142 lines
3.5 KiB
Go
142 lines
3.5 KiB
Go
package link
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/cilium/ebpf"
|
|
"github.com/cilium/ebpf/btf"
|
|
"github.com/cilium/ebpf/internal/sys"
|
|
)
|
|
|
|
type tracing struct {
|
|
RawLink
|
|
}
|
|
|
|
func (f *tracing) Update(new *ebpf.Program) error {
|
|
return fmt.Errorf("tracing update: %w", ErrNotSupported)
|
|
}
|
|
|
|
// AttachFreplace attaches the given eBPF program to the function it replaces.
|
|
//
|
|
// The program and name can either be provided at link time, or can be provided
|
|
// at program load time. If they were provided at load time, they should be nil
|
|
// and empty respectively here, as they will be ignored by the kernel.
|
|
// Examples:
|
|
//
|
|
// AttachFreplace(dispatcher, "function", replacement)
|
|
// AttachFreplace(nil, "", replacement)
|
|
func AttachFreplace(targetProg *ebpf.Program, name string, prog *ebpf.Program) (Link, error) {
|
|
if (name == "") != (targetProg == nil) {
|
|
return nil, fmt.Errorf("must provide both or neither of name and targetProg: %w", errInvalidInput)
|
|
}
|
|
if prog == nil {
|
|
return nil, fmt.Errorf("prog cannot be nil: %w", errInvalidInput)
|
|
}
|
|
if prog.Type() != ebpf.Extension {
|
|
return nil, fmt.Errorf("eBPF program type %s is not an Extension: %w", prog.Type(), errInvalidInput)
|
|
}
|
|
|
|
var (
|
|
target int
|
|
typeID btf.TypeID
|
|
)
|
|
if targetProg != nil {
|
|
btfHandle, err := targetProg.Handle()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer btfHandle.Close()
|
|
|
|
spec, err := btfHandle.Spec(nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
var function *btf.Func
|
|
if err := spec.TypeByName(name, &function); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
target = targetProg.FD()
|
|
typeID, err = spec.TypeID(function)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
link, err := AttachRawLink(RawLinkOptions{
|
|
Target: target,
|
|
Program: prog,
|
|
Attach: ebpf.AttachNone,
|
|
BTF: typeID,
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &tracing{*link}, nil
|
|
}
|
|
|
|
type TracingOptions struct {
|
|
// Program must be of type Tracing with attach type
|
|
// AttachTraceFEntry/AttachTraceFExit/AttachModifyReturn or
|
|
// AttachTraceRawTp.
|
|
Program *ebpf.Program
|
|
}
|
|
|
|
type LSMOptions struct {
|
|
// Program must be of type LSM with attach type
|
|
// AttachLSMMac.
|
|
Program *ebpf.Program
|
|
}
|
|
|
|
// attachBTFID links all BPF program types (Tracing/LSM) that they attach to a btf_id.
|
|
func attachBTFID(program *ebpf.Program) (Link, error) {
|
|
if program.FD() < 0 {
|
|
return nil, fmt.Errorf("invalid program %w", sys.ErrClosedFd)
|
|
}
|
|
|
|
fd, err := sys.RawTracepointOpen(&sys.RawTracepointOpenAttr{
|
|
ProgFd: uint32(program.FD()),
|
|
})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
raw := RawLink{fd: fd}
|
|
info, err := raw.Info()
|
|
if err != nil {
|
|
raw.Close()
|
|
return nil, err
|
|
}
|
|
|
|
if info.Type == RawTracepointType {
|
|
// Sadness upon sadness: a Tracing program with AttachRawTp returns
|
|
// a raw_tracepoint link. Other types return a tracing link.
|
|
return &rawTracepoint{raw}, nil
|
|
}
|
|
|
|
return &tracing{RawLink: RawLink{fd: fd}}, nil
|
|
}
|
|
|
|
// AttachTracing links a tracing (fentry/fexit/fmod_ret) BPF program or
|
|
// a BTF-powered raw tracepoint (tp_btf) BPF Program to a BPF hook defined
|
|
// in kernel modules.
|
|
func AttachTracing(opts TracingOptions) (Link, error) {
|
|
if t := opts.Program.Type(); t != ebpf.Tracing {
|
|
return nil, fmt.Errorf("invalid program type %s, expected Tracing", t)
|
|
}
|
|
|
|
return attachBTFID(opts.Program)
|
|
}
|
|
|
|
// AttachLSM links a Linux security module (LSM) BPF Program to a BPF
|
|
// hook defined in kernel modules.
|
|
func AttachLSM(opts LSMOptions) (Link, error) {
|
|
if t := opts.Program.Type(); t != ebpf.LSM {
|
|
return nil, fmt.Errorf("invalid program type %s, expected LSM", t)
|
|
}
|
|
|
|
return attachBTFID(opts.Program)
|
|
}
|