{"id":36926,"date":"2025-04-11T15:19:12","date_gmt":"2025-04-11T07:19:12","guid":{"rendered":"https:\/\/www.yunshan.net\/blog\/?p=36926"},"modified":"2025-04-11T15:19:12","modified_gmt":"2025-04-11T07:19:12","slug":"%e5%a6%82%e4%bd%95%e4%bd%bf%e7%94%a8ebpf%e8%bf%9b%e8%a1%8c%e8%bf%9b%e7%a8%8b%e9%97%b4%e9%80%9a%e4%bf%a1%e7%9a%84%e7%9b%91%e6%8e%a7%ef%bc%9f","status":"publish","type":"post","link":"https:\/\/www.yunshan.net\/blog\/archives\/36926.html","title":{"rendered":"\u5982\u4f55\u4f7f\u7528eBPF\u8fdb\u884c\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u76d1\u63a7\uff1f"},"content":{"rendered":"<p style=\"text-align: center;\">\n<p><img decoding=\"async\" src=\"https:\/\/www.yunshan.net\/blog\/wp-content\/uploads\/2025\/04\/20W9y0.jpg\" alt=\"\u5982\u4f55\u4f7f\u7528eBPF\u8fdb\u884c\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u76d1\u63a7\uff1f\" ><\/p>\n<\/p>\n<h3 id=\"\u524d\u8a00\">\u524d\u8a00<\/h3>\n<p>\u5728\u5206\u5e03\u5f0f\u7cfb\u7edf\u548c\u5bb9\u5668\u5316\u6280\u672f\u84ec\u52c3\u53d1\u5c55\u7684\u4eca\u5929\uff0c<strong>\u8fdb\u7a0b\u95f4\u901a\u4fe1\uff08IPC\uff09<\/strong> \u4f5c\u4e3a\u7cfb\u7edf\u67b6\u6784\u7684&rdquo;\u795e\u7ecf\u8109\u7edc&rdquo;\uff0c\u5176\u6027\u80fd\u548c\u5b89\u5168\u6027\u76f4\u63a5\u51b3\u5b9a\u4e86\u6574\u4e2a\u7cfb\u7edf\u7684\u7a33\u5b9a\u6027\u3002\u4f20\u7edf\u76d1\u63a7\u5de5\u5177\u5982<code>strace<\/code>\u6216<code>netstat<\/code>\u867d\u80fd\u63d0\u4f9b\u57fa\u7840\u6570\u636e\uff0c\u5374\u96be\u4ee5\u5728<strong>\u4f4e\u5f00\u9500<\/strong>\u548c<strong>\u9ad8\u7cbe\u5ea6<\/strong>\u4e4b\u95f4\u627e\u5230\u5e73\u8861\u3002\u800c<strong><a href=\"https:\/\/www.yunshan.net\/\"   target=\"_blank\" style=\"color:blue\">eBPF<\/a>\uff08Extended Berkeley Packet Filter\uff09<\/strong> \u51ed\u501f\u5176\u5185\u6838\u7ea7\u53ef\u7f16\u7a0b\u80fd\u529b\uff0c\u6b63\u5728\u6210\u4e3a\u7cfb\u7edf\u53ef\u89c2\u6d4b\u6027\u9886\u57df\u7684\u9769\u547d\u6027\u6280\u672f\u3002\u672c\u6587\u5c06\u6df1\u5165\u63a2\u8ba8\u5982\u4f55\u5229\u7528<a href=\"https:\/\/www.yunshan.net\/\"   target=\"_blank\" style=\"color:blue\">eBPF<\/a>\u5b9e\u73b0<strong>\u5b9e\u65f6\u3001\u52a8\u6001\u7684\u8fdb\u7a0b\u95f4\u901a\u4fe1\u76d1\u63a7<\/strong>\uff0c\u5e76\u901a\u8fc7\u5b9e\u9645\u4ee3\u7801\u793a\u4f8b\u63ed\u793a\u5176\u6280\u672f\u5185\u6838\u3002<\/p>\n<hr>\n<h3 id=\"\u4e00-ebpf-\u91cd\u65b0\u5b9a\u4e49\u5185\u6838\u89c2\u6d4b\u7684\u8fb9\u754c\">\u4e00\u3001eBPF\uff1a\u91cd\u65b0\u5b9a\u4e49\u5185\u6838\u89c2\u6d4b\u7684\u8fb9\u754c<\/h3>\n<p>eBPF\u5e76\u975e\u4e00\u9879\u5168\u65b0\u7684\u6280\u672f\uff0c\u4f46\u5176\u5728Linux 4.x\u7248\u672c\u540e\u7684\u7206\u53d1\u5f0f\u6f14\u8fdb\u5f7b\u5e95\u6539\u53d8\u4e86\u5f00\u53d1\u8005\u7684\u8fd0\u7ef4\u65b9\u5f0f\u3002\u4e0e\u4f20\u7edf\u7684<strong>\u9759\u6001\u63d2\u6869\uff08Static Tracing\uff09<\/strong>\u4e0d\u540c\uff0ceBPF\u5141\u8bb8\u7528\u6237\u5728\u5185\u6838\u4e2d<strong>\u52a8\u6001\u6ce8\u5165\u6c99\u76d2\u5316\u7a0b\u5e8f<\/strong>\uff0c\u65e0\u9700\u91cd\u65b0\u7f16\u8bd1\u5185\u6838\u5373\u53ef\u6355\u83b7\u7cfb\u7edf\u8c03\u7528\u3001\u7f51\u7edc\u6570\u636e\u5305\u7b49\u4e8b\u4ef6\u3002\u8fd9\u79cd\u7279\u6027\u4f7f\u5176\u6210\u4e3a\u76d1\u63a7<strong>\u77ed\u751f\u547d\u5468\u671f\u8fdb\u7a0b<\/strong>\uff08\u5982\u5bb9\u5668\u5185\u8fdb\u7a0b\uff09\u7684\u7406\u60f3\u9009\u62e9\u3002<\/p>\n<p>\u901a\u8fc7<strong>BPF\u6620\u5c04\uff08Map\uff09<\/strong>\u548c<strong>\u8f85\u52a9\u51fd\u6570\uff08Helper Function\uff09<\/strong>\uff0ceBPF\u7a0b\u5e8f\u80fd\u591f\u5c06\u91c7\u96c6\u7684\u6570\u636e\u5b9e\u65f6\u4f20\u9012\u5230\u7528\u6237\u7a7a\u95f4\u3002\u4f8b\u5982\uff0c\u5728\u76d1\u63a7Unix\u57df\u5957\u63a5\u5b57\u901a\u4fe1\u65f6\uff0ceBPF\u53ef\u4ee5\u7cbe\u51c6\u8bb0\u5f55<code>connect()<\/code>\u3001<code>sendmsg()<\/code>\u7b49\u7cfb\u7edf\u8c03\u7528\u7684\u53c2\u6570\uff0c\u540c\u65f6\u901a\u8fc7<code>BPF_PERF_OUTPUT<\/code>\u673a\u5236\u5c06\u4e8b\u4ef6\u63a8\u9001\u5230\u7528\u6237\u6001\u5206\u6790\u5de5\u5177\u3002<\/p>\n<hr>\n<h3 id=\"\u4e8c-\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u6838\u5fc3\u573a\u666f\u4e0e\u6311\u6218\">\u4e8c\u3001\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u6838\u5fc3\u573a\u666f\u4e0e\u6311\u6218<\/h3>\n<p>\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u5e38\u89c1\u5f62\u5f0f\u5305\u62ec<strong>\u7ba1\u9053\uff08Pipe\uff09<\/strong>\u3001<strong>\u4fe1\u53f7\uff08Signal\uff09<\/strong>\u3001<strong>\u5171\u4eab\u5185\u5b58\uff08Shared