Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

Last update: Jan 6, 2023

Overview

Aya

Overview

eBPF is a technology that allows running user-supplied programs inside the Linux kernel. For more info see https://ebpf.io/what-is-ebpf.

Aya is an eBPF library built with a focus on operability and developer experience. It does not rely on libbpf nor bcc - it's built from the ground up purely in Rust, using only the libc crate to execute syscalls. With BTF support and when linked with musl, it offers a true compile once, run everywhere solution, where a single self-contained binary can be deployed on many linux distributions and kernel versions.

Some of the major features provided include:

Support for the BPF Type Format (BTF), which is transparently enabled when supported by the target kernel. This allows eBPF programs compiled against one kernel version to run on different kernel versions without the need to recompile.
Support for function call relocation and global data maps, which allows eBPF programs to make function calls and use global variables and initializers.
Async support with both tokio and async-std.
Easy to deploy and fast to build: aya doesn't require a kernel build or compiled headers, and not even a C toolchain; a release build completes in a matter of seconds.

Example

Aya supports a large chunk of the eBPF API. The following example shows how to use a BPF_PROG_TYPE_CGROUP_SKB program with aya:

use std::fs::File;
use std::convert::TryInto;
use aya::Bpf;
use aya::programs::{CgroupSkb, CgroupSkbAttachType};

// load the BPF code
let mut bpf = Bpf::load_file("bpf.o")?;

// get the `ingress_filter` program compiled into `bpf.o`.
let ingress: &mut CgroupSkb = bpf.program_mut("ingress_filter")?.try_into()?;

// load the program into the kernel
ingress.load()?;

// attach th program to the root cgroup. `ingress_filter` will be called for all
// incoming packets.
let cgroup = File::open("/sys/fs/cgroup/unified")?;
ingress.attach(cgroup, CgroupSkbAttachType::Ingress)?;

Community

Join the conversation on Discord to discuss anything related to aya.

Contributing

Please see the contributing guide.

License

Aya is distributed under the terms of either the MIT license or the Apache License (version 2.0), at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this crate by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Comments

aya: remove Rc> usage in BPF program links.

This is a breaking change which transfers all ownership of a link to an eBPF program to the caller return value of the "attach" functions. This eliminates the overhead of Rc<RefCell>, as well as prevents the links section of ProgramData from growing without bound as programs are attached and detached.
fix aya

opened by eero-thia 28
Add support for raw tracepoint and LSM programs
This change adds support for the following program types:

raw tracepoint

LSM

Supporting LSM programs involved a necessity of supporting more load_attrs for the BPF_PROG_LOAD operation, concretely:

expected_attach_type - for LSM programs, it has always to be set to BPF_LSM_MAC

attach_btf_obj_fd - it's often used to reference the file descriptor of program's BTF info, altough in case of LSM programs, it only has to contain the value 0, which means the vmlinux object file (usually /sys/kernel/btf/vmlinux)

attach_btf_id - ID of the BTF object, which in case of LSM programs is the ID of the function (the LSM hook)

The example of LSM program using that functionality can be found here:

https://github.com/vadorovsky/aya-example-lsm

Fixes: #9 Signed-off-by: William Findlay [email protected] Signed-off-by: Michal Rostecki [email protected]
feature aya-bpf aya
opened by vadorovsky 18
regression introduced by d8d311738c974f3b6fad22006ab2b827d0925ce8: error parsing BPF object

Today I cargo update my project and suddenly I wasn't able to load my probes anymore, neither on x86_64 or ARMv7, in both cases I get a error parsing BPF object. It is caused by this line introduced by d8d311738c974f3b6fad22006ab2b827d0925ce8 and specifically the data.len() > sizeof(bpf_map_def) since in a lot of cases it'll result in something like 280 > 28, which is always true.

If I use aya from a commit before that one, everything works flawlessly.

An important note: on both platforms, all tests run correctly, meaning that loading an eBPF ELF is not really tested.

opened by evilsocket 18
Support using handle in tc programs
Implements step 1 of https://github.com/aya-rs/aya/issues/414.

Adds handle to the SchedClassifier attach API

Saves handle in the TcLink sruct and uses it when detaching programs

NOTE: This pr changes the API, so I think it will require a bump in the Aya version.

Signed-off-by: Andre Fredette [email protected]
opened by anfredette 15
Make a macro similar to BPF_PROG

The cool thing about libbpf is that it defines the BPF_PROG macro which allows to provide typed arguments which are unpacked from the BPF program context:

https://elixir.bootlin.com/linux/v5.14.13/source/tools/lib/bpf/bpf_tracing.h#L381

So far aya doesn't provide such a macro and all aya-based BPF programs are unpacking the context by manually providing offsets, like:

https://github.com/alessandrod/aya-echo-tracepoint/blob/main/echo-ebpf/src/main.rs#L35-L36

It would be nice to have some macro which takes sized types and does the unpacking with offset automatically, without necessity of doing that manually.

opened by vadorovsky 15
Implement Pinning For Maps and Programs
This commit adds 2 new methods to aya::sys

bpf_pin_object

bpf_get_object

Which allow the pinning and retrieval of programs/maps to bpffs.

For map pinning, the user must ensure the pinning u32 in the bpf_map_def is set to 1, maps will be pinned using a new builder API.

BpfLoader::new().map_pin_path("/sys/fs/bpf/myapp").load_file("myapp.o")

This will pin all maps whose definition requests pinning to path + name.

