libbpf和Rust开发ebpf程序实战示例

// tracecon.bpf.c
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_tracing.h>
…
SEC("kprobe/tcp_v4_connect")
int BPF_KPROBE(tcp_v4_connect_enter, struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
    u32 tid = get_tid();
    if (!tid)
        return 0;
    bpf_map_update_elem(&sockets, &tid, &sk, 0);
    return 0;
};
SEC("kretprobe/tcp_v4_connect")
int BPF_KRETPROBE(tcp_v4_connect_exit, int ret)
{
    u32 tid = get_tid();
    struct sock **sockpp;
    struct lookup *lookup;
    struct event event = {};
    u32 ip;
    if (!tid)
        return 0;
    if (ret != 0)
        goto cleanup;
    sockpp = bpf_map_lookup_elem(&sockets, &tid);
    if (!sockpp)
        return 0;
    ip = BPF_CORE_READ(*sockpp, __sk_common.skc_daddr);    // 读出ip
    lookup = bpf_map_lookup_elem(&hostnames, &ip);        // 查找hostname
    if (!lookup) {
        event.tag = IP;
        memcpy(&event.ip, &ip, sizeof(event.ip));
    } else {
        event.tag = HOSTNAME;
        memcpy(&event.hostname, &lookup->c, sizeof(lookup->c));
        bpf_map_delete_elem(&hostnames, &ip);
    }
    /* ctx is implied in the signature macro */
    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
cleanup:
    bpf_map_delete_elem(&sockets, &tid);
    return 0;
}
...

// tracecon.bpf.c
struct event {
    u8 tag;
    u8 ip[4];
    u8 hostname[HOSTNAME_LEN];
};

// build.rs
use libbpf_cargo::SkeletonBuilder;
const SRC: &str = "./src/bpf/tracecon.bpf.c";
fn main() {
    create_dir_all("./src/bpf/.output").unwrap();
    let skel = Path::new("./src/bpf/.output/tracecon.skel.rs");
    SkeletonBuilder::new()
        .source(SRC)
        .build_and_generate(&skel)
        .expect("bpf compilation failed");
    println!("cargo:rerun-if-changed={}", SRC);
}

// Cargo.toml
...
[build-dependencies]
libbpf-cargo = "0.13"

fn main() -> Result<()> {
    ...
    // 使用skel.rs中的TraceconSkelBuilder对象构造skel
    let mut skel_builder = TraceconSkelBuilder::default();
    let mut open_skel = skel_builder.open()?;
    let mut skel = open_skel.load()?;
    // 加载并运行
    let _kprobe = skel
        .progs_mut()
        .tcp_v4_connect_enter()
        .attach_kprobe(false, "tcp_v4_connect")?;
    let _kretprobe = skel
        .progs_mut()
        .tcp_v4_connect_exit()
        .attach_kprobe(true, "tcp_v4_connect")?;
    // 使用perf读events
    let perf = PerfBufferBuilder::new(skel.maps_mut().events())
        .sample_cb(handle_event)
        .build()?;
    while running.load(Ordering::SeqCst) {
        perf.poll(Duration::from_millis(100))?;
    }
    ...
}

fn handle_event(_cpu: i32, data: &[u8]) {
    let mut event = Event::default();
    plain::copy_from_bytes(&mut event, data).expect("Event data buffer was too short");
    match event.tag {
        0 => println!("ip event: {}", Ipv4Addr::from(event.ip)),
        1 => println!("host event: {}", String::from_utf8_lossy(&event.hostname)),
        _ => {}
    }
}

# cargo run