\u4f46\u662f\u5f88\u591a\u7684\u573a\u666f\u4e2d\uff08\u5c24\u5176\u662f\u4e91\u539f\u751f\u573a\u666f\uff09\uff0c\u6211\u4eec\u51fa\u4e8e\u907f\u514d\u91cd\u590d\u9020\u8f6e\u5b50\u3001\u66f4\u5feb\u7684\u8fed\u4ee3\u901f\u5ea6\u3001\u8fd0\u884c\u65f6\u5b89\u5168\u7b49\u539f\u56e0\uff0c\u4f1a\u9009\u62e9 go \u8bed\u8a00\u6765\u8fdb\u884c\u5f00\u53d1\uff0cebpf-go2<\/a><\/sup> \u8fd9\u4e2a\u5e93\u5c31\u662f\u5f53\u524d\u6700\u597d\u7684\u9009\u62e9\u3002 <\/p>\n \u4eca\u5929\uff0c\u6211\u4eec\u5c31\u5bf9 ebpf-go \u8fdb\u884c\u4e00\u4e2a\u521d\u4f53\u9a8c\uff0c\u8fd9\u4e2a\u4f53\u9a8c\u4e0d\u662f\u6309\u90e8\u5c31\u73ed\u7684 API \u6587\u6863\uff0c\u800c\u662f\u901a\u8fc7\u4e00\u4e2a\u7b80\u5355\u7684\u9700\u6c42\uff0c\u8ba9\u5927\u5bb6\u5f97\u5230\u4e00\u4e2a\u771f\u5207\u7684\u611f\u53d7\uff0c\u8fd9\u4e2a\u9700\u6c42\u5c31\u662f\uff1a\u7edf\u8ba1\u53d1\u5411\u672c\u673a\u7684\u6bcf\u4e2a \u201c\u8fde\u63a5\u201d<\/em> \u7684\u5305\u6570\u91cf\uff0c\u5e76\u4e14\u6bcf\u65b0\u589e 5 \u4e2a \u201c\u8fde\u63a5\u201d<\/em> \u5c31\u8fdb\u884c\u4e00\u6b21\u6570\u636e\u5c55\u793a\u3002<\/p>\n \u672c\u6b21\u4f53\u9a8c\u9700\u8981\u8bb8\u591a\u524d\u7f6e\u6761\u4ef6\uff1a<\/p>\n \u5982\u679c\u4f9d\u8d56\u4e0b\u8f7d\u8d85\u65f6\u7684\u8bdd\uff0c\u53ef\u4ee5\u8bbe\u7f6e\u4e0b\u4ee3\u7406\uff1a \u5b8c\u6574\u4ee3\u7801\u5728\uff1ahttps:\/\/github.com\/MageekChiu\/epbf-go-exp<\/a><\/p>\n \u672c\u673a\u8fd0\u884c\u4e00\u4e2a openresty \u5e76\u76d1\u542c 8080 \u7aef\u53e3\uff0c\u7136\u540e\u53cd\u590d\u8bbf\u95ee\u6d4b\u8bd5<\/p>\n \u67e5\u770b\u65e5\u5fd7<\/p>\n \u82e5\u8fed\u4ee3\u8fc7\u7a0b\u4e2d\uff0cC \u4ee3\u7801\u6709\u53d8\u5316\uff0c\u5219\u9700\u8981\u6267\u884c \u5982\u679c\u6211\u4eec\u7684 \u5c31\u53ef\u80fd\u4f1a\u5f97\u51fa\u4e00\u4e2a\u770b\u8d77\u6765\u5f88\u5947\u602a\u7684\u7ed3\u679c\uff1a<\/p>\n \u4ee5\u53ca<\/p>\n \u4e4d\u4e00\u770b\u4f60\u4f1a\u53d1\u73b0 map \u7684 key \u600e\u4e48\u6709\u4e9b\u91cd\u590d\u4e86\uff1f\u8fd9\u91cc\u5148\u5356\u4e2a\u5173\u5b50\uff0c\u540e\u9762\u6709\u673a\u4f1a\u518d\u6765\u5206\u6790\u3002<\/p>\n \u672c\u6587\u6211\u4eec\u4e86\u89e3 ebpf-go \u7684\u4e00\u4e9b\u5e38\u89c1\u7528\u6cd5\uff0c\u8ba9\u5927\u5bb6\u5bf9 ebpf-go \u6709\u4e86\u4e00\u4e2a\u6a21\u7cca\u4f46\u6574\u4f53\u7684\u8ba4\u8bc6\uff0c\u66f4\u591a\u7684\u7ec6\u8282\uff0c\u53ef\u4ee5\u901a\u8fc7\u5b98\u7f51\u7684\u6587\u68635<\/a><\/sup>\u4ee5\u53ca examples6<\/a><\/sup> \u8fdb\u884c\u4e86\u89e3\u3002<\/p>\n \u4e0b\u4e00\u7bc7\u6587\u7ae0\uff0c\u6211\u4eec\u5c31\u4ece\u5b9e\u6218\u7684\u89d2\u5ea6\uff0c\u770b\u770b cilium7<\/a><\/sup> \u662f\u600e\u4e48\u901a\u8fc7 ebpf-go \u6765\u53d1\u6325 ebpf \u5a01\u529b\u7684\u3002<\/p>\n<\/p>\n
\u4f53\u9a8c<\/h2>\n
\u4f9d\u8d56<\/h3>\n
\n
clang --version<\/code> )<\/li>\ngo version<\/code>)<\/li>\n<\/ul>\n\u9879\u76ee\u521d\u59cb\u5316<\/h3>\n
# \u521b\u5efa\u9879\u76ee\nmkdir ebpf-go-exp && cd ebpf-go-exp\ngo mod init ebpf-go-exp\ngo mod tidy\n# \u624b\u52a8\u5f15\u5165\u4f9d\u8d56\ngo get github.com\/cilium\/ebpf\/cmd\/bpf2go<\/code><\/pre>\ngo env -w GOPROXY=https:\/\/goproxy.cn,direct<\/code><\/p><\/blockquote>\n\u4ee3\u7801<\/h3>\n
C \u4ee3\u7801<\/h4>\n