Closes #45
feature aya
opened by dave-tucker 14

SchedClassifier cannot be attached to interface.

I have a BPF object file that can be successfully attached to a NIC interface but failed by aya.

use aya::Bpf;
use std::convert::TryInto;
use aya::programs::{tc, SchedClassifier, TcAttachType};

tc::qdisc_add_clsact("eth2")?;

let mut bpf = Bpf::load_file("bpf.o")?;

let prog: &mut SchedClassifier = bpf.program_mut("redirect_ingress")?.try_into()?;
prog.load()?;
prog.attach("eth2", TcAttachType::Ingress)?;

I follows this code snippet, and no error was reported during the running time. But tc filter show commands shows nothing, and no log printed to /sys/kernel/debug/tracing/trace_pipe.

My BPF is fairly simple:

TC_SEC("egress")
int egress(struct __sk_buff *skb)
{
	bpf_printk("hello bbbbbbpf");
	return TC_ACT_OK;
}

char __license[] __section("license") = "GPL";

And compiled via

clang -emit-llvm -I include -O2 -c bpf.c -o bpf.ir
llc -march=bpf -filetype=obj bpf.ir -o bpf.o

opened by d0u9 11

aya-bpf: introduce argument coercion
This PR introduces argument coercion for pt_regs and BTF program types and implements it for kprobes, uprobes, LSM programs, and BTF tracepoints.

You can see a more concrete example of using this API here.

Features:

Uses a FromBtfArgs trait with blanket implementations to enable coercion to both primitive types and raw pointers

No need for the user to perform any kind of manual casting on the BPF side

Similar logic for pt_regs programs, abstracting over the PT_REGS access

TODO:

Need to support architectures other than x86 for k/uprobe arguments (bindings need to be fixed)

While I was at it, I modified the Cargo.toml file of aya-bpf-macros to fix broken doctests. Perhaps we should add doctests to the CI workflow?

Closes #21
feature aya-bpf
opened by willfindlay 11
Return non-error only when helper function returns `0` in queue map

As described in https://github.com/aya-rs/aya/issues/288, queue does not return error even calling pop() from the empty queue.

This is because the helper functions (bpf_map_pop_elem()) does not return negative value for rust/aya correctly.

The bpf_map_pop_elem() and bpf_map_push_elem() returns 0 on success - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html, so this patch changes the condition as only 0 on success.

Fix https://github.com/aya-rs/aya/issues/288

opened by nak3 9
Support for BPF_PROG_TYPE_EXT
This PR add support for BPF_PROG_TYPE_EXT

These program types can be used to replace a function (freplace) of an already loaded BPF program. In order to to this we must ensure that when the main program is loaded, its BTF is also loaded into the kernel. This requires that we also provide func_info and line_info

In order to load BTF to the kernel safely, this PR also implements feature probing. This allows us to detect BTF feature support and conditionally enable/disable parts of the loading process and/or fix the BTF provided by LLVM to work with the current running kernel.

We properly adjust the func_info and line_info from the .BTF.ext ELF section, including in cases where we link functions from other ELF sections

If a program contains a valid .BTF and .BTF.ext and section, we will load these in to the kernel

We also set the program name in the BPF_PROG_LOAD syscall for ease of finding programs later

As a result, when loading a BPF program (written in C, with BTF) we get line information included in the output from bpftool prog dump xlated, as well as the ability to inspect a loaded programs BTF with bpftool btf dump.

The API for BPF_PROG_TYPE_EXT. The API is as follows:

Get the program from the loaded BPF as usual let ext : &mut Extension = bpf.programs_mut("xdp_pass").unwrap().try_into()

In order to load an Extension program, we need the BPF FD of the program we are targeting. This can be obtained from a LinkRef if we have one in scope, using LinkRef::fd(). Since it's likely that the root program may be pinned, I also implemented LinkRef::from_pinned_path().

The API for load and attach is as follows:

let prog_ref = LinkRef::from_pinned_path(path)?; let link_fd = prog_ref.fd()?; let pass: &mut Extension = bpf.program_mut("pass").unwrap().try_into()?; pass.load(link_fd, "prog0".to_string())?; pass.attach(link_fd)?;
feature aya-bpf aya
opened by dave-tucker 9

