mode 100644 31-ksyscall-hello-with-macro/main.go diff --git a/31-ksyscall-hello-with-macro/Makefile b/31-ksyscall-hello-with-macro/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/31-ksyscall-hello-with-macro/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/31-ksyscall-hello-with-macro/README.md b/31-ksyscall-hello-with-macro/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/31-ksyscall-hello-with-macro/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/31-ksyscall-hello-with-macro/common.h b/31-ksyscall-hello-with-macro/common.h new file mode 100644 index 0000000..fbc150b --- /dev/null +++ b/31-ksyscall-hello-with-macro/common.h @@ -0,0 +1,5 @@ +struct event { + u64 pid; + long long ret; + char filename[256]; +}; diff --git a/31-ksyscall-hello-with-macro/main.bpf.c b/31-ksyscall-hello-with-macro/main.bpf.c new file mode 100644 index 0000000..bdfd689 --- /dev/null +++ b/31-ksyscall-hello-with-macro/main.bpf.c @@ -0,0 +1,65 @@ +#include "vmlinux.h" + +#include "common.h" +#include +#include +#include + +/* BPF ringbuf map */ +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024 /* 256 KB */); +} events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 10240); + __type(key, pid_t); + __type(value, struct event); +} tmp_map SEC(".maps"); + +SEC("ksyscall/openat") +int BPF_KSYSCALL(ksyscall__openat, int dfd, const char *filename) { + struct event e = {0} ; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + e.pid = bpf_get_current_pid_tgid() >> 32; + + bpf_core_read_user_str(&e.filename, sizeof(e.filename), filename); + + bpf_map_update_elem(&tmp_map, &tid, &e, BPF_NOEXIST); + + return 0; +} + +SEC("kretsyscall/openat") +int BPF_KRETPROBE(kretsyscall__openat, long ret) { + struct event *e; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + struct event *tmp; + tmp = bpf_map_lookup_elem(&tmp_map, &tid); + if (!tmp) { + return 0; + } + + e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); + if (!e) { + return 0; + } + + e->ret = ret; + e->pid = tmp->pid; + __builtin_memcpy(&e->filename, tmp->filename, sizeof(e->filename)); + + + bpf_ringbuf_submit(e, 0); + + bpf_map_delete_elem(&tmp_map, &tid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/31-ksyscall-hello-with-macro/main.go b/31-ksyscall-hello-with-macro/main.go new file mode 100644 index 0000000..dd4cf06 --- /dev/null +++ b/31-ksyscall-hello-with-macro/main.go @@ -0,0 +1,91 @@ +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "log" + + bpf "github.com/aquasecurity/libbpfgo" + "golang.org/x/sys/unix" +) + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func goString(s []byte) string { + return string(bytes.Split(s, []byte("\x00"))[0]) +} + +func resizeMap(module *bpf.Module, name string, size uint32) error { + m, err := module.GetMap(name) + if err != nil { + return err + } + + if err = m.Resize(size); err != nil { + return err + } + + if actual := m.GetMaxEntries(); actual != size { + return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual) + } + + return nil +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + if err := resizeMap(bpfModule, "events", 8192); err != nil { + panic(err) + } + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog1, err := bpfModule.GetProgram("ksyscall__openat") + if err != nil { + panic(err) + } + if _, err := prog1.AttachGeneric(); err != nil { + panic(err) + } + prog2, err := bpfModule.GetProgram("kretsyscall__openat") + if err != nil { + panic(err) + } + if _, err := prog2.AttachGeneric(); err != nil { + panic(err) + } + + eventsChannel := make(chan []byte) + pb, err := bpfModule.InitRingBuf("events", eventsChannel) + if err != nil { + panic(err) + } + + pb.Start() + defer func() { + pb.Stop() + pb.Close() + }() + + for { + select { + case data := <-eventsChannel: + var event Event + if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + } + } +} diff --git a/README.rst b/README.rst index 8a923ad..3e7bb4b 100644 --- a/README.rst +++ b/README.rst @@ -77,13 +77,13 @@ Program Types +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | ``BPF_PROG_TYPE_FLOW_DISSECTOR`` | ``BPF_FLOW_DISSECTOR`` | ``flow_dissector`` | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ -| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` |`28`_ | +| ``BPF_PROG_TYPE_KPROBE`` | | ``kprobe+`` |`28`_ `29`_ | + + +----------------------------------+-----------------------+ -| | | ``kretprobe+`` | | +| | | ``kretprobe+`` |`28`_ `29`_ | + + +----------------------------------+-----------------------+ -| | | ``ksyscall+`` | | +| | | ``ksyscall+`` |`30`_ `31`_ | + + +----------------------------------+-----------------------+ -| | | ``kretsyscall+`` | | +| | | ``kretsyscall+`` |`30`_ `31`_ | + + +----------------------------------+-----------------------+ | | | ``uprobe+`` | | + + +----------------------------------+-----------------------+ @@ -206,5 +206,8 @@ Program Types .. _25: 25-tc-parse-packet-with-direct-memory-access .. _26: 26-lsm-path_chmod .. _28: 28-kprobe-hello +.. _29: 29-kprobe-hello-with-macro +.. _30: 30-ksyscall-hello +.. _31: 31-ksyscall-hello-with-macro From fe03454de173f7faba88faad39eac538a73124e9 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Thu, 30 Nov 2023 14:41:01 +0000 Subject: [PATCH 18/20] 32: add 32-fentry-hello --- 32-fentry-hello/Makefile | 1 + 32-fentry-hello/README.md | 15 +++ 32-fentry-hello/cilium-ebpf/Makefile | 1 + 32-fentry-hello/cilium-ebpf/README.md | 15 +++ 32-fentry-hello/cilium-ebpf/bpf_bpfeb.go | 131 +++++++++++++++++++++++ 32-fentry-hello/cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 5552 bytes 32-fentry-hello/cilium-ebpf/bpf_bpfel.go | 131 +++++++++++++++++++++++ 32-fentry-hello/cilium-ebpf/bpf_bpfel.o | Bin 0 -> 5552 bytes 32-fentry-hello/cilium-ebpf/main.go | 82 ++++++++++++++ 32-fentry-hello/common.h | 5 + 32-fentry-hello/main.bpf.c | 66 ++++++++++++ 32-fentry-hello/main.go | 91 ++++++++++++++++ README.rst | 5 +- 13 files changed, 541 insertions(+), 2 deletions(-) create mode 120000 32-fentry-hello/Makefile create mode 100644 32-fentry-hello/README.md create mode 120000 32-fentry-hello/cilium-ebpf/Makefile create mode 100644 32-fentry-hello/cilium-ebpf/README.md create mode 100644 32-fentry-hello/cilium-ebpf/bpf_bpfeb.go create mode 100644 32-fentry-hello/cilium-ebpf/bpf_bpfeb.o create mode 100644 32-fentry-hello/cilium-ebpf/bpf_bpfel.go create mode 100644 32-fentry-hello/cilium-ebpf/bpf_bpfel.o create mode 100644 32-fentry-hello/cilium-ebpf/main.go create mode 100644 32-fentry-hello/common.h create mode 100644 32-fentry-hello/main.bpf.c create mode 100644 32-fentry-hello/main.go diff --git a/32-fentry-hello/Makefile b/32-fentry-hello/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/32-fentry-hello/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/32-fentry-hello/README.md b/32-fentry-hello/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/32-fentry-hello/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/32-fentry-hello/cilium-ebpf/Makefile b/32-fentry-hello/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/32-fentry-hello/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/32-fentry-hello/cilium-ebpf/README.md b/32-fentry-hello/cilium-ebpf/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/32-fentry-hello/cilium-ebpf/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/32-fentry-hello/cilium-ebpf/bpf_bpfeb.go b/32-fentry-hello/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..e5e5437 --- /dev/null +++ b/32-fentry-hello/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + FentryDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"fentry__do_sys_openat2"` + FexitDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"fexit__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + FentryDoSysOpenat2 *ebpf.Program `ebpf:"fentry__do_sys_openat2"` + FexitDoSysOpenat2 *ebpf.Program `ebpf:"fexit__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.FentryDoSysOpenat2, + p.FexitDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/32-fentry-hello/cilium-ebpf/bpf_bpfeb.o b/32-fentry-hello/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..0c8ce926c8f9e38c43eb4e8a4828e5d3a882efae GIT binary patch literal 5552 zcmb`LOK4rk8OOhKCC6%$>X9a?