libbpfgo

package module
v0.9.3-libbpf-1.6.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 23, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

README

libbpfgo

GitHub release (latest by date) Go Report Card License

libbpfgo is a Go library for Linux's eBPF project. It was created for Tracee, our open source Runtime Security, and eBPF tracing tool, written in Go. If you are interested in eBPF and its applications, check out Tracee at Github: https://github.com/aquasecurity/tracee.

libbpfgo is built around libbpf - the standard library for interacting with eBPF programs from userspace - which is a C library maintained in Linux upstream. We have created libbpfgo as a thin Go wrapper around the libbpf project.

Installing

libbpfgo uses CGO to interop with libbpf and will expect to be linked with libbpf at run or link time. Simply importing libbpfgo is not enough to get started, and you will need to fulfill the required dependency in one of the following ways:

  1. Install libbpf as a shared object in the system. Libbpf may already be packaged for your distribution and, if not, you can build and install from source. More info here.
  2. Embed libbpf into your Go project as a vendored dependency. This means that the libbpf code is statically linked into the resulting binary, and there are no runtime dependencies. Tracee takes this approach.

Building

Currently you will find the following GNU Makefile rules:

Makefile Rule Description
all builds libbpfgo (dynamic)
clean cleans entire tree
selftest builds all selftests (static)
selftest-run runs all selftests (static)
  • libbpf dynamically linked (libbpf from OS)
Makefile Rule Description
libbpfgo-dynamic builds dynamic libbpfgo (libbpf)
libbpfgo-dynamic-test 'go test' with dynamic libbpfgo
selftest-dynamic build tests with dynamic libbpfgo
selftest-dynamic-run run tests using dynamic libbpfgo
  • statically compiled (libbpf submodule)
Makefile Rule Description
libbpfgo-static builds static libbpfgo (libbpf)
libbpfgo-static-test 'go test' with static libbpfgo
selftest-static build tests with static libbpfgo
selftest-static-run run tests using static libbpfgo
  • examples
$ make libbpfgo-static => libbpfgo statically linked with libbpf
$ make -C selftest/perfbuffers => single selftest build (static libbpf)
$ make -C selftest/perfbuffers run-dynamic => single selftest run (dynamic libbpf)
$ make selftest-static-run => will build & run all static selftests

Note 01: dynamic builds need your OS to have a recent enough libbpf package (and its headers) installed. Sometimes, recent features might require the use of backported OS packages in order for your OS to contain latest libbpf features (sometimes required by libbpfgo). Note 02: static builds need git submodule init first. Make sure to sync the libbpf git submodule before trying to statically compile or test the libbpfgo repository.

Concepts

libbpfgo tries to make it natural for Go developers to use, by abstracting away C technicalities. For example, it will translate low level return codes into Go error, it will organize functionality around Go struct, and it will use channel as to let you consume events.

In a high level, this is a typical workflow for working with the library:

  1. Compile your bpf program into an object file.
  2. Initialize a Module struct - that is a unit of BPF functionality around your compiled object file.
  3. Load bpf programs from the object file using the BPFProg struct.
  4. Attach BPFProg to system facilities, for example to "raw tracepoints" or "kprobes" using the BPFProg's associated functions.
  5. Instantiate and manipulate BPF Maps via the BPFMap struct and it's associated methods.
  6. Instantiate and manipulate Perf Buffer for communicating events from your BPF program to the driving userspace program, using the RingBuffer struct and it's associated objects.

Example

// initializing
import bpf "github.com/aquasecurity/libbpfgo"
...
bpfModule := bpf.NewModuleFromFile(bpfObjectPath)
bpfModule.BPFLoadObject()

// maps
mymap, _ := bpfModule.GetMap("mymap")
mymap.Update(key, value)

// ring buffer
rb, _ := bpfModule.InitRingBuffer("events", eventsChannel, buffSize)
rb.Poll(300)
e := <-eventsChannel

Releases

libbpfgo does not yet have a regular schedule for cutting releases. There has not yet been a major release but API backwards compatibility will be maintained for all releases with the same major release number. Milestones are created when preparing for release.

  • Major releases are cut when backwards compatibility is broken or major milestones are completed, such as reaching parity with libbpf's API.
  • Minor releases are cut to incorporate new support for libbpf APIs.
  • Patch releases are cut to incorporate important individual or groupings of bug fixes.
  • libbpf support numbering indicates the minimum required libbpf version that must be linked in order to ensure libbpfgo compatibility. For example, v0.2.1-libbpf-0.4.0 means that version 0.2.1 of libbpfgo requires v0.4.0 or newer of libbpf.

Note: some distributions might have local changes to their libbpf package and their version might include backports and/or fixes differently than upstream versions. In those cases we recommend that libbpfgo is used statically compiled.

Contributing

To better receive you, libbpfgo makes available GNU Makefile rules for vagrant machines (amd64/arm64) that can be used to compile and test on Linux and Darwin hosts:

Makefile Rule Description
vagrant-up starts and provisions the vagrant environment
vagrant-ssh connects to machine via SSH
vagrant-halt stops the vagrant machine
vagrant-destroy stops and deletes all traces of the vagrant machine

Once connected to the vagrant box you are ready to build libbpfgo (e.g. make libbpfgo-static).

For further information, check Vagrantfile.md.

Learn more

Please check our github milestones for an idea of the project roadmap. The general goal is to fully implement/expose libbpf's API in Go as seamlessly as possible.

Documentation

Index

Constants

View Source 
const (
	// libbpf print levels
	LibbpfWarnLevel  = int(C.LIBBPF_WARN)
	LibbpfInfoLevel  = int(C.LIBBPF_INFO)
	LibbpfDebugLevel = int(C.LIBBPF_DEBUG)
)

Variables

View Source 
var ErrNoInnerMap = errors.New("map has no inner map")

Functions

func BPFHelperIsSupported 

func BPFHelperIsSupported(progType BPFProgType, funcId BPFFunc) (bool, error)

BPFHelperIsSupported checks if a specific BPF helper function is supported for a given program type. This function probes the BPF helper using libbpf and returns whether the helper is supported.

Important Notes for the Caller:

  1. libbpf probes may return success (`true`) even if the BPF program load would fail due to permission issues (EPERM). To ensure reliability, it is necessary to either run with sufficient capabilities or explicitly check for EPERM. Reference: https://github.com/libbpf/bpftool/blob/a5c058054cc71836930e232162e8bd1ec6705eaf/src/feature.c#L694-L701

  2. libbpf does not always clear `errno` in certain scenarios. For example, if the file `/proc/version_signature` is missing, libbpf may set `errno` to ENOENT (errno=2) and leave it uncleared, even if the helper is supported. Reference: https://github.com/libbpf/libbpf/blob/09b9e83102eb8ab9e540d36b4559c55f3bcdb95d/src/libbpf_probes.c#L33-L39

  3. If the function returns `true` while running with appropriate capabilities, the helper is assumed to be supported. This behavior is documented in libbpf: Reference: https://github.com/libbpf/libbpf/blob/09b9e83102eb8ab9e540d36b4559c55f3bcdb95d/src/libbpf_probes.c#L448-L464

Caveats:

  • A return value of `true` does not guarantee that the BPF program will load successfully. It is critical to verify permissions or run with sufficient capabilities for accurate results.
  • If `retC < 0`, the helper is not supported. In such cases, additional details can be found in `errno`.

func BPFMapTypeIsSupported 

func BPFMapTypeIsSupported(mapType MapType) (bool, error)

func BPFProgramTypeIsSupported 

func BPFProgramTypeIsSupported(progType BPFProgType) (bool, error)

func CalcMapValueSize 

func CalcMapValueSize(valueSize int, mapType MapType) (int, error)

CalcMapValueSize calculates the size of the value for a map. For per-CPU maps, it is calculated based on the number of possible CPUs.

func GetBTFFDByID 

func GetBTFFDByID(id uint32) (int, error)

GetBTFFDByID returns a file descriptor for the BTF with the given ID.

func GetMapFDByID 

func GetMapFDByID(id uint32) (int, error)

GetMapFDByID returns a file descriptor for the map with the given ID.

func GetMapNextID 

func GetMapNextID(startId uint32) (uint32, error)

GetMapNextID retrieves the next available map ID after the given startID. It returns the next map ID and an error if one occurs during the operation.

func GetMapsIDsByName 

func GetMapsIDsByName(name string, startId *uint32) ([]uint32, error)

GetMapsIDsByName searches for maps with a specified name and collects their IDs. It starts the search from the given 'startId' and continues until no more matching maps are found. The function returns a slice of unsigned 32-bit integers representing the IDs of matching maps. If no maps with the provided 'name' are found, it returns an empty slice and no error. The 'startId' is modified and returned as the last processed map ID.

Example Usage: 

name := "myMap"          // The name of the map you want to find.
startId := uint32(0)     // The map ID to start the search from.

var mapIDs []uint32      // Initialize an empty slice to collect map IDs.
var err error            // Initialize an error variable.

