package link

import "github.com/cilium/ebpf/link"

Package link allows attaching eBPF programs to various kernel hooks.

Index ¶

• Variables
• type ID
• type Info
• type Iterator
• func (it *Iterator) Close()
• func (it *Iterator) Err() error
• func (it *Iterator) Next() bool
• func (it *Iterator) Take() Link
• type Link
• func LoadPinnedLink(fileName string, opts *ebpf.LoadPinOptions) (Link, error)
• func NewFromFD(fd int) (Link, error)
• func NewFromID(id ID) (Link, error)
• func NewLinkFromFD(fd int) (Link, error)
• type RawLink
• func AttachRawLink(opts RawLinkOptions) (*RawLink, error)
• func (l *RawLink) Close() error
• func (l *RawLink) FD() int
• func (l *RawLink) Info() (*Info, error)
• func (l *RawLink) IsPinned() bool
• func (l *RawLink) Pin(fileName string) error
• func (l *RawLink) Unpin() error
• func (l *RawLink) Update(new *ebpf.Program) error
• func (l *RawLink) UpdateArgs(opts RawLinkUpdateOptions) error
• type RawLinkOptions
• type RawLinkUpdateOptions
• type Type

Variables ¶

var ErrNotSupported = internal.ErrNotSupported

Types ¶

type ID ¶

type ID = sys.LinkID

ID uniquely identifies a BPF link.

type Info ¶

type Info struct {
	Type    Type
	ID      ID
	Program ebpf.ProgramID
	// contains filtered or unexported fields
}

Info contains metadata on a link.

type Iterator ¶

type Iterator struct {
	// The ID of the current link. Only valid after a call to Next
	ID ID
	// The current link. Only valid until a call to Next.
	// See Take if you want to retain the link.
	Link Link
	// contains filtered or unexported fields
}

Iterator allows iterating over links attached into the kernel.

func (*Iterator) Close ¶

func (it *Iterator) Close()

func (*Iterator) Err ¶

func (it *Iterator) Err() error

Err returns an error if iteration failed for some reason.

func (*Iterator) Next ¶

func (it *Iterator) Next() bool

Next retrieves the next link.

Returns true if another link was found. Call Iterator.Err after the function returns false.

func (*Iterator) Take ¶

func (it *Iterator) Take() Link

Take the ownership of the current link.

It's the callers responsibility to close the link.

type Link ¶

type Link interface {
	// Replace the current program with a new program.
	//
	// Passing a nil program is an error. May return an error wrapping ErrNotSupported.
	Update(*ebpf.Program) error

	// Persist a link by pinning it into a bpffs.
	//
	// May return an error wrapping ErrNotSupported.
	Pin(string) error

	// Undo a previous call to Pin.
	//
	// May return an error wrapping ErrNotSupported.
	Unpin() error

	// Close frees resources.
	//
	// The link will be broken unless it has been successfully pinned.
	// A link may continue past the lifetime of the process if Close is
	// not called.
	Close() error

	// Info returns metadata on a link.
	//
	// May return an error wrapping ErrNotSupported.
	Info() (*Info, error)
	// contains filtered or unexported methods
}

Link represents a Program attached to a BPF hook.

func LoadPinnedLink ¶

func LoadPinnedLink(fileName string, opts *ebpf.LoadPinOptions) (Link, error)

LoadPinnedLink loads a Link from a pin (file) on the BPF virtual filesystem.

Requires at least Linux 5.7.

func NewFromFD ¶

func NewFromFD(fd int) (Link, error)

NewFromFD creates a link from a raw fd.

You should not use fd after calling this function.

func NewFromID ¶

func NewFromID(id ID) (Link, error)

NewFromID returns the link associated with the given id.

Returns ErrNotExist if there is no link with the given id.

func NewLinkFromFD ¶

func NewLinkFromFD(fd int) (Link, error)

NewLinkFromFD creates a link from a raw fd.

Deprecated: use NewFromFD instead.

type RawLink ¶

type RawLink struct {
	// contains filtered or unexported fields
}

RawLink is the low-level API to bpf_link.

You should consider using the higher level interfaces in this package instead.

func AttachRawLink ¶

func AttachRawLink(opts RawLinkOptions) (*RawLink, error)

AttachRawLink creates a raw link.

func (*RawLink) Close ¶

func (l *RawLink) Close() error

Close breaks the link.

Use Pin if you want to make the link persistent.

func (*RawLink) FD ¶

func (l *RawLink) FD() int

FD returns the raw file descriptor.

func (*RawLink) Info ¶

func (l *RawLink) Info() (*Info, error)

Info returns metadata about the link.

Linktype specific metadata is not included and can be retrieved via the linktype specific Info() method.

func (*RawLink) IsPinned ¶

func (l *RawLink) IsPinned() bool

IsPinned returns true if the Link has a non-empty pinned path.

func (*RawLink) Pin ¶

func (l *RawLink) Pin(fileName string) error

Pin persists a link past the lifetime of the process.

Calling Close on a pinned Link will not break the link until the pin is removed.

func (*RawLink) Unpin ¶

func (l *RawLink) Unpin() error

Unpin implements the Link interface.

func (*RawLink) Update ¶

func (l *RawLink) Update(new *ebpf.Program) error

Update implements the Link interface.

func (*RawLink) UpdateArgs ¶

func (l *RawLink) UpdateArgs(opts RawLinkUpdateOptions) error

UpdateArgs updates a link based on args.

type RawLinkOptions ¶

type RawLinkOptions struct {
	// File descriptor to attach to. This differs for each attach type.
	Target int
	// Program to attach.
	Program *ebpf.Program
	// Attach must match the attach type of Program.
	Attach ebpf.AttachType
	// BTF is the BTF of the attachment target.
	BTF btf.TypeID
	// Flags control the attach behaviour.
	Flags uint32
}

RawLinkOptions control the creation of a raw link.

type RawLinkUpdateOptions ¶

type RawLinkUpdateOptions struct {
	New   *ebpf.Program
	Old   *ebpf.Program
	Flags uint32
}

RawLinkUpdateOptions control the behaviour of RawLink.UpdateArgs.

type Type ¶

type Type = sys.LinkType

Type is the kind of link.

Source Files ¶

doc.go link.go link_windows.go