v0.9.0
Release Highlight
- Support an experimental BPF-based extension module 1bfbbcf
Full Changelog: v0.8.0...v0.9.0
An experimental BPF-based extension module
ipftrace2 is used to provide the extension mechanism that can customize your output with a custom BPF program and Lua script. In this extension mechanism, we needed to write both of BPF custom data collector and Lua event decoder, which was sometimes annoying since we needed to go BPF and Lua back and forth.
In the new BPF-based extension mechanism, we only need to write the BPF program, but we can get a similar output. What you need to do in addition is putting some annotation to your struct definition.
#include <linux/types.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>
#define __ipft_sec_skip __attribute__((section("__ipft_skip")))
#define __ipft_event_struct __ipft_event_struct __ipft_sec_skip
struct event {
unsigned int len;
} __ipft_event_struct; // a special annotation
struct sk_buff {
unsigned int len;
};
__hidden int
module(void *ctx, struct sk_buff *skb, __u8 data[64])
{
struct event *ev = (struct event *)data;
ev->len = BPF_CORE_READ(skb, len);
return 0;
}
With this program, you can get an output like this. I believe it's much easier than writing both BPF and Lua.
464048546191357 005 nf_conntrack ipv4_conntrack_in ( len: 2688 )
464048546194045 005 nf_conntrack nf_conntrack_in ( len: 2688 )
464048546194858 005 nf_conntrack resolve_normal_ct ( len: 2688 )
464048546195703 005 nf_conntrack nf_conntrack_handle_packet ( len: 2688 )
464048546196407 005 nf_conntrack nf_conntrack_tcp_packet ( len: 2688 )
464048546197050 005 vmlinux nf_checksum ( len: 2688 )
464048546197694 005 vmlinux nf_ip_checksum ( len: 2688 )
464048546198546 005 nf_nat nf_nat_ipv4_pre_routing ( len: 2688 )
464048546199226 005 nf_nat nf_nat_inet_fn ( len: 2688 )
464048546207009 005 vmlinux tcp_v4_early_demux ( len: 2688 )
464048546208553 005 vmlinux ip_local_deliver ( len: 2688 )
464048546209310 005 vmlinux nf_hook_slow ( len: 2688 )
For more information, please see the guide. You an also find more advanced use cases in GSO example. Enjoy!