RedBPF

A Rust eBPF toolchain.

Overview

The RedBPF project is a collection of Rust libraries to work with eBPF programs. It includes:

• redbpf-probes - an idiomatic Rust API to write programs that can be compiled to eBPF bytecode and executed by the linux in-kernel eBPF virtual machine.

  

• redbpf-macros - companion crate to redbpf-probes which provides procedural macros to reduce the amount of boilerplate needed to produce eBPF programs.

  

• redbpf - a user space library that can be used to parse and load eBPF programs written using redbpf-probes and redbpf-macros.

  

• cargo-bpf - a cargo subcommand for creating, developing and building eBPF programs in Rust using the RedBPF APIs.

  

Usage

The easiest way to get started is to install cargo-bpf, see the cargo bpf documentation for more info.

The rust-tools directory also contains examples of using redbpf in real life.

To see how and what RedBPF can be used for, check out the ingraind project.

Requirements

In order to build some of the code here, you will need the following:

• Linux 4.19+, with a build tree. The build tree is picked up from standard locations, or the KERNEL_SOURCE environment variable.
• LLVM 10
• The latest stable Rust compiler. We only promise to build with the latest stable and nightly compilers.

NOTE: the latest nightly compilers will use LLVM 11, which doesn't ship with most distributions. Use a stable compiler for the time being.

Getting started

It's easiest to get started by installing cargo-bpf using cargo.

cargo install cargo-bpf
cargo bpf --help

If you would like to go the git way, clone this repository then make sure you sync the git submodules necessary to build redbpf:

git submodule sync
git submodule update --init

Then install the dependencies for your distro before running the usual ritual.

cargo install --path cargo-bpf

Ubuntu

Install the following dependencies:

apt-get install -y curl \
	wget \
	gnupg2 \
	software-properties-common \
	build-essential \
	clang-10 \
	llvm-10 \
	libelf-dev \
	linux-headers-$(uname -r) \
	zlib1g \
	ca-certificates

Fedora

yum install -y clang-10.0.0 \
	llvm-10.0.0 \
	llvm-libs-10.0.0 \
	llvm-devel-10.0.0 \
	llvm-static-10.0.0 \
	kernel \
	kernel-devel \
	elfutils-libelf-devel \
	ca-certificates

License

This repository contains code from other software in the following directories, licensed under their own particular licenses:

• bpf-sys/libelf/*: GPL2 + LGPL3
• bpf-sys/bcc/*: Apache2, public domain
• include/bpf_helpers.h LGPL2 + BSD-2
• include/bpf_helper_defs.h: LGPL2 + BSD-2
• bpf-sys/libbpf: LGPL2 + BSD-2

Where '+' means they are dual licensed.

RedBPF and its components, unless otherwise stated, are licensed under either of

• Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.