26
Library to work with ebpf from Go
source link: https://www.tuicool.com/articles/JBfAZzM
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Go eBPF
A nice and convenient way to work with eBPF programs from Go.
Requirements
- Go 1.9+
- Linux Kernel 4.15+
Supported eBPF program types
List of currently supported eBPF programs:
SocketFilter XDP
Support for other types of program can be added in future. Feel free to contribute :)
Installation
# Main library go get github.com/dropbox/goebpf # Mock version (if needed) go get github.com/dropbox/goebpf/goebpf_mock
Quick start
Consider very simple example of Read / Load / Attach
// In order to be simple this examples does not handle errors
bpf := goebpf.NewDefaultEbpfSystem()
// Read clang compiled binary
bpf.LoadElf("test.elf")
// Load XDP program into kernel (name matches function name in C)
xdp := bpf.GetProgramByName("xdp_test")
xdp.Load()
// Attach to interface
xdp.Attach("eth0")
defer xdp.Detach()
// Work with maps
test := bpf.GetMapByName("test")
value, _ := test.LookupInt(0)
fmt.Printf("Value at index 0 of map 'test': %d\n", )
Like it? Check our examples
Good readings
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK