ZBLOG

注册 原创投稿

10个ebpf uprobe golang的代码案例

作者：golang云原生栏目：公开2024-09-14 11:03214

这里给你提供10个使用eBPF和uprobes的Golang代码案例：

  1. 监控函数调用次数：
  1. package main
  3. import (
  4. 	"fmt"
  5. 	"os"
  7. 	bpf "github.com/iovisor/gobpf/bcc"
  8. )
  10. const source string = `
  11. #include <uapi/linux/ptrace.h>
  13. BPF_HASH(counts, u64);
  15. int count_calls(struct pt_regs *ctx) {
  16.     u64 key = PT_REGS_IP(ctx);
  17.     u64 *val = counts.lookup(&key);
  18.     if (val) {
  19.         (*val)++;
  20.     } else {
  21.         counts.update(&key, &(u64){1});
  22.     }
  23.     return 0;
  24. }
  25. `
  27. func main() {
  28. 	m := bpf.NewModule(source, []string{})
  29. 	defer m.Close()
  31. 	uprobeFD, err := m.LoadUprobe("count_calls")
  32. 	if err != nil {
  33. 		fmt.Fprintf(os.Stderr, "Failed to load uprobe: %v\n", err)
  34. 		os.Exit(1)
  35. 	}
  37. 	err = m.AttachUprobe("/path/to/binary", "function_name", uprobeFD)
  38. 	if err != nil {
  39. 		fmt.Fprintf(os.Stderr, "Failed to attach uprobe: %v\n", err)
  40. 		os.Exit(1)
  41. 	}
  43. 	table := bpf.NewTable(m.TableId("counts"), m)
  44. 	it := table.Iter()
  45. 	for it.Next() {
  46. 		key := binary.LittleEndian.Uint64(it.Key())
  47. 		val := binary.LittleEndian.Uint64(it.Leaf())
  48. 		fmt.Printf("Function at address 0x%x was called %d times\n", key, val)
  49. 	}
  50. }
  1. 统计函数执行时间：
  1. package main
  3. import (
  4. 	"fmt"
  5. 	bpf "github.com/iovisor/gobpf/bcc"
  6. )
  8. const source string = `
  9. #include <uapi/linux/ptrace.h>
  11. BPF_HASH(start, u32);
  12. BPF_HISTOGRAM(dist);
  14. int trace_entry(struct pt_regs *ctx) {
  15.     u32 pid = bpf_get_current_pid_tgid();
  16.     u64 ts = bpf_ktime_get_ns();
  17.     start.update(&pid, &ts);
  18.     return 0;
  19. }
  21. int trace_return(struct pt_regs *ctx) {
  22.     u32 pid = bpf_get_current_pid_tgid();
  23.     u64 *tsp, delta;
  25.     tsp = start.lookup(&pid);
  26.     if (tsp != 0) {
  27.         delta = bpf_ktime_get_ns() - *tsp;
  28.         dist.increment(bpf_log2l(delta));
  29.         start.delete(&pid);
  30.     }
  31.     
  32.     return 0;
  33. }
  34. `
  36. func main() {
  37. 	m := bpf.NewModule(source, []string{})
  38. 	defer m.Close()
  40. 	entryFD, err := m.LoadUprobe("trace_entry")
  41. 	if err != nil {
  42. 		fmt.Println(err)
  43. 		return
  44. 	}
  46. 	returnFD, err := m.LoadUprobe("trace_return")
  47. 	if err != nil {
  48. 		fmt.Println(err)
  49. 		return
  50. 	}
  52. 	err = m.AttachUprobe("/path/to/binary", "function_name", entryFD)
  53. 	if err != nil {
  54. 		fmt.Println(err)
  55. 		return
  56. 	}
  58. 	err = m.AttachUretprobe("/path/to/binary", "function_name", returnFD)
  59. 	if err != nil {
  60. 		fmt.Println(err)
  61. 		return
  62. 	}
  64. 	table := bpf.NewTable(m.TableId("dist"), m)
  66. 	buckets := table.HistogramRead()
  67. 	for i, count := range buckets {
  68. 		if count == 0 {
  69. 			continue
  70. 		}
  71. 		
  72. 		lower := 1 << uint32(i)
  73.         upper := lower << 1
  74.         fmt.Printf("[%d-%d] ns: %d\n", lower, upper, count)
  75.     }
  76. }
  1. 监控文件IO调用：
  1. package main
  3. import (
  4. 	"fmt"
  5. 	bpf "github.com/iovisor/gobpf/bcc"
  6. )
  8. const source string = `
  9. #include <uapi/linux/ptrace.h>
  11. struct data_t {
  12.     u64 ts;
  13.     char name[TASK_COMM_LEN];
  14. };
