-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
in_ebpf: initial version of the plugin (experimental)
This is a proposal to implement a ebpf trace ingestor plugin to allow sending traces from in kernel functions and userland through uprobes. This initial implementation has 3 traces implemented: bind (tcp), malloc (uprobe) and signals (kernel trace). Events types are known and defined in the fluent-bit codebase and those has to be implemented by the ebpf program to follow when submitted into the ring buffer. Signed-off-by: Jorge Niedbalski <jnr@metaklass.org>
- Loading branch information
1 parent
282923d
commit 1272c6e
Showing
46 changed files
with
508,340 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| cmake_minimum_required(VERSION 3.0) | ||
|
|
||
| # Define source files for the main plugin | ||
| file(GLOB_RECURSE src | ||
| "in_ebpf.c" | ||
| "traces/**/handler.c" | ||
| ) | ||
|
|
||
| # Determine architecture and set flags accordingly | ||
| if(CMAKE_SYSTEM_PROCESSOR MATCHES "x86_64") | ||
| set(ARCH_FLAG "-D__TARGET_ARCH_x86_64") | ||
| set(VMLINUX_PATH "${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes/external/gadget/amd64") | ||
| elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64" OR CMAKE_SYSTEM_PROCESSOR MATCHES "arm64") | ||
| set(ARCH_FLAG "-D__TARGET_ARCH_arm64") | ||
| set(VMLINUX_PATH "${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes/external/gadget/arm64") | ||
| else() | ||
| message(FATAL_ERROR "Unsupported architecture: ${CMAKE_SYSTEM_PROCESSOR}") | ||
| endif() | ||
|
|
||
| # Include directories for external headers, common headers, and generated skeletons | ||
| include_directories( | ||
| ${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes/external | ||
| ${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes | ||
| ) | ||
|
|
||
| # Create an interface library for gadget includes | ||
| add_library(gadget INTERFACE) | ||
| target_include_directories(gadget INTERFACE ${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes/external/gadget) | ||
|
|
||
| # Find all bpf.c files in the traces directory | ||
| file(GLOB_RECURSE TRACE_C_FILES ${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/*/bpf.c) | ||
|
|
||
| # Create a list to hold all the object files and skeleton headers that will be generated | ||
| set(TRACE_OBJ_FILES "") | ||
| set(TRACE_SKEL_HEADERS "") | ||
|
|
||
| # Iterate over each trace bpf.c file to generate corresponding .o and .skel.h files | ||
| foreach(TRACE_C_FILE ${TRACE_C_FILES}) | ||
| # Get the filename and parent directory name (for uniqueness) | ||
| get_filename_component(TRACE_FILE_NAME ${TRACE_C_FILE} NAME_WE) | ||
| get_filename_component(TRACE_PARENT_DIR ${TRACE_C_FILE} DIRECTORY) | ||
| get_filename_component(TRACE_PARENT_DIR_NAME ${TRACE_PARENT_DIR} NAME) | ||
|
|
||
| # Ensure the output filenames maintain the original "trace_" prefix | ||
| set(TRACE_BASE_NAME "trace_${TRACE_PARENT_DIR_NAME}") | ||
|
|
||
| # Set unique names by including the parent directory name in the output paths | ||
| set(TRACE_OBJ_FILE ${CMAKE_BINARY_DIR}/plugins/in_ebpf/traces/includes/generated/${TRACE_BASE_NAME}.o) | ||
| set(TRACE_SKEL_HEADER ${CMAKE_BINARY_DIR}/plugins/in_ebpf/traces/includes/generated/${TRACE_BASE_NAME}.skel.h) | ||
|
|
||
| # Compile each bpf.c file to its corresponding .o file | ||
| add_custom_command( | ||
| OUTPUT ${TRACE_OBJ_FILE} | ||
| COMMAND clang | ||
| -target bpf | ||
| ${ARCH_FLAG} # Use architecture-specific flag | ||
| -O2 # Optional: Optimization level | ||
| -g # Optional: Debug info | ||
| -I${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes/external | ||
| -I${CMAKE_SOURCE_DIR}/plugins/in_ebpf/traces/includes | ||
| -I${VMLINUX_PATH} # Include the correct vmlinux.h based on architecture | ||
| -c ${TRACE_C_FILE} | ||
| -o ${TRACE_OBJ_FILE} | ||
| DEPENDS ${TRACE_C_FILE} | ||
| ) | ||
|
|
||
| # Generate skeleton header for each compiled BPF object file | ||
| add_custom_command( | ||
| OUTPUT ${TRACE_SKEL_HEADER} | ||
| COMMAND bpftool gen skeleton ${TRACE_OBJ_FILE} > ${TRACE_SKEL_HEADER} | ||
| DEPENDS ${TRACE_OBJ_FILE} | ||
| COMMENT "Generating skeleton ${TRACE_SKEL_HEADER} from ${TRACE_OBJ_FILE}" | ||
| ) | ||
|
|
||
| # Add generated object and skeleton files to their respective lists | ||
| list(APPEND TRACE_OBJ_FILES ${TRACE_OBJ_FILE}) | ||
| list(APPEND TRACE_SKEL_HEADERS ${TRACE_SKEL_HEADER}) | ||
| endforeach() | ||
|
|
||
| # Create a custom target specifically for generating eBPF skeletons | ||
| add_custom_target(generate_skeletons DEPENDS ${TRACE_SKEL_HEADERS}) | ||
|
|
||
| # Create a custom target to compile all eBPF programs (all trace bpf.c files) | ||
| add_custom_target(compile_ebpf ALL DEPENDS ${TRACE_OBJ_FILES} ${TRACE_SKEL_HEADERS}) | ||
|
|
||
| # Ensure that the custom target depends on the gadget interface library (for include paths) | ||
| add_dependencies(compile_ebpf gadget) | ||
|
|
||
| # Include generated skeleton headers in the main plugin | ||
| include_directories(${CMAKE_BINARY_DIR}/plugins/in_ebpf/traces/includes/generated) | ||
|
|
||
| # Declare the Fluent Bit plugin (using the default compiler for the main plugin) | ||
| FLB_PLUGIN(in_ebpf "${src}" "") | ||
|
|
||
| # Link necessary libraries | ||
| target_link_libraries(flb-plugin-in_ebpf gadget -lbpf -lelf -lz) |
Oops, something went wrong.