hello-libbpfgo

Examples for libbpf, aquasecurity/libbpfgo and cilium/ebpf.

setup develop env

$ vagrant up

Program Types

Examples by program type:

+-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | Program Type | Attach Type | ELF Section Name | Examples | +===========================================+========================================+==================================+=======================+ | BPF_PROG_TYPE_CGROUP_DEVICE | BPF_CGROUP_DEVICE | cgroup/dev | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_CGROUP_SKB | | cgroup/skb | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET_EGRESS | cgroup_skb/egress | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET_INGRESS | cgroup_skb/ingress | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_CGROUP_SOCKOPT | BPF_CGROUP_GETSOCKOPT | cgroup/getsockopt | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_SETSOCKOPT | cgroup/setsockopt | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_CGROUP_SOCK_ADDR | BPF_CGROUP_INET4_BIND | cgroup/bind4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET4_CONNECT | cgroup/connect4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET4_GETPEERNAME | cgroup/getpeername4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET4_GETSOCKNAME | cgroup/getsockname4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET6_BIND | cgroup/bind6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET6_CONNECT | cgroup/connect6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET6_GETPEERNAME | cgroup/getpeername6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET6_GETSOCKNAME | cgroup/getsockname6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_UDP4_RECVMSG | cgroup/recvmsg4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_UDP4_SENDMSG | cgroup/sendmsg4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_UDP6_RECVMSG | cgroup/recvmsg6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_UDP6_SENDMSG | cgroup/sendmsg6 | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_CGROUP_SOCK | BPF_CGROUP_INET4_POST_BIND | cgroup/post_bind4 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET6_POST_BIND | cgroup/post_bind6 | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET_SOCK_CREATE | cgroup/sock_create | | + + +----------------------------------+-----------------------+ | | | cgroup/sock | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_CGROUP_INET_SOCK_RELEASE | cgroup/sock_release | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_CGROUP_SYSCTL | BPF_CGROUP_SYSCTL | cgroup/sysctl | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_EXT | | freplace+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_FLOW_DISSECTOR | BPF_FLOW_DISSECTOR | flow_dissector | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_KPROBE | | kprobe+ + + +----------------------------------+-----------------------+ | | | kretprobe+ + + +----------------------------------+-----------------------+ | | | ksyscall+ + + +----------------------------------+-----------------------+ | | | kretsyscall+ + + +----------------------------------+-----------------------+ | | | uprobe+ | | + + +----------------------------------+-----------------------+ | | | uprobe.s+ | | + + +----------------------------------+-----------------------+ | | | uretprobe+ | | + + +----------------------------------+-----------------------+ | | | uretprobe.s+ | | + + +----------------------------------+-----------------------+ | | | usdt+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_TRACE_KPROBE_MULTI | kprobe.multi+ | | + + +----------------------------------+-----------------------+ | | | kretprobe.multi+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LIRC_MODE2 | BPF_LIRC_MODE2 | lirc_mode2 | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LSM | BPF_LSM_CGROUP | lsm_cgroup+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_LSM_MAC | lsm+ + + +----------------------------------+-----------------------+ | | | lsm.s+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LWT_IN | | lwt_in | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LWT_OUT | | lwt_out | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LWT_SEG6LOCAL | | lwt_seg6local | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_LWT_XMIT | | lwt_xmit | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_PERF_EVENT | | perf_event | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE | | raw_tp.w+ | | + + +----------------------------------+-----------------------+ | | | raw_tracepoint.w+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_RAW_TRACEPOINT | | raw_tp+ + + +----------------------------------+ + | | | raw_tracepoint+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SCHED_ACT | | action | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SCHED_CLS | | classifier + + +----------------------------------+ + | | | tc | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SK_LOOKUP | BPF_SK_LOOKUP | sk_lookup | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SK_MSG | BPF_SK_MSG_VERDICT | sk_msg | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SK_REUSEPORT | BPF_SK_REUSEPORT_SELECT_OR_MIGRATE | sk_reuseport/migrate | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_SK_REUSEPORT_SELECT | sk_reuseport | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SK_SKB | | sk_skb | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_SK_SKB_STREAM_PARSER | sk_skb/stream_parser | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_SK_SKB_STREAM_VERDICT | sk_skb/stream_verdict | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SOCKET_FILTER | | socket +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SOCK_OPS | BPF_CGROUP_SOCK_OPS | sockops | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_STRUCT_OPS | | struct_ops+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_SYSCALL | | syscall | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_TRACEPOINT | | tp+ + + +----------------------------------+35 36 37 + | | | tracepoint+ | | +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_TRACING | BPF_MODIFY_RETURN | fmod_ret+ | | + + +----------------------------------+-----------------------+ | | | fmod_ret.s+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_TRACE_FENTRY | fentry+ + + +----------------------------------+-----------------------+ | | | fentry.s+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_TRACE_FEXIT | fexit+ + + +----------------------------------+-----------------------+ | | | fexit.s+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_TRACE_ITER | iter+ + + +----------------------------------+-----------------------+ | | | iter.s+ | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_TRACE_RAW_TP | tp_btf+ +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+ | BPF_PROG_TYPE_XDP | BPF_XDP_CPUMAP | xdp.frags/cpumap | | + + +----------------------------------+-----------------------+ | | | xdp/cpumap | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_XDP_DEVMAP | xdp.frags/devmap | | + + +----------------------------------+-----------------------+ | | | xdp/devmap | | + +----------------------------------------+----------------------------------+-----------------------+ | | BPF_XDP | xdp.frags | | + + +----------------------------------+-----------------------+ | | | xdp +-------------------------------------------+----------------------------------------+----------------------------------+-----------------------+

https://mozillazg.com/tag/libbpf.html