Add ringbuf support tests

.github/actions/build-dependencies/action.yaml

@@ -20,6 +20,7 @@ runs:
         sudo apt-get install --yes pkgconf
         sudo apt-get install --yes llvm-14 clang-14 clang-format-14
         sudo apt-get install --yes libelf-dev libzstd-dev zlib1g-dev
+        sudo apt-get install --yes virtme-ng
         for tool in "clang" "clang-format" "llc" "llvm-strip"
         do
           sudo rm -f /usr/bin/$tool

map-common.go

@@ -49,6 +49,9 @@ const (
 	MapTypeInodeStorage        MapType = C.BPF_MAP_TYPE_INODE_STORAGE
 	MapTypeTaskStorage         MapType = C.BPF_MAP_TYPE_TASK_STORAGE
 	MapTypeBloomFilter         MapType = C.BPF_MAP_TYPE_BLOOM_FILTER
+	MapTypeUserRingbuf         MapType = C.BPF_MAP_TYPE_USER_RINGBUF
+	MapTypeCgrpStorage         MapType = C.BPF_MAP_TYPE_CGRP_STORAGE
+	MapTypeArena               MapType = C.BPF_MAP_TYPE_ARENA
 )
 
 var mapTypeToString = map[MapType]string{
@@ -83,6 +86,9 @@ var mapTypeToString = map[MapType]string{
 	MapTypeInodeStorage:        "BPF_MAP_TYPE_INODE_STORAGE",
 	MapTypeTaskStorage:         "BPF_MAP_TYPE_TASK_STORAGE",
 	MapTypeBloomFilter:         "BPF_MAP_TYPE_BLOOM_FILTER",
+	MapTypeUserRingbuf:         "BPF_MAP_TYPE_USER_RINGBUF",
+	MapTypeCgrpStorage:         "BPF_MAP_TYPE_CGRP_STORAGE",
+	MapTypeArena:               "BPF_MAP_TYPE_ARENA",
 }
 
 func (t MapType) String() string {

prog-common.go

@@ -705,6 +705,7 @@ const (
 	BPFProgTypeLsm                   BPFProgType = C.BPF_PROG_TYPE_LSM
 	BPFProgTypeSkLookup              BPFProgType = C.BPF_PROG_TYPE_SK_LOOKUP
 	BPFProgTypeSyscall               BPFProgType = C.BPF_PROG_TYPE_SYSCALL
+	BPFProgTypeNetfilter             BPFProgType = C.BPF_PROG_TYPE_NETFILTER
 )
 
 // Deprecated: Convert type directly instead.
@@ -743,6 +744,7 @@ var bpfProgTypeToString = map[BPFProgType]string{
 	BPFProgTypeLsm:                   "BPF_PROG_TYPE_LSM",
 	BPFProgTypeSkLookup:              "BPF_PROG_TYPE_SK_LOOKUP",
 	BPFProgTypeSyscall:               "BPF_PROG_TYPE_SYSCALL",
+	BPFProgTypeNetfilter:             "BPF_PROG_TYPE_NETFILTER",
 }
 
 func (t BPFProgType) String() string {
@@ -809,6 +811,20 @@ const (
 	BPFAttachTypeSKReusePortSelectorMigrate BPFAttachType = C.BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
 	BPFAttachTypePerfEvent                  BPFAttachType = C.BPF_PERF_EVENT
 	BPFAttachTypeTraceKprobeMulti           BPFAttachType = C.BPF_TRACE_KPROBE_MULTI
+	BPFAttachTypeLSMCgroup                  BPFAttachType = C.BPF_LSM_CGROUP
+	BPFAttachTypeStructOps                  BPFAttachType = C.BPF_STRUCT_OPS
+	BPFAttachTypeNetfilter                  BPFAttachType = C.BPF_NETFILTER
+	BPFAttachTypeTCXIngress                 BPFAttachType = C.BPF_TCX_INGRESS
+	BPFAttachTypeTCXEgress                  BPFAttachType = C.BPF_TCX_EGRESS
+	BPFAttachTypeTraceUprobeMulti           BPFAttachType = C.BPF_TRACE_UPROBE_MULTI
+	BPFAttachTypeCgroupUnixConnect          BPFAttachType = C.BPF_CGROUP_UNIX_CONNECT
+	BPFAttachTypeCgroupUnixSendMsg          BPFAttachType = C.BPF_CGROUP_UNIX_SENDMSG
+	BPFAttachTypeCgroupUnixRecvMsg          BPFAttachType = C.BPF_CGROUP_UNIX_RECVMSG
+	BPFAttachTypeCgroupUnixGetPeerName      BPFAttachType = C.BPF_CGROUP_UNIX_GETPEERNAME
+	BPFAttachTypeCgroupUnixGetSockName      BPFAttachType = C.BPF_CGROUP_UNIX_GETSOCKNAME
+	BPFAttachTypeNetkitPrimary              BPFAttachType = C.BPF_NETKIT_PRIMARY
+	BPFAttachTypeNetkitPeer                 BPFAttachType = C.BPF_NETKIT_PEER
+	BPFAttachTypeTraceKprobeSession         BPFAttachType = C.BPF_TRACE_KPROBE_SESSION
 )
 