...\n\n\/\/go:build ignore\n\nstruct event {\n __u32 count;\n};\nconst struct event *unused __attribute__((unused));\n\nSEC("xdp") \nint count_packets(struct xdp_md *ctx) {\n __u32 ip;\n __u16 sport;\n __u16 dport;\n if (!parse_ip_src_addr(ctx, &ip, &sport, &dport)){\n goto done;\n }\n __u16 r_sport = bpf_ntohs(sport);\n bpf_printk("Process a packet of tuple from %u|%pI4n:%u|%u",ip,&ip,sport,r_sport);\n if(8080 != bpf_ntohs(dport)){\n goto done;\n }\n \n struct tuple key;\n __builtin_memset(&key,0,sizeof(key));\n key.addr = ip;\n key.port = sport;\n\n __u32 *pkt_count = bpf_map_lookup_elem(&pkt_count_map, &key);\n if (!pkt_count) {\n __u32 init_pkt_count = 1;\n bpf_map_update_elem(&pkt_count_map, &key, &init_pkt_count, BPF_NOEXIST);\n __u32 key = 0; \n __u64 *count = bpf_map_lookup_elem(&tuple_num, &key); \n if (count) { \n __sync_fetch_and_add(count, 1); \n if(*count % 5 == 0){\n struct event *e;\n e = bpf_ringbuf_reserve(&events, sizeof(struct event), 0);\n if (e){\n e->count = *count;\n bpf_ringbuf_submit(e, 0);\n }\n }\n }\n } else {\n __sync_fetch_and_add(pkt_count, 1);\n }\n\ndone:\n return XDP_PASS; \n}\n\n...<\/code><\/pre>\nGo \u4ee3\u7801<\/h4>\n
...\n\n\/\/go:generate go run github.com\/cilium\/ebpf\/cmd\/bpf2go -type event counter counter.c -- -I headers\n\nfunc main() {\n \/\/ Load the compiled eBPF ELF and load it into the kernel.\n var objs counterObjects\n if err := loadCounterObjects(&objs, nil); err != nil {\n log.Fatal("Loading eBPF objects:", err)\n }\n defer objs.Close()\n\n ifname := "lo"\n iface, err := net.InterfaceByName(ifname)\n if err != nil {\n log.Fatalf("Getting interface %s: %s", ifname, err)\n }\n\n \/\/ Attach count_packets to the network interface.\n link, err := link.AttachXDP(link.XDPOptions{\n Program: objs.CountPackets,\n Interface: iface.Index,\n })\n if err != nil {\n log.Fatal("Attaching XDP:", err)\n }\n defer link.Close()\n\n rd, err := ringbuf.NewReader(objs.Events)\n if err != nil {\n log.Fatalf("opening ringbuf reader: %s", err)\n }\n defer rd.Close()\n\n stopper := make(chan os.Signal, 1)\n signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)\n go func() {\n <-stopper\n if err := rd.Close(); err != nil {\n log.Fatalf("closing ringbuf reader: %s", err)\n }\n }()\n\n log.Println("Waiting for events..")\n\n \/\/ counterEvent is generated by bpf2go.\n var event counterEvent\n for {\n record, err := rd.Read()\n if err != nil {\n if errors.Is(err, ringbuf.ErrClosed) {\n log.Println("Received signal, exiting..")\n return\n }\n log.Printf("reading from reader: %s", err)\n continue\n }\n if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {\n log.Printf("parsing ringbuf event: %s", err)\n continue\n }\n log.Printf("tuple num: %d", event.Count)\n\n var (\n key counterTuple\n val uint32\n )\n iter := objs.PktCountMap.Iterate()\n for iter.Next(&key, &val) {\n sourceIP := key.Addr\n sourcePort := key.Port\n packetCount := val\n log.Printf("%d\/%s:%d => %d\/n", sourceIP, int2ip(sourceIP), sourcePort, packetCount)\n }\n }\n}\n\n...<\/code><\/pre>\n\u8fd0\u884c<\/h3>\n