Memory\uff09<\/strong>\u548c<strong>\u5957\u63a5\u5b57\uff08Socket\uff09<\/strong>\u3002\u4ee5\u5bb9\u5668\u5316\u73af\u5883\u4e3a\u4f8b\uff0c\u540c\u4e00Pod\u5185\u7684\u5bb9\u5668\u5f80\u5f80\u901a\u8fc7Unix\u57df\u5957\u63a5\u5b57\u901a\u4fe1\uff0c\u800c\u8de8\u8282\u70b9\u670d\u52a1\u5219\u4f9d\u8d56TCP\/UDP\u5957\u63a5\u5b57\u3002<\/p>\n<p>\u4f20\u7edf\u76d1\u63a7\u65b9\u6cd5\u7684\u5c40\u9650\u6027\u5728\u4e8e\uff1a<\/p>\n<ol>\n<li><strong>\u91c7\u6837\u7c92\u5ea6\u7c97<\/strong>\uff1a<code>\/proc<\/code>\u6587\u4ef6\u7cfb\u7edf\u4ec5\u63d0\u4f9b\u9759\u6001\u5feb\u7167\uff0c\u65e0\u6cd5\u6355\u6349\u77ac\u65f6\u901a\u4fe1\u884c\u4e3a\uff1b\n<\/li>\n<li><strong>\u6027\u80fd\u635f\u8017\u9ad8<\/strong>\uff1a\u5168\u91cf\u7cfb\u7edf\u8c03\u7528\u8ddf\u8e2a\u53ef\u80fd\u5bfc\u81f4\u9ad8\u8fbe30%\u7684\u6027\u80fd\u4e0b\u964d\uff1b\n<\/li>\n<li><strong>\u4e0a\u4e0b\u6587\u7f3a\u5931<\/strong>\uff1a\u96be\u4ee5\u5173\u8054\u901a\u4fe1\u4e8b\u4ef6\u4e0e\u5177\u4f53\u7684\u5bb9\u5668\u3001\u8fdb\u7a0b\u6216\u7ebf\u7a0b\u3002\n<\/li>\n<\/ol>\n<p>\u800ceBPF\u901a\u8fc7<strong>\u52a8\u6001\u6302\u8f7d\u63a2\u9488\uff08Kprobe\/Uprobe\uff09<\/strong>\uff0c\u80fd\u591f\u4ee5\u7eb3\u79d2\u7ea7\u7cbe\u5ea6\u6355\u83b7\u4e8b\u4ef6\uff0c\u5e76\u901a\u8fc7<code>bpf_get_current_pid_tgid()<\/code>\u7b49\u51fd\u6570\u81ea\u52a8\u5173\u8054\u8fdb\u7a0b\u4e0a\u4e0b\u6587\u4fe1\u606f\u3002<\/p>\n<hr>\n<h3 id=\"\u4e09-\u5b9e\u6218-\u6784\u5efaebpf\u9a71\u52a8\u7684ipc\u76d1\u63a7\u6846\u67b6\">\u4e09\u3001\u5b9e\u6218\uff1a\u6784\u5efaeBPF\u9a71\u52a8\u7684IPC\u76d1\u63a7\u6846\u67b6<\/h3>\n<h4 id=\"1-\u9009\u62e9\u89c2\u6d4b\u70b9\">1. <strong>\u9009\u62e9\u89c2\u6d4b\u70b9<\/strong><\/h4>\n<p>\u9488\u5bf9\u4e0d\u540cIPC\u673a\u5236\uff0c\u9700\u5728\u5185\u6838\u4e2d\u9009\u62e9\u5408\u9002\u7684\u94a9\u5b50\u70b9\uff1a<\/p>\n<ul>\n<li><strong>\u5957\u63a5\u5b57\u901a\u4fe1<\/strong>\uff1a\u6302\u94a9<code>__sys_connect<\/code>\u3001<code>__sys_sendmsg<\/code>\u7b49\u51fd\u6570\uff1b\n<\/li>\n<li><strong>\u4fe1\u53f7\u4f20\u9012<\/strong>\uff1a\u6355\u83b7<code>do_send_sig_info<\/code>\u51fd\u6570\u8c03\u7528\uff1b\n<\/li>\n<li><strong>\u5171\u4eab\u5185\u5b58<\/strong>\uff1a\u76d1\u63a7<code>shmat()<\/code>\u548c<code>shmdt()<\/code>\u7cfb\u7edf\u8c03\u7528\u3002\n<\/li>\n<\/ul>\n<h4 id=\"2-\u7f16\u5199ebpf\u7a0b\u5e8f\">2. <strong>\u7f16\u5199eBPF\u7a0b\u5e8f<\/strong><\/h4>\n<p>\u4ee5\u4e0b\u793a\u4f8b\u5c55\u793a\u5982\u4f55\u8ddf\u8e2aUnix\u57df\u5957\u63a5\u5b57\u7684\u8fde\u63a5\u8bf7\u6c42\uff1a<\/p>\n<pre><code class=\"language-c\">SEC(&quot;kprobe\/__sys_connect&quot;)  \r\nint kprobe__sys_connect(struct pt_regs *ctx) {  \r\nstruct sockaddr *uservaddr = (struct sockaddr *)PT_REGS_PARM2(ctx);  \r\nif (uservaddr-&gt;sa_family != AF_UNIX) return 0;  \/\/ \u8fc7\u6ee4\u975eUnix\u57df\u5957\u63a5\u5b57  \r\n  \r\nchar comm[TASK_COMM_LEN];  \r\nbpf_get_current_comm(&amp;comm, sizeof(comm));  \r\n  \r\nstruct event_t event = {  \r\n.pid = bpf_get_current_pid_tgid() &gt;&gt; 32,  \r\n.comm = comm,  \r\n.sun_path = uservaddr-&gt;sun_path  \r\n};  \r\nbpf_perf_event_output(ctx, &amp;events, BPF_F_CURRENT_CPU, &amp;event, sizeof(event));  \r\nreturn 0;  \r\n}  \r\n<\/code><\/pre>\n<p>\u6b64\u7a0b\u5e8f\u901a\u8fc7<strong>kprobe<\/strong>\u6302\u94a9<code>__sys_connect<\/code>\u7cfb\u7edf\u8c03\u7528\uff0c\u8fc7\u6ee4\u51fa\u76ee\u6807\u534f\u8bae\u65cf\u7684\u901a\u4fe1\u4e8b\u4ef6\uff0c\u5e76\u5c06\u8fdb\u7a0b\u540d\u3001PID\u548c\u76ee\u6807\u8def\u5f84\u8f93\u51fa\u5230\u7528\u6237\u7a7a\u95f4\u3002<\/p>\n<h4 id=\"3-\u7528\u6237\u7a7a\u95f4\u6570\u636e\u5904\u7406\">3. <strong>\u7528\u6237\u7a7a\u95f4\u6570\u636e\u5904\u7406<\/strong><\/h4>\n<p>\u4f7f\u7528Python\u548c<code>bcc<\/code>\u5e93\u89e3\u6790eBPF\u8f93\u51fa\uff1a<\/p>\n<pre><code class=\"language-python\">from bcc import BPF  \r\n  \r\nb = BPF(src_file=&quot;ipc_monitor.c&quot;)  \r\nprint(&quot;%-6s %-16s %s&quot; % (&quot;PID&quot;, &quot;Process&quot;, &quot;Unix Path&quot;))  \r\n  \r\ndef print_event(cpu, data, size):  \r\nevent = b[&quot;events&quot;].event(data)  \r\nprint(&quot;%-6d %-16s %s&quot; % (event.pid, event.comm, event.sun_path))  \r\n  \r\nb[&quot;events&quot;].open_perf_buffer(print_event)  \r\nwhile True:  \r\nb.perf_buffer_poll()  \r\n<\/code><\/pre>\n<p>\u8be5\u811a\u672c\u5b9e\u65f6\u6253\u5370\u53d1\u8d77Unix\u57df\u5957\u63a5\u5b57\u8fde\u63a5\u7684\u8fdb\u7a0b\u4fe1\u606f\uff0c\u5f62\u6210\u53ef\u8bfb\u6027\u5f3a\u7684\u76d1\u63a7\u65e5\u5fd7\u3002<\/p>\n<hr>\n<h3 id=\"\u56db-\u4f18\u5316\u4e0e\u9ad8\u7ea7\u6280\u5de7\">\u56db\u3001\u4f18\u5316\u4e0e\u9ad8\u7ea7\u6280\u5de7<\/h3>\n<ol>\n<li><strong>\u964d\u4f4e\u6027\u80fd\u5f00\u9500<\/strong>\n<\/li>\n<\/ol>\n<ul>\n<li>\u901a\u8fc7<code>BPF_FILTER<\/code>\u5728\u5185\u6838\u6001\u63d0\u524d\u8fc7\u6ee4\u65e0\u5173\u4e8b\u4ef6\uff1b\n<\/li>\n<li>\u4f7f\u7528<strong>\u73af\u5f62\u7f13\u51b2\u533a\uff08Ring Buffer\uff09<\/strong>\u66ff\u4ee3Perf