eBPF入門 /eBPF-getting-started

KIXS vol.006 LT 10 min
https://kixs.connpass.com/event/69643/

ブログ
https://takumakume.tech/blog/2017-12-18-ebpf-getting-started/

Transcript

1. ٱถ୓അ(.01FQBCP *OD
   
   ,JYTWPM-5NJO
   F#1'ೖ໳
   

   View Slide

2. (.0ϖύϘΠϯϑϥΤϯδχΞ
   ٱถ୓അ!UBLVNBLVNF
   ϗεςΟϯάࣄۀ෦
   IUUQTUBLVNBLVNFUFDI
   
   

   View Slide

3. View Slide

4. Έͳ͞Μ͸#1'ͯ͠·͔͢ʁ
   
   

   View Slide

5. #1'JT
   #FSLFMFZ1BDLFU'JMUFS
   -JOVYLFSOFMʹ࣮૷͞Ε͍ͯΔ
   ύέοτͷΩϟϓνϟ΍ϑΟϧλΛߦ͏ͨΊͷ
   ΠϯλʔϑΣΠε
   
   

   View Slide

6. UDQEVNQ
   
   
   

   View Slide

7. UDQEVNQ
   
   ~$ sudo tcpdump port 80
   tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
   listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
   00:27:12.580101 IP 192.168.0.18.61285 > archlinux.vagrant.vm.http: Flags
   [S], seq 1854919014, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS
   val 844367687 ecr 0,sackOK,eol], length 0
   :
   :
   ຖ೔ୟ͍͍ͯΔ͍ͭ΋ͷ΍ͭͰ͢Ͷ
   
   

   View Slide

8. UDQEVNQ
   #1'
   
   

   View Slide

9. #1'
   /*$
   5$14UBDL
   UDQEVNQ
   VTFS
   LFSOFM
   LFSOFM
   OFUXPSL
   
   

   View Slide

10. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    
    

    View Slide

11. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    #1'
    CZUFDPEF
    UDQEVNQ͸
    #1'༻ʹϓϩάϥϜΛ
    ίϯύΠϧͯ͠LFSOFM
    Ͱ࣮ߦ͢Δ
    
    

    View Slide

12. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    OHJOY
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    #1'
    130(
    UDQEVNQ͸
    #1'༻ʹϓϩάϥϜΛ
    ίϯύΠϧͯ͠LFSOFM
    Ͱ࣮ߦ͢Δ
    $ sudo tcpdump -d 'port 80'
    (000) ldh [12]
    (001) jeq #0x86dd jt 2 jf 10
    (002) ldb [20]
    (003) jeq #0x84 jt 6 jf 4
    (004) jeq #0x6 jt 6 jf 5
    (005) jeq #0x11 jt 6 jf 23
    (006) ldh [54]
    :
    BPF Assembler
    
    

    View Slide

13. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    OHJOY
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    #1'
    130(
    UDQEVNQ͸
    #1'༻ʹϓϩάϥϜΛ
    ίϯύΠϧͯ͠LFSOFM
    Ͱ࣮ߦ͢Δ
    ~$ sudo tcpdump -dd 'port 80'
    { 0x28, 0, 0, 0x0000000c },
    { 0x15, 0, 8, 0x000086dd },
    { 0x30, 0, 0, 0x00000014 },
    { 0x15, 2, 0, 0x00000084 },
    { 0x15, 1, 0, 0x00000006 },
    { 0x15, 0, 17, 0x00000011 },
    { 0x28, 0, 0, 0x00000036 },
    { 0x15, 14, 0, 0x00000050 },
    :
    BPF Bytecode
    
    

    View Slide

14. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    5$1QPSU
    #1'
    CZUFDPEF
    
    

    View Slide

15. #1'
    /*$
    5$14UBDL
    UDQEVNQ
    tcpdump port 80
    VTFS
    LFSOFM
    LFSOFM
    OFUXPSL
    UFSNJOBM
    දࣔ
    5$1QPSU
    #1'
    CZUFDPEF
    
    

    View Slide

16. #1'JT
    #FSLFMFZ1BDLFU'JMUFS
    -JOVYLFSOFMʹ࣮૷͞Ε͍ͯΔ
    ύέοτͷΩϟϓνϟ΍ϑΟϧλΛߦ͏ͨΊͷ
    ΠϯλʔϑΣΠε
    6TFSMBOEͰ࡞੒ͨ͠#1'#ZUFDPEFΛ
    ,FSOFMMBOEͰ࣮ߦ͢Δ
    ύέοτΩϟϓνϟҎ֎ͷ༻్ʹ΋࢖ΘΕ͍ͯΔ
    
    

    View Slide

17. TFDDPNQ
    
    
    