// Retry mechanism in case of errors using the last processed 'startId'.
for {
    mapIDs, err = GetMapsIDsByName(name, startId)
    if err != nil {
        // Handle other errors, possibly with a retry mechanism.
        // You can use the 'startId' who contains the last processed map ID to continue the search.
    } else {
        // Successful search, use the 'mapIDs' slice containing the IDs of matching maps.
        // Update 'startId' to the last processed map ID to continue the search.
    }
}

func LibbpfVersionString 

func LibbpfVersionString() string

LibbpfVersionString returns the string representation of the libbpf version which libbpfgo is linked against

func MajorVersion 

func MajorVersion() int

MajorVersion returns the major semver version of libbpf.

func MinorVersion 

func MinorVersion() int

MinorVersion returns the minor semver version of libbpf.

func NumPossibleCPUs 

func NumPossibleCPUs() (int, error)

func SetLoggerCbs 

func SetLoggerCbs(cbs Callbacks)

SetLoggerCbs receives Callbacks type to be used to log libbpf outputs and to filter out those outputs

func SetStrictMode 

func SetStrictMode(mode LibbpfStrictMode)

SetStrictMode is no-op as of libbpf v1.0

Types

type AttachFlag 

type AttachFlag uint32
const (
	BPFFNone          AttachFlag = 0
	BPFFAllowOverride AttachFlag = C.BPF_F_ALLOW_OVERRIDE
	BPFFAllowMulti    AttachFlag = C.BPF_F_ALLOW_MULTI
	BPFFReplace       AttachFlag = C.BPF_F_REPLACE
	BPFFBefore        AttachFlag = C.BPF_F_BEFORE
	BPFFAfter         AttachFlag = C.BPF_F_AFTER
	BPFFID            AttachFlag = C.BPF_F_ID
	BPFFLink          AttachFlag = C.BPF_F_LINK
)

type BPFAttachType 

type BPFAttachType uint32
const (
	BPFAttachTypeCgroupInetIngress          BPFAttachType = C.BPF_CGROUP_INET_INGRESS
	BPFAttachTypeCgroupInetEgress           BPFAttachType = C.BPF_CGROUP_INET_EGRESS
	BPFAttachTypeCgroupInetSockCreate       BPFAttachType = C.BPF_CGROUP_INET_SOCK_CREATE
	BPFAttachTypeCgroupSockOps              BPFAttachType = C.BPF_CGROUP_SOCK_OPS
	BPFAttachTypeSKSKBStreamParser          BPFAttachType = C.BPF_SK_SKB_STREAM_PARSER
	BPFAttachTypeSKSKBStreamVerdict         BPFAttachType = C.BPF_SK_SKB_STREAM_VERDICT
	BPFAttachTypeCgroupDevice               BPFAttachType = C.BPF_CGROUP_DEVICE
	BPFAttachTypeSKMSGVerdict               BPFAttachType = C.BPF_SK_MSG_VERDICT
	BPFAttachTypeCgroupInet4Bind            BPFAttachType = C.BPF_CGROUP_INET4_BIND
	BPFAttachTypeCgroupInet6Bind            BPFAttachType = C.BPF_CGROUP_INET6_BIND
	BPFAttachTypeCgroupInet4Connect         BPFAttachType = C.BPF_CGROUP_INET4_CONNECT
	BPFAttachTypeCgroupInet6Connect         BPFAttachType = C.BPF_CGROUP_INET6_CONNECT
	BPFAttachTypeCgroupInet4PostBind        BPFAttachType = C.BPF_CGROUP_INET4_POST_BIND
	BPFAttachTypeCgroupInet6PostBind        BPFAttachType = C.BPF_CGROUP_INET6_POST_BIND
	BPFAttachTypeCgroupUDP4SendMsg          BPFAttachType = C.BPF_CGROUP_UDP4_SENDMSG
	BPFAttachTypeCgroupUDP6SendMsg          BPFAttachType = C.BPF_CGROUP_UDP6_SENDMSG
	BPFAttachTypeLircMode2                  BPFAttachType = C.BPF_LIRC_MODE2
	BPFAttachTypeFlowDissector              BPFAttachType = C.BPF_FLOW_DISSECTOR
	BPFAttachTypeCgroupSysctl               BPFAttachType = C.BPF_CGROUP_SYSCTL
	BPFAttachTypeCgroupUDP4RecvMsg          BPFAttachType = C.BPF_CGROUP_UDP4_RECVMSG
	BPFAttachTypeCgroupUDP6RecvMsg          BPFAttachType = C.BPF_CGROUP_UDP6_RECVMSG
	BPFAttachTypeCgroupGetSockOpt           BPFAttachType = C.BPF_CGROUP_GETSOCKOPT
	BPFAttachTypeCgroupSetSockOpt           BPFAttachType = C.BPF_CGROUP_SETSOCKOPT
	BPFAttachTypeTraceRawTP                 BPFAttachType = C.BPF_TRACE_RAW_TP
	BPFAttachTypeTraceFentry                BPFAttachType = C.BPF_TRACE_FENTRY
	BPFAttachTypeTraceFexit                 BPFAttachType = C.BPF_TRACE_FEXIT
	BPFAttachTypeModifyReturn               BPFAttachType = C.BPF_MODIFY_RETURN
	BPFAttachTypeLSMMac                     BPFAttachType = C.BPF_LSM_MAC
	BPFAttachTypeTraceIter                  BPFAttachType = C.BPF_TRACE_ITER
	BPFAttachTypeCgroupInet4GetPeerName     BPFAttachType = C.BPF_CGROUP_INET4_GETPEERNAME
	BPFAttachTypeCgroupInet6GetPeerName     BPFAttachType = C.BPF_CGROUP_INET6_GETPEERNAME
	BPFAttachTypeCgroupInet4GetSockName     BPFAttachType = C.BPF_CGROUP_INET4_GETSOCKNAME
	BPFAttachTypeCgroupInet6GetSockName     BPFAttachType = C.BPF_CGROUP_INET6_GETSOCKNAME
	BPFAttachTypeXDPDevMap                  BPFAttachType = C.BPF_XDP_DEVMAP
	BPFAttachTypeCgroupInetSockRelease      BPFAttachType = C.BPF_CGROUP_INET_SOCK_RELEASE
	BPFAttachTypeXDPCPUMap                  BPFAttachType = C.BPF_XDP_CPUMAP
	BPFAttachTypeSKLookup                   BPFAttachType = C.BPF_SK_LOOKUP
	BPFAttachTypeXDP                        BPFAttachType = C.BPF_XDP
	BPFAttachTypeSKSKBVerdict               BPFAttachType = C.BPF_SK_SKB_VERDICT
	BPFAttachTypeSKReusePortSelect          BPFAttachType = C.BPF_SK_REUSEPORT_SELECT
	BPFAttachTypeSKReusePortSelectorMigrate BPFAttachType = C.BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
	BPFAttachTypePerfEvent                  BPFAttachType = C.BPF_PERF_EVENT
	BPFAttachTypeTraceKprobeMulti           BPFAttachType = C.BPF_TRACE_KPROBE_MULTI
	BPFAttachTypeLSMCgroup                  BPFAttachType = C.BPF_LSM_CGROUP
	BPFAttachTypeStructOps                  BPFAttachType = C.BPF_STRUCT_OPS
	BPFAttachTypeNetfilter                  BPFAttachType = C.BPF_NETFILTER
	BPFAttachTypeTCXIngress                 BPFAttachType = C.BPF_TCX_INGRESS
	BPFAttachTypeTCXEgress                  BPFAttachType = C.BPF_TCX_EGRESS
	BPFAttachTypeTraceUprobeMulti           BPFAttachType = C.BPF_TRACE_UPROBE_MULTI
	BPFAttachTypeCgroupUnixConnect          BPFAttachType = C.BPF_CGROUP_UNIX_CONNECT
	BPFAttachTypeCgroupUnixSendMsg          BPFAttachType = C.BPF_CGROUP_UNIX_SENDMSG
	BPFAttachTypeCgroupUnixRecvMsg          BPFAttachType = C.BPF_CGROUP_UNIX_RECVMSG
	BPFAttachTypeCgroupUnixGetPeerName      BPFAttachType = C.BPF_CGROUP_UNIX_GETPEERNAME
	BPFAttachTypeCgroupUnixGetSockName      BPFAttachType = C.BPF_CGROUP_UNIX_GETSOCKNAME
	BPFAttachTypeNetkitPrimary              BPFAttachType = C.BPF_NETKIT_PRIMARY
	BPFAttachTypeNetkitPeer                 BPFAttachType = C.BPF_NETKIT_PEER
	BPFAttachTypeTraceKprobeSession         BPFAttachType = C.BPF_TRACE_KPROBE_SESSION
)

func (BPFAttachType) Name 

func (t BPFAttachType) Name() string

func (BPFAttachType) String 

func (t BPFAttachType) String() string

type BPFCgroupIterOrder 

type BPFCgroupIterOrder uint32
const (
	BPFIterOrderUnspec BPFCgroupIterOrder = iota
	BPFIterSelfOnly
	BPFIterDescendantsPre
	BPFIterDescendantsPost
	BPFIterAncestorsUp
)

type BPFFunc 

type BPFFunc uint32

BPFFunc is an enum as defined in https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/bpf.h 