Build error on macOS

❯ cargo xtask build-ebpf
    Finished dev [unoptimized + debuginfo] target(s) in 0.44s
     Running `target/debug/xtask build-ebpf`
       Fresh core v0.0.0 (/Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/src/rust/library/core)
       Fresh unicode-ident v1.0.1
       Fresh rustc-std-workspace-core v1.99.0 (/Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/src/rust/library/rustc-std-workspace-core)
       Fresh compiler_builtins v0.1.73
       Fresh proc-macro2 v1.0.39
       Fresh quote v1.0.18
       Fresh aya-bpf-cty v0.2.1 (https://github.com/aya-rs/aya?branch=main#24597b15)
       Fresh aya-log-common v0.1.11-dev.0 (https://github.com/aya-rs/aya-log?branch=main#1b0d3da1)
       Fresh test-common v0.1.0 (/private/tmp/test/test-common)
       Fresh syn v1.0.96
       Fresh aya-bpf-bindings v0.1.0 (https://github.com/aya-rs/aya?branch=main#24597b15)
       Fresh aya-bpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#24597b15)
       Fresh aya-log-ebpf-macros v0.1.0 (https://github.com/aya-rs/aya-log?branch=main#1b0d3da1)
       Fresh aya-bpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#24597b15)
       Fresh aya-log-ebpf v0.1.0 (https://github.com/aya-rs/aya-log?branch=main#1b0d3da1)
   Compiling test-ebpf v0.1.0 (/private/tmp/test/test-ebpf)
     Running `rustc --crate-name test --edition=2021 src/main.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C opt-level=3 -C panic=abort -C lto -C codegen-units=1 -C metadata=2e82d0e5b2d39d7d -C extra-filename=-2e82d0e5b2d39d7d --out-dir /private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps --target bpfel-unknown-none -L dependency=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps -L dependency=/private/tmp/test/test-ebpf/../target/debug/deps --extern aya_bpf=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libaya_bpf-8eafcb4491315b37.rlib --extern aya_log_ebpf=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libaya_log_ebpf-dab76645e270effc.rlib --extern 'noprelude:compiler_builtins=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libcompiler_builtins-fb7baa4459bc0f28.rlib' --extern 'noprelude:core=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libcore-ac93b7c2e8668cc4.rlib' --extern test_common=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libtest_common-46aaf21c6fd808b3.rlib -Z unstable-options`
error: linking with `bpf-linker` failed: exit status: 101
  |
  = note: "bpf-linker" "--export-symbols" "/var/folders/zf/ddjjdvfx7sbdpg9m2v_dzq6c0000gn/T/rustcI90ALy/symbols" "/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/test-2e82d0e5b2d39d7d.test.964645a3-cgu.0.rcgu.o" "-L" "/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps" "-L" "/private/tmp/test/test-ebpf/../target/debug/deps" "-L" "/Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/bpfel-unknown-none/lib" "--cpu" "generic" "--cpu-features" "" "-L" "/Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/bpfel-unknown-none/lib" "-o" "/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/test-2e82d0e5b2d39d7d" "-O3" "--debug"
  = note: Unable to find LLVM shared lib in possible locations:
          - /Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib
          - /private/tmp/test/test-ebpf/../target/debug/deps
          - /Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib
          - /Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib
          - /private/tmp/test/target/debug/deps
          - /private/tmp/test/target/debug
          - /Users/weishu/.rustup/toolchains/stable-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib
          - /Users/weishu/.rustup/toolchains/stable-x86_64-apple-darwin/lib
          - /Users/weishu/lib
          - /usr/local/lib
          - /usr/lib
          - /Users/weishu/.rustup/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib
          - /Users/weishu/.cargo/lib
          - /Users/weishu/.cargo/lib
          - /Users/weishu/.cargo/lib
          - /Users/weishu/.pyenv/lib
          - /Users/weishu/perl5/lib
          - /opt/local/lib
          - /usr/local/lib
          - /usr/lib
          - /lib
          - /usr/lib
          - /Users/weishu/dev/env/android-sdk-macosx/lib
          - /usr/local/opt/binutils/lib
          - /usr/local/lib
          - /usr/lib
          - /lib
          - /usr/lib
          - /lib
          - /Applications/VMware Fusion.app/Contents/lib
          - /usr/local/go/lib
          - /Library/Apple/usr/lib
          - /Users/weishu/.cargo/lib
          - /Users/weishu/dev/env/android-sdk-macosx/lib
          - /usr/local/go/lib
          - /Users/weishu/.fzf/lib
          thread 'main' panicked at 'explicit panic', /Users/weishu/.cargo/registry/src/rsproxy.cn-8f6827c7555bfaf8/aya-rustc-llvm-proxy-0.4.0/src/lib.rs:66:17
          stack backtrace:
             0:        0x103b884d4 - std::backtrace_rs::backtrace::libunwind::trace::h3cae2b905fd8ac13
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/libunwind.rs:93:5
             1:        0x103b884d4 - std::backtrace_rs::backtrace::trace_unsynchronized::he35fb4c47e25f88c
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/../../backtrace/src/backtrace/mod.rs:66:5
             2:        0x103b884d4 - std::sys_common::backtrace::_print_fmt::hdb42afc2298dc41a
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:66:5
             3:        0x103b884d4 - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::hc80096156cd24709
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:45:22
             4:        0x103b9e49b - core::fmt::write::hb6b947db0e571766
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/fmt/mod.rs:1194:17
             5:        0x103b85c88 - std::io::Write::write_fmt::h59c4febf5f8fcb1e
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/io/mod.rs:1655:15
             6:        0x103b89ccd - std::sys_common::backtrace::_print::h72a3180302df7468
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:48:5
             7:        0x103b89ccd - std::sys_common::backtrace::print::ha0747cec3f48ad89
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sys_common/backtrace.rs:35:9
             8:        0x103b89ccd - std::panicking::default_hook::{{closure}}::h0e76f92bbb367061
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:295:22
             9:        0x103b899b1 - std::panicking::default_hook::hbbbb8c05ad6cce9a
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:314:9
            10:        0x103b8a24e - std::panicking::rust_panic_with_hook::ha581a2c99399f83b
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:698:17
            11:        0x103b657ab - std::panicking::begin_panic::{{closure}}::hc57fe083ca1eea73
            12:        0x103b65777 - std::sys_common::backtrace::__rust_end_short_backtrace::h9620d44d0f370b03
            13:        0x103ba7b6d - std::panicking::begin_panic::hedb03f8528414ed1
            14:        0x103b6345a - std::sync::once::Once::call_once::{{closure}}::h80d062e613295e1b
            15:        0x103ba9c45 - std::sync::once::Once::call_inner::h8b33a57e6782c624
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/sync/once.rs:434:21
            16:        0x103b61c5f - _LLVMInitializeBPFTarget
            17:        0x103afb325 - bpf_linker::llvm::init::hdf4839966017a037
            18:        0x103af558f - bpf_linker::linker::Linker::link::h662e8b3751512a65
            19:        0x103aed566 - bpf_linker::main::h6ca1e7dc87cd9f3a
            20:        0x103af3126 - std::sys_common::backtrace::__rust_begin_short_backtrace::h8879b42cc2650929
            21:        0x103ae117c - std::rt::lang_start::{{closure}}::hcac71c8faace75ca
            22:        0x103b7fb5a - core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &F>::call_once::h45b43bdd91db95dd
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/core/src/ops/function.rs:259:13
            23:        0x103b7fb5a - std::panicking::try::do_call::h249f439f16aa313c
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:492:40
            24:        0x103b7fb5a - std::panicking::try::ha8537a1873fa2ff9
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:456:19
            25:        0x103b7fb5a - std::panic::catch_unwind::hffa61ccaeb4f89c5
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panic.rs:137:14
            26:        0x103b7fb5a - std::rt::lang_start_internal::{{closure}}::h32bbf4c39987b002
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/rt.rs:128:48
            27:        0x103b7fb5a - std::panicking::try::do_call::h558936e01b59417c
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:492:40
            28:        0x103b7fb5a - std::panicking::try::h12a630e8ced1b46a
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panicking.rs:456:19
            29:        0x103b7fb5a - std::panic::catch_unwind::h539ca15d1ec773ea
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/panic.rs:137:14
            30:        0x103b7fb5a - std::rt::lang_start_internal::hdb19fe6764e59ca8
                                         at /rustc/fe5b13d681f25ee6474be29d748c65adcd91f69e/library/std/src/rt.rs:128:20
            31:        0x103aedd39 - _main


