# README
eBPF
eBPF is a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external dependencies and is intended to be used in long running processes.
ebpf/asm contains a basic assembler.
An Important Note About Licenses:
The main part of this code is governed by an MIT license. However, the examples folder is a near straight port of the Linux eBPF samples folder, which makes that code governed by GPLv2, so be careful if you copy from it heavily as you are likely pinning yourself to GPLv2.
Further reading
# Functions
Edit creates a new Editor.
IsUnreferencedSymbol returns true if err was caused by an unreferenced symbol.
LoadCollection parses an object file and converts it to a collection.
LoadCollectionSpec parse an object file and convert it to a collection.
LoadCollectionSpecFromReader parses an io.ReaderAt that represents an ELF layout into a CollectionSpec.
LoadPinnedCollection loads a Collection from the pinned directory.
LoadPinnedCollectionExplicit loads a Collection from the pinned directory with explicit parameters.
LoadPinnedMap load a Map from a BPF file.
LoadPinnedMapExplicit loads a map with explicit parameters.
LoadPinnedProgram loads a Program from a BPF file.
LoadPinnedProgramExplicit loads a program with explicit parameters.
NewCollection creates a Collection from a specification.
NewCollectionWithOptions creates a Collection from a specification.
NewMap creates a new Map.
NewPerfReader creates a new reader with the given options.
NewProgram creates a new Program.
NewProgramWithOptions creates a new Program.
SanitizeName replaces all invalid characters in name.
# Constants
AdjRoomNet Mode for SKBAdjustRoom helper.
Array is an array map.
ArrayOfMaps - Each item in the array is another map.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
AttachNone is an alias for AttachCGroupInetIngress for readability reasons.
No description provided by the author
No description provided by the author
No description provided by the author
CGroupArray - This is a very niche structure used to help SKBInCGroup determine if an skb is from a socket belonging to a specific cgroup.
CGroupDevice program.
CGroupSKB program.
CGroupSock program.
CGroupSockAddr program.
CGroupSockopt program.
CGroupSysctl program.
DefaultVerifierLogSize is the default number of bytes allocated for the verifier log.
FCtxLenMask PerfEventOutput for SKBuff input context.
FCurrentCPU PerfEventOutput and PerfEventRead flags.
FZeroCSUMTx SKBSetTunnelKey flag.
FFastStackCMP GetStackID flags.
FHdrFieldMask CSUMReplaceL4 and CSUMReplaceL3 flags.
FindIndexMask PerfEventOutput and PerfEventRead flags.
FIngress CloneRedirect and Redirect flags.
FInvalidateHash SKBStoreBytes flags.
FlowDissector program.
FMakrEnforce CSUMReplaceL4 flags.
FMarkMangled0 CSUMReplaceL4 flags.
FPseudoHdr CSUMReplaceL4 flags.
FReuseStackID GetStackID flags.
FSkipFieldMask GetStackID flags.
FTunInfoIPV6 SKBSetTunnelKey and SKBGetTunnelKey flags.
FUserStack GetStackID flags.
FZeroCSUMTx SKBSetTunnelKey flag.
Hash is a hash map.
HashOfMaps - Each item in the hash map is another map.
Kprobe program.
LircMode2 program.
LPMTrie - This is an implementation of Longest-Prefix-Match Trie structure.
LRUCPUHash - This is NOT like PerCPUHash, this structure is shared among the CPUs, it has more to do with including the CPU id with the LRU calculation so that if a particular CPU is using a value over-and-over again, then it will be saved, but if a value is being retrieved a lot but sparsely across CPUs it is not as important, basically giving weight to CPU locality over overall usage.
LRUHash - This allows you to create a small hash structure that will purge the least recently used items rather than thow an error when you run out of memory.
LWTIn program.
LWTOut program.
LWTSeg6Local program.
LWTXmit program.
PerCPUArray - This data structure is useful for people who have high performance network needs and can reconcile adds at the end of some cycle, so that hashes can be lock free without the use of XAdd, which can be costly.
PerCPUHash - This data structure is useful for people who have high performance network needs and can reconcile adds at the end of some cycle, so that hashes can be lock free without the use of XAdd, which can be costly.
PerfEvent program.
PerfEventArray - A perf event array is used in conjunction with PerfEventRead and PerfEventOutput calls, to read the raw bpf_perf_data from the registers.
ProgramArray - A program array map is a special kind of array map whose map values contain only file descriptors referring to other eBPF programs.
RawTracepoint program.
RawTracepointWritable program.
RecomputeCSUM SKBStoreBytes flags.
SchedACT routing control shaper.
SchedCLS traffic control shaper.
SkMsg program.
SkReuseport program.
SkSKB program.
SocketFilter socket or seccomp filter.
SockOps program.
StackTrace - This holds whole user and kernel stack traces, it can be retrieved with GetStackID.
TracePoint program.
Unrecognized program type.
All the various map types that can be created.
XDP program.
# Variables
Errors returned by the implementation.
# Structs
Collection is a collection of Programs and Maps associated with their symbols.
CollectionABI describes the interface of an eBPF collection.
CollectionOptions control loading a collection into the kernel.
CollectionSpec describes a collection.
Editor modifies eBPF instructions.
Map represents a Map file descriptor.
MapABI describes a Map.
MapIterator iterates a Map.
MapSpec defines a Map.
PerfReader allows reading bpf_perf_event_output from user space.
PerfReaderOptions control the behaviour of the user space reader.
PerfSample is read from the kernel by PerfReader.
Program represents BPF program loaded into the kernel.
ProgramABI describes a Program.
ProgramOptions control loading a program into the kernel.
ProgramSpec defines a Program.
# Interfaces
Marshaler allows controlling the binary representation used for getting and setting keys on a map.
# Type aliases
AttachType of the eBPF program, needed to differentiate allowed context accesses in some newer program types like CGroupSockAddr.
MapType indicates the type map structure that will be initialized in the kernel.
ProgType of the eBPF program.