Buffer\u4ee5\u51cf\u5c11\u5185\u5b58\u62f7\u8d1d\uff1b\n<\/li>\n<li>\u5bf9\u9ad8\u9891\u7387\u4e8b\u4ef6\uff08\u5982\u4fe1\u53f7\uff09\u542f\u7528\u91c7\u6837\u6a21\u5f0f\u3002\n<\/li>\n<\/ul>\n<ol>\n<li><strong>\u589e\u5f3a\u5b89\u5168\u6027\u5206\u6790<\/strong><br \/>\n\u7ed3\u5408<code>bpf_probe_read_user_str()<\/code>\u51fd\u6570\u8bfb\u53d6\u8fdb\u7a0b\u53c2\u6570\uff0c\u68c0\u6d4b\u53ef\u7591\u7684IPC\u884c\u4e3a\u6a21\u5f0f\uff1a\n<\/li>\n<\/ol>\n<pre><code class=\"language-c\">char filename[256];  \r\nbpf_probe_read_user_str(filename, sizeof(filename), uptr_filename);  \r\nif (strstr(filename, &quot;malicious.sock&quot;)) {  \r\nbpf_override_return(ctx, -EPERM);  \/\/ \u963b\u65ad\u6076\u610f\u8fde\u63a5  \r\n}  \r\n<\/code><\/pre>\n<ol>\n<li><strong>\u4e0e\u5bb9\u5668\u5143\u6570\u636e\u96c6\u6210<\/strong><br \/>\n\u901a\u8fc7<code>bpf_get_ns_current_pid_tgid()<\/code>\u83b7\u53d6\u5bb9\u5668\u7684cgroup ID\uff0c\u5e76\u4e0eKubernetes\u5143\u6570\u636e\u5e93\u5173\u8054\uff0c\u5b9e\u73b0\u8de8\u5c42\u6b21\u7684\u76d1\u63a7\u89c6\u56fe\u3002\n<\/li>\n<\/ol>\n<hr>\n<h3 id=\"\u4e94-\u5178\u578b\u6848\u4f8b\u5206\u6790\">\u4e94\u3001\u5178\u578b\u6848\u4f8b\u5206\u6790<\/h3>\n<p>\u67d0\u91d1\u878d\u79d1\u6280\u516c\u53f8\u5728Kubernetes\u96c6\u7fa4\u4e2d\u90e8\u7f72\u5fae\u670d\u52a1\u65f6\uff0c\u53d1\u73b0<strong>\u5ef6\u8fdf\u6bdb\u523a<\/strong>\u73b0\u8c61\u3002\u901a\u8fc7\u90e8\u7f72\u57fa\u4e8eeBPF\u7684IPC\u76d1\u63a7\u5de5\u5177\uff0c\u56e2\u961f\u8fc5\u901f\u5b9a\u4f4d\u5230\u95ee\u9898\u6839\u6e90\uff1a\u67d0\u4e2a\u9ad8\u9891\u8c03\u7528\u7684gRPC\u670d\u52a1\u56e0\u8fc7\u5ea6\u4f7f\u7528Unix\u57df\u5957\u63a5\u5b57\uff0c\u5bfc\u81f4\u63a5\u6536\u961f\u5217\u79ef\u538b\u3002\u901a\u8fc7\u4f18\u5316\u8fde\u63a5\u6c60\u7b56\u7565\uff0c\u5e73\u5747\u5ef6\u8fdf\u4ece<strong>850ms<\/strong>\u964d\u81f3<strong>120ms<\/strong>\uff0c\u540c\u65f6\u76d1\u63a7\u7cfb\u7edf\u81ea\u8eabCPU\u5360\u7528\u7387\u59cb\u7ec8\u4f4e\u4e8e<strong>2%<\/strong>\u3002<\/p>\n<p>\u8fd9\u4e00\u6848\u4f8b\u5370\u8bc1\u4e86eBPF\u5728<strong>\u590d\u6742\u73af\u5883\u4e0b\u7684\u8bca\u65ad\u4ef7\u503c<\/strong>\u2014\u2014\u5b83\u4e0d\u4ec5\u80fd\u591f\u63ed\u793a\u4f20\u7edf\u5de5\u5177\u65e0\u6cd5\u89c2\u6d4b\u7684\u77ac\u65f6\u72b6\u6001\uff0c\u8fd8\u80fd\u4ee5\u8fd1\u4e4e\u96f6\u4fb5\u5165\u7684\u65b9\u5f0f\u878d\u5165\u751f\u4ea7\u73af\u5883\u3002<\/p>\n<hr>\n<h3 