Your blog category
Table of Contents The BPF (Berkeley Packet Filter) subsystem in the Linux kernel offers powerful capabilities for in-kernel processing of network packets and system events. BPF programs can be used to analyze, filter, and modify data directly within the kernel. One common requirement for BPF programs is to send collected data from the kernel to …
Table of Contents xdp_prog_func The main function in the program is xdp_prog_func, which is the actual XDP hook function. This function is executed whenever a packet passes through the XDP hook. The function first retrieves the data record associated with the XDP_PASS action from the xdp_stats_map using the bpf_map_lookup_elem() function. If the lookup is successful, the function increments …
Table of Contents bpf_map_lookup_elem is a function in the Linux kernel’s BPF subsystem that is used to look up an element in a BPF map. BPF maps are key-value data structures that can be used by BPF programs running in the Linux kernel to store and retrieve data. The bpf_map_lookup_elem function takes two arguments: map: A pointer to …
Table of Contents Interacting with eBPF maps happens through lookup/update/delete primitives. Userspace The userspace API map helpers for eBPF are defined in tools/lib/bpf/bpf.h and include the following functions: /* Userspace helpers */ int bpf_map_lookup_elem(int fd, void *key, void *value); int bpf_map_update_elem(int fd, void *key, void *value, __u64 flags); int bpf_map_delete_elem(int fd, void *key); /* Only userspace: */ int bpf_map_get_next_key(int …
Table of Contents The program is designed to be attached to an XDP (eXpress Data Path) hook, which is a high-performance data path in the Linux kernel for fast packet processing. The goal of this program is to count the number of packets that pass through the XDP hook and store the statistics in a BPF hash map. …
sudo -s export BPF_CLANG=clang go build ip link is a command in Linux used to display and manage network interfaces. When used without any arguments, the ip link command displays a list of available network interfaces on the system along with their status, state, and hardware addresses Here is an example output of the ip link command: In this example, lo and wlp0s20f3 are …
Table of Contents Cilium is an open-source project that provides a networking and security solution for containerized applications that leverages eBPF technology. The Cilium eBPF library provides a Go interface to the eBPF subsystem, making it easier to write eBPF programs in Go. The Cilium eBPF library is a Go library that provides abstractions over eBPF programs …
Table of Contents $ebpf-network |==go.mod |==go.sum |==Readme.md |==headers |——–bpf_endian.h |——–bpf_helper_defs.h |——–bpf_helpers.h |——–bpf_tracing.h |——–common.h |——–update.sh |===xdp |——–bpf_bpfeb.go |——–bpf_bpfeb.o |——–bpf_bpfel.go |——–bpf_bpfel.o |——–main.go |________xdp.c go.mod and go.sum go.mod and go.sum are two files used by the Go programming language to manage dependencies of a project. go.mod file defines the module’s dependencies and metadata, including the module’s name, version, and requirements for other …
Major components you might find in this userspace eBPF program written using the Cilium eBPF library in Go are as follows: Loading pre-compiled eBPF programs into the kernel Attaching the eBPF program to a network interface using XDP (eXpress Data Path) Printing the contents of the BPF hash map (source IP address -> packet count) to stdout every …
//go:build ignore This is a build constraint for Go. It specifies that this file should be ignored by the Go build system. #include “bpf_endian.h” #include “common.h” Header files that provide some utility functions and macros that are used in the program defined in the Cilium eBPF library. bpf_endian.h: This header file defines macros for converting between …