error: could not compile `test-ebpf` due to previous error

Caused by:
  process didn't exit successfully: `rustc --crate-name test --edition=2021 src/main.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type bin --emit=dep-info,link -C opt-level=3 -C panic=abort -C lto -C codegen-units=1 -C metadata=2e82d0e5b2d39d7d -C extra-filename=-2e82d0e5b2d39d7d --out-dir /private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps --target bpfel-unknown-none -L dependency=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps -L dependency=/private/tmp/test/test-ebpf/../target/debug/deps --extern aya_bpf=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libaya_bpf-8eafcb4491315b37.rlib --extern aya_log_ebpf=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libaya_log_ebpf-dab76645e270effc.rlib --extern 'noprelude:compiler_builtins=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libcompiler_builtins-fb7baa4459bc0f28.rlib' --extern 'noprelude:core=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libcore-ac93b7c2e8668cc4.rlib' --extern test_common=/private/tmp/test/test-ebpf/../target/bpfel-unknown-none/debug/deps/libtest_common-46aaf21c6fd808b3.rlib -Z unstable-options` (exit status: 1)
thread 'main' panicked at 'assertion failed: status.success()', xtask/src/build_ebpf.rs:62:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

opened by tiann 8

Add program::links() and NetworkInterface
I haven't finished testing but I wanted to open it early to corrections/conversation.

NetworkInterface provides a way to store network interface indexes as well as retrieve an interface's name using the NetworkInterface.name() method.

Interfaces can be created manually or retrieved via new .interface() methods on XdpLink and SchedClassifierLink.

Interface names are extracted from the kernel for 2 reasons.

Interface names can change within the kernel at anytime which aya will not be aware of.

Names are not always available when a NetworkInterface is created. For example in the XdpLink .interface() implementation.

A new method NetworkInterface::list() also provides a list of network interfaces from the kernel.
opened by FallingSnow 1
add tracefs mount point select function
This PR would to improve the access to tracefs.

This is implemented with a single check to determine if the tracefs is mounted or not. It checks in two known locations, in order of priority:

/sys/kernel/tracing

/sys/kernel/debug/tracing

Most of the systems have both tracefs and debugfs mounted, but in some hardened systems the kernel is compiled without debugfs or simply not mounted. Android documentation for example has a warning for debugfs in user builds.
opened by banditopazzo 1
How do I get the payload of tcp

I want to calculate tcp cheksum by tcp payload, but in my tests, ctx.data() & ctx.data_end() just point to headers (eth/ip/tcp) . I tried to get it from the function "bpf_xdp_load_bytes", but there was an error "invalid func unknown#189" on startup.

opened by YeautyYE 1
Publish all aya-bpf and aya-log-ebpf crates to crates.io?

Only the following crates are available on crates.io: https://crates.io/crates/aya/0.11.0 https://crates.io/crates/aya-log/0.1.13 https://crates.io/crates/aya-log-common/0.1.13

I think that covers the user space parts.

However, everything else requires a github dependency: aya-bpf v0.1.0 aya-bpf-bindings v0.1.0 aya-bpf-cty v0.2.1 aya-bpf-macros v0.1.0 (proc-macro) aya-log-ebpf v0.1.0 aya-log-ebpf-macros v0.1.0 (proc-macro) aya-log-parser v0.1.11-dev.0

Is there any blockers to getting these into crates.io?

