Go eBPF

A nice and convenient way to work with eBPF programs from Go.

Requirements

• Go 1.9+
• Linux Kernel 4.15+

Supported eBPF program types

List of currently supported eBPF programs:

• SocketFilter
• XDP

Support for other types of program can be added in future. Feel free to contribute :)

Installation

# Main library
go get github.com/dropbox/goebpf

# Mock version (if needed)
go get github.com/dropbox/goebpf/goebpf_mock

Quick start

Consider very simple example of Read / Load / Attach

    // In order to be simple this examples does not handle errors
    bpf := goebpf.NewDefaultEbpfSystem()
    // Read clang compiled binary
    bpf.LoadElf("test.elf")
    // Load XDP program into kernel (name matches function name in C)
    xdp := bpf.GetProgramByName("xdp_test")
    xdp.Load()
    // Attach to interface
    xdp.Attach("eth0")
    defer xdp.Detach()
    // Work with maps
    test := bpf.GetMapByName("test")
    value, _ := test.LookupInt(0)
    fmt.Printf("Value at index 0 of map 'test': %d\n", )

Like it? Check our examples

Good readings

• Cilium BPF and XDP Reference Guide
• Prototype Kernel: XDP
• AF_XDP: Accelerating networking
• eBPF, part 1: Past, Present, and Future
• eBPF, part 2: Syscall and Map Types