const (
	BPFFuncUnspec BPFFunc = iota
	BPFFuncMapLookupElem
	BPFFuncMapUpdateElem
	BPFFuncMapDeleteElem
	BPFFuncProbeRead
	BPFFuncKtimeGetNs
	BPFFuncTracePrintk
	BPFFuncGetPrandomU32
	BPFFuncGetSmpProcessorId
	BPFFuncSkbStoreBytes
	BPFFuncL3CsumReplace
	BPFFuncL4CsumReplace
	BPFFuncTailCall
	BPFFuncCloneRedirect
	BPFFuncGetCurrentPidTgid
	BPFFuncGetCurrentUidGid
	BPFFuncGetCurrentComm
	BPFFuncGetCgroupClassid
	BPFFuncSkbVlanPush
	BPFFuncSkbVlanPop
	BPFFuncSkbGetTunnelKey
	BPFFuncSkbSetTunnelKey
	BPFFuncPerfEventRead
	BPFFuncRedirect
	BPFFuncGetRouteRealm
	BPFFuncPerfEventOutput
	BPFFuncSkbLoadBytes
	BPFFuncGetStackid
	BPFFuncCsumDiff
	BPFFuncSkbGetTunnelOpt
	BPFFuncSkbSetTunnelOpt
	BPFFuncSkbChangeProto
	BPFFuncSkbChangeType
	BPFFuncSkbUnderCgroup
	BPFFuncGetHashRecalc
	BPFFuncGetCurrentTask
	BPFFuncProbeWriteUser
	BPFFuncCurrentTaskUnderCgroup
	BPFFuncSkbChangeTail
	BPFFuncSkbPullData
	BPFFuncCsumUpdate
	BPFFuncSetHashInvalid
	BPFFuncGetNumaNodeId
	BPFFuncSkbChangeHead
	BPFFuncXdpAdjustHead
	BPFFuncProbeReadStr
	BPFFuncGetSocketCookie
	BPFFuncGetSocketUid
	BPFFuncSetHash
	BPFFuncSetsockopt
	BPFFuncSkbAdjustRoom
	BPFFuncRedirectMap
	BPFFuncSkRedirectMap
	BPFFuncSockMapUpdate
	BPFFuncXdpAdjustMeta
	BPFFuncPerfEventReadValue
	BPFFuncPerfProgReadValue
	BPFFuncGetsockopt
	BPFFuncOverrideReturn
	BPFFuncSockOpsCbFlagsSet
	BPFFuncMsgRedirectMap
	BPFFuncMsgApplyBytes
	BPFFuncMsgCorkBytes
	BPFFuncMsgPullData
	BPFFuncBind
	BPFFuncXdpAdjustTail
	BPFFuncSkbGetXfrmState
	BPFFuncGetStack
	BPFFuncSkbLoadBytesRelative
	BPFFuncFibLookup
	BPFFuncSockHashUpdate
	BPFFuncMsgRedirectHash
	BPFFuncSkRedirectHash
	BPFFuncLwtPushEncap
	BPFFuncLwtSeg6StoreBytes
	BPFFuncLwtSeg6AdjustSrh
	BPFFuncLwtSeg6Action
	BPFFuncRcRepeat
	BPFFuncRcKeydown
	BPFFuncSkbCgroupId
	BPFFuncGetCurrentCgroupId
	BPFFuncGetLocalStorage
	BPFFuncSkSelectReuseport
	BPFFuncSkbAncestorCgroupId
	BPFFuncSkLookupTcp
	BPFFuncSkLookupUdp
	BPFFuncSkRelease
	BPFFuncMapPushElem
	BPFFuncMapPopElem
	BPFFuncMapPeekElem
	BPFFuncMsgPushData
	BPFFuncMsgPopData
	BPFFuncRcPointerRel
	BPFFuncSpinLock
	BPFFuncSpinUnlock
	BPFFuncSkFullsock
	BPFFuncTcpSock
	BPFFuncSkbEcnSetCe
	BPFFuncGetListenerSock
	BPFFuncSkcLookupTcp
	BPFFuncTcpCheckSyncookie
	BPFFuncSysctlGetName
	BPFFuncSysctlGetCurrentValue
	BPFFuncSysctlGetNewValue
	BPFFuncSysctlSetNewValue
	BPFFuncStrtol
	BPFFuncStrtoul
	BPFFuncSkStorageGet
	BPFFuncSkStorageDelete
	BPFFuncSendSignal
	BPFFuncTcpGenSyncookie
	BPFFuncSkbOutput
	BPFFuncProbeReadUser
	BPFFuncProbeReadKernel
	BPFFuncProbeReadUserStr
	BPFFuncProbeReadKernelStr
	BPFFuncTcpSendAck
	BPFFuncSendSignalThread
	BPFFuncJiffies64
	BPFFuncReadBranchRecords
	BPFFuncGetNsCurrentPidTgid
	BPFFuncXdpOutput
	BPFFuncGetNetnsCookie
	BPFFuncGetCurrentAncestorCgroupId
	BPFFuncSkAssign
	BPFFuncKtimeGetBootNs
	BPFFuncSeqPrintf
	BPFFuncSeqWrite
	BPFFuncSkCgroupId
	BPFFuncSkAncestorCgroupId
	BPFFuncRingbufOutput
	BPFFuncRingbufReserve
	BPFFuncRingbufSubmit
	BPFFuncRingbufDiscard
	BPFFuncRingbufQuery
	BPFFuncCsumLevel
	BPFFuncSkcToTcp6Sock
	BPFFuncSkcToTcpSock
	BPFFuncSkcToTcpTimewaitSock
	BPFFuncSkcToTcpRequestSock
	BPFFuncSkcToUdp6Sock
	BPFFuncGetTaskStack
	BPFFuncLoadHdrOpt
	BPFFuncStoreHdrOpt
	BPFFuncReserveHdrOpt
	BPFFuncInodeStorageGet
	BPFFuncInodeStorageDelete
	BPFFuncDPath
	BPFFuncCopyFromUser
	BPFFuncSnprintfBtf
	BPFFuncSeqPrintfBtf
	BPFFuncSkbCgroupClassid
	BPFFuncRedirectNeigh
	BPFFuncPerCpuPtr
	BPFFuncThisCpuPtr
	BPFFuncRedirectPeer
	BPFFuncTaskStorageGet
	BPFFuncTaskStorageDelete
	BPFFuncGetCurrentTaskBtf
	BPFFuncBprmOptsSet
	BPFFuncKtimeGetCoarseNs
	BPFFuncImaInodeHash
	BPFFuncSockFromFile
	BPFFuncCheckMtu
	BPFFuncForEachMapElem
	BPFFuncSnprintf
	BPFFuncSysBpf
	BPFFuncBtfFindByNameKind
	BPFFuncSysClose
	BPFFuncTimerInit
	BPFFuncTimerSetCallback
	BPFFuncTimerStart
	BPFFuncTimerCancel
	BPFFuncGetFuncIp
	BPFFuncGetAttachCookie
	BPFFuncTaskPtRegs
	BPFFuncGetBranchSnapshot
	BPFFuncTraceVprintk
	BPFFuncSkcToUnixSock
	BPFFuncKallsymsLookupName
	BPFFuncFindVma
	BPFFuncLoop
	BPFFuncStrncmp
	BPFFuncGetFuncArg
	BPFFuncGetFuncRet
	BPFFuncGetFuncArgCnt
	BPFFuncGetRetval
	BPFFuncSetRetval
	BPFFuncXdpGetBuffLen
	BPFFuncXdpLoadBytes
	BPFFuncXdpStoreBytes
	BPFFuncCopyFromUserTask
	BPFFuncSkbSetTstamp
	BPFFuncImaFileHash
	BPFFuncKptrXchg
	BPFFuncMapLookupPercpuElem
	BPFFuncSkcToMptcpSock
	BPFFuncDynptrFromMem
	BPFFuncRingbufReserveDynptr
	BPFFuncRingbufSubmitDynptr
	BPFFuncRingbufDiscardDynptr
	BPFFuncDynptrRead
	BPFFuncDynptrWrite
	BPFFuncDynptrData
	BPFFuncTcpRawGenSyncookieIpv4
	BPFFuncTcpRawGenSyncookieIpv6
	BPFFuncTcpRawCheckSyncookieIpv4
	BPFFuncTcpRawCheckSyncookieIpv6
	BPFFuncKtimeGetTaiNs
	BPFFuncUserRingbufDrain
	BPFFuncCgrpStorageGet
	BPFFuncCgrpStorageDelete
)

func (BPFFunc) String 

func (b BPFFunc) String() string

func (BPFFunc) Value 

func (b BPFFunc) Value() uint64
type BPFLink struct {
	// contains filtered or unexported fields
}

func (*BPFLink) Destroy 

func (l *BPFLink) Destroy() error

func (*BPFLink) DestroyLegacy 

func (l *BPFLink) DestroyLegacy(linkType LinkType) error

func (*BPFLink) FileDescriptor 

func (l *BPFLink) FileDescriptor() int

func (*BPFLink) GetFd deprecated 

func (l *BPFLink) GetFd() int

Deprecated: use BPFLink.FileDescriptor() instead.

func (*BPFLink) Pin 

func (l *BPFLink) Pin(pinPath string) error

func (*BPFLink) Reader 

func (l *BPFLink) Reader() (*BPFLinkReader, error)

func (*BPFLink) Unpin 

func (l *BPFLink) Unpin() error

type BPFLinkReader 

type BPFLinkReader struct {
	// contains filtered or unexported fields
}

BPFLinkReader read data from a BPF link

func (*BPFLinkReader) Close 

func (i *BPFLinkReader) Close() error

func (*BPFLinkReader) Read 

func (i *BPFLinkReader) Read(p []byte) (n int, err error)

type BPFMap 

type BPFMap struct {
	// contains filtered or unexported fields
}

BPFMap is a wrapper around a libbpf bpf_map.

func (*BPFMap) AttachStructOps 

func (m *BPFMap) AttachStructOps() (*BPFLink, error)

func (*BPFMap) Autocreate 

func (m *BPFMap) Autocreate() bool

func (*BPFMap) BTFKeyTypeID 

func (m *BPFMap) BTFKeyTypeID() uint32

func (*BPFMap) BTFValueTypeID 

func (m *BPFMap) BTFValueTypeID() uint32

func (*BPFMap) DeleteKey 

func (m *BPFMap) DeleteKey(key unsafe.Pointer) error

DeleteKey removes a specified key and its associated value from the BPFMap.