# \u751f\u6210\u811a\u624b\u67b6\u4ee3\u7801\ngo generate\n\n# \u5229\u7528\u751f\u6210\u7684 GO \u4ee3\u7801\uff0c\u8fdb\u884c\u7f16\u8bd1\u548c\u8fd0\u884c\ngo build && sudo .\/ebpf-go-exp\n<\/code><\/pre>\nopenresty\n\ncurl localhost:8080\ncurl localhost:8080\n...<\/code><\/pre>\n# bpf \u8f93\u51fa\nbpftool prog tracelog\n bpf_trace_printk: Process a packet of tuple from 16777343|127.0.0.1:31876|33916\n ...\n bpf_trace_printk: Process a packet of tuple from 16777343|127.0.0.1:56449|33244\n ...\n\n# go \u8f93\u51fa\nWaiting for events..\ntuple num: 5\n16777343\/127.0.0.1:31876 => 7\n16777343\/127.0.0.1:31364 => 7\n16777343\/127.0.0.1:56449 => 1\n16777343\/127.0.0.1:10909 => 7\n16777343\/127.0.0.1:30340 => 7\n...<\/code><\/pre>\ngo generate<\/code>\uff0c\u5426\u5219\u4ec5\u6267\u884c Go \u7f16\u8bd1\u90e8\u5206\u5373\u53ef\u3002<\/p>\n\u91cd\u70b9\u89e3\u6790<\/h3>\n
\n
pkt_count_map<\/code>\u3002tuple_num<\/code> \u8fd9\u4e2a map \u4f5c\u4e3a\u5168\u5c40\u53d8\u91cf\uff0c\u901a\u8fc7 __sync_fetch_and_add<\/code> \u5b89\u5168\u5730\u5e76\u53d1\uff0c\u6bcf\u5f53\u65b0\u589e 5 \u4e2a \u201c\u8fde\u63a5\u201d<\/em> \u5c31\u5411\u7528\u6237\u7a7a\u95f4\u53d1\u9001\u4e8b\u4ef6\u3002<\/li>\nunused<\/code> \u8fd9\u4e2a event<\/code> \u6307\u9488\u5fc5\u987b\u58f0\u660e\uff0c\u4e0d\u7136\u7528\u6237\u6001\u7684 go \u5c31\u62ff\u4e0d\u5230\u8fd9\u4e2a\u6570\u636e\u7ed3\u6784\u3002<\/li>\nignore<\/code> \u662f\u5fc5\u987b\u7684\uff0c\u907f\u514d go build \u62a5\u9519: C source files not allowed when not using cgo or SWIG<\/code><\/li>\ngo generate<\/code> \u547d\u4ee4\u4f1a\u6839\u636e go \u4ee3\u7801\u4e2d\u7684 go:generate<\/code> \u8bed\u53e5\u751f\u6210\u811a\u624b\u67b6\u4ee3\u7801\uff0c\u5c31\u50cf BPF Skeleton3<\/a><\/sup>\uff0c\u7136\u540e\u6211\u4eec\u5c31\u53ef\u4ee5\u5728 go \u4ee3\u7801\u4e2d\u4fbf\u6377\u5730\u8bbf\u95ee c \u4e2d\u5b9a\u4e49\u7684 map\uff0cprog \u4ee5\u53ca\u4e00\u4e9b\u6570\u636e\u7ed3\u6784\u3002-type event counter<\/code> \u4f7f\u5f97 c \u4e2d\u5b9a\u4e49\u7684 event<\/code> \u7ed3\u6784\u4f53\u5728 go \u4e2d\u5c31\u662f counterEvent<\/code> \u7ed3\u6784\u4f53\u3002<\/li>\n\u5c0f\u63d2\u66f2<\/h3>\n
pkt_count_map<\/code> \u8fd9\u6837\u5199\u7684\u8bdd\uff1a<\/p>\nstruct tuple key = {ip,bpf_ntohs(sport)};\n__u32 *pkt_count = bpf_map_lookup_elem(&pkt_count_map, &key);\nif (!pkt_count) {\n ...\n}else{\n ...\n}<\/code><\/pre>\nWaiting for events..\ntuple num: 5\n16777343\/127.0.0.1:60162 => 3\n16777343\/127.0.0.1:45076 => 3\n16777343\/127.0.0.1:45082 => 3\n16777343\/127.0.0.1:60162 => 4\n16777343\/127.0.0.1:45076 => 4<\/code><\/pre>\nbpftool map dump name pkt_count_map\n[{\n "key": {\n "addr": 16777343,\n "port": 60162\n },\n "value": 3\n },{\n "key": {\n "addr": 16777343,\n "port": 45082\n },\n "value": 3\n },{\n "key": {\n "addr": 16777343,\n "port": 45076\n },\n "value": 3\n },{\n "key": {\n "addr": 16777343,\n "port": 45082\n },\n "value": 4\n },{\n "key": {\n "addr": 16777343,\n "port": 60162\n },\n "value": 4\n },{\n "key": {\n "addr": 16777343,\n "port": 45076\n },\n "value": 4\n }\n]<\/code><\/pre>\n\u603b\u7ed3<\/h2>\n
\u53c2\u8003<\/h2>\n
\n\n