 var bpfAttachTypeToString = map[BPFAttachType]string{
@@ -855,6 +871,20 @@ var bpfAttachTypeToString = map[BPFAttachType]string{
 	BPFAttachTypeSKReusePortSelectorMigrate: "BPF_SK_REUSEPORT_SELECT_OR_MIGRATE",
 	BPFAttachTypePerfEvent:                  "BPF_PERF_EVENT",
 	BPFAttachTypeTraceKprobeMulti:           "BPF_TRACE_KPROBE_MULTI",
+	BPFAttachTypeLSMCgroup:                  "BPF_LSM_CGROUP",
+	BPFAttachTypeStructOps:                  "BPF_STRUCT_OPS",
+	BPFAttachTypeNetfilter:                  "BPF_NETFILTER",
+	BPFAttachTypeTCXIngress:                 "BPF_TCX_INGRESS",
+	BPFAttachTypeTCXEgress:                  "BPF_TCX_EGRESS",
+	BPFAttachTypeTraceUprobeMulti:           "BPF_TRACE_UPROBE_MULTI",
+	BPFAttachTypeCgroupUnixConnect:          "BPF_CGROUP_UNIX_CONNECT",
+	BPFAttachTypeCgroupUnixSendMsg:          "BPF_CGROUP_UNIX_SENDMSG",
+	BPFAttachTypeCgroupUnixRecvMsg:          "BPF_CGROUP_UNIX_RECVMSG",
+	BPFAttachTypeCgroupUnixGetPeerName:      "BPF_CGROUP_UNIX_GETPEERNAME",
+	BPFAttachTypeCgroupUnixGetSockName:      "BPF_CGROUP_UNIX_GETSOCKNAME",
+	BPFAttachTypeNetkitPrimary:              "BPF_NETKIT_PRIMARY",
+	BPFAttachTypeNetkitPeer:                 "BPF_NETKIT_PEER",
+	BPFAttachTypeTraceKprobeSession:         "BPF_TRACE_KPROBE_SESSION",
 }
 
 func (t BPFAttachType) String() string {
@@ -895,6 +925,10 @@ const (
 	BPFFAllowOverride AttachFlag = C.BPF_F_ALLOW_OVERRIDE
 	BPFFAllowMulti    AttachFlag = C.BPF_F_ALLOW_MULTI
 	BPFFReplace       AttachFlag = C.BPF_F_REPLACE
+	BPFFBefore        AttachFlag = C.BPF_F_BEFORE
+	BPFFAfter         AttachFlag = C.BPF_F_AFTER
+	BPFFID            AttachFlag = C.BPF_F_ID
+	BPFFLink          AttachFlag = C.BPF_F_LINK
 )
 
 //

selftest/common/run-vm-stage2.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+# COMMON
+
+[[ -f $COMMON ]] && { . $COMMON; } || { error "no common"; exit 1; }
+
+# MAIN
+
+check_build
+# check_ppid # not needed for VM
+test_exec
+test_finish
+
+exit 0

selftest/probe-ringbuf-non-supported/Makefile

@@ -0,0 +1 @@
+../common/Makefile

selftest/probe-ringbuf-non-supported/go.mod

@@ -0,0 +1,7 @@
+module github.com/aquasecurity/libbpfgo/selftest/map-pin-info
+
+go 1.21
+
+require github.com/aquasecurity/libbpfgo v0.0.0
+
+replace github.com/aquasecurity/libbpfgo => ../../