id=\"\u516d-\u6700\u4f73\u5b9e\u8df5\u4e0e\u6ce8\u610f\u4e8b\u9879\">\u516d\u3001\u6700\u4f73\u5b9e\u8df5\u4e0e\u6ce8\u610f\u4e8b\u9879<\/h3>\n<ul>\n<li><strong>\u7248\u672c\u517c\u5bb9\u6027<\/strong>\uff1a\u786e\u4fddLinux\u5185\u6838\u7248\u672c\u22654.18\u4ee5\u652f\u6301BPF\u7c7b\u578b\u683c\u5f0f\uff08BTF\uff09\uff1b\n<\/li>\n<li><strong>\u6743\u9650\u7ba1\u7406<\/strong>\uff1a\u901a\u8fc7Capability\u673a\u5236\u9650\u5236\u975e\u7279\u6743\u7528\u6237\u52a0\u8f7deBPF\u7a0b\u5e8f\uff1b\n<\/li>\n<li><strong>\u751f\u547d\u5468\u671f\u7ba1\u7406<\/strong>\uff1a\u4f7f\u7528<code>bpftool<\/code>\u5b9a\u671f\u6e05\u7406\u6b8b\u7559\u7684eBPF\u7a0b\u5e8f\uff0c\u907f\u514d\u5185\u6838\u8d44\u6e90\u6cc4\u6f0f\uff1b\n<\/li>\n<li><strong>\u53ef\u89c6\u5316\u6574\u5408<\/strong>\uff1a\u5c06eBPF\u6570\u636e\u5bfc\u5165<a href=\"https:\/\/www.yunshan.net\/\"   target=\"_blank\" style=\"color:blue\">Prometheus<\/a>+Grafana\u6808\uff0c\u6784\u5efa\u5b9e\u65f6\u76d1\u63a7\u4eea\u8868\u76d8\u3002<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u8a00 \u5728\u5206\u5e03\u5f0f\u7cfb\u7edf\u548c\u5bb9\u5668\u5316\u6280\u672f\u84ec\u52c3\u53d1\u5c55\u7684\u4eca\u5929\uff0c\u8fdb\u7a0b\u95f4\u901a\u4fe1\uff08IPC\uff09 \u4f5c\u4e3a\u7cfb\u7edf\u67b6\u6784\u7684&rdquo;\u795e\u7ecf\u8109\u7edc&rdquo;\uff0c\u5176\u6027\u80fd\u548c\u5b89\u5168\u6027\u76f4\u63a5\u51b3\u5b9a\u4e86\u6574\u4e2a\u7cfb\u7edf\u7684\u7a33\u5b9a\u6027\u3002\u4f20\u7edf\u76d1\u63a7\u5de5\u5177\u5982strace\u6216netstat\u867d\u80fd\u63d0\u4f9b\u57fa\u7840\u6570\u636e\uff0c\u5374\u96be\u4ee5\u5728\u4f4e\u5f00\u9500\u548c\u9ad8\u7cbe\u5ea6\u4e4b\u95f4\u627e\u5230\u5e73\u8861\u3002\u800ceBPF\uff08Extended Berkeley Packet Filter\uff09 \u51ed\u501f\u5176\u5185\u6838\u7ea7\u53ef\u7f16\u7a0b\u80fd\u529b\uff0c\u6b63\u5728\u6210\u4e3a\u7cfb\u7edf\u53ef\u89c2\u6d4b\u6027\u9886\u57df\u7684\u9769\u547d\u6027\u6280\u672f\u3002\u672c\u6587\u5c06\u6df1\u5165\u63a2\u8ba8\u5982\u4f55\u5229\u7528eBPF\u5b9e\u73b0\u5b9e\u65f6\u3001\u52a8\u6001\u7684\u8fdb\u7a0b\u95f4\u901a\u4fe1\u76d1\u63a7\uff0c\u5e76\u901a\u8fc7\u5b9e\u9645\u4ee3\u7801\u793a\u4f8b\u63ed\u793a\u5176\u6280\u672f\u5185\u6838\u3002 \u4e00\u3001eBPF\uff1a\u91cd\u65b0\u5b9a\u4e49\u5185\u6838\u89c2\u6d4b\u7684\u8fb9\u754c eBPF\u5e76\u975e\u4e00\u9879\u5168\u65b0\u7684\u6280\u672f\uff0c\u4f46\u5176\u5728Linux 