Learning eBPF

Spis treści książki

• Preface
  • Who This Book Is For
  • What This Book Covers
  • Prerequisite Knowledge
  • Example Code and Exercises
  • Is eBPF Only for Linux?
  • Conventions Used in This Book
  • Using Code Examples
  • OReilly Online Learning
  • How to Contact Us
  • Acknowledgments
• 1. What Is eBPF, and Why Is It Important?
  • eBPFs Roots: The Berkeley Packet Filter
  • From BPF to eBPF
  • The Evolution of eBPF to Production Systems
  • Naming Is Hard
  • The Linux Kernel
  • Adding New Functionality to the Kernel
  • Kernel Modules
  • Dynamic Loading of eBPF Programs
  • High Performance of eBPF Programs
  • eBPF in Cloud Native Environments
  • Summary
• 2. eBPFs Hello World
  • BCCs Hello World
  • Running Hello World
  • BPF Maps
    • Hash Table Map
    • Perf and Ring Buffer Maps
    • Function Calls
    • Tail Calls
  • Summary
  • Exercises
• 3. Anatomy of an eBPF Program
  • The eBPF Virtual Machine
    • eBPF Registers
    • eBPF Instructions
  • eBPF Hello World for a Network Interface
  • Compiling an eBPF Object File
  • Inspecting an eBPF Object File
  • Loading the Program into the Kernel
  • Inspecting the Loaded Program
    • The BPF Program Tag
    • The Translated Bytecode
    • The JIT-Compiled Machine Code
  • Attaching to an Event
  • Global Variables
  • Detaching the Program
  • Unloading the Program
  • BPF to BPF Calls
  • Summary
  • Exercises
• 4. The bpf() System Call
  • Loading BTF Data
  • Creating Maps
  • Loading a Program
  • Modifying a Map from User Space
  • BPF Program and Map References
    • Pinning
    • BPF Links
  • Additional Syscalls Involved in eBPF
    • Initializing the Perf Buffer
    • Attaching to Kprobe Events
    • Setting Up and Reading Perf Events
  • Ring Buffers
  • Reading Information from a Map
    • Finding a Map
    • Reading Map Elements
  • Summary
  • Exercises
• 5. CO-RE, BTF, and Libbpf
  • BCCs Approach to Portability
  • CO-RE Overview
  • BPF Type Format
    • BTF Use Cases
    • Listing BTF Information with bpftool
    • BTF Types
    • Maps with BTF Information
    • BTF Data for Functions and Function Prototypes
    • Inspecting BTF Data for Maps and Programs
  • Generating a Kernel Header File
  • CO-RE eBPF Programs
    • Header Files
      • Kernel header information
      • Headers from libbpf
      • Application-specific headers
    • Defining Maps
    • eBPF Program Sections
    • Memory Access with CO-RE
    • License Definition
  • Compiling eBPF Programs for CO-RE
    • Debug Information
    • Optimization
    • Target Architecture
    • Makefile
    • BTF Information in the Object File
  • BPF Relocations
  • CO-RE User Space Code
  • The Libbpf Library for User Space
    • BPF Skeletons
      • Loading programs and maps into the kernel
      • Accessing existing maps
      • Attaching to events
      • Managing an event buffer
    • Libbpf Code Examples
  • Summary
  • Exercises
• 6. The eBPF Verifier
  • The Verification Process
  • The Verifier Log
  • Visualizing Control Flow
  • Validating Helper Functions
  • Helper Function Arguments
  • Checking the License
  • Checking Memory Access
  • Checking Pointers Before Dereferencing Them
  • Accessing Context
  • Running to Completion
  • Loops
  • Checking the Return Code
  • Invalid Instructions
  • Unreachable Instructions
  • Summary
  • Exercises
• 7. eBPF Program and Attachment Types
  • Program Context Arguments
  • Helper Functions and Return Codes
  • Kfuncs
  • Tracing
    • Kprobes and Kretprobes
      • Attaching kprobes to syscall entry points
      • Attaching kprobes to other kernel functions
    • Fentry/Fexit
    • Tracepoints
    • BTF-Enabled Tracepoints
    • User Space Attachments
    • LSM
  • Networking
    • Sockets
    • Traffic Control
    • XDP
    • Flow Dissector
    • Lightweight Tunnels
    • Cgroups
    • Infrared Controllers
  • BPF Attachment Types
  • Summary
  • Exercises
• 8. eBPF for Networking
  • Packet Drops
    • XDP Program Return Codes
    • XDP Packet Parsing
  • Load Balancing and Forwarding
  • XDP Offloading
  • Traffic Control (TC)
  • Packet Encryption and Decryption
    • User Space SSL Libraries
  • eBPF and Kubernetes Networking
    • Avoiding iptables
    • Coordinated Network Programs
    • Network Policy Enforcement
    • Encrypted Connections
  • Summary
  • Exercises and Further Reading
• 9. eBPF for Security
  • Security Observability Requires Policy and Context
  • Using System Calls for Security Events
    • Seccomp
    • Generating Seccomp Profiles
    • Syscall-Tracking Security Tools
  • BPF LSM
  • Cilium Tetragon
    • Attaching to Internal Kernel Functions
    • Preventative Security
  • Network Security
  • Summary
• 10. eBPF Programming
  • Bpftrace
  • Language Choices for eBPF in the Kernel
  • BCC Python/Lua/C++
  • C and Libbpf
    • Go
    • Gobpf
    • Ebpf-go
    • Libbpfgo
  • Rust
    • Libbpf-rs
    • Redbpf
    • Aya
    • Rust-bcc
  • Testing BPF Programs
  • Multiple eBPF Programs
  • Summary
  • Exercises
• 11. The Future Evolution of eBPF
  • The eBPF Foundation
  • eBPF for Windows
  • Linux eBPF Evolution
  • eBPF Is a Platform, Not a Feature
  • Conclusion
• Index

pokaż cały spis treści

ukryj recenzje