`aXeTu7rH8ByFO;#Erp^P?Ox+TF9m4=<41h>Eiq9 zeb`b&si0|5p#_&x5Ofh00yT8wMX0=!7Abg9iWjA5(S;UW26BOM<} z^g##D{O33G&3xa?oIB^pKfG||VkQ&FK?>v_s3#f@dQchKQ_5R8Ai+{m`bZmt+9u1t z*?+_uRBfTV#yh6lrVmW-n{JujGreni$8_Cv&GfeEs_Ba9qG{7~!F0xS+O%ML*)(rD zVLEP_H4RONO$SZ;Oet9R<44pVvk>Votv`OqisxGdk#Kqa@g6IipJ6F-8nf;1@5@F= z3S{$D>cP0y=BVS-A?+SN-29p`q6F^^Yc#Hn+o@v*7rYR z*OPwsKT6MQ_QB?io9Ou&`8I25J6p%#2I6C~aX)%qsJL&8>@n6j8(x4#;V|^u_}1c zSQWfttO{N=Rt4WSRt2vatAf{!Rl#?RRl#?SRl)a+Rl!@vs^I&^s^AC4s^D#7Rq&3n zDtOme6})Gx3Vvj)y7YoO=;gpExX<-F-5ez0`3+V4bMwxB_+0j+pYuzFD{i9yvi$qI z8sD%RmRT2J?$xI?;~IM)whHNmb;xEmTB2Dm@@J7xxz#F%V6i!#V*SV%jzWUaj63pa zWSc_1fch!qJo0Ei3Z&D>+HdoIoQ+53ebVNc<888R_VIE0m-K){22g*^>gvXP4Wa!a zVuibav2w$oMP@1><0r4NPC-9~yn_5ao9C0L7p?vr>hrcpHsz7u_6#MzW6XWmVTm>J zY!HUCKn4FKMCRUo44H|0_cU@I`KQRAKwd%qIWlA4LjI-gDbHRf%b)6uo}+>g(5|Yj1q#LNs-~a3PAMv(${GR$PqYdZ$&1+Y;YItu4(;IpT;LajPCz zBZu0@E@{ObnX6Reda)Ku_th`Ml4ZBvuFTita#(HD=e3Z-T4|x!k{j`o+$>hRv2<$9 zs8(!Bsk10^^u82DM|qb=i5k3U*W6ICmvxZaK>hh1xnClPy}`Fr9^xG#`{KO^gV8O;0i_sITE`5dkw zeye%r-N`$MHu~;>{t@}FBGY^yu@4+fh-vjNcdOz<v)gvj?ghmmk_It|AWX~_Fp#sP~?5ScP!2x-18rh7hQkPS4HlVSBx)-Y(Ing zs_}JfE#Hr~6U_cKn`_%lIU9>-!um@`5xYy9m@1JDC zUNh-4z_|iN(Z3OrTtNH5w-fee3!LcB{LK1oKHY2fd%lZ0*I+DTsMD9{Z=lZixM%uH z_Rplanc|fc-%jy*iWyIG{;d>0NbydJ_nu_kw#0n;n@+4pf5SqEg zb#m3}&016}ms|KuN?gi#rFV+6l4~#3RBa-;a{l~F(JLo^9Ub$U)hOIYQ2HIs`1F;Y z?!aRH4=Im1Qom(E)NZTS{ceUK7$&-(XI!Zx3%C#(MV!?s@_|C{l8za+==9DU-q zKJQ(oyp{(=Kc5e#L1ccC`*r&9Z2ukd3I6@NRPQU89V9=V4ZlS`$^Wj67>Ck7?;0jQ zp8hA0y?-AcZIF6*R1WVO!vlLV|4un+eA2%kOZEO)pF;NI$%%Ao*uhhON;I;XJih|? zg!K>Dc>TW{uHV~v|6D)cu_yR{+Tzdnd0?t3>7Vz#pEvKieK~O1)q));{nHmy(*H6+u@o{_q!~X&?k@zG4 literal 0 HcmV?d00001 diff --git a/32-fentry-hello/cilium-ebpf/bpf_bpfel.go b/32-fentry-hello/cilium-ebpf/bpf_bpfel.go new file mode 100644 index 0000000..6252211 --- /dev/null +++ b/32-fentry-hello/cilium-ebpf/bpf_bpfel.go @@ -0,0 +1,131 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +type bpfEvent struct { + Pid uint64 + Ret int64 + Filename [256]int8 +} + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + FentryDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"fentry__do_sys_openat2"` + FexitDoSysOpenat2 *ebpf.ProgramSpec `ebpf:"fexit__do_sys_openat2"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` + TmpMap *ebpf.MapSpec `ebpf:"tmp_map"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` + TmpMap *ebpf.Map `ebpf:"tmp_map"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + m.TmpMap, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + FentryDoSysOpenat2 *ebpf.Program `ebpf:"fentry__do_sys_openat2"` + FexitDoSysOpenat2 *ebpf.Program `ebpf:"fexit__do_sys_openat2"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.FentryDoSysOpenat2, + p.FexitDoSysOpenat2, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/32-fentry-hello/cilium-ebpf/bpf_bpfel.o b/32-fentry-hello/cilium-ebpf/bpf_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..16082cf4212ac238c1732d450e786b05dc4ed03c GIT binary patch literal 5552 zcmbtYO=w)#6~2g>1yUl8a#i@ zys>pNlnR;_7g}&B1w$8cn?eoUXb~#yq(uu}l;TAxT6CdB7lL@9MIeHPsNZ+*xzf|~ zr1a;&x!?WHJ@=k-f8Kp><_A}k8S?R zI3FXQ^tkkAsP*UEK&PMkuC1i~IFAe*SCJou{eB2NtzIWporXI%Mq8>n8HYx@N+;vc zXqRUvpX!L||helr#?$GGGaEC@u33q68LAXPsXM{U6dRDkYqZfrc zG`b<&q0vji9U8qX+@aC;ggZ3)zHo;|KM?NF=!e1`8vRJPL!(!OJ2ZMtxI?2iggZ3) zv2ce*KN0TG=uP1cjouRO(CBU94vpRs?$GF6;SRCi_M~FJEgC%_+~K-qI5#}B5T2WN zp#RCaSY*?gu?;RJuJxF4Qx4rbK!fOH%EjIoPL)O^WH${yAtr6yp6H zgNr;urTRm00SFsB^qL^gI+Yd=!OmN457jtxgV&oAep-9_iTG{f1uN zUoSa2a1!`+sdH{3y?iZPg(6TNpLeeIh%^>}r=fZ1H1q}NGW2^;$iVX`w5_Uv&j1%( zy=MTJhrWH7_q-#V^MH?^j-BHf*tp)_ih5rF%C$QNrEu*Ap?T;}peLZq(4RrM&KuBQ zKq152dmjMRUgk%E?F8rlE9hD1yUsSmeWs+_zY1sAhQ8pMSsu!lIqzAE8vYXMj5z=! zx^c-lPb>Z$kOa_S_`uitkW)C8D%WBahOgeZ@#?Mc=4)?W38!xru7shAO(RlOy%a{Z zxLJ-`D!PMOOEt=+kUefk&016m9kp$2Qq3q<^W{oZ)740|zxEY)vTWB{<%L>Q3M%#5 zf-TfRt+=S0>ULz*9bIWhDy}xdDz3$1yrkwC-GpJO9=1#?tT!-l{IZxYrmVS(x!lF7 zF4uB%jrm-WQwuH^u7-shZ(PfEA89RQg+OB ziE{9R`=|Q_las+KFFS8~73<9?Y(}~iwp&p%L^|1XQ7(~t`R%AapFJ>*jR(F}f^rzF zb=Yo{bR30IC8}o6$p(xE=P&`3(YRg4@4Rtk=CzyC=s6!PmE$g(0&99tQhU&)-~Y4) z zued;Vp%mUTe}D>ApGW<5cXy%Y?oQr8^zrYGKcoJ4X#b46Kglm)fRVS9;`bo=P2gw= zcUFQAf@g*Q7KLrYh$;yWCzp?#8 zr8b58`Fg)@c*MP`o@qMbzi1LIw`{%Nj-N2AS&)&$IBQr(%8SrbICXvx0vaKAp(Ba$ zw~;S}?_c_R@%{Ksa!Tl?W+h<{;c;0YypD(BQ{S<$g;wve>k>XEMd@IFwQru1gHlH7# zXNsQ>pWh_sbD88*DL#|piz&X8;(q^pya%cFM=8FR;*V2&GsU-4d^g1h68p>QaAxGx zNtKJErC8;fQ6+bI`f83uKBL@yi>uy#>f|bwJJnE^N=a?`@9*uuhpk(D ze}4RZCBy9Z_xyLLbc??&@h8NQl=nPbC07;7V?+W#-{Trz^B{%N9`{ed +#include +#include + +/* BPF ringbuf map */ +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024 /* 256 KB */); +} events SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 10240); + __type(key, pid_t); + __type(value, struct event); +} tmp_map SEC(".maps"); + +SEC("fentry/do_sys_openat2") +int BPF_PROG(fentry__do_sys_openat2, int dfd, const char *filename, struct open_how *how) { + struct event e = {0} ; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + e.pid = bpf_get_current_pid_tgid() >> 32; + + bpf_core_read_user_str(&e.filename, sizeof(e.filename), filename); + + + bpf_map_update_elem(&tmp_map, &tid, &e, BPF_NOEXIST); + + return 0; +} + +SEC("fexit/do_sys_openat2") +int BPF_PROG(fexit__do_sys_openat2, int dfd, const char *filename, struct open_how *how, long ret) { + struct event *e; + + pid_t tid = (pid_t)bpf_get_current_pid_tgid(); + + struct event *tmp; + tmp = bpf_map_lookup_elem(&tmp_map, &tid); + if (!tmp) { + return 0; + } + + e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); + if (!e) { + return 0; + } + + e->ret = ret; + e->pid = tmp->pid; + + __builtin_memcpy(&e->filename, tmp->filename, sizeof(e->filename)); + + bpf_ringbuf_submit(e, 0); + + bpf_map_delete_elem(&tmp_map, &tid); + + return 0; +} + +char _license[] SEC("license") = "GPL"; diff --git a/32-fentry-hello/main.go b/32-fentry-hello/main.go new file mode 100644 index 0000000..9272b69 --- /dev/null +++ b/32-fentry-hello/main.go @@ -0,0 +1,91 @@ +package main + +import ( + "bytes" + "encoding/binary" + "fmt" + "log" + + bpf "github.com/aquasecurity/libbpfgo" + "golang.org/x/sys/unix" +) + +type Event struct { + Pid uint64 + Ret int64 + FileName [256]byte +} + +func goString(s []byte) string { + return string(bytes.Split(s, []byte("\x00"))[0]) +} + +func resizeMap(module *bpf.Module, name string, size uint32) error { + m, err := module.GetMap(name) + if err != nil { + return err + } + + if err = m.Resize(size); err != nil { + return err + } + + if actual := m.GetMaxEntries(); actual != size { + return fmt.Errorf("map resize failed, expected %v, actual %v", size, actual) + } + + return nil +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + if err := resizeMap(bpfModule, "events", 8192); err != nil { + panic(err) + } + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog1, err := bpfModule.GetProgram("fentry__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog1.AttachGeneric(); err != nil { + panic(err) + } + prog2, err := bpfModule.GetProgram("fexit__do_sys_openat2") + if err != nil { + panic(err) + } + if _, err := prog2.AttachGeneric(); err != nil { + panic(err) + } + + eventsChannel := make(chan []byte) + pb, err := bpfModule.InitRingBuf("events", eventsChannel) + if err != nil { + panic(err) + } + + pb.Start() + defer func() { + pb.Stop() + pb.Close() + }() + + for { + select { + case data := <-eventsChannel: + var event Event + if err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event); err != nil { + log.Printf("parse event: %s", err) + continue + } + log.Printf("pid %d, file: %s, ret: %d", event.Pid, unix.ByteSliceToString(event.FileName[:]), event.Ret) + } + } +} diff --git a/README.rst b/README.rst index 3e7bb4b..5e305e3 100644 --- a/README.rst +++ b/README.rst @@ -161,11 +161,11 @@ Program Types + + +----------------------------------+-----------------------+ | | | ``fmod_ret.s+`` | | + +----------------------------------------+----------------------------------+-----------------------+ -| | ``BPF_TRACE_FENTRY`` | ``fentry+`` | | +| | ``BPF_TRACE_FENTRY`` | ``fentry+`` |`32`_ | + + +----------------------------------+-----------------------+ | | | ``fentry.s+`` | | + +----------------------------------------+----------------------------------+-----------------------+ -| | ``BPF_TRACE_FEXIT`` | ``fexit+`` | | +| | ``BPF_TRACE_FEXIT`` | ``fexit+`` |`32`_ | + + +----------------------------------+-----------------------+ | | | ``fexit.s+`` | | + +----------------------------------------+----------------------------------+-----------------------+ @@ -209,5 +209,6 @@ Program Types .. _29: 29-kprobe-hello-with-macro .. _30: 30-ksyscall-hello .. _31: 31-ksyscall-hello-with-macro +.. _32: 32-fentry-hello From c296efdfcd8bc148171b0d34aec19e82b71b6ed4 Mon Sep 17 00:00:00 2001 From: mozillazg Date: Fri, 1 Dec 2023 03:54:56 +0000 Subject: [PATCH 19/20] 33: add 33-xdp-hello --- 33-xdp-hello/Makefile | 1 + 33-xdp-hello/README.md | 21 +++++ 33-xdp-hello/cilium-ebpf/Makefile | 1 + 33-xdp-hello/cilium-ebpf/README.md | 21 +++++ 33-xdp-hello/cilium-ebpf/bpf_bpfeb.go | 119 ++++++++++++++++++++++++++ 33-xdp-hello/cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 4032 bytes 33-xdp-hello/cilium-ebpf/bpf_bpfel.go | 119 ++++++++++++++++++++++++++ 33-xdp-hello/cilium-ebpf/bpf_bpfel.o | Bin 0 -> 4032 bytes 33-xdp-hello/cilium-ebpf/main.go | 96 +++++++++++++++++++++ 33-xdp-hello/main.bpf.c | 54 ++++++++++++ 33-xdp-hello/main.go | 76 ++++++++++++++++ 11 files changed, 508 insertions(+) create mode 120000 33-xdp-hello/Makefile create mode 100644 33-xdp-hello/README.md create mode 120000 33-xdp-hello/cilium-ebpf/Makefile create mode 100644 33-xdp-hello/cilium-ebpf/README.md create mode 100644 33-xdp-hello/cilium-ebpf/bpf_bpfeb.go create mode 100644 33-xdp-hello/cilium-ebpf/bpf_bpfeb.o create mode 100644 33-xdp-hello/cilium-ebpf/bpf_bpfel.go create mode 100644 33-xdp-hello/cilium-ebpf/bpf_bpfel.o create mode 100644 33-xdp-hello/cilium-ebpf/main.go create mode 100644 33-xdp-hello/main.bpf.c create mode 100644 33-xdp-hello/main.go diff --git a/33-xdp-hello/Makefile b/33-xdp-hello/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/33-xdp-hello/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/33-xdp-hello/README.md b/33-xdp-hello/README.md new file mode 100644 index 0000000..ca081ef --- /dev/null +++ b/33-xdp-hello/README.md @@ -0,0 +1,21 @@ + + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run + +$ printf 'HTTP/1.1 200 OK\nContent-Length: 0\n\n' |nc -l 9090 & + +$ curl http://127.0.0.1:9090 + +``` diff --git a/33-xdp-hello/cilium-ebpf/Makefile b/33-xdp-hello/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/33-xdp-hello/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/33-xdp-hello/cilium-ebpf/README.md b/33-xdp-hello/cilium-ebpf/README.md new file mode 100644 index 0000000..ca081ef --- /dev/null +++ b/33-xdp-hello/cilium-ebpf/README.md @@ -0,0 +1,21 @@ + + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run + +$ printf 'HTTP/1.1 200 OK\nContent-Length: 0\n\n' |nc -l 9090 & + +$ curl http://127.0.0.1:9090 + +``` diff --git a/33-xdp-hello/cilium-ebpf/bpf_bpfeb.go b/33-xdp-hello/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..4ff97b8 --- /dev/null +++ b/33-xdp-hello/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,119 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + HandleXdp *ebpf.ProgramSpec `ebpf:"handle_xdp"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { + Events *ebpf.MapSpec `ebpf:"events"` +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { + Events *ebpf.Map `ebpf:"events"` +} + +func (m *bpfMaps) Close() error { + return _BpfClose( + m.Events, + ) +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + HandleXdp *ebpf.Program `ebpf:"handle_xdp"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.HandleXdp, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/33-xdp-hello/cilium-ebpf/bpf_bpfeb.o b/33-xdp-hello/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..43d505b9ecb20fe151e34e2feeb37062d1666986 GIT binary patch literal 4032 zcmb_fON6c#4BU}54yO-x|n!sV=7xghS0F)=RGg$bVX>b;(tLc+$I+;`8t@4ox) zeZT5{V`%u9d_E^V%E@2ADMPOZpl@1h71J(}Ty4F~qgGp^ZE|HWkqawYJ~*&P?jriS zs`W)z@>Gsf zRI8N8bx>jzIbiy)JeOFQ54!)RUz$u_@^)fe{dFSqAEllC13z0GmR~RGWm=VV7cPrv zexJH2vjCVgi#ZQcv5!VWbmRJw=UYEu1*Va%jK3Oey5)X@E0B*FJPo-)FC^j^o6X@i z=vxtM0VHEpz>C17AuzE5?>D#t`J%z2kS&9!A&(n;3GyrhgBF9&Wpl@-(Zu>b1}_AE z(wEqQ`$?%^{7 z+dW`SD9rfeeuUxf#G3obU=Oy(Fo7!~1}=^%XhEO$XfzhHK$1Zm6~-XPyw}zVL3! zexK=|C!QaR!q}=R9ZJt^Ze3Sr&+3t0!;>9Lp{z+n1tG?`V&jBza9AF zMMN6dWqY?HN;xy?<|DRiPp_%^ZAh=Ks$LUCDwW`7ii-FmFN4y;ABOWApf>UGgZ z@mg(}bi>FCe2Iey96N2-7q21Bur}@l&8Eb0TRLG72lb#W^_E*diaqIWnO%{3s}{mE z=C0q&9<;s1idsR)EsVMoFxMK5Fp`J@+rpNku(;)IPw8UP39H9VIXiXUsA_0rud{b} zX#Z^CiO0Y$o1R*;Q|+r(4;~mf;Ee34qE5ALo$`ZN#r2MWu@Djk-LURT!;NBz++$L! zA9W~kB-TrV72{Y)bi$Vq9-XK~59x;E;$m3+cqqqlPJ-h!Ih{D{Z3E(S{jr}2%~Ws- zoK_t8QUBKR)^f3ElcAL-iybS``)A{a}js6>+z%{^?M9<^hnc`c!H>K0RW%SQQF5o-Cca8D#)Y;GX zl={yi-#iRFo#+KTT~|5(g_Mr(qpl79Jt77d){1=3@B56=@n+9(4VHshJKsbS>%FW| zf~o&u^nOTwo_{fV3z9ile`CH;;QdWK!M*+lkhL=}OGPY%wOiXYfR$K4){rL7KM4DR zv=P|WgW5GV`(60V=%&B$9dyRD{#Yk{HmqLB=+%rqn$bHMeLAC`&*+yjI`d_&cK)jw zeI}z{%jmz))pgmac={fsb(Qhokkcsn1iX-JYCq^yBM|r>-_$+qgC+rRc&K+hva_MDlpef-@= z!f%v0q!-j!h^?MIf0a3-W)-`yw3NZO8h?$BDdK&!v<8501gWCiUbFa;fy*KLz_w01 zo_7A0vGd!0m`FK=hQ#}oCOe+CJ>Z*--(m)(>!r#16FV85HbXg{L(sy*iR`uMc(1^E zv--a@BNQa-=l=+j&7bx2y-erBenYqMHzz1}Dv`Z5JwIdKZ2p;KM6LqK`K@1i{!PL4 nVZH9taF|Pd%#W1WmpS9(E6h1Ajv;w7oKSdM02xte}>F_K68NnjN1{x?v6!SWrdDD3^eKWlGrauU= zQ6y?uV8jF#3JVflupn`PCMK|O;gXdr7lfTLCdP%jFv0J;@80(H@#DgioOi$PoOACz z_jm5R*FUhQxv5F4G|68w%dAyodf_b2YnYcsh%78?(X6mE_TN|)m-AtM4zPE_g2B@$*Fhm2Y{$j|Hn-uk z1&X=VZRLTv4wQZ;y}4?T3MeG?|PA2 zh{}q1#0mxI&^Ck?J($xa&V0Z$wJ4)AG%j{$#Va25Eh!DGPZ4EBM~8(agv0L;AVP`f_U zz?Y2u9B@OQ5V30#&x$@0@p-W4=0qIV@f7MX=mT(+TvmObu;dx~IAMR9MhM#w&yU1$ zUOss6<6x+}-rDJS$!xH4X-HryDxouS0V3*Qg%Q#SM#V+7;zS@5*eA6Knw)wR%q#=i=lo+m(KJ)RE^sPQ%@4b` zGLjy?uXtr685Q8%_&k9s~n89hq3V0n+-DcYMsC#SH&T+OOibp6nk>{y{5ie)&G z{9RQ%n-JdD)PJCzIM@Ryd4GNl<$0&@X~O%2Hhu6>UW49*W{$@3dw}a;l{|){XxCHZtFXtULDY7@g+rbf{>wg9R(hKpu#`ehD!4abUcfePDi?