package link

import "github.com/cilium/ebpf/link"

Package link allows attaching eBPF programs to various kernel hooks.

Index ¶

• Variables
• func RawAttachProgram(opts RawAttachProgramOptions) error
• func RawDetachProgram(opts RawDetachProgramOptions) error
• type CgroupOptions
• type Iter
• func AttachIter(opts IterOptions) (*Iter, error)
• func LoadPinnedIter(fileName string) (*Iter, error)
• func (it *Iter) Close() error
• func (it *Iter) FD() int
• func (it *Iter) Open() (io.ReadCloser, error)
• func (it *Iter) Pin(fileName string) error
• func (it *Iter) Update(new *ebpf.Program) error
• type IterOptions
• type Link
• func AttachCgroup(opts CgroupOptions) (Link, error)
• func AttachRawTracepoint(opts RawTracepointOptions) (Link, error)
• func LoadPinnedCgroup(fileName string) (Link, error)
• type RawAttachProgramOptions
• type RawDetachProgramOptions
• type RawLink
• func AttachRawLink(opts RawLinkOptions) (*RawLink, error)
• func LoadPinnedRawLink(fileName string) (*RawLink, error)
• func (l *RawLink) Close() error
• func (l *RawLink) FD() int
• func (l *RawLink) Pin(fileName string) error
• func (l *RawLink) Update(new *ebpf.Program) error
• func (l *RawLink) UpdateArgs(opts RawLinkUpdateOptions) error
• type RawLinkOptions
• type RawLinkUpdateOptions
• type RawTracepointOptions

Variables ¶

var ErrNotSupported = internal.ErrNotSupported

Functions ¶

func RawAttachProgram ¶

func RawAttachProgram(opts RawAttachProgramOptions) error

RawAttachProgram is a low level wrapper around BPF_PROG_ATTACH.

You should use one of the higher level abstractions available in this package if possible.

func RawDetachProgram ¶

func RawDetachProgram(opts RawDetachProgramOptions) error

RawDetachProgram is a low level wrapper around BPF_PROG_DETACH.

You should use one of the higher level abstractions available in this package if possible.

Types ¶

type CgroupOptions ¶

type CgroupOptions struct {
	// Path to a cgroupv2 folder.
	Path string
	// One of the AttachCgroup* constants
	Attach ebpf.AttachType
	// Program must be of type CGroup*, and the attach type must match Attach.
	Program *ebpf.Program
}

type Iter ¶

type Iter struct {
	// contains filtered or unexported fields
}

Iter represents an attached bpf_iter.

func AttachIter ¶

func AttachIter(opts IterOptions) (*Iter, error)

AttachIter attaches a BPF seq_file iterator.

func LoadPinnedIter ¶

func LoadPinnedIter(fileName string) (*Iter, error)

LoadPinnedIter loads a pinned iterator from a bpffs.

func (*Iter) Close ¶

func (it *Iter) Close() error

Close implements Link.

func (*Iter) FD ¶

func (it *Iter) FD() int

FD returns the underlying file descriptor.

func (*Iter) Open ¶

func (it *Iter) Open() (io.ReadCloser, error)

Open creates a new instance of the iterator.

Reading from the returned reader triggers the BPF program.

func (*Iter) Pin ¶

func (it *Iter) Pin(fileName string) error

Pin implements Link.

func (*Iter) Update ¶

func (it *Iter) Update(new *ebpf.Program) error

Update implements Link.

type IterOptions ¶

type IterOptions struct {
	// Program must be of type Tracing with attach type
	// AttachTraceIter. The kind of iterator to attach to is
	// determined at load time via the AttachTo field.
	//
	// AttachTo requires the kernel to include BTF of itself,
	// and it to be compiled with a recent pahole (>= 1.16).
	Program *ebpf.Program
}

type Link ¶

type Link interface {
	// Replace the current program with a new program.
	//
	// Passing a nil program is an error.
	Update(*ebpf.Program) error

	// Persist a link by pinning it into a bpffs.
	//
	// May return an error wrapping ErrNotSupported.
	Pin(string) error

	// Close frees resources.
	//
	// The link will be broken unless it has been pinned. A link
	// may continue past the lifetime of the process if Close is
	// not called.
	Close() error
	// contains filtered or unexported methods
}

Link represents a Program attached to a BPF hook.

func AttachCgroup ¶

func AttachCgroup(opts CgroupOptions) (Link, error)

AttachCgroup links a BPF program to a cgroup.

func AttachRawTracepoint ¶

func AttachRawTracepoint(opts RawTracepointOptions) (Link, error)

AttachRawTracepoint links a BPF program to a raw_tracepoint.

Requires at least Linux 4.17.

func LoadPinnedCgroup ¶

func LoadPinnedCgroup(fileName string) (Link, error)

LoadPinnedCgroup loads a pinned cgroup from a bpffs.

type RawAttachProgramOptions ¶

type RawAttachProgramOptions struct {
	// File descriptor to attach to. This differs for each attach type.
	Target int
	// Program to attach.
	Program *ebpf.Program
	// Program to replace (cgroups).
	Replace *ebpf.Program
	// Attach must match the attach type of Program (and Replace).
	Attach ebpf.AttachType
	// Flags control the attach behaviour. This differs for each attach type.
	Flags uint32
}

type RawDetachProgramOptions ¶

type RawDetachProgramOptions struct {
	Target  int
	Program *ebpf.Program
	Attach  ebpf.AttachType
}

type RawLink ¶

type RawLink struct {
	// contains filtered or unexported fields
}

RawLink is the low-level API to bpf_link.

You should consider using the higher level interfaces in this package instead.

func AttachRawLink ¶

func AttachRawLink(opts RawLinkOptions) (*RawLink, error)

AttachRawLink creates a raw link.

func LoadPinnedRawLink ¶

func LoadPinnedRawLink(fileName string) (*RawLink, error)

LoadPinnedRawLink loads a persisted link from a bpffs.

func (*RawLink) Close ¶

func (l *RawLink) Close() error

Close breaks the link.

Use Pin if you want to make the link persistent.

func (*RawLink) FD ¶

func (l *RawLink) FD() int

FD returns the raw file descriptor.

func (*RawLink) Pin ¶

func (l *RawLink) Pin(fileName string) error

Pin persists a link past the lifetime of the process.

Calling Close on a pinned Link will not break the link until the pin is removed.

func (*RawLink) Update ¶

func (l *RawLink) Update(new *ebpf.Program) error

Update implements Link.

func (*RawLink) UpdateArgs ¶

func (l *RawLink) UpdateArgs(opts RawLinkUpdateOptions) error

UpdateArgs updates a link based on args.

type RawLinkOptions ¶

type RawLinkOptions struct {
	// File descriptor to attach to. This differs for each attach type.
	Target int
	// Program to attach.
	Program *ebpf.Program
	// Attach must match the attach type of Program.
	Attach ebpf.AttachType
}

RawLinkOptions control the creation of a raw link.

type RawLinkUpdateOptions ¶

type RawLinkUpdateOptions struct {
	New   *ebpf.Program
	Old   *ebpf.Program
	Flags uint32
}

RawLinkUpdateOptions control the behaviour of RawLink.UpdateArgs.

type RawTracepointOptions ¶

type RawTracepointOptions struct {
	// Tracepoint name.
	Name string
	// Program must be of type RawTracepoint*
	Program *ebpf.Program
}

Source Files ¶

cgroup.go doc.go iter.go link.go program.go raw_tracepoint.go syscalls.go