I'm not allowed to use github dependencies :(

opened by OliverGavin 2

Cannot attach XDP BPF program in DRV_MODE

Hey! I am trying to use XDP in driver mode but it doesn't work:

Caused by:
    0: netlink error while attaching XDP program
    1: Invalid argument (os error 22)

I've been testing on Amazon Linux with two different kernels and ENA drivers:

oligavin@dev] uname -r
5.4.209-129.367.amzn2.x86_64
oligavin@dev] modinfo ena | grep ^version
version:        2.7.4g

[oligavin@ip-10-0-115-159]~% uname -r                   
5.10.118-111.515.amzn2.x86_64
[oligavin@ip-10-0-115-159]~% modinfo ena | grep ^version
version:        2.7.1g

I have successfully been using AF_XDP (via another library) on 5.10 so I think this is an AYA issue.

I would be happy to attempt a fix if you can guide me in the right direction :)

Steps to reproduce

Running the generated XDP program:

oligavin@dev] cargo generate https://github.com/aya-rs/aya-template

⚠️   Favorite `https://github.com/aya-rs/aya-template` not found in config, using it as a git repository: https://github.com/aya-rs/aya-template
🤷   Project Name: test_xdp_driver_mode
⚠️   Renaming project called `test_xdp_driver_mode` to `test-xdp-driver-mode`...
🔧   Destination: /tmp/testing/test-xdp-driver-mode ...
🔧   project-name: test-xdp-driver-mode ...
🔧   Generating template ...
✔ 🤷   Which type of eBPF program? · xdp
[ 1/34]   Done: .cargo/config.toml                                                                                                                                                                                                                                                                  
[ 2/34]   Done: .cargo                                                                                                                                                                                                                                                                              [ 3/34]   Done: .gitignore                                                                                                                                                                                                                                                                          [ 4/34]   Done: .vim/coc-settings.json                                                                                                                                                                                                                                                              [ 5/34]   Done: .vim                                                                                                                                                                                                                                                                                
[ 6/34]   Done: .vscode/settings.json                                                                                                                                                                                                                                                               
[ 7/34]   Done: .vscode                                                                                                                                                                                                                                                                             
[ 8/34]   Done: Cargo.toml                                                                                                                                                                                                                                                                          
[ 9/34]   Done: README.md                                                                                                                                                                                                                                                                           
[10/34]   Done: xtask/Cargo.toml                                                                                                                                                                                                                                                                    
[11/34]   Done: xtask/src/build_ebpf.rs                                                                                                                                                                                                                                                             
[12/34]   Done: xtask/src/main.rs                                                                                                                                                                                                                                                                   
[13/34]   Done: xtask/src/run.rs                                                                                                                                                                                                                                                                    
[14/34]   Done: xtask/src                                                                                                                                                                                                                                                                           
[15/34]   Done: xtask                                                                                                                                                                                                                                                                               
[16/34]   Done: test-xdp-driver-mode/Cargo.toml                                                                                                                                                                                                                                                     
[17/34]   Done: test-xdp-driver-mode/src/main.rs                                                                                                                                                                                                                                                    
[18/34]   Done: test-xdp-driver-mode/src                                                                                                                                                                                                                                                            
[19/34]   Done: test-xdp-driver-mode                                                                                                                                                                                                                                                                
[20/34]   Done: test-xdp-driver-mode-common/Cargo.toml                                                                                                                                                                                                                                              
[21/34]   Done: test-xdp-driver-mode-common/src/lib.rs                                                                                                                                                                                                                                              
[22/34]   Done: test-xdp-driver-mode-common/src                                                                                                                                                                                                                                                     
[23/34]   Done: test-xdp-driver-mode-common                                                                                                                                                                                                                                                         
[24/34]   Done: test-xdp-driver-mode-ebpf/.cargo/config.toml                                                                                                                                                                                                                                        
[25/34]   Done: test-xdp-driver-mode-ebpf/.cargo                                                                                                                                                                                                                                                    
[26/34]   Done: test-xdp-driver-mode-ebpf/.vim/coc-settings.json                                                                                                                                                                                                                                    
[27/34]   Done: test-xdp-driver-mode-ebpf/.vim                                                                                                                                                                                                                                                      
[28/34]   Done: test-xdp-driver-mode-ebpf/.vscode/settings.json                                                                                                                                                                                                                                     
[29/34]   Done: test-xdp-driver-mode-ebpf/.vscode                                                                                                                                                                                                                                                   
[30/34]   Done: test-xdp-driver-mode-ebpf/Cargo.toml                                                                                                                                                                                                                                                
[31/34]   Done: test-xdp-driver-mode-ebpf/rust-toolchain.toml                                                                                                                                                                                                                                       
[32/34]   Done: test-xdp-driver-mode-ebpf/src/main.rs                                                                                                                                                                                                                                               
[33/34]   Done: test-xdp-driver-mode-ebpf/src                                                                                                                                                                                                                                                       
[34/34]   Done: test-xdp-driver-mode-ebpf                                                                                                                                                                                                                                                           
🔧   Moving generated files into: `/tmp/testing/test-xdp-driver-mode`...
💡   Initializing a fresh Git repository
✨   Done! New project created /tmp/testing/test-xdp-driver-mode

