oxidebpf 0.2.7

A pure-Rust library for managing eBPF programs.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

#include <linux/kconfig.h>
#include <linux/ptrace.h>
#include <linux/version.h>
#include <uapi/linux/bpf.h>
#include <linux/uio.h>
#include <linux/types.h>

static void *(*bpf_map_lookup_elem)(void *map, void *key) =
    (void *)1;
static int (*bpf_map_update_elem)(void *map, void *key, void *value, unsigned long long flags) =
    (void *)2;
static unsigned long long (*bpf_get_current_pid_tgid)(void) =
    (void *)14;
static unsigned long long (*bpf_tail_call)(void *ctx, void *map, void *index) =
    (void *)12;

struct map_t
{
    u32 map_type;
    u32 key_size;
    u32 value_size;
    u32 max_entries;
};

struct map_t __test_map __attribute__((section("maps/test_map"), used)) = {
    BPF_MAP_TYPE_ARRAY,
    sizeof(u32),
    sizeof(u32),
    1024};

struct map_t __map_combined_section1 __attribute__((section("maps"), used)) = {
    BPF_MAP_TYPE_ARRAY,
    sizeof(u32),
    8,
    1024};

struct map_t __map_combined_section2 __attribute__((section("maps"), used)) = {
    BPF_MAP_TYPE_ARRAY,
    sizeof(u32),
    12,
    1024};

struct map_t __test_hash_map __attribute__((section("maps/test_hash_map"), used)) = {
    BPF_MAP_TYPE_HASH,
    sizeof(u64),
    sizeof(u64),
    1024};

struct map_t __test_tailcall_map __attribute__((section("maps/test_tailcall"), used)) = {
        BPF_MAP_TYPE_PROG_ARRAY,
        4,
        4,
        32};

__attribute__((section("kprobe/test_program"), used)) int test_program(struct pt_regs *regs)
{
    (void)bpf_get_current_pid_tgid();
    return 0;
}

__attribute__((section("kprobe/test_program_tailcall_update_map"), used)) int test_program_tailcall_update_map(void *ctx)
{
    u32 value = 111;
    u32 idx = 150;
    bpf_map_update_elem(&__test_map, &idx, &value, BPF_ANY);
    return 0;
}

__attribute__((section("kprobe/test_program_tailcall"), used)) int test_program_tailcall(struct pt_regs *regs)
{
    bpf_tail_call(regs, &__test_tailcall_map, 0);
    return 0;
}

__attribute__((section("kprobe/test_program_map_update"), used)) int test_program_map_update(struct pt_regs *regs)
{
    u32 index = 0;
    u64 key = 0x12345;
    u32 *value = bpf_map_lookup_elem(&__test_map, &index);
    if (!value)
    {
        return 0;
    }
    else
    {
        u32 new_value = 1234;
        u64 new_value64 = 1234;
        bpf_map_update_elem(&__test_map, &index, &new_value, BPF_ANY);
        bpf_map_update_elem(&__test_hash_map, &key, &new_value64, BPF_ANY);
    }
    return 0;
}

char _license[] __attribute__((section("license"), used)) = "Proprietary";
uint32_t _version __attribute__((section("version"), used)) = 0xFFFFFFFE;