This function accepts an unsafe.Pointer that references the key to be removed from the map. All basic types, and structs are supported as keys.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

func (*BPFMap) DeleteKeyBatch 

func (m *BPFMap) DeleteKeyBatch(keys unsafe.Pointer, count uint32) (uint32, error)

DeleteKeyBatch deletes multiple elements from the map by specified keys.

The first argument, keys, is a pointer to an array or slice of keys which will be deleted.

The last argument, count, is the number of keys to delete.

It returns the number of elements that were deleted.

The API can delete fewer elements than requested even though the underlying logic received -1. For checking if the deleted elements are partial, you can compare the number of elements returned with the passed count. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) FileDescriptor 

func (m *BPFMap) FileDescriptor() int

func (*BPFMap) GetFd deprecated 

func (m *BPFMap) GetFd() int

Deprecated: use BPFMap.FileDescriptor() instead.

func (*BPFMap) GetMaxEntries deprecated 

func (m *BPFMap) GetMaxEntries() uint32

Deprecated: use BPFMap.MaxEntries() instead.

func (*BPFMap) GetModule deprecated 

func (m *BPFMap) GetModule() *Module

Deprecated: use BPFMap.Module() instead.

func (*BPFMap) GetName deprecated 

func (m *BPFMap) GetName() string

Deprecated: use BPFMap.Name() instead.

func (*BPFMap) GetNextKey 

func (m *BPFMap) GetNextKey(key unsafe.Pointer, nextKey unsafe.Pointer) error

GetNextKey allows to iterate BPF map keys by fetching next key that follows current key.

func (*BPFMap) GetPinPath deprecated 

func (m *BPFMap) GetPinPath() string

Deprecated: use BPFMap.PinPath() instead.

func (*BPFMap) GetValue 

func (m *BPFMap) GetValue(key unsafe.Pointer) ([]byte, error)

GetValue retrieves the value associated with a given key in the BPFMap.

This function accepts an unsafe.Pointer to the key value to be searched in the map, and it returns the corresponding value as a slice of bytes. All basic types, and structs are supported as keys.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

For example:

key := []byte{'a', 'b', 'c'} keyPtr := unsafe.Pointer(&key[0]) bpfmap.GetValue(keyPtr)

func (*BPFMap) GetValueAndDeleteBatch 

func (m *BPFMap) GetValueAndDeleteBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, uint32, error)

GetValueAndDeleteBatch allows for batch lookup and deletion of elements where each element is deleted after being retrieved from the map.

The first argument, keys, is a pointer to an array or slice of keys which will be populated with the keys returned from this operation.

This API allows for batch lookups and deletion of multiple keys, potentially in steps over multiple iterations. For example, you provide the last key seen (or nil) for the startKey, and the first key to start the next iteration with in nextKey. Once the first iteration is complete you can provide the last key seen in the previous iteration as the startKey for the next iteration and repeat until nextKey is nil.

The last argument, count, is the number of keys to lookup and delete.

It returns the associated values as a slice of slices of bytes and the number of elements that were retrieved and deleted.

The API can return partial results even though the underlying logic received -1. In this case, no error will be returned. For checking if the returned values are partial, you can compare the number of elements returned with the passed count. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) GetValueAndDeleteKey 

func (m *BPFMap) GetValueAndDeleteKey(key unsafe.Pointer) ([]byte, error)

GetValueAndDeleteKey retrieves the value associated with a given key and delete the key in the BPFMap. It returns the value as a slice of bytes.

func (*BPFMap) GetValueAndDeleteKeyFlags 

func (m *BPFMap) GetValueAndDeleteKeyFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

GetValueAndDeleteKeyFlags retrieves the value associated with a given key and delete the key in the BPFMap, with the specified flags. It returns the value as a slice of bytes.

func (*BPFMap) GetValueBatch 

func (m *BPFMap) GetValueBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, uint32, error)

GetValueBatch allows for batch lookups of multiple keys from the map.

The first argument, keys, is a pointer to an array or slice of keys which will be populated with the keys returned from this operation.

This API allows for batch lookups of multiple keys, potentially in steps over multiple iterations. For example, you provide the last key seen (or nil) for the startKey, and the first key to start the next iteration with in nextKey. Once the first iteration is complete you can provide the last key seen in the previous iteration as the startKey for the next iteration and repeat until nextKey is nil.

The last argument, count, is the number of keys to lookup.

It returns the associated values as a slice of slices of bytes and the number of elements that were retrieved.

The API can return partial results even though the underlying logic received -1. In this case, no error will be returned. For checking if the returned values are partial, you can compare the number of elements returned with the passed count. See the comment in `BPFMapLow.GetValueBatch` for more context.

func (*BPFMap) GetValueFlags 

func (m *BPFMap) GetValueFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

func (*BPFMap) GetValueReadInto deprecated 

func (m *BPFMap) GetValueReadInto(key unsafe.Pointer, value *[]byte) error

Deprecated: use BPFMap.GetValue() or BPFMap.GetValueFlags() instead, since they already calculate the value size for per-cpu maps.

func (*BPFMap) IfIndex 

func (m *BPFMap) IfIndex() uint32

func (*BPFMap) InitialValue 

func (m *BPFMap) InitialValue() ([]byte, error)

func (*BPFMap) InnerMapInfo 

func (m *BPFMap) InnerMapInfo() (*BPFMapInfo, error)

InnerMap retrieves the inner map prototype information associated with a BPFMap that represents a map of maps.

NOTE: It must be called before the module is loaded, since it is a prototype destroyed right after the outer map is created.

Reference: https://lore.kernel.org/bpf/20200429002739.48006-4-andriin@fb.com/

func (*BPFMap) IsPinned 

func (m *BPFMap) IsPinned() bool

func (*BPFMap) Iterator 

func (m *BPFMap) Iterator() *BPFMapIterator

func (*BPFMap) KeySize 

func (m *BPFMap) KeySize() int

func (*BPFMap) LookupAndDeleteElem 

func (m *BPFMap) LookupAndDeleteElem(
	key unsafe.Pointer,
	value unsafe.Pointer,
	valueSize uint64,
	flags MapFlag,
) error

LookupAndDeleteElem stores the value associated with a given key into the provided unsafe.Pointer and deletes the key from the BPFMap.

func (*BPFMap) MapExtra 

func (m *BPFMap) MapExtra() uint64

func (*BPFMap) MapFlags 

func (m *BPFMap) MapFlags() MapFlag

func (*BPFMap) MaxEntries 

func (m *BPFMap) MaxEntries() uint32

MaxEntries returns the capacity of the BPFMap.

For ring and perf buffer types, this returns the capacity in bytes.

func (*BPFMap) Module 

func (m *BPFMap) Module() *Module

func (*BPFMap) Name 

func (m *BPFMap) Name() string

func (*BPFMap) Pin 

func (m *BPFMap) Pin(pinPath string) error

func (*BPFMap) PinPath 

func (m *BPFMap) PinPath() string

func (*BPFMap) Resize deprecated 

func (m *BPFMap) Resize(maxEntries uint32) error

Deprecated: use BPFMap.SetMaxEntries() instead.

func (*BPFMap) ReuseFD 

func (m *BPFMap) ReuseFD(fd int) error

ReuseFD associates the BPFMap instance with the provided map file descriptor.

This function is useful for reusing a map that was previously created by a different process. By passing the file descriptor of the existing map, the current BPFMap instance becomes linked to that map.

NOTE: The function closes the current file descriptor associated with the BPFMap instance and replaces it with a duplicated descriptor pointing to the given fd. As a result, the instance original file descriptor becomes invalid, and all associated information is overwritten.

func (*BPFMap) SetAutocreate 

func (m *BPFMap) SetAutocreate(autocreate bool) error

Autocreate sets whether libbpf has to auto-create BPF map during BPF object load phase.

func (*BPFMap) SetInitialValue 

func (m *BPFMap) SetInitialValue(value unsafe.Pointer) error

func (*BPFMap) SetInnerMap 

func (m *BPFMap) SetInnerMap(templateMapFD int) error

SetInnerMap configures the inner map prototype for a BPFMap that represents a map of maps.

This function accepts the file descriptor of another map, which will serve as a prototype.