  16. BPF_HASH(start, u32);
  17. BPF_PERF_OUTPUT(events);
  19. int trace_entry(struct pt_regs *ctx) {
  20.     struct data_t data = {};
  21.     u32 pid = bpf_get_current_pid_tgid();
  23.     if (bpf_get_current_comm(&data.name, sizeof(data.name)) == 0) {
  24.         data.ts = bpf_ktime_get_ns();
  25.         start.update(&pid, &data);
  26.     }
  28.     return 0;
  29. }
  31. int trace_return(struct pt_regs *ctx) {
  32.     struct data_t *datap;
  33.     
  34. 	u32 pid = bpf_get_current_pid_tgid();
  35. 	datap = start.lookup(&pid);
  37. 	if (datap != 0) {
  38. 		u64 delta;
  40. 		delta = bpf_ktime_get_ns() - datap->ts;
  41.         events.perf_submit(ctx, datap, sizeof(*datap));
  42.         
  43. 		start.delete(&pid);
  44. 	}
  46. 	return 0;
  47. }
  48. `
  50. type eventData struct {
  51. 	Timestamp uint64
  52. 	Name      [16]byte
  53. }
  55. func main() {
  56. 	m := bpf.NewModule(source, []string{})
  57. 	defer m.Close()
  59. 	entryFD, err := m.LoadUprobe("trace_entry")
  60. 	if err != nil {
  61. 		fmt.Println(err)
  62. 		return
  63. 	}
  65. 	returnFD, err := m.LoadUprobe("trace_return")
  66. 	if err != nil {
  67. 		fmt.Println(err)
  68. 		return
  69. 	}
  71. 	err = m.AttachUprobe("/path/to/binary", "function_name", entryFD)
  72. 	if err != nil {
  73. 		fmt.Println(err)
  74. 		return
  75. 	}
  77. 	err = m.AttachUretprobe("/path/to/binary", "function_name", returnFD)
  78. 	if err != nil {
  79. 		fmt.Println(err)
  80. 		return
  81. 	}
  83. 	table := bpf.NewTable(m.TableId("events"), m)
  85. 	channel := make(chan []byte)
  86. 	perfMap, err := bpf.InitPerfMap(table, channel)
  87. 	if err != nil {
  88. 		fmt.Println(err)
  89. 		return
  90. 	}
  92. 	go func() {
  93.         for data := range channel {
  94.             var event eventData
  95. 			err = binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event)
  96. 			if err != nil {
  97. 				fmt.Println(err)
  98. 				continue
  99. 			}
  100. 			
  101.             fmt.Printf("Process: %s, Timestamp: %d\n", string(event.Name[:]), event.Timestamp)
  102.         }
  103.     }()
  104. 	
  105. 	select {}
  106. }
  1. 监控系统调用：
  1. package main
  3. import (
  4.     "fmt"
  5.     "os"
  7.     bpf "github.com/iovisor/gobpf/bcc"
  8. )
  10. const source string = `
  11. #include <uapi/linux/ptrace.h>
  13. BPF_HASH(syscall_counts, u32);
  15. int count_syscalls(struct pt_regs *ctx) {
  16.     u32 pid = bpf_get_current_pid_tgid();
  17.     u64 *count = syscall_counts.lookup(&pid);
  18.     if (count) {
  19.         (*count)++;
  20.     } else {
  21.         syscall_counts.update(&pid, &(u64){1});
  22.     }
  23.     
  24.     return 0;
  25. }
  26. `
  28. func main() {
  29. 	m := bpf.NewModule(source, []string{})
  30. 	defer m.Close()
  32. 	syscallFD, err := m.LoadUprobe("count_syscalls")
  33. 	if err != nil {
  34. 		fmt.Fprintf(os.Stderr, "Failed to load uprobe: %v\n", err)
  35. 		os.Exit(1)
  36. 	}
  38. 	err = m.AttachUprobe("", "__x64_sys_read", syscallFD)
  39. 	if err != nil {
  40. 		fmt.Fprintf(os.Stderr, "Failed to attach uprobe: %v\n", err)
  41. 		os.Exit(1)
  42.     }
  44.     table := bpf.NewTable(m.TableId("syscall_counts"), m)
  46. 	it := table.Iter()
  47. 	for it.Next() {
  48. 		pid := binary.LittleEndian.Uint32(it.Key())
  49. 		count := binary.LittleEndian.Uint64(it.Leaf())