oligavin@] cargo xtask run
    Finished dev [unoptimized + debuginfo] target(s) in 0.03s
     Running `target/debug/xtask run`
       Fresh unicode-ident v1.0.5
       Fresh proc-macro2 v1.0.47
       Fresh core v0.0.0 (/local/home/oligavin/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core)
       Fresh rustc-std-workspace-core v1.99.0 (/local/home/oligavin/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/rustc-std-workspace-core)                                                                                                                     
       Fresh quote v1.0.21
       Fresh compiler_builtins v0.1.82
       Fresh rustversion v1.0.9
       Fresh syn v1.0.105
       Fresh aya-bpf-cty v0.2.1 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh test-xdp-driver-mode-common v0.1.0 (/tmp/testing/test-xdp-driver-mode/test-xdp-driver-mode-common)
       Fresh num_enum_derive v0.5.7
       Fresh aya-bpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-bpf-bindings v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh num_enum v0.5.7
       Fresh aya-bpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-log-common v0.1.13 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-log-parser v0.1.11-dev.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-log-ebpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-log-ebpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh test-xdp-driver-mode-ebpf v0.1.0 (/tmp/testing/test-xdp-driver-mode/test-xdp-driver-mode-ebpf)
    Finished dev [optimized] target(s) in 0.39s
    Finished dev [unoptimized + debuginfo] target(s) in 0.27s
Error: failed to attach the XDP program with default flags - try changing XdpFlags::default() to XdpFlags::SKB_MODE

Caused by:
    0: netlink error while attaching XDP program
    1: Invalid argument (os error 22)

Modifying the XDP program to use SKB mode works

test-xdp-driver-mode/src/main.rs:

-    program.attach(&opt.iface, XdpFlags::default())
+    program.attach(&opt.iface, XdpFlags::SKB_MODE)

oligavin@dev] RUST_LOG=DEBUG cargo xtask run
    Finished dev [unoptimized + debuginfo] target(s) in 0.03s         
     Running `target/debug/xtask run`                              
       Fresh unicode-ident v1.0.5                                  
       Fresh proc-macro2 v1.0.47                                                   
       Fresh core v0.0.0 (/local/home/oligavin/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core)
       Fresh rustc-std-workspace-core v1.99.0 (/local/home/oligavin/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/rustc-std-workspace-core)
       Fresh quote v1.0.21                                                               
       Fresh compiler_builtins v0.1.82                             
       Fresh rustversion v1.0.9                                    
       Fresh syn v1.0.105                                                                                                         
       Fresh aya-bpf-cty v0.2.1 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh test-xdp-driver-mode-common v0.1.0 (/tmp/testing/test-xdp-driver-mode/test-xdp-driver-mode-common)
       Fresh num_enum_derive v0.5.7                                
       Fresh aya-bpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-bpf-bindings v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh num_enum v0.5.7                                       
       Fresh aya-bpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)
       Fresh aya-log-common v0.1.13 (https://github.com/aya-rs/aya?branch=main#16b029ed)                                                                                                                                                                                                            
       Fresh aya-log-parser v0.1.11-dev.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)                                                                                                                                                                                                      
       Fresh aya-log-ebpf-macros v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)                                                                                                                                                                                                        
       Fresh aya-log-ebpf v0.1.0 (https://github.com/aya-rs/aya?branch=main#16b029ed)                                                                                                                                                                                                               
       Fresh test-xdp-driver-mode-ebpf v0.1.0 (/tmp/testing/test-xdp-driver-mode/test-xdp-driver-mode-ebpf)                                                                                                                                                                                         
    Finished dev [optimized] target(s) in 0.38s                                                                                                                                                                                                                                                     
    Finished dev [unoptimized + debuginfo] target(s) in 0.27s                                                                                                                                                                                                                                       
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BPF program name support: true                                                                                                                                                                                                                   
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF support: true                                                                                                                                                                                                                                
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF func support: true                                                                                                                                                                                                                           
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF global func support: false                                                                                                                                                                                                                   
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF var and datasec support: true                                                                                                                                                                                                                
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF float support: false                                                                                                                                                                                                                         
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF decl_tag support: false                                                                                                                                                                                                                      
[2022-12-06T20:34:41Z DEBUG aya::bpf] [FEAT PROBE] BTF type_tag support: false                                                                                                                                                                                                                      
[2022-12-06T20:34:41Z DEBUG aya::obj::relocation] relocating program test_xdp_driver_mode function test_xdp_driver_mode                                                                                                                                                                             
[2022-12-06T20:34:41Z DEBUG aya::obj::relocation] finished relocating program test_xdp_driver_mode function test_xdp_driver_mode                                                                                                                                                                    
[2022-12-06T20:34:41Z INFO  test_xdp_driver_mode] Waiting for Ctrl-C...
[2022-12-06T20:34:41Z INFO  test_xdp_driver_mode] received a packet
[2022-12-06T20:34:41Z INFO  test_xdp_driver_mode] received a packet
[2022-12-06T20:34:41Z INFO  test_xdp_driver_mode] received a packet

Modifying the XDP program to use DRV mode does not work

test-xdp-driver-mode/src/main.rs:

-    program.attach(&opt.iface, XdpFlags::default())
+    program.attach(&opt.iface, XdpFlags::DRV_MODE)

Same error as I started with:

Error: failed to attach the XDP program with default flags - try changing XdpFlags::default() to XdpFlags::SKB_MODE