NOTE: It must be called before the module is loaded.

func (*BPFMap) SetKeySize 

func (m *BPFMap) SetKeySize(size uint32) error

SetKeySize sets the key size to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) SetMaxEntries 

func (m *BPFMap) SetMaxEntries(maxEntries uint32) error

SetMaxEntries sets the capacity of the BPFMap to the given maxEntries value.

This function must be called after BPF module initialization and before loading the module with BPFLoadObject, enabling customization of the map capacity.

For ring and perf buffer types, maxEntries represents the capacity in bytes.

func (*BPFMap) SetPinPath 

func (m *BPFMap) SetPinPath(pinPath string) error

func (*BPFMap) SetType 

func (m *BPFMap) SetType(mapType MapType) error

SetType assigns a specific type to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) SetValueSize 

func (m *BPFMap) SetValueSize(size uint32) error

SetValueSize sets the value size to a BPFMap instance that is not yet associated with a file descriptor.

func (*BPFMap) Type 

func (m *BPFMap) Type() MapType

func (*BPFMap) Unpin 

func (m *BPFMap) Unpin(pinPath string) error

func (*BPFMap) Update 

func (m *BPFMap) Update(key, value unsafe.Pointer) error

Update inserts or updates value in BPFMap that corresponds to a given key.

This function accepts unsafe.Pointer references to both the key and value. All basic types, and structs are supported.

NOTE: Slices and arrays are supported, but references should point to the first element in the slice or array, instead of the slice or array itself. This is crucial to prevent undefined behavior.

For example:

key := 1 value := []byte{'a', 'b', 'c'} keyPtr := unsafe.Pointer(&key) valuePtr := unsafe.Pointer(&value[0]) bpfmap.Update(keyPtr, valuePtr)

func (*BPFMap) UpdateBatch 

func (m *BPFMap) UpdateBatch(keys, values unsafe.Pointer, count uint32) (uint32, error)

UpdateBatch updates multiple elements in the map by specified keys and their corresponding values.

The first argument, keys, is a pointer to an array or slice of keys which will be updated using the second argument, values.

The last argument, count, is the number of keys to update.

It returns the number of elements that were updated.

The API can update fewer elements than requested even though the underlying logic received -1. This can happen if the map is full and the update operation fails for some of the keys. In this case, no error will be returned. For checking if the updated values are partial, you can compare the number of elements returned with the passed count. See the comment in `BPFMapLow.GetValueBatch` and `BPFMapLow.UpdateBatch` for more context.

func (*BPFMap) UpdateValueFlags 

func (m *BPFMap) UpdateValueFlags(key, value unsafe.Pointer, flags MapFlag) error

func (*BPFMap) ValueSize 

func (m *BPFMap) ValueSize() int

type BPFMapCreateOpts 

type BPFMapCreateOpts struct {
	BTFFD                 uint32
	BTFKeyTypeID          uint32
	BTFValueTypeID        uint32
	BTFVmlinuxValueTypeID uint32
	InnerMapFD            uint32
	MapFlags              uint32
	MapExtra              uint64
	NumaNode              uint32
	MapIfIndex            uint32
}

BPFMapCreateOpts mirrors the C structure bpf_map_create_opts.

type BPFMapInfo 

type BPFMapInfo struct {
	Type                  MapType
	ID                    uint32
	KeySize               uint32
	ValueSize             uint32
	MaxEntries            uint32
	MapFlags              uint32
	Name                  string
	IfIndex               uint32
	BTFVmlinuxValueTypeID uint32
	NetnsDev              uint64
	NetnsIno              uint64
	BTFID                 uint32
	BTFKeyTypeID          uint32
	BTFValueTypeID        uint32
	MapExtra              uint64
}

BPFMapInfo mirrors the C structure bpf_map_info.

func GetMapInfoByFD 

func GetMapInfoByFD(fd int) (*BPFMapInfo, error)

GetMapInfoByFD returns the BPFMapInfo for the map with the given file descriptor.

type BPFMapIterator 

type BPFMapIterator struct {
	// contains filtered or unexported fields
}

BPFMapIterator iterates over keys in a BPF map.

func (*BPFMapIterator) Err 

func (it *BPFMapIterator) Err() error

Err returns the last error that ocurred while table.Iter or iter.Next.

func (*BPFMapIterator) Key 

func (it *BPFMapIterator) Key() []byte

Key returns the current key value of the iterator, if the most recent call to Next returned true. The slice is valid only until the next call to Next.

func (*BPFMapIterator) Next 

func (it *BPFMapIterator) Next() bool

Next advances the iterator to the next key in the map.

type BPFMapLow 

type BPFMapLow struct {
	// contains filtered or unexported fields
}

BPFMapLow provides a low-level interface to BPF maps. Its methods follow the BPFMap naming convention.

func CreateMap 

func CreateMap(mapType MapType, mapName string, keySize, valueSize, maxEntries int, opts *BPFMapCreateOpts) (*BPFMapLow, error)

CreateMap creates a new BPF map with the given parameters.

func GetMapByID 

func GetMapByID(id uint32) (*BPFMapLow, error)

GetMapByID returns a BPFMapLow instance for the map with the given ID.

func (*BPFMapLow) DeleteKey 

func (m *BPFMapLow) DeleteKey(key unsafe.Pointer) error

func (*BPFMapLow) DeleteKeyBatch 

func (m *BPFMapLow) DeleteKeyBatch(keys unsafe.Pointer, count uint32) (uint32, error)

DeleteKeyBatch deletes the elements with the given keys from the map. It returns the number of deleted elements.

func (*BPFMapLow) FileDescriptor 

func (m *BPFMapLow) FileDescriptor() int

func (*BPFMapLow) GetNextKey 

func (m *BPFMapLow) GetNextKey(key unsafe.Pointer, nextKey unsafe.Pointer) error

func (*BPFMapLow) GetValue 

func (m *BPFMapLow) GetValue(key unsafe.Pointer) ([]byte, error)

func (*BPFMapLow) GetValueAndDeleteBatch 

func (m *BPFMapLow) GetValueAndDeleteBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, uint32, error)

GetValueAndDeleteBatch gets the values with the given keys from the map and deletes them. It returns the values and the number of deleted elements.

func (*BPFMapLow) GetValueAndDeleteKey 

func (m *BPFMapLow) GetValueAndDeleteKey(key unsafe.Pointer) ([]byte, error)

func (*BPFMapLow) GetValueAndDeleteKeyFlags 

func (m *BPFMapLow) GetValueAndDeleteKeyFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

func (*BPFMapLow) GetValueBatch 

func (m *BPFMapLow) GetValueBatch(keys, startKey, nextKey unsafe.Pointer, count uint32) ([][]byte, uint32, error)

GetValueBatch gets the values with the given keys from the map. It returns the values and the number of read elements.

func (*BPFMapLow) GetValueFlags 

func (m *BPFMapLow) GetValueFlags(key unsafe.Pointer, flags MapFlag) ([]byte, error)

func (*BPFMapLow) Iterator 

func (m *BPFMapLow) Iterator() *BPFMapIterator

func (*BPFMapLow) KeySize 

func (m *BPFMapLow) KeySize() int

func (*BPFMapLow) LookupAndDeleteElem 

func (m *BPFMapLow) LookupAndDeleteElem(
	key unsafe.Pointer,
	value unsafe.Pointer,
) error

func (*BPFMapLow) LookupAndDeleteElemFlags 

func (m *BPFMapLow) LookupAndDeleteElemFlags(
	key unsafe.Pointer,
	value unsafe.Pointer,
	flags MapFlag,
) error

func (*BPFMapLow) MaxEntries 

func (m *BPFMapLow) MaxEntries() uint32

func (*BPFMapLow) Name 

func (m *BPFMapLow) Name() string

func (*BPFMapLow) ReuseFD 

func (m *BPFMapLow) ReuseFD(fd int) error

func (*BPFMapLow) Type 

func (m *BPFMapLow) Type() MapType

func (*BPFMapLow) Update 

func (m *BPFMapLow) Update(key, value unsafe.Pointer) error

func (*BPFMapLow) UpdateBatch 

func (m *BPFMapLow) UpdateBatch(keys, values unsafe.Pointer, count uint32) (uint32, error)

UpdateBatch updates the elements with the given keys and values in the map. It returns the number of updated elements.

func (*BPFMapLow) UpdateValueFlags 

func (m *BPFMapLow) UpdateValueFlags(key, value unsafe.Pointer, flags MapFlag) error

func (*BPFMapLow) ValueSize 

func (m *BPFMapLow) ValueSize() int

type BPFObjectIterator 

type BPFObjectIterator struct {
	// contains filtered or unexported fields
}

BPFObjectProgramIterator iterates over programs and maps in a BPF object

func (*BPFObjectIterator) NextMap 

func (it *BPFObjectIterator) NextMap() *BPFMap

func (*BPFObjectIterator) NextProgram 

func (it *BPFObjectIterator) NextProgram() *BPFProg

type BPFProg 

type BPFProg struct {
	// contains filtered or unexported fields
}

func (*BPFProg) AttachCgroup 

func (p *BPFProg) AttachCgroup(cgroupV2DirPath string) (*BPFLink, error)

AttachCgroup attaches the BPFProg to a cgroup described by given fd.

func (*BPFProg) AttachCgroupLegacy 

func (p *BPFProg) AttachCgroupLegacy(cgroupV2DirPath string, attachType BPFAttachType) (*BPFLink, error)

AttachCgroupLegacy attaches the BPFProg to a cgroup described by the given fd. It first tries to use the most recent attachment method and, if that does not work, instead of failing, it tries the legacy way: to attach the cgroup eBPF program without previously creating a link. This allows attaching cgroup eBPF ingress/egress in older kernels. Note: the first attempt error message is filtered out inside libbpf_print_fn() as it is actually a feature probe attempt as well.