4.x\u7248\u672c\u540e\u7684\u7206\u53d1\u5f0f\u6f14\u8fdb\u5f7b\u5e95\u6539\u53d8\u4e86\u5f00\u53d1\u8005\u7684\u8fd0\u7ef4\u65b9\u5f0f\u3002\u4e0e\u4f20\u7edf\u7684\u9759\u6001\u63d2\u6869\uff08Static Tracing\uff09\u4e0d\u540c\uff0ceBPF\u5141\u8bb8\u7528\u6237\u5728\u5185\u6838\u4e2d\u52a8\u6001\u6ce8\u5165\u6c99\u76d2\u5316\u7a0b\u5e8f\uff0c\u65e0\u9700\u91cd\u65b0\u7f16\u8bd1\u5185\u6838\u5373\u53ef\u6355\u83b7\u7cfb\u7edf\u8c03\u7528\u3001\u7f51\u7edc\u6570\u636e\u5305\u7b49\u4e8b\u4ef6\u3002\u8fd9\u79cd\u7279\u6027\u4f7f\u5176\u6210\u4e3a\u76d1\u63a7\u77ed\u751f\u547d\u5468\u671f\u8fdb\u7a0b\uff08\u5982\u5bb9\u5668\u5185\u8fdb\u7a0b\uff09\u7684\u7406\u60f3\u9009\u62e9\u3002 \u901a\u8fc7BPF\u6620\u5c04\uff08Map\uff09\u548c\u8f85\u52a9\u51fd\u6570\uff08Helper Function\uff09\uff0ceBPF\u7a0b\u5e8f\u80fd\u591f\u5c06\u91c7\u96c6\u7684\u6570\u636e\u5b9e\u65f6\u4f20\u9012\u5230\u7528\u6237\u7a7a\u95f4\u3002\u4f8b\u5982\uff0c\u5728\u76d1\u63a7Unix\u57df\u5957\u63a5\u5b57\u901a\u4fe1\u65f6\uff0ceBPF\u53ef\u4ee5\u7cbe\u51c6\u8bb0\u5f55connect()\u3001sendmsg()\u7b49\u7cfb\u7edf\u8c03\u7528\u7684\u53c2\u6570\uff0c\u540c\u65f6\u901a\u8fc7BPF_PERF_OUTPUT\u673a\u5236\u5c06\u4e8b\u4ef6\u63a8\u9001\u5230\u7528\u6237\u6001\u5206\u6790\u5de5\u5177\u3002 \u4e8c\u3001\u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u6838\u5fc3\u573a\u666f\u4e0e\u6311\u6218 \u8fdb\u7a0b\u95f4\u901a\u4fe1\u7684\u5e38\u89c1\u5f62\u5f0f\u5305\u62ec\u7ba1\u9053\uff08Pipe\uff09\u3001\u4fe1\u53f7\uff08Signal\uff09\u3001\u5171\u4eab\u5185\u5b58\uff08Shared Memory\uff09\u548c\u5957\u63a5\u5b57\uff08Socket\uff09\u3002\u4ee5\u5bb9\u5668\u5316\u73af\u5883\u4e3a\u4f8b\uff0c\u540c\u4e00Pod\u5185\u7684\u5bb9\u5668\u5f80\u5f80\u901a\u8fc7Unix\u57df\u5957\u63a5\u5b57\u901a\u4fe1\uff0c\u800c\u8de8\u8282\u70b9\u670d\u52a1\u5219\u4f9d\u8d56TCP\/UDP\u5957\u63a5\u5b57\u3002 \u4f20\u7edf\u76d1\u63a7\u65b9\u6cd5\u7684\u5c40\u9650\u6027\u5728\u4e8e\uff1a \u91c7\u6837\u7c92\u5ea6\u7c97\uff1a\/proc\u6587\u4ef6\u7cfb\u7edf\u4ec5\u63d0\u4f9b\u9759\u6001\u5feb\u7167\uff0c\u65e0\u6cd5\u6355\u6349\u77ac\u65f6\u901a\u4fe1\u884c\u4e3a\uff1b \u6027\u80fd\u635f\u8017\u9ad8\uff1a\u5168\u91cf\u7cfb\u7edf\u8c03\u7528\u8ddf\u8e2a\u53ef\u80fd\u5bfc\u81f4\u9ad8\u8fbe30%\u7684\u6027\u80fd\u4e0b\u964d\uff1b \u4e0a\u4e0b\u6587\u7f3a\u5931\uff1a\u96be\u4ee5\u5173\u8054\u901a\u4fe1\u4e8b\u4ef6\u4e0e\u5177\u4f53\u7684\u5bb9\u5668\u3001\u8fdb\u7a0b\u6216\u7ebf\u7a0b\u3002 \u800ceBPF\u901a\u8fc7\u52a8\u6001\u6302\u8f7d\u63a2\u9488\uff08Kprobe\/Uprobe\uff09\uff0c\u80fd\u591f\u4ee5\u7eb3\u79d2\u7ea7\u7cbe\u5ea6\u6355\u83b7\u4e8b\u4ef6\uff0c\u5e76\u901a\u8fc7bpf_get_current_pid_tgid()\u7b49\u51fd\u6570\u81ea\u52a8\u5173\u8054\u8fdb\u7a0b\u4e0a\u4e0b\u6587\u4fe1\u606f\u3002 \u4e09\u3001\u5b9e\u6218\uff1a\u6784\u5efaeBPF\u9a71\u52a8\u7684IPC\u76d1\u63a7\u6846\u67b6 1. \u9009\u62e9\u89c2\u6d4b\u70b9 \u9488\u5bf9\u4e0d\u540cIPC\u673a\u5236\uff0c\u9700\u5728\u5185\u6838\u4e2d\u9009\u62e9\u5408\u9002\u7684\u94a9\u5b50\u70b9\uff1a \u5957\u63a5\u5b57\u901a\u4fe1\uff1a\u6302\u94a9__sys_connect\u3001__sys_sendmsg\u7b49\u51fd\u6570\uff1b \u4fe1\u53f7\u4f20\u9012\uff1a\u6355\u83b7do_send_sig_info\u51fd\u6570\u8c03\u7528\uff1b \u5171\u4eab\u5185\u5b58\uff1a\u76d1\u63a7shmat()\u548cshmdt()\u7cfb\u7edf\u8c03\u7528\u3002 2. \u7f16\u5199eBPF\u7a0b\u5e8f \u4ee5\u4e0b\u793a\u4f8b\u5c55\u793a\u5982\u4f55\u8ddf\u8e2aUnix\u57df\u5957\u63a5\u5b57\u7684\u8fde\u63a5\u8bf7\u6c42\uff1a SEC(&quot;kprobe\/__sys_connect&quot;) int kprobe__sys_connect(struct pt_regs *ctx) { struct sockaddr *uservaddr = (struct sockaddr *)PT_REGS_PARM2(ctx); if (uservaddr-&gt;sa_family != AF_UNIX) return 0; \/\/ \u8fc7\u6ee4\u975eUnix\u57df\u5957\u63a5\u5b57 char comm[TASK_COMM_LEN]; bpf_get_current_comm(&amp;comm, [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":36927,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[],"class_list":["post-36926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-product-news"],"_links":{"self":[{"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/posts\/36926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/comments?post=36926"}],"version-history":[{"count":1,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/posts\/36926\/revisions"}],"predecessor-version":[{"id":36928,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/posts\/36926\/revisions\/36928"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/media\/36927"}],"wp:attachment":[{"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/media?parent=36926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/categories?post=36926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yunshan.net\/blog\/wp-json\/wp\/v2\/tags?post=36926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}