@{F z9k`RaZi*m8`^gu8a~!O1g_zm{f9ntUO))&=od(hg&N})&L)iws3Z)QJ{~&>ML;0fm z#Y|oWxC?6I0Us#y_##P3N%MI+r=%+bvNREY+c>$FOYCb0n0-@rL6^+j*t28dxG7AR zUGP993Jd@!and^pAHDL$Rz=TiJ~irai`e>YS9TPc1!#eYw6 zJqXxrdprXa%TRWZ!~eVaoa|P5y^&AW4bhL%D}E&IcH;>%K!SlhT8Y;O1$|N#?9h=GDpmC zXKdtDypQKdeh!-@ocE;UKps~Ab}|^4XE7-&K={_nCyl_D`LKp`#)ZD)I8IyN+WD4Y z|LHlf`@)_t)67hL%XdGZ{$@4`Nsrf)0{rW#|0#Bx#>HgW~{rbOU`p=vC?4NPz{x`rjZ{RMTwK5HzkxsM!((95+ YM-HI|eirVLPSgK6<6*tz`rCE=7gOllNB{r; literal 0 HcmV?d00001 diff --git a/33-xdp-hello/cilium-ebpf/main.go b/33-xdp-hello/cilium-ebpf/main.go new file mode 100644 index 0000000..0f0b57b --- /dev/null +++ b/33-xdp-hello/cilium-ebpf/main.go @@ -0,0 +1,96 @@ +package main + +import ( + "context" + "errors" + "log" + "net" + "os/signal" + "syscall" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/perf" + "github.com/cilium/ebpf/rlimit" + "github.com/google/gopacket" + "github.com/google/gopacket/layers" +) + +// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS bpf ../main.bpf.c -- -I../ -I../output + +func parseEvent(data []byte) { + // Decode a packet + packet := gopacket.NewPacket(data, layers.LayerTypeEthernet, gopacket.Default) + // Get the TCP layer from this packet + if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil { + log.Println("This is a TCP packet!") + // Get actual TCP data from this layer + tcp, _ := tcpLayer.(*layers.TCP) + log.Printf("From src port %d to dst port %d", tcp.SrcPort, tcp.DstPort) + } +} + +func main() { + if err := rlimit.RemoveMemlock(); err != nil { + log.Fatal(err) + } + + objs := bpfObjects{} + if err := loadBpfObjects(&objs, nil); err != nil { + log.Fatal(err) + } + defer objs.Close() + + xdpIface := "lo" + devID, err := net.InterfaceByName(xdpIface) + if err != nil { + log.Println(err) + return + } + + l, err := link.AttachXDP(link.XDPOptions{ + Program: objs.HandleXdp, + Interface: devID.Index, + }) + if err != nil { + log.Fatalf("could not attach XDP program: %s", err) + } + defer l.Close() + + reader, err := perf.NewReader(objs.Events, 4096) + if err != nil { + log.Println(err) + return + } + defer reader.Close() + + ctx, stop := signal.NotifyContext( + context.Background(), syscall.SIGINT, syscall.SIGTERM, + ) + defer stop() + + log.Println("...") +loop: + for { + select { + case <-ctx.Done(): + break loop + default: + } + record, err := reader.Read() + if err != nil { + if errors.Is(err, perf.ErrClosed) { + log.Println("Received signal, exiting...") + return + } + log.Printf("reading from reader: %s", err) + continue + } + if record.LostSamples > 0 { + log.Printf("lost %d events", record.LostSamples) + continue + } + parseEvent(record.RawSample) + } + log.Println("bye bye") +} diff --git a/33-xdp-hello/main.bpf.c b/33-xdp-hello/main.bpf.c new file mode 100644 index 0000000..95d4171 --- /dev/null +++ b/33-xdp-hello/main.bpf.c @@ -0,0 +1,54 @@ +#include "vmlinux.h" + +#include +#include +#include +#include + +#define ETH_P_IP 0x0800 /* Internet Protocol packet */ // ipv4 +#define ETH_HLEN 14 /* Total octets in header. */ + + +struct event_t { +}; + +struct { + __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); + __uint(key_size, sizeof(u32)); + __uint(value_size, sizeof(u32)); +} events SEC(".maps"); + +SEC("xdp") +int handle_xdp(struct xdp_md *ctx) { + void *data_end = (void *)(long)ctx->data_end; + void *data = (void *)(long)ctx->data; + + struct iphdr *ip_hdr = data + ETH_HLEN; + if ((void *)ip_hdr + sizeof(struct iphdr) > data_end) { + return XDP_PASS; + } + if (ip_hdr->protocol != IPPROTO_TCP) { // not tcp + return XDP_PASS; + } + + struct tcphdr *tcp_hdr = (void *)ip_hdr + sizeof(struct iphdr); + if ((void *)tcp_hdr + sizeof(struct tcphdr) > data_end) { + return XDP_PASS; + } + if (tcp_hdr->dest != bpf_htons(9090)) // not 9090 port + return XDP_PASS; + // if (tcp_hdr->psh == 0) // no payload + // return XDP_PASS; + + struct event_t event = {}; + + u64 flags = BPF_F_CURRENT_CPU; + u64 save_size = (u64)(data_end - data); + // save_size = min(save_size, 1024); + flags |= save_size << 32; + bpf_perf_event_output(ctx, &events, flags, &event, sizeof(event)); + + return XDP_PASS; +} + +char _license[] SEC("license") = "GPL"; diff --git a/33-xdp-hello/main.go b/33-xdp-hello/main.go new file mode 100644 index 0000000..0d87e33 --- /dev/null +++ b/33-xdp-hello/main.go @@ -0,0 +1,76 @@ +package main + +import ( + "context" + "log" + "os/signal" + "syscall" + + bpf "github.com/aquasecurity/libbpfgo" + "github.com/google/gopacket" + "github.com/google/gopacket/layers" +) + +func parseEvent(data []byte) { + // Decode a packet + packet := gopacket.NewPacket(data, layers.LayerTypeEthernet, gopacket.Default) + // Get the TCP layer from this packet + if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil { + log.Println("This is a TCP packet!") + // Get actual TCP data from this layer + tcp, _ := tcpLayer.(*layers.TCP) + log.Printf("From src port %d to dst port %d", tcp.SrcPort, tcp.DstPort) + } +} + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + + xdpProg, err := bpfModule.GetProgram("handle_xdp") + if xdpProg == nil { + log.Fatal(err) + } + link, err := xdpProg.AttachXDP("lo") + if err != nil { + log.Fatal(err) + } + defer link.Destroy() + + eventsChannel := make(chan []byte) + lostChannel := make(chan uint64) + pb, err := bpfModule.InitPerfBuf("events", eventsChannel, lostChannel, 1024) + if err != nil { + return + } + ctx, stop := signal.NotifyContext( + context.Background(), syscall.SIGINT, syscall.SIGTERM, + ) + pb.Start() + defer func() { + pb.Stop() + pb.Close() + stop() + }() + + log.Println("...") +loop: + for { + select { + case data := <-eventsChannel: + parseEvent(data) + case n := <-lostChannel: + log.Printf("lost %d events", n) + case <-ctx.Done(): + break loop + } + } + log.Println("bye bye~") +} From af1a344ab6098633cf2681f619f46cfc064b400e Mon Sep 17 00:00:00 2001 From: mozillazg Date: Fri, 1 Dec 2023 03:56:35 +0000 Subject: [PATCH 20/20] 34: add 34-iter-task-hello --- 34-iter-task-hello/Makefile | 1 + 34-iter-task-hello/README.md | 15 +++ 34-iter-task-hello/cilium-ebpf/Makefile | 1 + 34-iter-task-hello/cilium-ebpf/README.md | 15 +++ 34-iter-task-hello/cilium-ebpf/bpf_bpfeb.go | 115 ++++++++++++++++++++ 34-iter-task-hello/cilium-ebpf/bpf_bpfeb.o | Bin 0 -> 29688 bytes 34-iter-task-hello/cilium-ebpf/bpf_bpfel.go | 115 ++++++++++++++++++++ 34-iter-task-hello/cilium-ebpf/bpf_bpfel.o | Bin 0 -> 29688 bytes 34-iter-task-hello/cilium-ebpf/main.go | 61 +++++++++++ 34-iter-task-hello/common.h | 5 + 34-iter-task-hello/main.bpf.c | 22 ++++ 34-iter-task-hello/main.go | 40 +++++++ README.rst | 9 +- 13 files changed, 396 insertions(+), 3 deletions(-) create mode 120000 34-iter-task-hello/Makefile create mode 100644 34-iter-task-hello/README.md create mode 120000 34-iter-task-hello/cilium-ebpf/Makefile create mode 100644 34-iter-task-hello/cilium-ebpf/README.md create mode 100644 34-iter-task-hello/cilium-ebpf/bpf_bpfeb.go create mode 100644 34-iter-task-hello/cilium-ebpf/bpf_bpfeb.o create mode 100644 34-iter-task-hello/cilium-ebpf/bpf_bpfel.go create mode 100644 34-iter-task-hello/cilium-ebpf/bpf_bpfel.o create mode 100644 34-iter-task-hello/cilium-ebpf/main.go create mode 100644 34-iter-task-hello/common.h create mode 100644 34-iter-task-hello/main.bpf.c create mode 100644 34-iter-task-hello/main.go diff --git a/34-iter-task-hello/Makefile b/34-iter-task-hello/Makefile new file mode 120000 