Caused by:
    0: netlink error while attaching XDP program
    1: Invalid argument (os error 22)

opened by OliverGavin 18

Releases(aya-log-v0.1.13)

aya-log-v0.1.13(Nov 16, 2022)
no changes

Source code(tar.gz)
Source code(zip)
aya-log-common-v0.1.13(Nov 16, 2022)
no changes

Source code(tar.gz)
Source code(zip)
aya-log-v0.1.11(Sep 1, 2022)
no changes

Source code(tar.gz)
Source code(zip)
aya-log-common-v0.1.11(Sep 1, 2022)
no changes

Source code(tar.gz)
Source code(zip)
aya-v0.11.0(Jun 6, 2022)
🚀 Features

aya: rework links

PR: #249

aya: Implement forget_link

PR: #253

Add support for BPF_PROG_TYPE_CGROUP_SYSCTL

PR: #256

Add Support for BPF_PROG_TYPE_CGROUP_SOCK_ADDR

PR: #261

Add support for BPF_PROG_TYPE_CGROUP_SOCKOPT

PR: #268

Add riscv64 architecture support to xtask/codegen

PR: #275

riscv scaffolding for codegen

PR: #278

Add riscv64 bindings

PR: #280

Add support for BPF_PROG_TYPE_SK_LOOKUP

PR: #265

Program unload API

PR: #264

🐛 Fixes and 🤏 Small Changes

aya: perf_buffer: call BytesMut::reserve() internally

PR: #243

aya: Support multiple maps in map sections

PR: #181

aya-gen: Disable Debug derive for BTF types

PR: #250

aya: Relocate maps using symbol_index

PR: #252

Set attach type during load for BPF_PROG_TYPE_CGROUP_SKB

PR: #263

aya: Export program modules

PR: #281

Getters be gone

PR: #293

Codegen changes for RingBuf

PR: #295

aya: Rename forget_link to take_link

PR: #306

🤝 Dependencies and 🤖 Generated Code

Update libbpf to 3a4e26307d0f9b227e3ebd28b443a1a715e4e17d

PR: #251

xtask: Add bpf_.* instead of bpf_map_.* to allowed type

PR: #266

Update libbpf to 86eb09863c1c0177e99c2c703092042d3cdba910

PR: #267

Update libbpf to 4eb6485c08867edaa5a0a81c64ddb23580420340

PR: #296

📃 Documentation

xtask: Add docs build

PR: #259

Add Netlify Config and Update README

PR: #260

xtask: Add all crates to sidebar

PR: #273

Source code(tar.gz)
Source code(zip)
aya-v0.10.7(Mar 19, 2022)
🚀 Features

Support for fentry and fexit programs

PR: #139

Mark .rodata maps as readonly and freeze on load

PR: #146

Support for BPF_PROG_TYPE_EXT

PR: #127

btf: Add support for BTF_TYPE_KIND_{TAG,DECL_TAG}

PR: #168

Add support for BPF_MAP_TYPE_LPM_TRIE

PR: #161

🐛 Fixes and 🤏 Small Changes

fix: make maps compatible with kernel <= 4.14

PR: #107

Use current kernel version as default if not specified

PR: #109

update some cfgs to get rid of the annoying warnings

PR: #111

bpf: Fix cgroup_skb macro

PR: #112

Support k/uprobes on older kernels.

PR: #108

Add wrapper and docs for for bpf_get_current_uid_gid

PR: #114

aya: expand include_bytes_aligned to accept expressions.

PR: #122

aya: programs_mut iterator to complement programs.

PR: #121

aya: close file descriptors on Map drop.

PR: #116

aya: remove unnecessary usage of &dyn trait in favor of impl trait.

PR: #115

aya: use correct program name when relocating

PR: #130

aya: eliminate name duplication in maps and programs.

PR: #120

aya: Remove unnecessary unsafe markers on map iteration.

PR: #131

obj: Improve section detection

PR: #125

Implement Pod for u128 and i128

PR: #136

aya: allocate func/line_info buffers outside if

PR: #158

aya: Retrieve program from pinned path

PR: #165

aya: Fix BTF type resolution for Arrays and Ints

PR: #169

aya: Truncate long program names

PR: #171

aya: Fix name truncation

PR: #172

btf: fix sanitization if BTF_FUNC_GLOBAL is not supported

PR: #174

Add fixup for FuncProto

PR: #173

aya: Fix BTF verifier output

PR: #164

aya: Merge Fixup and Sanitzation to single step

PR: #175

relocate .text references

PR: #177

btf: Replace / in DATASEC before load to kernel

PR: #179

aya: implement Pod for arrays of Pod types

PR: #224

aya: Fix Loading from cgroup/skb sections

PR: #229

Fix socket_filter section match

PR: #228

🧪 Tests

github: Set toolchain override

PR: #138

ci: Use crabby-the-crab

PR: #135

.github: force push to codegen branch

PR: #144

ci: Add autogenerated release notes

PR: #152

ci: Add dependencies/codegen/docs to rel notes

PR: #154

test: Add regression tests

PR: #160

Regression Test Framework Improvements

PR: #182

ci: Fix image build workflow

PR: #183

ci: lint: aya: Skip doctests with miri

PR: #232

🤝 Dependencies and 🤖 Generated Code

Update libbpf to 93e89b34740c509406e948c78a404dd2fba67b8b

PR: #134

codegen: Add more bindings

PR: #143

Update libbpf to 19656636a9b9a2de1f71fa3135709295c16701cc

PR: #145

Add bpf_lpm_trie_key to bindings

PR: #162

Update libbpf to 22411acc4b2c846868fd570b2d9f3b016d2af2cb

PR: #163

codegen: add btf_decl_tag

PR: #166

Update libbpf to be89b28f96be426e30a2b0c5312d13b30ee518c7

PR: #167

📃 Documentation

aya: document the public api

PR: #157

Fix typo in README.md

PR: #234

fix typo in aya/src/programs/fentry.rs

PR: #237

bpf: Improve documentation of set_global method

PR: #238

Source code(tar.gz)
Source code(zip)