selftest/probe-ringbuf-non-supported/go.sum

@@ -0,0 +1,12 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.73 h1:Th2b8jljYqkyZKS3aD3N9VpYsQpHuXLgea+SZUIfODA=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.73/go.mod h1:hbeKwKcboEsxARYmcy/AdPVN11wmT/Wnpgv4k4ftyqY=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.73 h1:SEAEUiPVylTD4vqqi+vtGkSnXeP2FcRO3FoZB1MklMw=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.73/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=

selftest/probe-ringbuf-non-supported/main.bpf.c

@@ -0,0 +1,8 @@
+//+build ignore
+
+#include <vmlinux.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";

selftest/probe-ringbuf-non-supported/main.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	bpf "github.com/aquasecurity/libbpfgo"
+)
+
+func main() {
+	// Should not be supported before 5.8
+	isSupported, err := bpf.BPFMapTypeIsSupported(bpf.MapTypeRingbuf)
+	if err == nil || isSupported {
+		fmt.Fprintln(os.Stderr, "Ringbuf is supported unexpectedly or no error")
+		os.Exit(-1)
+	}
+
+	fmt.Fprintln(os.Stdout, "Ringbuf is not supported as expected")
+}

selftest/probe-ringbuf-non-supported/run-vm.sh

@@ -0,0 +1 @@
+../common/run-vm-stage2.sh

selftest/probe-ringbuf-non-supported/run.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+TEST=$(dirname $0)/$1  # execute
+TIMEOUT=10             # seconds
+KERNEL_VERSION=v5.7    # kernel version
+
+# SETTINGS
+COMMON="$(dirname $0)/../common/common.sh"
+
+vng -v -r $KERNEL_VERSION --rodir="$(realpath ..)" --  "export TEST=$TEST COMMON=$COMMON TIMEOUT=$TIMEOUT; ./run-vm.sh"
+
+exit 0

selftest/probe-ringbuf/Makefile

@@ -0,0 +1 @@
+../common/Makefile

selftest/probe-ringbuf/go.mod

@@ -0,0 +1,7 @@
+module github.com/aquasecurity/libbpfgo/selftest/map-pin-info
+
+go 1.21
+
+require github.com/aquasecurity/libbpfgo v0.0.0
+
+replace github.com/aquasecurity/libbpfgo => ../../

selftest/probe-ringbuf/go.sum

@@ -0,0 +1,12 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.73 h1:Th2b8jljYqkyZKS3aD3N9VpYsQpHuXLgea+SZUIfODA=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.73/go.mod h1:hbeKwKcboEsxARYmcy/AdPVN11wmT/Wnpgv4k4ftyqY=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.73 h1:SEAEUiPVylTD4vqqi+vtGkSnXeP2FcRO3FoZB1MklMw=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.73/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=

selftest/probe-ringbuf/main.bpf.c

@@ -0,0 +1,13 @@
+//+build ignore
+
+#include <vmlinux.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 1 << 8);
+} events1 SEC(".maps");
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";

selftest/probe-ringbuf/main.go

@@ -0,0 +1,39 @@
+package main
+
+import "C"
+
+import (
+	"fmt"
+	"os"
+
+	bpf "github.com/aquasecurity/libbpfgo"
+)
+
+func main() {
+	bpfModule, err := bpf.NewModuleFromFile("main.bpf.o")
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
+	defer bpfModule.Close()
+
+	err = bpfModule.BPFLoadObject()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
+
+	// Should be supported from 5.8 onwards
+	isSupported, err := bpf.BPFMapTypeIsSupported(bpf.MapTypeRingbuf)
+	if err != nil || !isSupported {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
+
+	eventsChannel1 := make(chan []byte)
+	_, err = bpfModule.InitRingBuf("events1", eventsChannel1)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+	}
+}

selftest/probe-ringbuf/run-vm.sh

@@ -0,0 +1 @@
+../common/run-vm-stage2.sh

selftest/probe-ringbuf/run.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+TEST=$(dirname $0)/$1  # execute
+TIMEOUT=10             # seconds
+KERNEL_VERSION=v5.8    # kernel version
+
+# SETTINGS
+COMMON="$(dirname $0)/../common/common.sh"
+
+vng -v -r $KERNEL_VERSION --rodir="$(realpath ..)" --  "export TEST=$TEST COMMON=$COMMON TIMEOUT=$TIMEOUT; ./run-vm.sh"
+
+exit 0