v0.9.0

Release Highlight

• Support an experimental BPF-based extension module 1bfbbcf

Full Changelog: v0.8.0...v0.9.0

An experimental BPF-based extension module

ipftrace2 is used to provide the extension mechanism that can customize your output with a custom BPF program and Lua script. In this extension mechanism, we needed to write both of BPF custom data collector and Lua event decoder, which was sometimes annoying since we needed to go BPF and Lua back and forth.

In the new BPF-based extension mechanism, we only need to write the BPF program, but we can get a similar output. What you need to do in addition is putting some annotation to your struct definition.

#include <linux/types.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>

#define __ipft_sec_skip __attribute__((section("__ipft_skip")))
#define __ipft_event_struct __ipft_event_struct __ipft_sec_skip

struct event {
  unsigned int len;
} __ipft_event_struct; // a special annotation

struct sk_buff {
  unsigned int len;
};

__hidden int
module(void *ctx, struct sk_buff *skb, __u8 data[64])
{
  struct event *ev = (struct event *)data;

  ev->len = BPF_CORE_READ(skb, len);

  return 0;
}

With this program, you can get an output like this. I believe it's much easier than writing both BPF and Lua.

464048546191357      005             nf_conntrack                ipv4_conntrack_in ( len: 2688 )
464048546194045      005             nf_conntrack                  nf_conntrack_in ( len: 2688 )
464048546194858      005             nf_conntrack                resolve_normal_ct ( len: 2688 )
464048546195703      005             nf_conntrack       nf_conntrack_handle_packet ( len: 2688 )
464048546196407      005             nf_conntrack          nf_conntrack_tcp_packet ( len: 2688 )
464048546197050      005                  vmlinux                      nf_checksum ( len: 2688 )
464048546197694      005                  vmlinux                   nf_ip_checksum ( len: 2688 )
464048546198546      005                   nf_nat          nf_nat_ipv4_pre_routing ( len: 2688 )
464048546199226      005                   nf_nat                   nf_nat_inet_fn ( len: 2688 )
464048546207009      005                  vmlinux               tcp_v4_early_demux ( len: 2688 )
464048546208553      005                  vmlinux                 ip_local_deliver ( len: 2688 )
464048546209310      005                  vmlinux                     nf_hook_slow ( len: 2688 )

For more information, please see the guide. You an also find more advanced use cases in GSO example. Enjoy!