Owner

GitHub https://aya-rs.github.io/book/

EXPERIMENTAL: Bitcoin Core Prometheus exporter based on User-Space, Statically Defined Tracing and eBPF.

bitcoind-observer An experimental Prometheus metric exporter for Bitcoin Core based on Userspace, Statically Defined Tracing and eBPF. This demo is ba

24 Nov 8, 2022

A demo app covering building an eBPF load-balancer in Rust

eBPF Rust UDP LoadBalancer Demo This is an example of creating a UDP load-balancer in Rust as an eXpress Data Path (XDP) type eBPF program using the a

17 Jan 5, 2023

Torii ⛩️ is a simple, powerful and extensible open-source Internal Developer Portal

Torii ⛩️ Torii is a simple, powerful and extensible open-source Internal Developer Portal where developers can find all the tools and services they ne

64 Dec 17, 2023

🎙️ Catalyst Voices provides a unified experience and platform including production-ready liquid democracy

??️ Catalyst Voices provides a unified experience and platform including production-ready liquid democracy, meaningful collaboration opportunities & data-driven context for better onboarding & decisions.

6 Oct 11, 2023

This is an experiment in designing a distributed connected garden experience.

This is an experiment in designing a distributed connected garden experience. It started as an implementation of a blockchain, but has moved on to be a bit more than that. There is no proof of work like a cryptocurrency, but plays with the idea of a distributed consensus-building system.

4 Feb 28, 2022

A github rust workflows template, just want to focus on coding

rust-template A github rust workflows template, just want to focus on coding. Demo template GitHub Actions Workflow file Table of contents Features Us

3 Jul 23, 2023

A simple MD5 implementation with a focus on buffered reading

md5-rs A simple MD5 implementation with a focus on buffered reading, and is completely no_std. This shouldn't be used in any security-critical softwar

3 Mar 25, 2022

Built for Perpetual Protocol v2 Curie on Optimism chain. This CLI tool was built with Rust.

Perpetual Protocol CLI for Perp v2 Curie This tool is to provide a simple, fast and efficient way to interact Perpetual Protocol contracts from your t

4 Jan 11, 2023

An extensible and practical demonstration of constructing evm-based sandwich attacks built with ethers-rs and Huff language.

subway-rs • Construct evm-based sandwich attacks using Rust and Huff. Getting Started subway-rs is a port of libevm's original subway, implemented wit

230 Apr 25, 2023

Aya is an eBPF library for the Rust programming language, built with a focus on developer experience and operability.

Related tags

Overview

Aya

Overview

Example

Community

Contributing

License

Comments

Steps to reproduce

Running the generated XDP program:

Modifying the XDP program to use SKB mode works

Modifying the XDP program to use DRV mode does not work

Releases(aya-log-v0.1.13)

aya-log-v0.1.13(Nov 16, 2022)

aya-log-common-v0.1.13(Nov 16, 2022)

aya-log-v0.1.11(Sep 1, 2022)

aya-log-common-v0.1.11(Sep 1, 2022)

aya-v0.11.0(Jun 6, 2022)

🚀 Features

🐛 Fixes and 🤏 Small Changes

🤝 Dependencies and 🤖 Generated Code

📃 Documentation

aya-v0.10.7(Mar 19, 2022)

🚀 Features

🐛 Fixes and 🤏 Small Changes

🧪 Tests

🤝 Dependencies and 🤖 Generated Code

📃 Documentation

Owner

EXPERIMENTAL: Bitcoin Core Prometheus exporter based on User-Space, Statically Defined Tracing and eBPF.

A demo app covering building an eBPF load-balancer in Rust

Torii ⛩️ is a simple, powerful and extensible open-source Internal Developer Portal

🎙️ Catalyst Voices provides a unified experience and platform including production-ready liquid democracy

This is an experiment in designing a distributed connected garden experience.

A github rust workflows template, just want to focus on coding

A simple MD5 implementation with a focus on buffered reading

Built for Perpetual Protocol v2 Curie on Optimism chain. This CLI tool was built with Rust.

An extensible and practical demonstration of constructing evm-based sandwich attacks built with ethers-rs and Huff language.

A low-level assembly language for the Ethereum Virtual Machine built in blazing-fast pure rust.

A bitcoin vanity address generator written with the Rust programming language.

Zerocaf: A library built for EC operations in Zero Knowledge.

Rusty Hog is a secret scanner built in Rust for performance, and based on TruffleHog which is written in Python.

Employ your built-in wetware pattern recognition and signal processing facilities to understand your network traffic

Ingraind - a security monitoring agent built around RedBPF for complex containerized environments and endpoints.

A tutorial for an NFT Market Place Built with Near Protocol and React.js

CosmWasm-Examples is a collection of example contracts and applications built using the CosmWasm framework

STARK - SNARK recursive zero knowledge proofs, combinaison of the Winterfell library and the Circom language

The simple password manager for geeks, built with Rust.