Related kernel commit: https://github.com/torvalds/linux/commit/af6eea57437a

func (*BPFProg) AttachGeneric 

func (p *BPFProg) AttachGeneric() (*BPFLink, error)

AttachGeneric is used to attach the BPF program using autodetection for the attach target. You can specify the destination in BPF code via the SEC() such as `SEC("fentry/some_kernel_func")`

func (*BPFProg) AttachGenericFD 

func (p *BPFProg) AttachGenericFD(targetFd int, attachType BPFAttachType, flags AttachFlag) error

AttachGenericFD attaches the BPFProgram to a targetFd at the specified attachType hook.

func (*BPFProg) AttachIter 

func (p *BPFProg) AttachIter(opts IterOpts) (*BPFLink, error)

func (*BPFProg) AttachKprobe 

func (p *BPFProg) AttachKprobe(symbol string) (*BPFLink, error)

AttachKprobe attaches the BPFProgram to the given symbol name.

func (*BPFProg) AttachKprobeOffset 

func (p *BPFProg) AttachKprobeOffset(offset uint64) (*BPFLink, error)

AttachKprobeOnOffset attaches the BPFProgram to the given offset.

func (*BPFProg) AttachKretprobe 

func (p *BPFProg) AttachKretprobe(symbol string) (*BPFLink, error)

AttachKretprobe attaches the BPFProgram to the given symbol name (for return).

func (*BPFProg) AttachKretprobeOnOffset 

func (p *BPFProg) AttachKretprobeOnOffset(offset uint64) (*BPFLink, error)

AttachKretprobeOnOffset attaches the BPFProgram to the given offset (for return).

func (*BPFProg) AttachLSM 

func (p *BPFProg) AttachLSM() (*BPFLink, error)

func (*BPFProg) AttachNetns 

func (p *BPFProg) AttachNetns(networkNamespacePath string) (*BPFLink, error)

func (*BPFProg) AttachPerfEvent 

func (p *BPFProg) AttachPerfEvent(fd int) (*BPFLink, error)

func (*BPFProg) AttachRawTracepoint 

func (p *BPFProg) AttachRawTracepoint(tpEvent string) (*BPFLink, error)

func (*BPFProg) AttachTCX 

func (p *BPFProg) AttachTCX(deviceName string) (*BPFLink, error)

AttachTCX attaches the BPF program via the TCX helper. The behaviour is analogous to AttachXDP but uses the `bpf_program__attach_tcx` call introduced in newer kernels. The resulting BPFLink has its linkType set to TCX so consumers can distinguish these links when iterating or printing debug information.

func (*BPFProg) AttachTracepoint 

func (p *BPFProg) AttachTracepoint(category, name string) (*BPFLink, error)

func (*BPFProg) AttachURetprobe 

func (p *BPFProg) AttachURetprobe(pid int, path string, offset uint64) (*BPFLink, error)

AttachURetprobe attaches the BPFProgram to exit of the symbol in the library or binary at 'path' which can be relative or absolute. A pid can be provided to attach to, or -1 can be specified to attach to all processes

func (*BPFProg) AttachURetprobeMulti 

func (p *BPFProg) AttachURetprobeMulti(pid int, path string, offsets, cookies []uint64) (*BPFLink, error)

AttachURetprobeMulti attaches the BPFProgram to exit of the symbol in the library or binary at 'path' which can be relative or absolute, using the uprobe_multi link, allowing to specify multiple offsets. A pid can be provided to attach to, or -1 can be specified to attach to all processes. func_pattern argument to libbpf bpf_program__attach_uprobe_multi() which accepts a regular expression to specify functions to attach BPF program to, is currently not supported.

func (*BPFProg) AttachUSDT 

func (p *BPFProg) AttachUSDT(pid int, binaryPath string, provider string, name string) (*BPFLink, error)

AttachUSDT attaches the BPFProgram to the USDT static marker in the library or binary at 'binaryPath' which can be relative or absolute. A pid can be provided to attach to, or -1 can be specified to attach to all processes.

func (*BPFProg) AttachUprobe 

func (p *BPFProg) AttachUprobe(pid int, path string, offset uint64) (*BPFLink, error)

AttachUprobe attaches the BPFProgram to entry of the symbol in the library or binary at 'path' which can be relative or absolute. A pid can be provided to attach to, or -1 can be specified to attach to all processes

func (*BPFProg) AttachUprobeMulti 

func (p *BPFProg) AttachUprobeMulti(pid int, path string, offsets, cookies []uint64) (*BPFLink, error)

AttachUprobeMulti attaches the BPFProgram to entry of the symbol in the library or binary at 'path' which can be relative or absolute, using the uprobe_multi link, allowing to specify multiple offsets. A pid can be provided to attach to, or -1 can be specified to attach to all processes. func_pattern argument to libbpf bpf_program__attach_uprobe_multi() which accepts a regular expression to specify functions to attach BPF program to, is currently not supported.

func (*BPFProg) AttachXDP 

func (p *BPFProg) AttachXDP(deviceName string) (*BPFLink, error)

func (*BPFProg) AttachXDPLegacy 

func (p *BPFProg) AttachXDPLegacy(deviceName string, flag XDPFlags) error

func (*BPFProg) Autoattach 

func (p *BPFProg) Autoattach() bool

func (*BPFProg) Autoload 

func (p *BPFProg) Autoload() bool

func (*BPFProg) DetachCgroupLegacy 

func (p *BPFProg) DetachCgroupLegacy(cgroupV2DirPath string, attachType BPFAttachType) error

DetachCgroupLegacy detaches the BPFProg from a cgroup described by the given fd. This is needed because in legacy attachment there is no BPFLink, just a fake one (kernel did not support it, nor libbpf). This function should be called by the (*BPFLink)->Destroy() function, since BPFLink is emulated (so users don´t need to distinguish between regular and legacy cgroup detachments).

func (*BPFProg) DetachGenericFD 

func (p *BPFProg) DetachGenericFD(targetFd int, attachType BPFAttachType) error

DetachGenericFD detaches the BPFProgram associated with the targetFd at the hook specified by attachType.

func (*BPFProg) DetachXDPLegacy 

func (p *BPFProg) DetachXDPLegacy(deviceName string, flag XDPFlags) error

func (*BPFProg) FileDescriptor 

func (p *BPFProg) FileDescriptor() int

func (*BPFProg) GetFd deprecated 

func (p *BPFProg) GetFd() int

Deprecated: use BPFProg.FileDescriptor() instead.

func (*BPFProg) GetModule 

func (p *BPFProg) GetModule() *Module

func (*BPFProg) GetName deprecated 

func (p *BPFProg) GetName() string

Deprecated: use BPFProg.Name() instead.

func (*BPFProg) GetPinPath deprecated 

func (p *BPFProg) GetPinPath() string

Deprecated: use BPFProg.PinPath() instead.

func (*BPFProg) GetSectionName deprecated 

func (p *BPFProg) GetSectionName() string

Deprecated: use BPFProg.SectionName() instead.

func (*BPFProg) GetType 

func (p *BPFProg) GetType() BPFProgType

func (*BPFProg) Name 

func (p *BPFProg) Name() string

func (*BPFProg) Pin 

func (p *BPFProg) Pin(path string) error

func (*BPFProg) PinPath 

func (p *BPFProg) PinPath() string

func (*BPFProg) Run 

func (p *BPFProg) Run(opts *RunOpts) error

Run executes the eBPF program without attaching it to actual hooks, filling the results in the provided RunOpts. Reference:

Example Usage: 

/*
SEC("tc")
int test(struct __sk_buff *skb)
{
    return foo() ? 1 : 0;
}
*/

func TestFunc(t *testing.T) {
    ...
    prog, _ := module.GetProgram("test")
    opts := RunOpts{
        DataIn: make([]byte, 0, 14),
        DataSizeIn: 14,
        DataOut: make([]byte, 0, 14),
        DataSizeOut: 14,
        Repeat: 1,
    }
    prog.Run(&opts)
    if opts.RetVal != 1 {
        t.Errorf("result = %d; want 1", opts.RetVal)
    }
}

func (*BPFProg) SectionName 

func (p *BPFProg) SectionName() string

func (*BPFProg) SetAttachTarget 

func (p *BPFProg) SetAttachTarget(attachProgFD int, attachFuncName string) error

SetAttachTarget can be used to specify the program and/or function to attach the BPF program to. To attach to a kernel function specify attachProgFD as 0

func (*BPFProg) SetAttachType deprecated 

func (p *BPFProg) SetAttachType(attachType BPFAttachType)

Deprecated: use BPFProg.SetExpectedAttachType() instead.

