Struct redbpf::Program

pub struct Program {
    pub kind: ProgramKind,
    pub name: String,
    // some fields omitted
}

You can load an eBPF module, and all the programs in it like so:

use redbpf::Module;

let mut module = Module::parse(&vec![]).unwrap();
for prog in module.programs.iter_mut() {
    prog.load(module.version, module.license.clone()).unwrap();
}

Note that during the parsing the ELF file all BPF maps are automatically initialised.

You can attach kprobes like very easily:

use redbpf::Module;
use redbpf::ProgramKind::*;

let code = std::fs::read("bpf.elf").unwrap();
let mut module = Module::parse(&code).unwrap();
for prog in module
    .programs
    .iter_mut()
    .filter(|p| p.kind == Kprobe || p.kind == Kretprobe)
{
    prog.attach_probe().unwrap();
}

XDP and socket filters additionally require an interface to attach to. Note that in case of XDP, the driver needs to support XDP probes, so, for example, network bridges may not work out of the box.

use redbpf::Module;
use redbpf::ProgramKind::*;

let code = std::fs::read("bpf.elf").unwrap();
let mut module = Module::parse(&code).unwrap();
for prog in module
    .programs
    .iter_mut()
    .filter(|p| p.kind == XDP)
{
    prog.attach_xdp("eth0").unwrap();
}

Fields

kind: ProgramKind

name: String

Methods

impl Program

pub fn new(kind: &str, name: &str, code: &[u8]) -> Result<Program>

pub fn is_loaded(&self) -> bool

pub fn is_attached(&self) -> bool

pub fn load(&mut self, kernel_version: u32, license: String) -> Result<RawFd>

pub fn attach_probe(&mut self) -> Result<RawFd>

pub fn attach_probe_to_name(&mut self, name: &str) -> Result<RawFd>

pub fn attach_tracepoint(&mut self, category: &str, name: &str) -> Result<RawFd>

pub fn attach_xdp(&mut self, iface: &str) -> Result<()>

pub fn attach_socketfilter(&mut self, iface: &str) -> Result<RawFd>