5 unstable releases

✓ Uses Rust 2018 edition

new 0.3.2 Aug 19, 2019
0.3.1 Aug 9, 2019
0.2.0 Feb 14, 2019
0.1.1 Sep 26, 2018
0.1.0 Sep 25, 2018

#43 in FFI

Download history 4/week @ 2019-05-04 8/week @ 2019-05-11 9/week @ 2019-05-18 10/week @ 2019-05-25 3/week @ 2019-06-01 15/week @ 2019-06-08 2/week @ 2019-06-15 27/week @ 2019-06-22 9/week @ 2019-06-29 17/week @ 2019-07-06 2/week @ 2019-07-13 7/week @ 2019-07-20 3/week @ 2019-07-27 27/week @ 2019-08-03 31/week @ 2019-08-10

57 downloads per month

GPL-3.0 license

415KB
12K SLoC

C 8K SLoC // 0.1% comments Rust 3.5K SLoC // 0.1% comments Shell 231 SLoC // 0.1% comments BASH 44 SLoC // 0.0% comments

RedBPF

LICENSE CircleCI Crates.io Version Documentation

A Rust eBPF library.

Targeting Rust 2018, so currently only builds on nightly.

For more information, look at the Red Sift Blog, the ingraind wiki and the crate documentation.


lib.rs:

RedBPF

This crate provides a build-load-run workflow for eBPF modules. If the build cargo feature is enabled, build-specific functionality is available. You may want to use the redbpf crate like so:

[build-dependencies]
redbpf = { version = "0.1", features = ["build"] }

[dependencies]
redbpf = "0.1"

For more information about build-specific examples, look at the documentation for the build module.

ELF object expectations

The ELF sections loaded by RedBPF should follow the following naming convention:

  • maps/name for maps
  • kprobe/function_name for entry probes for function_name
  • kretprobe/function_name for return probes for function_name
  • xdp/name for XDP probes. Names can be anything.
  • socketfilter/name for socket filters. Names can be anything.

Additionally, as per convention, the following sections should be present in the ELF object:

__u32 _version SEC("version") = 0xFFFFFFFE;
char _license[] SEC("license") = "GPL";

If the license is not GPL, some in-kernel functionality is not available for eBPF modules.

The magic version number is compatible with GoBPF's convention: during loading it is replaced with the currently running kernel's internal version, as returned by uname().

Dependencies

~5–7.5MB
~174K SLoC