func (*BPFProg) SetAutoattach 

func (p *BPFProg) SetAutoattach(autoload bool)

func (*BPFProg) SetAutoload 

func (p *BPFProg) SetAutoload(autoload bool) error

func (*BPFProg) SetExpectedAttachType 

func (p *BPFProg) SetExpectedAttachType(attachType BPFAttachType) error

func (*BPFProg) SetProgramType deprecated 

func (p *BPFProg) SetProgramType(progType BPFProgType)

Deprecated: use BPFProg.SetType() instead.

func (*BPFProg) SetType 

func (p *BPFProg) SetType(progType BPFProgType) error

func (*BPFProg) Unpin 

func (p *BPFProg) Unpin(path string) error

type BPFProgType 

type BPFProgType uint32

BPFProgType is an enum as defined in https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/bpf.h 

const (
	BPFProgTypeUnspec                BPFProgType = C.BPF_PROG_TYPE_UNSPEC
	BPFProgTypeSocketFilter          BPFProgType = C.BPF_PROG_TYPE_SOCKET_FILTER
	BPFProgTypeKprobe                BPFProgType = C.BPF_PROG_TYPE_KPROBE
	BPFProgTypeSchedCls              BPFProgType = C.BPF_PROG_TYPE_SCHED_CLS
	BPFProgTypeSchedAct              BPFProgType = C.BPF_PROG_TYPE_SCHED_ACT
	BPFProgTypeTracepoint            BPFProgType = C.BPF_PROG_TYPE_TRACEPOINT
	BPFProgTypeXdp                   BPFProgType = C.BPF_PROG_TYPE_XDP
	BPFProgTypePerfEvent             BPFProgType = C.BPF_PROG_TYPE_PERF_EVENT
	BPFProgTypeCgroupSkb             BPFProgType = C.BPF_PROG_TYPE_CGROUP_SKB
	BPFProgTypeCgroupSock            BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCK
	BPFProgTypeLwtIn                 BPFProgType = C.BPF_PROG_TYPE_LWT_IN
	BPFProgTypeLwtOut                BPFProgType = C.BPF_PROG_TYPE_LWT_OUT
	BPFProgTypeLwtXmit               BPFProgType = C.BPF_PROG_TYPE_LWT_XMIT
	BPFProgTypeSockOps               BPFProgType = C.BPF_PROG_TYPE_SOCK_OPS
	BPFProgTypeSkSkb                 BPFProgType = C.BPF_PROG_TYPE_SK_SKB
	BPFProgTypeCgroupDevice          BPFProgType = C.BPF_PROG_TYPE_CGROUP_DEVICE
	BPFProgTypeSkMsg                 BPFProgType = C.BPF_PROG_TYPE_SK_MSG
	BPFProgTypeRawTracepoint         BPFProgType = C.BPF_PROG_TYPE_RAW_TRACEPOINT
	BPFProgTypeCgroupSockAddr        BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCK_ADDR
	BPFProgTypeLwtSeg6Local          BPFProgType = C.BPF_PROG_TYPE_LWT_SEG6LOCAL
	BPFProgTypeLircMode2             BPFProgType = C.BPF_PROG_TYPE_LIRC_MODE2
	BPFProgTypeSkReuseport           BPFProgType = C.BPF_PROG_TYPE_SK_REUSEPORT
	BPFProgTypeFlowDissector         BPFProgType = C.BPF_PROG_TYPE_FLOW_DISSECTOR
	BPFProgTypeCgroupSysctl          BPFProgType = C.BPF_PROG_TYPE_CGROUP_SYSCTL
	BPFProgTypeRawTracepointWritable BPFProgType = C.BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE
	BPFProgTypeCgroupSockopt         BPFProgType = C.BPF_PROG_TYPE_CGROUP_SOCKOPT
	BPFProgTypeTracing               BPFProgType = C.BPF_PROG_TYPE_TRACING
	BPFProgTypeStructOps             BPFProgType = C.BPF_PROG_TYPE_STRUCT_OPS
	BPFProgTypeExt                   BPFProgType = C.BPF_PROG_TYPE_EXT
	BPFProgTypeLsm                   BPFProgType = C.BPF_PROG_TYPE_LSM
	BPFProgTypeSkLookup              BPFProgType = C.BPF_PROG_TYPE_SK_LOOKUP
	BPFProgTypeSyscall               BPFProgType = C.BPF_PROG_TYPE_SYSCALL
	BPFProgTypeNetfilter             BPFProgType = C.BPF_PROG_TYPE_NETFILTER
)

func (BPFProgType) Name 

func (t BPFProgType) Name() string

func (BPFProgType) String 

func (t BPFProgType) String() string

func (BPFProgType) Value deprecated 

func (t BPFProgType) Value() uint64

Deprecated: Convert type directly instead.

type Callbacks 

type Callbacks struct {
	Log        func(level int, msg string)
	LogFilters []func(libLevel int, msg string) bool
}

Callbacks stores the callbacks to be used by libbpfgo

type IterOpts 

type IterOpts struct {
	MapFd           int
	CgroupIterOrder BPFCgroupIterOrder
	CgroupFd        int
	CgroupId        uint64
	Tid             int
	Pid             int
	PidFd           int
}

type LibbpfStrictMode 

type LibbpfStrictMode uint32

LibbpfStrictMode is an enum as defined in https://github.com/libbpf/libbpf/blob/2cd2d03f63242c048a896179398c68d2dbefe3d6/src/libbpf_legacy.h#L23 

const (
	LibbpfStrictModeAll               LibbpfStrictMode = C.LIBBPF_STRICT_ALL
	LibbpfStrictModeNone              LibbpfStrictMode = C.LIBBPF_STRICT_NONE
	LibbpfStrictModeCleanPtrs         LibbpfStrictMode = C.LIBBPF_STRICT_CLEAN_PTRS
	LibbpfStrictModeDirectErrs        LibbpfStrictMode = C.LIBBPF_STRICT_DIRECT_ERRS
	LibbpfStrictModeSecName           LibbpfStrictMode = C.LIBBPF_STRICT_SEC_NAME
	LibbpfStrictModeNoObjectList      LibbpfStrictMode = C.LIBBPF_STRICT_NO_OBJECT_LIST
	LibbpfStrictModeAutoRlimitMemlock LibbpfStrictMode = C.LIBBPF_STRICT_AUTO_RLIMIT_MEMLOCK
	LibbpfStrictModeMapDefinitions    LibbpfStrictMode = C.LIBBPF_STRICT_MAP_DEFINITIONS
)

func (LibbpfStrictMode) String 

func (b LibbpfStrictMode) String() (str string)

type LinkType 

type LinkType int
const (
	Tracepoint LinkType = iota
	RawTracepoint
	Kprobe
	Kretprobe
	LSM
	PerfEvent
	Uprobe
	Uretprobe
	Tracing
	XDP
	TCX // traffic control eXpress (new attachment type)
	Cgroup
	CgroupLegacy
	Netns
	Iter
	StructOps
	USDT
)

func (LinkType) String 

func (t LinkType) String() string

String returns a human‑readable representation of the link type. This helper is useful for debug output and tests.

type MapFlag 

type MapFlag uint32
const (
	MapFlagUpdateAny     MapFlag = iota // create new element or update existing
	MapFlagUpdateNoExist                // create new element if it didn't exist
	MapFlagUpdateExist                  // update existing element
	MapFlagFLock                        // spin_lock-ed map_lookup/map_update
)

type MapType 

type MapType uint32
const (
	MapTypeUnspec              MapType = C.BPF_MAP_TYPE_UNSPEC
	MapTypeHash                MapType = C.BPF_MAP_TYPE_HASH
	MapTypeArray               MapType = C.BPF_MAP_TYPE_ARRAY
	MapTypeProgArray           MapType = C.BPF_MAP_TYPE_PROG_ARRAY
	MapTypePerfEventArray      MapType = C.BPF_MAP_TYPE_PERF_EVENT_ARRAY
	MapTypePerCPUHash          MapType = C.BPF_MAP_TYPE_PERCPU_HASH
	MapTypePerCPUArray         MapType = C.BPF_MAP_TYPE_PERCPU_ARRAY
	MapTypeStackTrace          MapType = C.BPF_MAP_TYPE_STACK_TRACE
	MapTypeCgroupArray         MapType = C.BPF_MAP_TYPE_CGROUP_ARRAY
	MapTypeLRUHash             MapType = C.BPF_MAP_TYPE_LRU_HASH
	MapTypeLRUPerCPUHash       MapType = C.BPF_MAP_TYPE_LRU_PERCPU_HASH
	MapTypeLPMTrie             MapType = C.BPF_MAP_TYPE_LPM_TRIE
	MapTypeArrayOfMaps         MapType = C.BPF_MAP_TYPE_ARRAY_OF_MAPS
	MapTypeHashOfMaps          MapType = C.BPF_MAP_TYPE_HASH_OF_MAPS
	MapTypeDevMap              MapType = C.BPF_MAP_TYPE_DEVMAP
	MapTypeSockMap             MapType = C.BPF_MAP_TYPE_SOCKMAP
	MapTypeCPUMap              MapType = C.BPF_MAP_TYPE_CPUMAP
	MapTypeXSKMap              MapType = C.BPF_MAP_TYPE_XSKMAP
	MapTypeSockHash            MapType = C.BPF_MAP_TYPE_SOCKHASH
	MapTypeCgroupStorage       MapType = C.BPF_MAP_TYPE_CGROUP_STORAGE
	MapTypeReusePortSockArray  MapType = C.BPF_MAP_TYPE_REUSEPORT_SOCKARRAY
	MapTypePerCPUCgroupStorage MapType = C.BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE
	MapTypeQueue               MapType = C.BPF_MAP_TYPE_QUEUE
	MapTypeStack               MapType = C.BPF_MAP_TYPE_STACK
	MapTypeSKStorage           MapType = C.BPF_MAP_TYPE_SK_STORAGE
	MapTypeDevmapHash          MapType = C.BPF_MAP_TYPE_DEVMAP_HASH
	MapTypeStructOps           MapType = C.BPF_MAP_TYPE_STRUCT_OPS
	MapTypeRingbuf             MapType = C.BPF_MAP_TYPE_RINGBUF
	MapTypeInodeStorage        MapType = C.BPF_MAP_TYPE_INODE_STORAGE
	MapTypeTaskStorage         MapType = C.BPF_MAP_TYPE_TASK_STORAGE
	MapTypeBloomFilter         MapType = C.BPF_MAP_TYPE_BLOOM_FILTER
	MapTypeUserRingbuf         MapType = C.BPF_MAP_TYPE_USER_RINGBUF
	MapTypeCgrpStorage         MapType = C.BPF_MAP_TYPE_CGRP_STORAGE
	MapTypeArena               MapType = C.BPF_MAP_TYPE_ARENA
)