index 0000000..d981720 --- /dev/null +++ b/34-iter-task-hello/Makefile @@ -0,0 +1 @@ +../common/Makefile \ No newline at end of file diff --git a/34-iter-task-hello/README.md b/34-iter-task-hello/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/34-iter-task-hello/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/34-iter-task-hello/cilium-ebpf/Makefile b/34-iter-task-hello/cilium-ebpf/Makefile new file mode 120000 index 0000000..97ab7f0 --- /dev/null +++ b/34-iter-task-hello/cilium-ebpf/Makefile @@ -0,0 +1 @@ +../../common/cilium-ebpf.Makefile \ No newline at end of file diff --git a/34-iter-task-hello/cilium-ebpf/README.md b/34-iter-task-hello/cilium-ebpf/README.md new file mode 100644 index 0000000..1adac9e --- /dev/null +++ b/34-iter-task-hello/cilium-ebpf/README.md @@ -0,0 +1,15 @@ + + +## Usage + +build: + +``` +$ make +``` + +run: + +``` +$ make run +``` diff --git a/34-iter-task-hello/cilium-ebpf/bpf_bpfeb.go b/34-iter-task-hello/cilium-ebpf/bpf_bpfeb.go new file mode 100644 index 0000000..4f6e951 --- /dev/null +++ b/34-iter-task-hello/cilium-ebpf/bpf_bpfeb.go @@ -0,0 +1,115 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build arm64be || armbe || mips || mips64 || mips64p32 || ppc64 || s390 || s390x || sparc || sparc64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + IterTask *ebpf.ProgramSpec `ebpf:"iter__task"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { +} + +func (m *bpfMaps) Close() error { + return _BpfClose() +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + IterTask *ebpf.Program `ebpf:"iter__task"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.IterTask, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfeb.o +var _BpfBytes []byte diff --git a/34-iter-task-hello/cilium-ebpf/bpf_bpfeb.o b/34-iter-task-hello/cilium-ebpf/bpf_bpfeb.o new file mode 100644 index 0000000000000000000000000000000000000000..2e40e4df474631f5651c054ec6cac686cc4a3017 GIT binary patch literal 29688 zcmcJYdAuA|nfFiMY$RlZ>=`6=!h9l0jv3a2fYyW&*y5Gos_Dqc}S9et*w7)m;htdH;FeW2(;g zJoVIBpR-n9e9hKvXAKPGT+ij)Z{Uoe_XKEu%0f}N&v3bY%iLiK&C9#_^7kE~d*6R( zgF=UY>NA_=J2z{K_xEj@`W;d6gsF-A5z}+|F9iR(d!PHU@Y8{3!9NZ8kSJ0XZglP!&aD~34AR~ zJgS=9&4KgqZGj{Bj=+QPU4dixgMs(MpM*(wLIOVmFZWHG`!c-JH(~B;@Oocexo^N5 z=m|0Us&~pfU;G42J{LsrPhsL*Ao>5m$QC5zTlKx!H|4;hz&sns!!L7A<}jc-+-liy z1E<2ovphn+CGa4u-a^@z$M7rQv*83T!8}`mH*gKNbKwZS4yKK^h;M6ZoIt3y>dxpMq%{vg!t&<+c`%sJp4~MQ{So_42J^6=&j>8}Iq)vz2~2!$*oxyOsEp+8y#2^4ffHEvAo&4UWrSr$6W+v)wm3h6 zDVyr>{1|?>IOopa539W5yWuYez6btp;Ctbp2TrhwiGe>0s~z?3Be3-am^z!dHpm}^ zPY(P!SnVbK&%-L0_zUn=fggjf4*U;r7bgGP@Fw2CZ4{1Rm1UoE+a3H;YE`J?&VMDlGM!zw%aJ0zDqqq8G|HFk&-_!*e`y-4!kz^{g5Mw%Rq z&c$NY2~6|3Nox1kz>=?m@pmQg37#*(o3w=+HhD<|EAbg{3||^Jfv@l^(WD`6uXXOy z2v)mO-peEpb#WOyB~1A2TlAt~8HaLb8=iL8-@h5*7{;+dpyvg6@ zhJHB@KLLLfj^KZT{|Zjv|AuL!3Or@1=V81l^SP16a0D-dZ-58kW8qK1F}wkO3!K2G z!;@KgM6l}TZ{Qfd1SSt7349eyyrXzic5{0ej^GabX*h=W!G8-U@J;aFIakG-Lfg8} zz!7{eoWLLhO8f+LtZFx~+#g(=sbL3kZZ{Ci?pZ7SXmqh~q^T!N|dy?9f{xe?di2!3tg7``)b z0zU{-HZ|>3?80G}`(pTW@OR(@{u)f2*Wyk6A-C_s5&W!|UxznsI=AmJ^dX;i1WbKi z7sHET-n}k?mH+QMcRilDf2PYv$Ttz9?cbfiXTbmJ+`jyl6UV);Ex490Ar8tNgGDoG;GApf+OTVfEU3r{O^JH z!+(HD>%9r<{E40syTj*lqh9t$@G|&+!!dj!OuGB`!!Ltrul)&pC5-;vc!yuj?I}2d z_rX7cWB4^N`gbSrErAcf?}eYXVa*->0hsvj!8`oZ+~^zkL@@U2ehkO(Kf}*3^d+!t zZ-EVc?(qMHdH23N%U<47-@h+{sRQ>@IEI(NKZ6r^1&q%7@TMQfZ6+MSr^3|v`(pS^ z$#d>~34C7Q&%!SkpW)v32s{d7Z};O(?{Fgz_s8(7;s1aW`0X${@5h_2O8U7CzpSgN z^a+F)vQ~T{K5Zd4{Q+*`2>t{VY~8usjq0vzo%{mX%=>m&pIe&Gi$iAe$S(`L48Bqs z#wj}T*DL=Du?j(v-ilt0$gvM;&ycOE9Jm>3yVYDVd=vg!bRw?XVDgbmkgH9x6D2X@ zJ%JJVo;*A_sli;vMb!o)3_-d!J7le_*No3%0Kfw-c~8_oP|$Uk*G^NYxX4bA*|;5_p0pfiQ=23U1&<$(Va zR$ayLZv!Wo3vrnZ;F&!v!_OmE9>v5nOXCdoE}QAq$$I4Z8@)XqAWroQ>R4_T?^rz~ z@adja##v_vj^K*|$M9u=6PWsS8+|IXuJ-bQh_p4HP~L$UowhjV2KK{*jqirv9GH5Y zB^#E`z3>C@iM*S@AN4#@%;jE+?cvY*yea~>2~NkM6X35Z=eWc0Bf{UKex)jY68|JF z+^na$olHK(zv6a^udi9MZ|WcyQ&j`-i{S)T9OB1d`mFI+Va9*s@4&Kky^{}Vh5DVX zv4^x|PqR-6`KHdiGTy0T3{ja;zmR(ox-XsVRfu->g z;7(xr&g^~ml7H94$|z24AL7cr1HGGW^y8}1d>fDE9WDho`<-GsGQrt*i;0gpYxVSue+QLOLvp*5iCQg?p{0{&&D(UR+aSQ!%_EUi)!?J(rBpd@N+o7tC zP@3Whx#kLS46EM739Rx3`#fT^mk&h9w+D{l%L6BH(K97=N9+z9!5Wi^b3zQ?890F- z@~omAfjvlPVg!e>OpM{52YC{PKXfJ`I#PXB9KkCC$FOWg@&rD|GnU|vECr6>@xU?s z22xjL(ym9U&CcR77uxuG1p+I+FbC<3=E!&QlHB>a1s%!n_Hn9QM}C0YHa(Y9%><|M zX$x13&POPbUgw1){{~<6i#zhu+*D3;JXC~SlSlCBPjW~89XGM^|M|eP;jaW<2!A`| za|iqb6&9!Y2l0fdA>KUCoW#BkuNAd(t*FbBD?ha%jnK|m$$n@@< zWq}j?P)E7Fqz9cCO3yM$yK-_uAuKOMScqUa}i-DbJRv5pK~q@93e-~ zUBVT^R|QVsVR*G~<~cQ(cV*vmu7fZ3smysTd>I@ee=Cg6Kn$zzz5-6*yI}G=LHuF( zmEK(;c z+T0>HsnPax8~7pVx#O_{BeA;r*@qC*Z92aa~AS1Jyjn6w04}E;9tXqoBJ5IHdmfY zuEP~EPaKc0IAe4kKMcUN;B@RjH22@hu*yihbDuR0zbqs1c`_SIo_dgv{yf^u4ju63 zE#js&Gw1V}yIg_5Y9B?c&XPxe75-i>+`M(%l%)t(KE;DDYYl7D7~UK>!B69SBl7d4 zjJp=z5!k$t?v2O`q^ls~rmdCFvNzm3t;t@+6)EiX{rsRx2u}Il!bKFRPOjW%<#o~! z5A_Odk)D}KBRw-!{PScZH*m#pH{|nm@Qu8y#>Jbb`RPV3+`K!3&g25GVCBU+phD#LbugX08aHi;n7n_~)<0e+w6G{tLsq zsr;58mu;-!iliUjCI7Z|m)x8(8QjhITeuKS`Xu^#bSm$jjejc_ZvHlIw{yktPJGIe z6JOEKgV~ST2{&K%^LDO?OO+~TaRt6j0t%^erH*&!ZzDebsUOUzZ)<*#o8RSj16KsU z2LByggYfI{*K)=1Exef8i`t~u<{?eZXXzMU5qo)#abW(vAtO0_Yim_PaChKu;i8^< z@9g892SR%2&;KZo-lOMoAzsQm|KXs+yYnCAk@9LT=-3z=Sap`Z%lOk{`frb|-hw{$ zJ3l=?xnDY&{Cu0>`z4dhl;uc*DhtJ&|9$iom2B@v_#tn0M*lv-G4h{SWjOai_!ogc z#PQWYV8xf_nYF@#IYIsr$wPkdtPlRBWaumoIuFA6z}VB|Cs0&YsjCGW@x!A9C&OyX zJaXmzV_Xqen(m(=*Pfq$rZb4IK8#zSxlVbE;AY?$rp@icQi31iakTS-I3)T>_{~H} zJz2a`dq_7qI%<$FP@j063EhG_gFaDMU-)Y;@5TQqg+tp}Uk!XkMsDknAb(Rv&U&l& z?ll=M_Sro`p6~bh&oR#}c!>N=;W>SIf%=2S6x@QZauY}Jw*trT4+1Cflb%(~1wRcO z!M_b0V>WiEK=^Z9XpBi=p!gmhJ(sVPn}`I6}S@Up&Ya%9VRnhHuZX+9=f-=iOyw zR?hlRNcUz50>6{vn)j*{-Ys4OE4Y?-H{oCJ<+g5C-NoT7Og5WPce1THzS+_^-M=GK z1Bd2O$o)h&pQgT(q@24m!`jQH`5GksQ^|TIOG0Tnwx_E(gxTwZI$T4$Ql`2$ubbWB3OA)3_4&7B3$V-{DziwD`Wj5&S^l z7=AEt0zXU~FY;Bp_;X%9F+whT=A3L|41YK9YvE^L>UH9Nm@y%Dx^;86_`fJSRjWE# zlEXiS3%7)Dx-MNZQ;Z-_H9aPtXzgj|EXVK?ZMH=AbPVlr9K2AB{CIeA(5Ft8EDQ1z z;Z=c8g4YB-89p{JOmK3O4X7^f!{P^C;t|;1~0JEf;RdIo!lC ze2Hgr=f88TrY6OCrExfe3-BQCHn*Ck!zfhJmUHy z{7d|pv9}3-4NlPcB+R%s3D3@Z{|kK>2L%;4r9kM z&86SqHV>Bkhk*y-p9hY^=Q-)@hi4-v{)Gw5n30=hS#n3oR>|uk$xnvSUmU?(VDh|p z5WWz7Dr9jCUjb9tCDLi2L!3(_=aQW)Nnpm(9Pungl+KAuBjj&KPN9}c=N&wxT{V0i z^)BQT>L}^l1=D_t?(>TJ%t->u}V6#Xhaz&UGeBVzis_J{>k|NgTD>` z5BMeg=kWKUhdY|GXJ>&RE4;P(f<1Wp293R|5}uFK$m4)V+4rvtwn#!f9iuV6aB9*kcJ zYrs&QTmdf)d?max@Kx~oz?37O*2y3o1$hysE-aoQn0yv+6AcF4>9K#=jd3PYe<8s*Uzyais!st)H z%YTy_Iuj!JhZ4Ypc)xO1Yfg&GJ~BjTZ4~WZrMrP0{3(# zB0m#3@yIP>Y)RR4cy93w;-~S9X1J5#xX%Z@`^LU}*`H0FObJj!R9mhxjSDgzN~@bBTD$YqWQC7+G{4ft!l)bs~}{AT>Lyl)R2 z;VU!J;hp90BpTH@Zuz^pDV_wr4;}s~&&waeSN-6Ye}a;rT4$+fID4chb+E;q}fiVst7zmmTfr zO5@fXlQMnz&~&tx={Vu%tqAA#IV(@dpXLzhX8NO#mm(eIU(9L!mF9yn zb%oAw7x*HtxXZsTjTQGIlRZT6`{BH^x?1rdzVeYUTq;}3xCpM0O)4D0596=kih~_W zo*;kJ>nOJ?zJP2MIf>BuI0AGAV#c?31WwTTnr9Vf#rM%)P0=FwDR>PW!~YR<68Kr< z*Z?JRD@nu{os}A2iGPyhsv~ja{Cp~okrTJc6Zj<0lks|W^|}nd2A!7?n+k$yuDlGt zH}8<{a_PziTanHc1j8J(vJB__wQ_gh4d}G`aoYK9HqMpknY+=CpNbQ7GgT`1&0=04 zxbikJFb95*n2chtEAJOiVc`e=rFbHPKTLaRouJ>ft^9n@r#@Dy{%2DA)alCaiZSXJ z;HzAr>=SP#NIG&WpX4Uab7gdF|B~wbh(|pgMM8bOmUsUn#7UoAsj(uIeI@G%v)M?R zLEpyQz=e$b&oextbvSVzjtrZ%{=Qz%Y34JCQ*%j#ulYiKJf`@HQhhUl8P9U)Q!8#2 z#m-?9xd_hVpF&Qgv(C$9pQ}#bMm!T^nD~v8{urTFTD6@;KuH^U>VJ!fMM zq2OCy3FbCQBfNK9hDm#sz6&X{4^V%qvoJ5M8bwb2C12IV4{@&Q1dfpJ4IIPQ2TowZ z(ziO0{fi^yZwMU2HwRAOw|Z6%SG_H81m7MwhTj=Df$#Ke^(Q+e{s|HC{effn-oOd{ z`%%xTs#PBf9FeEch7)5<`;|eSpz{&WR`(y}EhR*Kulg+SoDAbueK~LhYYtRiW3IHG zYZ=A{dh#2@iZHle;&0(n=F)em@5TDwIGJfRW?nsuM`{b)s;9WAEh6~W1Hh#=TZu`HG zpVb<}#Ci0K_=+cjcL$E)YXc|nt6|Q}EN^cNOklOzU2?Lx`tHEw&usFgKL4v9phfsc zmfh-4P_78Tt=7D;Iq)O!d4azGZwvf5yd&_pDZADn)br{e;%i*Nt$v!DI1m3Ma0F|v zkbDqUdx>NCH-Y!VzYCne&ym)dgb%PpC!f-vFo>URcg3-VYc8LF45_-CP*-c{D=M$t8p_e*i^wE(tlt>?