11 unstable releases (3 breaking)

✓ Uses Rust 2018 edition

new 0.9.4 Nov 6, 2019
0.9.3 Nov 6, 2019
0.9.0 Oct 31, 2019
0.3.3 Sep 3, 2019
0.1.1 Sep 26, 2018

#30 in FFI

Download history 2/week @ 2019-07-24 5/week @ 2019-07-31 38/week @ 2019-08-07 55/week @ 2019-08-14 119/week @ 2019-08-21 104/week @ 2019-08-28 79/week @ 2019-09-04 29/week @ 2019-09-11 104/week @ 2019-09-18 37/week @ 2019-09-25 12/week @ 2019-10-02 1/week @ 2019-10-09 35/week @ 2019-10-16 14/week @ 2019-10-23 81/week @ 2019-10-30

240 downloads per month
Used in 3 crates

GPL-3.0 license

530KB
15K SLoC

C 11K SLoC // 0.1% comments Rust 3.5K SLoC // 0.1% comments Shell 376 SLoC // 0.1% comments BASH 44 SLoC // 0.0% comments

RedBPF

LICENSE CircleCI Crates.io Version Documentation

A Rust eBPF library.

Targeting Rust 2018, so currently only builds on nightly.

For more information, look at the Red Sift Blog, the ingraind wiki and the crate documentation.


lib.rs:

RedBPF

This crate provides a build-load-run workflow for eBPF modules. If the build cargo feature is enabled, build-specific functionality is available. You may want to use the redbpf crate like so:

[build-dependencies]
redbpf = { version = "0.1", features = ["build"] }

[dependencies]
redbpf = "0.1"

For more information about build-specific examples, look at the documentation for the build module.

ELF object expectations

The ELF sections loaded by RedBPF should follow the following naming convention:

  • maps/name for maps
  • kprobe/function_name for entry probes for function_name
  • kretprobe/function_name for return probes for function_name
  • xdp/name for XDP probes. Names can be anything.
  • socketfilter/name for socket filters. Names can be anything.

Additionally, as per convention, the following sections should be present in the ELF object:

__u32 _version SEC("version") = 0xFFFFFFFE;
char _license[] SEC("license") = "GPL";

If the license is not GPL, some in-kernel functionality is not available for eBPF modules.

The magic version number is compatible with GoBPF's convention: during loading it is replaced with the currently running kernel's internal version, as returned by uname().

Dependencies

~4.5–7MB
~163K SLoC