func (MapType) Name 

func (t MapType) Name() string

func (MapType) String 

func (t MapType) String() string

type Module 

type Module struct {
	// contains filtered or unexported fields
}

func NewModuleFromBuffer 

func NewModuleFromBuffer(bpfObjBuff []byte, bpfObjName string) (*Module, error)

func NewModuleFromBufferArgs 

func NewModuleFromBufferArgs(args NewModuleArgs) (*Module, error)

func NewModuleFromFile 

func NewModuleFromFile(bpfObjPath string) (*Module, error)

func NewModuleFromFileArgs 

func NewModuleFromFileArgs(args NewModuleArgs) (*Module, error)

func (*Module) AddRingBuf 

func (m *Module) AddRingBuf(ringBuf *RingBuffer, mapName string, eventsChan chan []byte) (bool, error)

func (*Module) AttachPrograms 

func (m *Module) AttachPrograms() error

AttachPrograms attach all loaded and no attached progs once like bpf_object__attach_skeleton

func (*Module) BPFLoadObject 

func (m *Module) BPFLoadObject() error

func (*Module) Close 

func (m *Module) Close()

func (*Module) DetachPrograms 

func (m *Module) DetachPrograms() error

DetachPrograms detach all attached progs once like bpf_object__detach_skeleton

func (*Module) GetMap 

func (m *Module) GetMap(mapName string) (*BPFMap, error)

func (*Module) GetProgram 

func (m *Module) GetProgram(progName string) (*BPFProg, error)

func (*Module) InitGlobalVariable 

func (m *Module) InitGlobalVariable(name string, value interface{}) error

InitGlobalVariable sets global variables (defined in .data or .rodata) in bpf code. It must be called before the BPF object is loaded.

func (*Module) InitPerfBuf 

func (m *Module) InitPerfBuf(mapName string, eventsChan chan []byte, lostChan chan uint64, pageCnt int) (*PerfBuffer, error)

func (*Module) InitRingBuf 

func (m *Module) InitRingBuf(mapName string, eventsChan chan []byte) (*RingBuffer, error)

func (*Module) InitUserRingBuf 

func (m *Module) InitUserRingBuf(mapName string, eventsChan chan []byte) (*UserRingBuffer, error)

func (*Module) Iterator 

func (m *Module) Iterator() *BPFObjectIterator

func (*Module) TcHookInit 

func (m *Module) TcHookInit() *TcHook

type NewModuleArgs 

type NewModuleArgs struct {
	KConfigFilePath string
	BTFObjPath      string
	BPFObjName      string
	BPFObjPath      string
	BPFObjBuff      []byte
	SkipMemlockBump bool
	KernelLogLevel  uint32
}

type PerfBuffer 

type PerfBuffer struct {
	// contains filtered or unexported fields
}

func (*PerfBuffer) Close 

func (pb *PerfBuffer) Close()

func (*PerfBuffer) Poll 

func (pb *PerfBuffer) Poll(timeout int)

Poll will wait until timeout in milliseconds to gather data from the perf buffer.

func (*PerfBuffer) Start deprecated 

func (pb *PerfBuffer) Start()

Deprecated: use PerfBuffer.Poll() instead.

func (*PerfBuffer) Stop 

func (pb *PerfBuffer) Stop()

type RingBuffer 

type RingBuffer struct {
	// contains filtered or unexported fields
}

func (*RingBuffer) Close 

func (rb *RingBuffer) Close()

func (*RingBuffer) Poll 

func (rb *RingBuffer) Poll(timeout int)

Poll will wait until timeout in milliseconds to gather data from the ring buffer.

func (*RingBuffer) Start deprecated 

func (rb *RingBuffer) Start()

Deprecated: use RingBuffer.Poll() instead.

func (*RingBuffer) Stop 

func (rb *RingBuffer) Stop()

type RunFlag 

type RunFlag uint32
const (
	RunFlagRunOnCPU      RunFlag = C.BPF_F_TEST_RUN_ON_CPU
	RunFlagXDPLiveFrames RunFlag = C.BPF_F_TEST_XDP_LIVE_FRAMES
)

type RunOpts 

type RunOpts struct {
	DataIn      []byte
	DataOut     []byte
	DataSizeIn  uint32
	DataSizeOut uint32
	CtxIn       []byte
	CtxOut      []byte
	CtxSizeIn   uint32
	CtxSizeOut  uint32
	RetVal      uint32
	Repeat      int
	Duration    time.Duration
	Flags       RunFlag
	CPU         uint32
	BatchSize   uint32
}

RunOpts mirrors the C structure bpf_test_run_opts.

type Symbol 

type Symbol struct {
	// contains filtered or unexported fields
}

type TcAttachPoint 

type TcAttachPoint uint32
const (
	BPFTcIngress       TcAttachPoint = C.BPF_TC_INGRESS
	BPFTcEgress        TcAttachPoint = C.BPF_TC_EGRESS
	BPFTcIngressEgress TcAttachPoint = C.BPF_TC_INGRESS | C.BPF_TC_EGRESS
	BPFTcCustom        TcAttachPoint = C.BPF_TC_CUSTOM
)

type TcFlags 

type TcFlags uint32
const (
	BpfTcFReplace TcFlags = C.BPF_TC_F_REPLACE
)

type TcHook 

type TcHook struct {
	// contains filtered or unexported fields
}

func (*TcHook) Attach 

func (hook *TcHook) Attach(tcOpts *TcOpts) error

func (*TcHook) Create 

func (hook *TcHook) Create() error

func (*TcHook) Destroy 

func (hook *TcHook) Destroy() error

func (*TcHook) Detach 

func (hook *TcHook) Detach(tcOpts *TcOpts) error

func (*TcHook) GetInterfaceIndex 

func (hook *TcHook) GetInterfaceIndex() int

func (*TcHook) Query 

func (hook *TcHook) Query(tcOpts *TcOpts) error

func (*TcHook) SetAttachPoint 

func (hook *TcHook) SetAttachPoint(attachPoint TcAttachPoint)

func (*TcHook) SetInterfaceByIndex 

func (hook *TcHook) SetInterfaceByIndex(ifaceIdx int)

func (*TcHook) SetInterfaceByName 

func (hook *TcHook) SetInterfaceByName(ifaceName string) error

func (*TcHook) SetParent 

func (hook *TcHook) SetParent(a int, b int)

type TcOpts 

type TcOpts struct {
	ProgFd   int
	Flags    TcFlags
	ProgId   uint
	Handle   uint
	Priority uint
}

type UserRingBuffer 

type UserRingBuffer struct {
	// contains filtered or unexported fields
}

func (*UserRingBuffer) Close 

func (rb *UserRingBuffer) Close()

func (*UserRingBuffer) Error 

func (rb *UserRingBuffer) Error() error

func (*UserRingBuffer) Start 

func (rb *UserRingBuffer) Start()

func (*UserRingBuffer) Stop 

func (rb *UserRingBuffer) Stop()

type XDPFlags 

type XDPFlags uint32
const (
	XDPFlagsUpdateIfNoExist XDPFlags = C.XDP_FLAGS_UPDATE_IF_NOEXIST
	XDPFlagsSkbMode         XDPFlags = C.XDP_FLAGS_SKB_MODE
	XDPFlagsDrvMode         XDPFlags = C.XDP_FLAGS_DRV_MODE
	XDPFlagsHwMode          XDPFlags = C.XDP_FLAGS_HW_MODE
	XDPFlagsReplace         XDPFlags = C.XDP_FLAGS_REPLACE
	XDPFlagsModes           XDPFlags = C.XDP_FLAGS_MODES
	XDPFlagsMask            XDPFlags = C.XDP_FLAGS_MASK
)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.