|F(xUSCJ0+m@r5lN`XgV^%u#T za5pgH>zdaDj^P^ulTTakpO1cm{7uMdYgM&x6v{>%Yi>g_0Z9bE7ujYWen?sK8L#gm>Y<2Y+NO^OM!xb#=x-++b7k8|y0XK`hsZTPNp6nJq%O!+?S5f` zcZayIle>tZ-kru$;`Et%=yE&FGPDEGQ7LbYxidOwHdxG!|(3%lzaO;{zwGm|F2mC@JU_#0GJJBM7eCzRDevm@vFB#^vJ7YH^Vq91@=RSF_PdPy zb$y>)8U9g*f6?cOxAuA6K!#`cd1159 z>+*e`vaiqUGWEIcq`rLG^ggdUtIxSd`n>Ma3|BJT&hYgaeshNJ$nXa;{P7HD>SSG} zPS#~?a^0_c`a{j(LbX$A6$+hVd$${_bc)WX)YOVcUs+2Coio+;B^Y*Uy>)re7h2dJY*|tZX3*}0wxUbM@yIQf`Dd?SwYgJ0TSLn7Y<$g?x zgP2>_xMr)`Q0kp(sbE}hw8n}x&#jL6t!ihVYnMh912MNLu4{E%x#miZR;5sHlq;S} zjmGY3;6|y`Z4zyx9$vMk8fi7UP1hxwv1XyAS~Ij9Q07*pGS=)6W2ZV?t+d*1$ZDaW z`fWC9)zUs!Z>bpVLa|nB?5UJh9qj^@Mde{#y^z6}nOb$EW%(#HEA?`$o~qZ5C7LwT~NaHLk7H)!K!z%2>HlEACT#FjicvSt{dL{BYS7 zJB=~S+PA1uDq_$>wFW({N$2g1s0XX#6-vc=k*-DKVfn=tue;!tMys_l0@tn%)no=f zKQ*(B&`Ha|4;?i0ZzaJ+v)5_nAoTVh0@iWHRo{hjqfVvK0G3{%!@DKYz@U}Bg*AXS z3VYD5VCZJ=kcQ-9JtNF!*-Y5Hjs4yB@} z%GA352-s z8VnJB=pCbonw5N`R4F*qR<%(qIdytpQN>cJQ_zS+FWkszMQD616Hp`WZ8FNzNqYl# zHedt1hHQEOa#}^>Xra|$aIg^`dAn8|I^==%rnW1M_yU(|*e^CYrdwmE%N%GGp@u1v z!HkHCq+2jH`I<^Yerz3Pz}rhB(c)u5=LPnHMot<~BTRvXMl&1s${7WVobrUJtEy?W zGOlTE*k(;X*0O*o7OTr zs>IeuMs5tq>A^nF<-(p(hHjOpCHrBdueXWAa?GH5khs)swN!7aFgj!}SgtfXqx7Tn z!LaWadfQj64>!hXiY|$4Yl zk@Z}nMvH|=P@%lOK9yi$l!33eJWza^Xc*mDPxy(rt2WpAv`b^NNMQ~+I8-Q(kGS1q z#U|$5qSw<_zIu9VBjteZh&lS+k_lTChB=fT&&2R;wG zX+7qPp$fH4_Ua|3lG?^HqZf;>!fy1#{M;M9&Gb?2blV3n=Uw-NOO$XcHcQ>A_ zjBxK|q&?bTUGCRjYHn)U)@<0NkH{}xEHN#`)GT`8(B40u4g(sl3eS6t3HH`w>Q3q( zrQx==6Jz@d^zClFZcExd70k2aWMRrjA%ufht&gXY){xI%p#b@n7fn}V@F(1|NPt>p zm}+4aT^MC{&@eh43Tr87&(m$P#$YY2G0c)A^ZooNzygU{2mJ8rr@QKq*H%2e+$&(( zJ)pz8O5HkE*;V$8VeEdr)6vpT)vcPgR#XmH^s_r-5m0W7sHz!;C1xaIWYhl3G&LuO zcv$m?c%ZZmKvwW&mXVBY%piVNfQI%cT&}R&^eJ1Zv%2Y6P?qApYNb}Di-2|QDz%pJ z`ynLh=mjd47Hf;J>F`0#m#mI#i>rHoXFJL;tQX9v3hl-)6K1nYhh)~Qvu|Ob8!GBu z+virXk_wA-7G7w|A1$_6iYp4MS8oSt6ub3+E)^0{KR1g#XXmbSFW9=Xu>HcFTQA;q z=FVL%m89YBsp=f3_WMSOgwl;C*%>d^*rp71*`;-~F7u`Jn@A=ID!WVsXYSm2=F1Bg zpZkifgw zZLl-rL8DbVC`JjjeC={5(Z@o2U%iwKhjlXYE>~czsd>&2MZfUD(f#gaq**of}WVGSv6^= z-{xj>D$TCbE(N{)1N2>mZEC=`!4SVSq#?82<=~`JDU1}GQnG^sn=jF$^$_{#m7@pk z;))s&NRZtor)<5T^cplKUUQ@|JZ$e_MkZ)!N9KtVGUoct-5wSaTDuoDMEgC4UiW7= zkaqXBz8K~(iCMonq8!lx9)d@eX(BzSEUM3R8rATFf}d1RJ`uE~ZU0b2>vJ{+ww)}t z*jZZchU+$P`SmUb>0RIGZ$viOxQjqai@51va>? zdZos>m_1iUcuTfZFx6eV7^Ajtb@I>Lb?&7`TQ0m{$Cr*xXy9NXSR+#N1sYr2iH z4OK*%K|0L9m6E)=d>tud681rF*xsbf5|ka+D(=CIt91oqO%7ehb=aAb~>fbQElx@LkAxn6l@BRtyab<(KR-I+v|SNx3H#qP9|*1 z$7g+{$yGs3{9_H8-U0^!K5C92L4f ztnn*>+18dSHBCKPsVp@NybO01ch*v$C)1Y2*Fp*^h;3?ENwFmAZOOw4O>?Z9Zi^UY z{J=_2U{+^i#t}5DlNuX*ox6sx--22T2E}04J;e}aYBOD%ae|C>O#i7C2by|@b-vBu zW`mL5z zsZr&v7Kgu_;9+wNn#1g+RFIM254Ua98S!2?&KlBu#tA`}vX)yXr>9)y)+w&k+N3>t zvrun2_VNvNJUSuf&xAk~Kus3tV_nv-qCLfyj)mExa}Gxjp+yV4=bF1)T{p}ZmU5-7 zEtXB)HAbAy1{*m2eWNQkSv9bq;Q@zc<17+fng8;KGQBBd)6QF_ua9sF?G4(SoM*qY z^A(UD0{K_`+~7I9;R6^(h>n$wKhP>tJ3b~(137ve>*@oLrg!FA_Vs*5uw}eImG*|` zPl9B=tV#UWl#D1{Np`$#6HCjfIT^gH-5CS3K^sNv!RQ_r&c5xW>7e+Z_aIHhKkyTT zXY0_7I?FphDQJU*U5&}4y`G^j3R8`LEPFMB$Fjs}2hxmkjTiLFz2wuv?wu z_z!@cW=JfYm1z;l;Kb=TbGata%s}J~YRA@{XBDe&!ZihdnRuAh%)AmXw)Hn%PnZ!yH()8KaptY@z!F`nIRme_(}B?pPf2fyd_qVY(DXY9>?gA9B(~0qZozO}3d#Wm+emfBy0H3zkzLvME9_UWP@G>f$zjOv0ljmqF( z3WD%GVkG3uZxH+tXR~%63$1cfR|PSx^MRB@^eSeqX`!BCNk-5_ zN9$tMoZUA1Y=$=UojbV%*ti?o3vJ}u;994-)~SxO!qQ$x zw`y0Jyqrz#lJWZ<7Sp83_Y-DrpBsLXV*;OBzb`c=IX;%!GNL%X_oR(%UVA&4;U;a( z+R^{$tB?k%oiSu-kfpM$jxA$&@J9k>037IQ)9W9b#D`^Qdx!az3!ks~TqB)+a4$au zVSC28jz$5<&vbx|bsV4Tvlt_RB4^pI>hnpkp`eet;l1YBd9}v^M(H~}!&*FY9bq;Sdv7v> zvk~zF0anXe`<2XLC|L;nY*YvRq>;Yfv`I zzMk!y-d@jsrSA6X(5f&r&JXD}Za9tmDW}=5={D~;t8nqwiwZk-p1Xb5S!>y!zc9ai zRr!jJUF|FC%U_t+y7ss;{AL!vTJDMZsP)9Lrz_r*_^;IUe;ByFfYFR`w4$?a4#V8~ zR>Q`xG~7EyF%#qvjvs{VF4*rNw7Bs7E&JWEw{X?5t&StpP+lgOt0vur=|ocXqFzdT5PoY4F1VXJgMMY0>UU%>d^ zgB*Nd5VO1uR+-tvZz8-nT`Adu#uSIT!~E#L zKkW_pVFECPkesoO99fX^{o2kgdy76oO?`~j0B>`!PGIS%I#XaB8cyUgKiKfCz|XgA z&&H}tR>297{pco4cmz3L?w{L*A9ZSVrF~6WdV>0`OsESxE3pH6pAid(HKz@DzL`~0 z7Zy~uHPa}QJ;%1A@^C8CYioodnehMnl@C7?=kGW4Hyrlg`rD6xJ=bAe$8qToF68vL zCirDa}jzlV1HD$0=NLdZzF#3gDDBznAZY^DsJVzJ)KRyeRww z3y~ooUaP+eksIXVc`q#4pLG1DKl8Kxo*MPilP5hX^-f__{;X48rF^Jd;??{y)S>Zz z75N26guh#mQgHk&fjQNsSoMZ`$;Y`V9O8M&Kf?N(hgAQCuyoUKbVzu|A>qM8!p%d% z@gd<`4+-x-B>dnZVdXEIAGK39{LCTY-ya;d|8KU8es1X@&wJ&aHF36Eugx7}d8M{~ z^RBbjEAad=zb`RO1^rLN*Vk%vGYwyK?99|a$Lkb_+b=7*^wO~!58ym>=m6Z!go zrQCznXm+PRA9AH*#ql zk&Eo!yERgp4NT`s%bC6}`7l?SzQ%%#v%h^;*!o%aL5B7BLFxNx{Nb_wn>psP<&_}S z7q<=xOBP%%?_u||L6Cac`05D%RQXjtxjdK3pN@gq@*j>on;(Ly8`F4*v%kCa=qV|GZprE2xd13iGRchYe( IO@HD40rKMMzW@LL literal 0 HcmV?d00001 diff --git a/34-iter-task-hello/cilium-ebpf/bpf_bpfel.go b/34-iter-task-hello/cilium-ebpf/bpf_bpfel.go new file mode 100644 index 0000000..d39666a --- /dev/null +++ b/34-iter-task-hello/cilium-ebpf/bpf_bpfel.go @@ -0,0 +1,115 @@ +// Code generated by bpf2go; DO NOT EDIT. +//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64 + +package main + +import ( + "bytes" + _ "embed" + "fmt" + "io" + + "github.com/cilium/ebpf" +) + +// loadBpf returns the embedded CollectionSpec for bpf. +func loadBpf() (*ebpf.CollectionSpec, error) { + reader := bytes.NewReader(_BpfBytes) + spec, err := ebpf.LoadCollectionSpecFromReader(reader) + if err != nil { + return nil, fmt.Errorf("can't load bpf: %w", err) + } + + return spec, err +} + +// loadBpfObjects loads bpf and converts it into a struct. +// +// The following types are suitable as obj argument: +// +// *bpfObjects +// *bpfPrograms +// *bpfMaps +// +// See ebpf.CollectionSpec.LoadAndAssign documentation for details. +func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error { + spec, err := loadBpf() + if err != nil { + return err + } + + return spec.LoadAndAssign(obj, opts) +} + +// bpfSpecs contains maps and programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfSpecs struct { + bpfProgramSpecs + bpfMapSpecs +} + +// bpfSpecs contains programs before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfProgramSpecs struct { + IterTask *ebpf.ProgramSpec `ebpf:"iter__task"` +} + +// bpfMapSpecs contains maps before they are loaded into the kernel. +// +// It can be passed ebpf.CollectionSpec.Assign. +type bpfMapSpecs struct { +} + +// bpfObjects contains all objects after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfObjects struct { + bpfPrograms + bpfMaps +} + +func (o *bpfObjects) Close() error { + return _BpfClose( + &o.bpfPrograms, + &o.bpfMaps, + ) +} + +// bpfMaps contains all maps after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfMaps struct { +} + +func (m *bpfMaps) Close() error { + return _BpfClose() +} + +// bpfPrograms contains all programs after they have been loaded into the kernel. +// +// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign. +type bpfPrograms struct { + IterTask *ebpf.Program `ebpf:"iter__task"` +} + +func (p *bpfPrograms) Close() error { + return _BpfClose( + p.IterTask, + ) +} + +func _BpfClose(closers ...io.Closer) error { + for _, closer := range closers { + if err := closer.Close(); err != nil { + return err + } + } + return nil +} + +// Do not access this directly. +// +//go:embed bpf_bpfel.o +var _BpfBytes []byte diff --git a/34-iter-task-hello/cilium-ebpf/bpf_bpfel.o b/34-iter-task-hello/cilium-ebpf/bpf_bpfel.o new file mode 100644 index 0000000000000000000000000000000000000000..dc6741f40784ee08bc76bccd1c4e3885b9b6d636 GIT binary patch literal 29688 zcmcJYcbsHZnfFf@GuW_X6C!GZgdq(xLl(sg!;F9k0}Me$s;jH2yNj-_Dk}8!2;vnn zi%W71YZ%3V`l_r6cX733O^XRvS4_JO@S^UT!y4AW`~5xVIn{R>-u>tOyvMn9zUR5m zJ@(hxr0S>ntv3%jGab)RudJ-YN5i?