  50. 		fmt.Printf("Process with PID %d made %d syscalls\n", pid, count)
  51.     }
  52. }
  1. 拦截网络数据包：
  1. package main
  3. import (
  4.     "fmt"
  5.     "os"
  6.     
  7.     bpf "github.com/iovisor/gobpf/bcc"
  8. )
  10. const source string = `
  11. #include <uapi/linux/ptrace.h>
  12. #include <bcc/proto.h>
  14. BPF_PERF_OUTPUT(events);
  16. int trace_packet(struct __sk_buff *skb) {
  17.     u8 *cursor = 0;
  18. 	struct ethernet_t *ethernet = cursor_advance(cursor, sizeof(*ethernet));
  19. 	
  20. 	if (ethernet->type == ETH_P_IP) {
  21.         struct ip_t *ip = cursor_advance(cursor, sizeof(*ip));
  23.         if (ip->protocol == IPPROTO_TCP) {
  24.             struct tcp_t *tcp = cursor_advance(cursor, sizeof(*tcp));
  26.             if (tcp->dest == bpf_htons(80)) { // HTTP traffic
  27.                 events.perf_submit(skb, skb->len);
  28.             }
  29.         }
  30.     }
  31.     
  32. 	return 0;
  33. }
  34. `
  36. func main() {
  37. 	m := bpf.NewModule(source, []string{})
  38. 	defer m.Close()
  40. 	uprobeFD, err := m.LoadUprobe("trace_packet")
  41. 	if err != nil {
  42. 		fmt.Fprintf(os.Stderr, "Failed to load uprobe: %v\n", err)
  43. 		os.Exit(1)
  44. 	}
  46. 	err = m.AttachUprobe("tcp_sendmsg", uprobeFD)
  47. 	if err != nil {
  48. 		fmt.Fprintf(os.Stderr, "Failed to attach uprobe: %v\n", err)
  49. 		os.Exit(1)
  50.     }
  52.     perfMap, err := bpf.InitPerfMap(m.TableId("events"), printPacketSize)
  53. 	if err != nil {
  54. 		fmt.Fprintf(os.Stderr, "Failed to initialize perf map: %v\n", err)
  55. 		os.Exit(1)
  56.     }
  57.     
  58.     perfMap.Start()
  60.     select {}
  61. }
  63. func printPacketSize(data []byte) {
  64. 	fmt.Printf("Received packet of size %d bytes\n", len(data))
  65. }
  1. 拦截文件读写操作：
  1. package main
  3. import (
  4.     "fmt"
  5.     "os"
  7. 	bpf "github.com/iovisor/gobpf/bcc"
  8. )
  10. const source string = `
  11. #include <uapi/linux/ptrace.h>
  12. #include <linux/sched.h>
  14. struct key_t {
  15. 	int id;
  16. 	u64 inode;
  17. 	char name[TASK_COMM_LEN];
  18. };
  20. BPF_HASH(open_files, struct key_t);
  22. int trace_open(struct pt_regs *ctx) {
  23. 	struct key_t key = {};
  24. 	u64 id = bpf_get_current_pid_tgid();
  25. 	
  26. 	key.id = id >> 32;
  27. 	key.inode = PT_REGS_RC(ctx);
  28. 	bpf_get_current_comm(&key.name, sizeof(key.name));
  29. 	open_files.update(&key, &id);
  31. 	return 0;
  32. }
  34. int trace_close(struct pt_regs *ctx) {
  35. 	struct key_t key = {};
  36. 	u64 id = bpf_get_current_pid_tgid();
  38. 	key.id = id >> 32;
  39. 	key.inode = PT_REGS_RC(ctx);
  40. 	bpf_get_current_comm(&key.name, sizeof(key.name));
  41. 	open_files.delete(&key);
  43. 	return 0;
  44. }
  45. `
  47. type fileKey struct {
  48. 	ID    int32
  49. 	Inode uint64
  50. 	Name  [16]byte
  51. }
  53. func main() {
  54. 	m := bpf.NewModule(source, []string{})
  55. 	defer m.Close()
  57. 	openFD, err := m.LoadUprobe("trace_open")
  58. 	if err != nil {
  59. 		fmt.Println(err)
  60. 		return
  61. 	}
  63. 	closeFD, err := m.LoadUprobe("trace_close")
  64. 	if err != nil {
  65. 		fmt.Println(err)
  66. 		return
  67. 	}
  69. 	err = m.AttachUprobe("/path/to/binary", "open", openFD)
  70. 	if err != nil {
  71. 		fmt.Println(err)
  72. 		return
  73. 	}
  75. 	err = m.AttachUretprobe("/path/to/binary", "close", closeFD)
  76. 	if err != nil {