    View Slide

18. TFDDPNQ
    ࢦఆͨ͠TZTUFNDBMMΛ࣮ߦͰ͖ͳ͍Α͏ʹ͢Δ
    -JOVYLFSOFMͷػೳ
    ͜͜Ͱ͍͏TFDDPNQ͸-JOVYLFSOFMҎ߱ͷ
    TFDDPNQNPEFΛࢦ͢
    TFDDPNQNPEF͸ɺϑΟϧλϦϯάʹ#1'͕
    ࢖ΘΕ͓ͯΒͣɺॊೈੑ͕ͳ͍ػೳͩͬͨ
    
    

    View Slide

19. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    LFSOFM
    
    

    View Slide

20. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    LFSOFM
    ࣮ߦ
    
    

    View Slide

21. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    TFDDPNQ
    ࣮ߦ
    LFSOFM
    ࣮ߦ
    ྫͱͯ͠XSJUF
    Λ੍ݶ͢Δ
    
    

    View Slide

22. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    TFDDPNQ
    ࣮ߦ
    LFSOFM
    ࣮ߦ
    ͜ͷϓϩηεͰ͸XSJUF
    
    ͕࣮ߦͰ͖ͳ͘ͳΔ
    #1'༻ʹϓϩάϥϜΛ
    ίϯύΠϧͯ͠
    LFSOFMͰ࣮ߦ͢Δ
    #1'
    CZUFDPEF
    
    ྫͱͯ͠XSJUF
    Λ੍ݶ͢Δ
    

    View Slide

23. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    TFDDPNQ
    ࣮ߦ
    LFSOFM
    ࣮ߦ
    PQFO
    ࣮ߦ
    ڐՄ
    #1'
    CZUFDPEF
    
    ྫͱͯ͠XSJUF
    Λ੍ݶ͢Δ
    

    View Slide

24. #1'
    ϓϩάϥϜ
    VTFS
    LFSOFM
    TFDDPNQ
    ࣮ߦ
    LFSOFM
    ࣮ߦ
    PQFO
    ࣮ߦ
    XSJUF
    ࣮ߦ
    #1'
    CZUFDPEF
    ڋ൱
    
    

    View Slide

25. Έͳ͞Μ#1'ָ͍͠Ͱ͔͢ʁ
    
    

    View Slide

26. ָ͍͠Ͱ͢Ͷʁ
    
    

    View Slide

27. F#1'ೖ໳
    

    View Slide

28. F#1'
    &YUFOEFE#1'
    
    
    

    View Slide

29. F#1'
    -JOVYLFSOFMҎ߱Ͱ࣮૷͞Ε͍ͯΔ
    #1'ͷ֦ு࣮૷
    VQSPCFTVTFSMFWFMEZOBNJDUSBDJOH
    LQSPCFTLFSOFMEZOBNJDUSBDJOH
    9%1F9QSFTT%BUB1BUI
    ύέοτΛ,FSOFMͷ/FUXPSL4UBDLʹ
    ౉͞ΕΔલͷυϥΠόϨϕϧͰ੍ޚͰ͖Δ
    FUD
    
    

    View Slide

30. IUUQTHJUIVCDPNUPSWBMETMJOVYCMPCWJODMVEFUSBDFFWFOUTCQGI
    
    

    View Slide

31. IUUQTHJUIVCDPNUPSWBMETMJOVYCMPCWJODMVEFUSBDFFWFOUTCQGI
    
    

    View Slide

32. F#1'ͷͬ͘͟Γͱͨ͠࢓૊Έ
    
    

    View Slide

33. LQSPCFTF#1'
    ,FSOFMEZOBNJDUSBDJOH
    
    

    View Slide

34. LQSPCFT
    LFSOFM
    ໋ྩ
    ໋ྩ
    ໋ྩ
    ໋ྩ
    ϒϨʔΫϙΠϯτ
    LQSPCFT
    NPEVMF
    ஫ೖ
    TBWFDPOUFYU
    SFTUPSFDPOUFYU
    ࣮ߦ͍ͨ͠ॲཧ
    KNQ
    LFSOFMʹϒϨʔΫϙΠϯτΛઃఆ͠ϓϩάϥϜΛ࣮ߦͰ͖Δػೳ
    
    

    View Slide

35. VTFS
    LFSOFM
    ϓϩάϥϜ
    F#1'
    LQSPCFT
    LQSPCFTF#1'
    
    

    View Slide

36. VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    ੜ੒
    LQSPCFT
    LQSPCFTF#1'
    
    

    View Slide

37. VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    LQSPCFT
    LQSPCFTF#1'
    
    

    View Slide

38. VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    LQSPCFT
    ϓϩάϥϜͷ҆શੑ
    ΛνΣοΫ
    LQSPCFTF#1'
    
    

    View Slide

39. VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF
    LQSPCFT
    LQSPCFTF#1'
    
    

    View Slide

40. VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    ੜ੒
    6TFS,FSOFMؒͰσʔλͷ΍ΓऔΓΛ͢Δ
    )BTI
    "SSBZ
    FUDʜ
    LQSPCFT
    LQSPCFTF#1'
    
    

    View Slide

41. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    
    

    View Slide

42. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    F#1'WFSJpFSʹΑͬͯ
    ҆શʹίʔυΛ࣮ߦͰ͖Δʂ
    