{A=QAqLa zJMrvah486^qI}O|{r;1`wTq~7%+TT)^d?Au-s3Bu@}mds{(TMhgzIXhxfEU-qi}F-7yaw)8lJJ~ zY-Df!@tEoB_Vz4Z;RvNHl=K?47x9X{qAc*LQQ&nU^Avh3)mqY{n8i?1*%Xq_qv4%R zGWsZ`{L$H6`RvD~cRw+zj496vL?@9dA$YUy7CPw#HAzYgsLO!sYM%Wit{f1l^CbKh=Nx{o^EUWnu+;^=6FyLR(h*;Q4-)gjufeOuG}t%bHDFGI z-2>A!A*TWEg;mas2KXtgJahQZa0U_ELe5V;pf25fQN7uK1_8&>qEE>J^;?)ZO+%jx53sg@IN^Z z;eUajh5mN<0r*^4h5bFe3e4bLb_(GDrE_>@2(N&xFW~E8>kIfz&fA_D#%^x50%v&%F1`_4o7C-9X#n$gL>gXMQ~cns&LJaam84`+4Ye((z=hYyBxcnBZk94^G3 zVY5ki6D(hr!xuRZ;Y*#vMIlVVFG44S+px9I#UTuwGx#dk&*7Ij58=N_`j_Abl0N({ z_!W9D{4w~i;qcrLz6k#fIJ`83Z#jqOg>av92LBL#y`F{t1iw-G@EDE%w{UhDz8Zd$ zbl^wAZ;=lCc-ZW-9Kun~IeZHIR_VZ}!rS05$@qrf24?Uk`0a2GUjp9(58*QW4meao zn1SC3W^mg%hp%!T!mosHmHt!+H^M5<5PlQ<9?7fRhaU}Q@JHbr;2a*p{|g?%UxD8b zhZ^?d`V;WI@ZTZM;QxR>EPeRDVfFQ}j^AK{6KkM92L33R!3V(Cz?1M{@WOQXJ4=6t_JRLFI`D;(S2_zLD9n15jceyVc@UkHB@c@94hUIh=~I{ZjD>+)*nN%#u*OVWp50DoEf@b&O2 zIP|bh_$$(Z-w)p`9r%;5wPzn+0spJ?2O)gNb#nN}@G3pK5W*i}%qWB{EJAh(;hSIv z@9w+_-XBISOu~o5%0GuscHRbWa-AVuh4(=xEQYWETYJJUa?as5IuGI7;OnK2v-}76 z9x#VL3x5k9!e4_e&*!rqg1?PCgMXjoIK16bY4|?93rF%rcuz2czXv}K&f))b-Uj~#wz|M8{>tCGjd>itU(dn^!2es%!pFiY z^EUW&SbaBypXd5=RF}gKAkW~f@DJb|eqqvwuXElGzZL!=I&y69ftA1b6R?eO_)GAQ z5a;l}!9RhAw_tnlW2OHNd<(2+C*YlT^Z5nd6aFdk9DY3fGk6F;*>&VBkAn9=p1~)= zYV#aE)#bx?GLJid8h*C(o$m~%%)(}G@4~mhDnkxm4gXy4f^SSZ@5YzIzd$YrtabHH zzP{I*+4^0#&=F@`ABD~K;7`DWF})+>x+|u~9|eEKS$*;i*INNkaCs;xzSs5kg?|F` zS}kwFpJ3UD!k8L>s_bXclFqKk^=^fIV4kym)4}lmQEZ=2u zdav?21%3i?A(T>H6nLe|wjLeTOW~PtD(3|-VSIv*i=7XEpBH&d72b=>L+Qzh*iOEN z0yNQMjI2;$w!#Pd{j1?a;GFAa@G9aA9qlj7=811a&Oh5czS%kBg&%Ov;oF^u@Ryy{ z;opU=4`Hp-4kw!&z8Cos@DToyvl{uQu-OCrXZT3HcW2rVqa|zWgWcg|KaYZCGa1*D zV6wA4$fli)*L=QQV>w1<-Fe-`qTzxwGgzquK?IP)}7Np0kzbWkGXQ?%8y(Z{u} z$dFfIva-;3&Pct$Ifq{ftNcT*o1C}9Z-=dpGvdnm02 zCXi!~*KUW^FKT0jHOSQ_L#~sZ1J6FgS^1pjoWmC#ze|km4dJItzH0{ZCxEKwpW%~X)l-KiPlbo@xbqj_J)Q4{AM5-r_(?ED zUNONldRJ=Sqmk=fL#`8G!nn1WVJMv#V-;ohlboMI{PdXL&Qv{|8=ngmV)RldshvEO zbVhN7=l?W>edkl)t&zv{tnAT4X-y)E{#tIn3_ad=t=@S9Y_`UB;&skUb347w850`2 z)tTz1VlmvAySUbK(H`NW=n&EwQ}}1nkJoE>;yZ8}j}JI!DF4hkhyUO_giCw7KF{vy zoWc7!=kOuULwF6mmgiKE(_Egx=Q!u^CC)>*;w+~%m-OMQlRo^$qz~Vo^l7lWlRo@F z(uaSM^wp>gYOC)`#;kJ&ALN|F$2$+q!mmT0F#b%7?4u<4+dNMh!+YSfm+p(GdGt@~iF2+GphNT7eEARXImi?~0n3-B zKz26YYoDmGrSM5~#InoJIn(9gtIk?0+yfKFH}Ubk$jO#h=nP2tPH^u&?#0{e{Q> zWL&>?&S4cu@*&r5upVCpr!zY+JQlfR8P@^ML)b%Ukp|b95p}j_k3c8c@jAGUVwSW~ zy9ho3IcudAcf%XuRL*mqrGF88A#u)inez~yh7TcDM>kzx_I)LMf#ekAMexO72EWF2 za`<)dbC3_=x4^2`kg~rYey;RsypO?`!a4kpu*x=sKL=k12W;^x&KdkI_%YIle*~AM z5B~|Cl0N;rGnK7^8T>eyFn$Ri2g1o-#m}}|%;~O^+J)k-nBd-V$gS@1iLjN;pCKwe zo6J0vo|lLO%3g??(Am%OYhPdD9Y9s>C9Bh>C7~PJG|=};+$*X z<$N)GElhUi_iuo&MW*mZ*Ley2-hz(qy;L6_c(2VXva7WB(yf;z1>%<%Sna?SK0=;p zj?tN8nq#CY9o6>^bhJlQxXT$cvh!KhcN6?o$#NB znX<|+zwr#7y`EU%Z1`s4oa=m8b;-&2QaF`C_HzSrh0BrONSrAVLn-A&vUHOR$s$$R zp4EG3UmFK)So4Fz0KSGe<9Z?dTH;Br7sIQFbFS-P)m8nYJ}LG&qSEX5@UUwgMGvJu zd<)MK(%K;1Rg;7_aINQ3J9{W?MdMa~pW62C;5VncF)m$?&K<6!XFmh0tc6gTOK+ll zmlwEOV0~}sp`^WA;v3Y{AEi;ntEw)cZV*>pz# zPGmXPk3IkQ!oPBUA6$AYAG}xjc_=-HOdsj;54cd}QGaL*e$Zw6xz25*C!A$Z_wrr} zY4*Gpx!P6XcvyWo!L=U#5OK!kq4d|hFkPUG_%TSGhG7{yr(kxb*R*bm=-W@KCz6z|Sl2 zD+;Xdl#~7y1+EnMP88ln83^M&d0}{72nQz+aU1z*eeebNd;ZXuVfl_Q zfy{XvegNjN75vZk!G*oC%C=H={~$W*Cxu19+A&UKm3q{T{_b>2t?lG&ZV=k{~#W6rM0^n!$avm9S|iq6n>oUQuZGe_>G0ygtQ*JgWj<_Q1F<F-r=0Vw>szWZAl-#1AYp5sBu4=^x?0<>YJRCu5UZP2>uDI{mnLXehHtf zXBnse1=Fb4YK)9=K$g~}d}4GTyh*J?`MK7ogao|vH+-x`|193~aq9R~m@-;8 z!#O8)VUkmSea~?SGWAOZxr{5LFXodzd?jo)%bQ=8z-@-ZkRpgWK5dJQ#a;oos=A6M}`$u^W zkHf#0KD;}uJ{s2lMCp@tfv_GHH#A{xZCWo@EaF2CR10y5N52N%$AeIV|TOoo(=5 zu;mXw0p3&jP^iP;>%k#>yz6H);CfhPo`lbZABlbrUkX1;<)Po&u=32|99CNm;a9?s zR{oSF&50R&Bl5>0AHuJN%?5~H&$X}eBz_Cmez5ZUAQ#OMhQwcRxqf*0@9^Q$hwq1# zPY(YKK0^7!S|`g7%W!^&{3z+eCGMRlorCDB-Q0!`W}S#!{hq;l!t|q^bxgp2;&ZH(YU#+?O>n{5UIwxZ~IcfPK{#i(K+61Z3 zpu=|6<~rT{16R)VMVAlZdz|&+`;-0{e$x3=_&3g{!GCmK53i&xl>h1QKF%B91DrR) zM>;6&pF0*xedqI#U+sK8 z{A%Y5;5RsLhTrXcAv|=x2)@VpV));jIcpmGp)+TmW50H0zcyByh-G7cF}Ale`;oEz zo!O6!9pubhJhs}o44>pY31`miN5;-_<~!7}3!GVpk4-sqMl^PXGyCwdtJ>yG{n* z5A!cf!oP9uz+(r*d~$ei=WXy4VfE<{Rv>FT_dC?(k{wszq=QQhr+Pk;om*g~xo`PQ z7M`6gaKFHLfs4<+ydeMU0{?A+Z!Pd`FkxIi_hT?_VZ~4q!hc!Z>3L#)Fw7BtMY{LG5Qz&rpp84>4BsJ|H3(k!-4VHp_o7!R!$o6 zK|U#z3cOQ+R}^??lZ*KINRjI&XO@ zan2<_FMc_f0^J$wi@xLvUv(abzXRi@?9A;x*zAY&51n&Zp+r`yqrxs;PVueiU*g1)}%XSrZO=cU?<<4iPqkJd6t_az10#}#x($|w$a2Vwm21>OCfDc?vn<@*G`cUVFHiSTvg zgW0g#VJ!rw2XBF&ge>DF?}jJf9KOwUhOmB1bO3Tad%Mds_zw8V(&v&LD$gPO8P`z< zejYv;Sq7&wlN?U#v?2Vpq`wnuc=!0QoD`j7aa z^8vKh9nJ^Slb>@w1pTi$Gp=^}w(}9uv{g=9XX@__c#nnq&=F6>2poMClC)Q?BOm~Cm#b_J}Wqjb{@hbAF&eOft)aY zG|zh|>D)sBRWng>^6e>BSryh5p40xqL+Kd!Qt~ERaVtW#S!$zMs|6684qaxm&$Xo>r9|i@q99P z&N+vl?>vOBc74h=_Ht*|T4OgjvpyVqn=|XfG1=tPz5KT#U#WkT;iGUSIpGfYH0L{E z_IMUP51;M)Wq6bGJ@78ny@S^MaPl!fbe=%|W9JP1x$`9aYv&yPo%1&MkIqB*LHJbO zwH;2sub#BtMqtez->H6=Zy!H2`Wy9;%A@s^g36QDRw|Epg6q-fi`Q@|tmj=B@#B!I zE<>&-Id6wmo{g$I*Wt+7CtE{m?RJLPJO4~LcLz#QM(efHrQ=~kfzdJhIhH&}_T!wn zK6Y(7sSPDgZ8!m^Hq7AEhLf-dYc%Wy|4Lk2)_ck+3=DRDGj)H z6LM~^$Y_AK!fA}W1LlmwD*Zl~a}9GUpGx{9E7(lx(=Q_zXIz?x&p|(jJ@ATne?9Te zE+jI!>MD65>?o(k~yhqRCcf!dmCJ1|Q)=~_Xm!6ZJs{bt4G=F3q_5x45sZhiV#fMgt|ZsrekEQkJo};o-&Ei?60r^KAd0D`C>u-^#X4%@XreT>jL`^?d|Qm9=4R{V+wp|fsZe+z6(iZ z(BH8oKC_^6ae=1`e0hNv3#`BEO8LCFARjBVx&AgW>FDpS5?@!)*LQG9{-%Qb!v+3q zfxlMZ9~Agk1=cz>iT5h7zHdl669u{c{x8W7Ey#~6u>KA#>1-^>?~FESIb2kb z*9+V$@KptVRe|47;P({xBL)6!fxlMZdkg&A0*9&2bh**5cgy8|r8gJm>-|bFs`eK{ zqty?Eo5G{*=9;Iheaf1!`smfGkDjkITC2%rbu~;7dj0O8+MkeC+4*oKCZ0Ayjz^s$ zKG`%I(-W)Wou^HlbK%)%9~Ra;h5r?E>D8|&PdA$NiNm3kgNk_6DF{wpD!diDSMT*2 z?N+%_3wp3Mm{%MI#~&NYWql4>y~a$dUYlsPTQl}yRrPX){%p5isg)b8={67a`jvh? z@L8P;gI;B(9;Ta>nO^AhyOnA^@SbXC5Vln2>g9T?-`yHgvR-^^J*peJ{ZMO$YP(x6x7xLOq-wi8*KlrEtAh^Nwp;$Fb=6F_J?Ml1+01v!UA3B_ zm4G^T>-G6gpB(#*=|;WV3scq#Wwmdo-E361hE`YA=#?wYW_wG$rsn9CX)GEK>l&pD z=FQX^GhHi3xl?b|8m*ZyKa$iMy~O4X^=EB)EBOp?^)?Wt-XA&uK6z0|Ya zdavFuV-(Zv?p*5aHWt^I8uaTuRlC`)VDe@MvAw8ZOm=z=GdFeVpgzE!O{-gn!eAKTcN$&3sJ+Xz zc8f-%1MGd}KF?Np2L`S8TUrjZUEYFr9b@k|=H)f?Ib)xUodp@DC0YyB-j>j6SQP8+ z4_Fhl+kH#U({R(Y^L*uUi#zRJV=-mI=v$VymwR0)S(om&7Bh+;vdvnwf?gk*tK+cR z7;dXFUvJbZc>Uhi-a@aA&s01+AAMDCOQT<%EmzwEn%=yZORSvJy&(783pBu>t6pgJ zI^FgnUMX5N(QKtv3)Z=*SSit~EKrhUVaW;fDhwe0bwZ-X^J&p2btk|8wL14gWl&?7 zRT&TUMGDxSX|x8io;Vd4RjDVLZS7St!!n))?^m65J2K0UGe&cIl#marGOWxXV{DEd zXQ%O`d5}(!%jv{v6ZTp$Qf2Ccsa~bUpdNG?%yCMYqLIwibee-1x&LORG4CE?3S+1F zm?##aGP#7U??ixZQ~-M>z${Hnw4UwG^jY!R-;|11`YbyP?c)6UzSH=6t2Zv zky@B9B-DwE9lR`qbmX{;33Kpr*^B_>^osmwx!cA$n1@H+YgVR~-LTQr3)Pue;c656 z#U|(V(ViMG2Uog8;kxrt==Y=5(>;ZXBI#3>_%tE76 zOh@H{f@My9eCldwTCFc=nwz#+Gx}N<5S21k)3R1rN|8~cT?@+v<@w5D6e^#3mtk0L zQDf6{zsv~KQb7(z^~5f%`)mp}y-t(G#k~An?AO73G|DdHPd>$zs!m6vG*I~M^mphG4J+7Xn zyOo(>{=TP0K&{d3H^^-X@!S|t(2cE;YvnDoxNg;`EBnFIw|eAZCB~`lAg&I&UA3DU zi~%`H*6N-9EaNEMn2zH@PsgT>>GlF$G2mq^+cd;jbaZCDNTy+T>b!xRwSLrSz;YSH z?e@GUpz_Rghc31?vhGXN?y?YZ73v$?Q!gyf;`m0(1LdcQ2Jg;#B2L5u^|{uk13H^U z3UkPgsd8muCd|!OI+$~pQBPmR<{7PxR04)0<`_pyA#F|Qb0{O8nG^qRGb*MTow<2I zcRxMVT}uw_1~l=@v52(^n5VZFDzzFFh32AX5sqZtMrXlpZedA z(FXn(8`h0jhBdm8qn;wubj&@l~Ef-{@@wLj?XxSS7zW7cVz z&*x~FukA~!Z@GYRU!q$~AaO0yXEtPr(VJx!9h9?&txy+R3N+1M^t#nhW2I=Rc%!9B zXONt&$Ah)Us~~)i3euZxvo4QoFLgI9ZEH5{GG-JPFZMDm#ndf&VEO1@NNzyxs{D}K znBZtVrs1UVQJwB-J2Aht%-9~ZTDGL!QpY^|K^CTRls)ZHqqUGE-Kki6I|;5isCGy=4Qd7V2B(G4{CL>1*ky=2lBvFRBDA`q`ba2&lDZ)YQ0PiSa~u zHtoMmQ**NC!d3aZ`dr%C&f@*mV%$hCs zEjYTVik`K7ZUZZ+vq)#*g{I=!N|&X$vaoiIc961|(+!4{zeMBQEcT4^H=p^e4d<87 zIrsbx7i>QD{LLXrQhIQr2FHm@W24H8(#DhGEL56oQ>F&&()wDL#oESABohRUT_b~2 z&p-dvXO}NH^En&Jo1eXDL%Hl7rOIH3jjFcaasS0QGSuvB5M58ajk(1Qk2@q!