  77. 		fmt.Println(err)
  78. 		return
  79.     }
  81.     table := bpf.NewTable(m.TableId("open_files"), m)
  83. 	channel := make(chan []byte)
  84. 	perfMap, err := bpf.InitPerfMap(table, channel)
  85. 	if err != nil {
  86. 		fmt.Println(err)
  87. 		return
  88.     }
  90. 	go func() {
  91.         for data := range channel {
  92.             var key fileKey
  93. 			err = binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &key)
  94. 			if err != nil {
  95. 				fmt.Println(err)
  96. 				continue
  97. 			}
  98. 			
  99.             fmt.Printf("Process: %s opened file with inode %d\n", string(key.Name[:]), key.Inode)
  100.         }
  101.     }()
  102. 	
  103. 	select {}
  104. }
  1. 监控TCP连接：
  1. package main
  3. import (
  4.     "fmt"
  5.     "os"
  7. 	bpf "github.com/iovisor/gobpf/bcc"
  8. )
  10. const source string = `
  11. #include <uapi/linux/ptrace.h>
  12. #include <linux/sched.h>
  14. struct key_t {
  15. 	u64 ip;
  16. 	u64 pid;
  17. };
  19. BPF_HASH(tcp_connections, struct key_t);
  21. int trace_connect(struct pt_regs *ctx) {
  22. 	struct key_t key = {};
  23. 	u64 ip = PT_REGS_RC(ctx);
  24. 	u64 pid = bpf_get_current_pid_tgid();
  26. 	key.ip = ip;
  27. 	key.pid = pid;
  28. 	tcp_connections.update(&key, &ip);
  30. 	return 0;
  31. }
  33. int trace_accept(struct pt_regs *ctx) {
  34. 	struct key_t key = {};
  35. 	u64 ip = PT_REGS_RC(ctx);
  36. 	u64 pid = bpf_get_current_pid_tgid();
  38. 	key.ip = ip;
  39. 	key.pid = pid;
  40. 	tcp_connections.update(&key, &ip);
  42. 	return 0;
  43. }
  44. `
  46. type connectionKey struct {
  47. 	IP  uint64
  48. 	PID uint64
  49. }
  51. func main() {
  52. 	m := bpf.NewModule(source, []string{})
  53. 	defer m.Close()
  55. 	connectFD, err := m.LoadUprobe("trace_connect")
  56. 	if err != nil {
  57. 		fmt.Println(err)
  58. 		return
  59. 	}
  61. 	acceptFD, err := m.LoadUprobe("trace_accept")
  62. 	if err != nil {
  63. 		fmt.Println(err)
  64. 		return
  65.     }
  67.     err = m.AttachUprobe("/path/to/binary", "connect", connectFD)
  68. 	if err != nil {
  69. 		fmt.Println(err)
  70. 		return
  71.     }
  72.     
  73. 	err = m.AttachUprobe("/path/to/binary", "accept", acceptFD)
  74. 	if err != nil {
  75. 		fmt.Println(err)
  76. 		return
  77.     }
  79.     table := bpf.NewTable(m.TableId("tcp_connections"), m)
  81. 	it := table.Iter()
  82. 	for it.Next() {
  83. 		var key connectionKey
  84.         var ip uint64
  86.         if binary.Read(bytes.NewBuffer(it.Key()), binary.LittleEndian, &key) == nil && 
  87.            binary.Read(bytes.NewBuffer(it.Leaf()), binary.LittleEndian, &ip) == nil {
  89.             fmt.Printf("Process with PID %d connected to IP %d\n", key.PID, ip)
  90.         }
  91.     }
  92. }
  1. 监控内存分配：

”`go package main

import (

  1. "fmt"
  2. "os"
  4. bpf "github.com/iovisor/gobpf/bcc"

)

const source string = ` #include

BPF_HASH(allocations, u64);

int trace


内容由零声教学AI助手提供，问题来源于学员提问

本站部分文章来源于网络，版权归原作者所有，如有侵权请联系站长删除。
转载请注明出处：https://golang.0voice.com/?id=18474

golang云原生 golang云原生 管理员
分享：
扫描分享到社交APP
上一篇
下一篇

相关推荐

发表列表
游客 游客
此处应有掌声~
评论列表

还没有评论，快来说点什么吧~

golang云原生

golang云原生

  • 23956文章
  • 0评论
  • 2粉丝
  • 0被赞
最近发布
热门排行
热评文章
猜您喜欢
热门标签
Copyright ©2022    湖南零声信息科技有限公司    版权所有     湘ICP备18009867号-1          证照中心 

联系我们

在线咨询： 点击这里给我发消息

微信号：3007537140

上班时间: 10:30-22:30

关注我们
x

注册

已经有帐号？
简单注册快人一步