    

    View Slide

43. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    F#1'NBQʹΑͬͯ
    6TFSTQBDFͱ,FSOFMͰಈత
    ʹσʔλΛڞ༗Ͱ͖Δʂ
    
    

    View Slide

44. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    Կͷ໾ཱͪ·͔͢ʁ
    
    

    View Slide

45. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    .FNPSZBMMPDBUJPOΛτϨʔε
    ͯ͠ɺ.FNPSZMFBLΛ୳͢
    
    

    View Slide

46. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    'JMFTZTUFNΛτϨʔεͯ͠
    ϑΝΠϧͷPQFO SFBE XSJUF
    ͳͲʹ͔͔Δ࣌ؒΛܭଌͯ͠
    ϘτϧωοΫΛ୳͢
    
    

    View Slide

47. LQSPCFTF#1'
    VTFS
    LFSOFM
    ϓϩάϥϜ
    #1'CZUFDPEF
    F#1'
    WFSJpFS
    ੜ੒
    MPBE
    #1'CZUFDPEF NBQ
    USBDJOH
    ॻ͖ࠐΈ
    ࢀর
    LQSPCFT
    00.LJMMFSΛτϨʔε͠
    ͦͷॠؒͷͱ͋ΔϓϩάϥϜͷ
    UBTL@TUSVDUߏ଄ମͷத਎Λ
    μϯϓͯ͠ݪҼΛ୳͢
    
    

    View Slide

48. 9%1
    F9QSFTT%BUB1BUI
    
    ύέοτΛ,FSOFMͷ/FUXPSL4UBDL
    ʹ౉͞ΕΔલͷυϥΠόϨϕϧͰ੍ޚͰ͖Δ
    

    View Slide

49. JQUBCMFT
    /*$
    %SJWFS
    "QQMJDBUJPO
    OFUpMUFS
    %301
    "$$&15
    VTFS
    LFSOFM
    
    JQUBCMFT
    /FUXPSL4UBDL
    

    View Slide

50. JQUBCMFTXJUI#1'
    /*$
    %SJWFS
    /FUXPSL4UBDL
    "QQMJDBUJPO
    "$$&15
    VTFS
    LFSOFM
    
    JQUBCMFT
    D#1'
    %301 CZUFDPEF
    

    View Slide

51. 9%1
    /*$
    %SJWFS
    /FUXPSL4UBDL
    "QQMJDBUJPO
    "$$&15
    VTFS
    LFSOFM
    
    9%11SPH
    %301 F#1' CZUFDPEF
    

    View Slide

52. 9%1
    /*$
    %SJWFS
    /FUXPSL4UBDL
    "QQMJDBUJPO
    VTFS
    LFSOFM
    9%1
    %301
    "$$&15
    ωοτϫʔΫυϥΠόϨϕϧͰ
    ύέοτͷૢ࡞͕Ͱ͖Δʂ
    ରԠ͍ͯ͠ΔωοτϫʔΫυϥΠό͸ҎԼΛࢀর
    IUUQTHJUIVCDPNJPWJTPSCDDCMPCNBTUFSEPDTLFSOFMWFSTJPOTNEYEQ
    
    

    View Slide

53. 9%1
    /*$
    %SJWFS
    /FUXPSL4UBDL
    "QQMJDBUJPO
    VTFS
    LFSOFM
    9%1
    %301
    "$$&15
    ଎
    
    

    View Slide

54. 9%1
    /*$
    %SJWFS
    /FUXPSL4UBDL
    "QQMJDBUJPO
    VTFS
    LFSOFM
    9%1
    %301
    "$$&15
    %%P4ରࡦ
    ηΩϡϦςΟରࡦ
    -# ೔ຊͰ΋ࣄྫ͋Γ
    
    
    

    View Slide

55. ເ͕޿͕Γ·͢Ͷʁ
    
    

    View Slide

56. ·ͱΊ
    #1'͸6TFSTQBDFͰ࡞੒ͨ͠#ZUFDPEFΛ
    ,FSOFMͰ࣮ߦ͢Δࣄ͕Ͱ͖Δɻ
    D#1'͸ύέοτ΍γεςϜίʔϧΛϑΟϧλ
    Ϧϯά͢Δ͜ͱ͕Ͱ͖Δɻ
    F#1'͸LQSPCF΍VQSPCFΛར༻ͨ͠τϨʔε
    ΍9%1ͷΑ͏ͳ%SJWFSϨϕϧͷߴ଎ͳύέο
    τૢ࡞͕Ͱ͖Δɻଞʹ΋ػೳ͕͋Δɻ
    7FSJpFSʹΑΓ҆શʹίʔυΛ࣮ߦͰ͖Δɻ
    .BQʹΑΓಈతʹσʔλͷ΍ΓऔΓ͕Ͱ͖Δɻ
    

    View Slide

57. དྷ೥΋΍͍͖ͬͯ·͠ΐ͏ʂ
    
    

    View Slide

58. ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ʂ
    
    

    View Slide