$P9bU zdcBhdqOo$|4rZb|$qa1W=X#N)XQS92u-Q_y!|2o~vN>|P!UDQh7`Nrhv}!5!hu+f| zux0kc-JET+Gvh|PTiqc?3AKD3a44~a<=)m-wV3vGKv87Ng`yyC9E*~r()ugB{N+l& zuQP)kUfJQ0f(>)=`9`f-53@_oW4h60Ftg;;REvcQwZK z9Ly4V16o0wOJ^aPt#{7_O~2B+?3kFs?zN?FtxbKa>v2K22W+yvrpb#h3l1n`7IXhzHX( zY)v1tY(tfiW{^HJaJ{OirC3J_g%`(UH0)?nW(g`z=vKC1#*LN|JX1_s!j!Ca3R+hr zrm5@*D@LQkvp$Z*JUV*-O4wyXXQxvd9F6YQl-lv=plnlsY_+~Xjjpiy+a8Zj-_n}u zIhn92pP2QLCRZgj@z1yEep{BsZI;cv1D)Mz9i>S$t_n2kg!YyeQVx zis^wH?;HmR$m8coo8&R;5YOuvk0GWb^JvB~F6X-5)vlFj3#(kl`_xvB z3d0uG_;qKtwbgo4Q%_MUOLfPKyR*EDmiiExwk)v~5~w1!sbM9>l4!Ig_Y<1V{2*p@p^yB;ZenyJlnZN_mK>zJjxS{!KVnb!F> z&dr=-JZMhI7Kid2tJsmF?~^ndc+%I1-i>J~EJta_lI0mXma86*wDAU7$?4FH7sj(v z#-*k-Rok2%H;}S%S4*jYAHs!MrYuTH8jj5s&+$K});CDLc)Qx1i~?ZPHOM z>%5wEx0d_CT*<>erU_LBYg4Q3F=-vP^R|W4014XlM(63fOdL4P6E{K8UBs_Vd@AfW zY4UED!(UGDusNLOG_82NG5l;$%|2nN)();&I*a@D#gglc!4_UN5* zs~gzMw>9t>gqS}Q0!;vQSfI}jSig$4RJuAAW{b`_93zAtE%RLH%ykE0nr~QY^`5p^ zHgz}gIQ=!|IOFHqQ0uU2U_ZkR4$T%=B=DaQnK6}h1)C1hGGlxADReaGXmXL`&Mr1U zIs}T3#JM4|KM@lchG)mhCLU;2Xq}i7r-2+j&JXkjkfwL$TK4sPjbO|8cq$zYFP;R+ zd|8vkZ&M1Qw36&c+a{N8P8xboy;tL)kvAp4;4d-kwv!C0%p?vy=Q%?^Mk#4x;%*_uY zJ^%c3&wr@++>IL_Dm?R?Q`g%%>>+u(+}xloDGP-(v!xBDIk4>EqnS2rd1vOzMra<7 zKRPdKv}W0(Q%Rd|SQl0Cm)edPvCNkz93|qMJ4((jjL^0$vQED9VkYryZ3J=(VFxUD z9_;{G+h7Uv6^?6J{Z$)$H`eGx8;`5`++1(#{1iJV8BnxQ zSu0ClzRZ%@=o@2w?ZPf%PFr?;A%^Lu_K07mvHqCHYUPWqMbbdyM9I$v%WHWs#-~U2j@>cxvh8)XZGTTs-EqMerap+Y658%yz8>v@~?J=zZ*9)E694 zPbZu`PB>?`=(s8M3MVf!EG@Oa@HGdmphItV-}cqTQqnBeb}(uS)-gOkz`JV1DqgVAUxqTbcvn)<rrWNUzQ5QC(kSat8kfTN(mq2niPS6e8i(|U%SO&2 zTD#1AX*?O(uvr>XaS70w-O5@{2mkgetqJ1|Ex+Qag{=t86usDfggiaKpDk3nYsHDpL(>1cpsqN5y`(0UB4_?DbhvvukDcg*dN^fce@Nhn&$ZVQd(m zR_&pF@RYrdAJ16aU3*;Uu059P7_N2Lc$iv*)^e>0-IGH1#K2i$bulokdJQJ8U{kwf z{Jw|9H1Fj56K3vM8h(;vf>_$PFE!?Md|7JCh|0p^ackMUj&?HB9r~KJWBk!qIVEYG zd1NWcQdw5VmeFrKOu`I+16^%;<870~vId?tP$!ch}mP#X;v4lIAmb+Rs&q;brNC-|~lzLhm78|B!}_MP5h9>N1YNkv&4_l~25tB!4T9GQ;emVPP_U905Hx_z5b)vrdF2jdLor!sL% zK$F>KPhL3wVr3+eO~re~aTK}m-Ln1iApJOD^tFer(&H4#Zq$AO6Mqk~rg+DEBs(1_5wfOvOOECE?EU9K=z{> zpYTX>zPxm9=RfMy>Pq{XRC|*8t&F#Yot4;ueJqHjea&eOFLtwP8hk-zTQhl?;yJb* zmHVm8sIL+FYxMv7HDN#7jeozPzu|Z_*EX)Jxb$=8qqzKM<@#F_{e6MS;!mCV`yA5G z;yRc=Opr|JEnK@C8+DbwiR*wPFlMl#Gfa}KMgto9R-z>KNlGN_n!3A=3NWv30OMcWM2$|+9~~(DB~Od>^K`n#g3@{>vsBbodegG>USvp^qzJ6JH+p_d+ z%hF$3mj2$d^iP(h|FkT4)od;;_NgMhCY*iRX=}>sVrl;0KQAH+`@@oD zSsmjYboDa1H^WG(w66Fk3nTH!9+o7L)PBWq9Etzw`MZnCaPlchycUqp$&w(&?Ff5$ zdN*R#Gd-W=)5!FG`GI2COF}|%oGI;Mp@nn!lx%q$>c5wxu)My@pYNixT&CwHT=@Gr zrIy0-{94?4xccwq^`G!ZRe$-w<@M)pe;@Y!`_9J)^*5Kru>AeX^WomV#^0YZ*ZZZn x{QXZyw$s@UN;~Hog*9$}%iDEXaqPe6y}a*~$t7wS!mTl~V#s@@_siES{2x4&=HCDS literal 0 HcmV?d00001 diff --git a/34-iter-task-hello/cilium-ebpf/main.go b/34-iter-task-hello/cilium-ebpf/main.go new file mode 100644 index 0000000..a8e7969 --- /dev/null +++ b/34-iter-task-hello/cilium-ebpf/main.go @@ -0,0 +1,61 @@ +package main + +import ( + "bufio" + "log" + "strings" + "syscall" + + "github.com/cilium/ebpf/link" + "github.com/cilium/ebpf/rlimit" +) + +// $BPF_CLANG and $BPF_CFLAGS are set by the Makefile +// +//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS bpf ../main.bpf.c -- -I../ -I../output + +type RawLinkReader struct { + l *link.RawLink +} + +func (r *RawLinkReader) Read(p []byte) (n int, err error) { + return syscall.Read(r.l.FD(), p) +} + +func (r *RawLinkReader) Close() error { + return syscall.Close(r.l.FD()) +} + +func main() { + if err := rlimit.RemoveMemlock(); err != nil { + log.Fatal(err) + } + + objs := bpfObjects{} + if err := loadBpfObjects(&objs, nil); err != nil { + log.Fatal(err) + } + defer objs.Close() + + iter, err := link.AttachIter(link.IterOptions{ + Program: objs.IterTask, + }) + if err != nil { + log.Println(err) + return + } + + reader, err := iter.Open() + if err != nil { + log.Println(err) + return + } + defer reader.Close() + + scanner := bufio.NewScanner(reader) + for scanner.Scan() { + fields := strings.Split(scanner.Text(), "\t") + log.Printf("ppid: %s, pid: %s, comm: %s", fields[0], fields[1], fields[2]) + } + +} diff --git a/34-iter-task-hello/common.h b/34-iter-task-hello/common.h new file mode 100644 index 0000000..fbc150b --- /dev/null +++ b/34-iter-task-hello/common.h @@ -0,0 +1,5 @@ +struct event { + u64 pid; + long long ret; + char filename[256]; +}; diff --git a/34-iter-task-hello/main.bpf.c b/34-iter-task-hello/main.bpf.c new file mode 100644 index 0000000..f96e718 --- /dev/null +++ b/34-iter-task-hello/main.bpf.c @@ -0,0 +1,22 @@ +#include "vmlinux.h" + +#include +#include +#include + + +SEC("iter/task") +// int BPF_PROG(iter__task) { +int iter__task(struct bpf_iter__task *ctx) { + struct seq_file *seq = ctx->meta->seq; + struct task_struct *task = ctx->task; + if (task == NULL) + return 0; + + BPF_SEQ_PRINTF(seq, "%d\t%d\t%s\n", task->parent->pid, task->pid, task->comm); + + return 0; +} + + +char _license[] SEC("license") = "GPL"; diff --git a/34-iter-task-hello/main.go b/34-iter-task-hello/main.go new file mode 100644 index 0000000..e46d3fb --- /dev/null +++ b/34-iter-task-hello/main.go @@ -0,0 +1,40 @@ +package main + +import ( + "bufio" + "log" + "strings" + + bpf "github.com/aquasecurity/libbpfgo" +) + +func main() { + bpfModule, err := bpf.NewModuleFromFile("main.bpf.o") + if err != nil { + panic(err) + } + defer bpfModule.Close() + + if err := bpfModule.BPFLoadObject(); err != nil { + panic(err) + } + prog, err := bpfModule.GetProgram("iter__task") + if err != nil { + panic(err) + } + link, err := prog.AttachIter(bpf.IterOpts{}) + if err != nil { + panic(err) + } + reader, err := link.Reader() + if err != nil { + panic(err) + } + defer reader.Close() + + scanner := bufio.NewScanner(reader) + for scanner.Scan() { + fields := strings.Split(scanner.Text(), "\t") + log.Printf("ppid: %s, pid: %s, comm: %s", fields[0], fields[1], fields[2]) + } +} diff --git a/README.rst b/README.rst index 5e305e3..67dee79 100644 --- a/README.rst +++ b/README.rst @@ -6,7 +6,6 @@ hello-libbpfgo Examples for libbpf, `aquasecurity/libbpfgo `__ and `cilium/ebpf `__. -https://mozillazg.com/tag/libbpf.html setup develop env @@ -21,6 +20,7 @@ Program Types ------------------ +Examples by program type: +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | Program Type | Attach Type | ELF Section Name | Examples | @@ -169,7 +169,7 @@ Program Types + + +----------------------------------+-----------------------+ | | | ``fexit.s+`` | | + +----------------------------------------+----------------------------------+-----------------------+ -| | ``BPF_TRACE_ITER`` | ``iter+`` | | +| | ``BPF_TRACE_ITER`` | ``iter+`` |`34`_ | + + +----------------------------------+-----------------------+ | | | ``iter.s+`` | | + +----------------------------------------+----------------------------------+-----------------------+ @@ -185,7 +185,7 @@ Program Types + +----------------------------------------+----------------------------------+-----------------------+ | | ``BPF_XDP`` | ``xdp.frags`` | | + + +----------------------------------+-----------------------+ -| | | ``xdp`` | | +| | | ``xdp`` |`33`_ | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ @@ -210,5 +210,8 @@ Program Types .. _30: 30-ksyscall-hello .. _31: 31-ksyscall-hello-with-macro .. _32: 32-fentry-hello +.. _33: 33-xdp-hello +.. _34: 34-iter-task-hello +https://mozillazg.com/tag/libbpf.html