After is the position just after target.

After is the position just after target.

After is the position just after target.

After is the position just after target.

AttachCgroup links a BPF program to a cgroup.

AttachFreplace attaches the given eBPF program to the function it replaces.

AttachIter attaches a BPF seq_file iterator.

AttachLSM links a Linux security module (LSM) BPF Program to a BPF hook defined in kernel modules.

AttachNetfilter links a netfilter BPF program to a netfilter hook.

AttachNetNs attaches a program to a network namespace.

AttachRawLink creates a raw link.

AttachRawTracepoint links a BPF program to a raw_tracepoint.

AttachSocketFilter attaches a SocketFilter BPF program to a socket.

AttachTracing links a tracing (fentry/fexit/fmod_ret) BPF program or a BTF-powered raw tracepoint (tp_btf) BPF Program to a BPF hook defined in kernel modules.

AttachXDP links an XDP BPF program to an XDP hook.

Before is the position just in front of target.

Before is the position just in front of target.

Before is the position just in front of target.

Before is the position just in front of target.

DetachSocketFilter detaches a SocketFilter BPF program from a socket.

Head is the position before all other programs or links.

Kprobe attaches the given eBPF program to a perf event that fires when the given kernel symbol starts executing.

KprobeMulti attaches the given eBPF program to the entry point of a given set of kernel symbols.

Kretprobe attaches the given eBPF program to a perf event that fires right before the given kernel symbol exits, with the function stack left intact.

KretprobeMulti attaches the given eBPF program to the return point of a given set of kernel symbols.

LoadPinnedLink loads a Link from a pin (file) on the BPF virtual filesystem.

NewFromFD creates a link from a raw fd.

NewFromID returns the link associated with the given id.

NewLinkFromFD creates a link from a raw fd.

To open a new Executable, use: OpenExecutable("/bin/bash") The returned value can then be used to open Uprobe(s).

QueryPrograms retrieves a list of programs for the given AttachType.

RawAttachProgram is a low level wrapper around BPF_PROG_ATTACH.

RawDetachProgram is a low level wrapper around BPF_PROG_DETACH.

Replace the target itself.

Replace the target itself.

Tail is the position after all other programs or links.

Tracepoint attaches the given eBPF program to the tracepoint with the given group and name.

Valid link types.

Valid link types.

Valid link types.

Enable IP packet defragmentation.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

Valid link types.

XDPDriverMode links XDP BPF program into the driver’s receive path.

XDPGenericMode (SKB) links XDP BPF program for drivers which do not yet support native XDP.

XDPOffloadMode offloads the entire XDP BPF program into hardware.

Valid link types.

ErrNoSymbol indicates that the given symbol was not found in the ELF symbols table.

Executable defines an executable program on the filesystem.

Info contains metadata on a link.

Iter represents an attached bpf_iter.

Iterator allows iterating over links attached into the kernel.

KprobeMultiOptions defines additional parameters that will be used when opening a KprobeMulti Link.

KprobeOptions defines additional parameters that will be used when loading Kprobes.

NetNsLink is a program attached to a network namespace.

QueryOptions defines additional parameters when querying for programs.

QueryResult describes which programs and links are active.

RawLink is the low-level API to bpf_link.

RawLinkOptions control the creation of a raw link.

RawLinkUpdateOptions control the behaviour of RawLink.UpdateArgs.

TracepointOptions defines additional parameters that will be used when loading Tracepoints.

UprobeMultiOptions defines additional parameters that will be used when opening a UprobeMulti Link.

UprobeOptions defines additional parameters that will be used when loading Uprobes.

Anchor is a reference to a link or program.

Link represents a Program attached to a BPF hook.

PerfEvent is implemented by some Link types which use a perf event under the hood.

ID uniquely identifies a BPF link.

Type is the kind of link.

XDPAttachFlags represents how XDP program will be attached to interface.