{"id":113049,"date":"2024-01-22T17:28:02","date_gmt":"2024-01-22T15:28:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya"},"modified":"2024-01-22T17:28:02","modified_gmt":"2024-01-22T15:28:04","slug":"proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","title":{"rendered":"Projekt bpftime arendab eBPF-i rakendust, mis t\u00f6\u00f6tab kasutajate ruumis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Esitletakse projekti bpftime, mis arendab runtime'i ja virtuaalmasinat eBPF-handlerite t\u00e4itmiseks kasutaja ruumis. Bpftime v\u00f5imaldab t\u00e4ies ulatuses kasutada kasutaja ruumis eBPF-programme j\u00e4lgimiseks ja protsesside sekkumiseks, kasutades selliseid funktsioone nagu uprobe ja s\u00fcsteemikallutatute programmiline intervjueerimine. T\u00e4heldatakse, et t\u00e4nu liigsete konteksti vahetuste v\u00e4listamisele v\u00f5imaldab bpftime saavutada k\u00fcmnekordset kulu v\u00e4henemist v\u00f5rreldes Linuxi kernelis pakutava uprobe ja uretprobe funktsionaalsusega. Lisaks lihtsustab bpftime oluliselt t\u00f5rkeotsingut, seda saab potentsiaalselt kasutada mitte-Linuxi kerneliga s\u00fcsteemides ning ei n\u00f5ua k\u00f5rgeid \u00f5igusi, mis on vajalikud eBPF-rakenduse laadimiseks kernelisse. Projekti kood on kirjutatud C\/C++ keeltes ja jagatakse MIT litsentsi alusel. <\/p>\n

S\u00fcsteemikallutatute peremeeste j\u00e4lgimise ja uprobe-kontrollide integreerimine on teostatud t\u00e4idesaatva koodi (binary rewriting) \u00fcmberkirjutamise tehnika abil, kus s\u00fcsteemikallutuste, sisenemispunktide ja kohalike funktsioonide kutsed asendatakse \u00fclemineku suunamisega t\u00f5rkeotsingu k\u00e4itlejatele v\u00e4l\u6267\u884c\u5143\u68cb\u724coodatud rakenduse masinkoodi muutmise kaudu, mis on oluliselt t\u00f5husam kui uprobe tasemel kernelis j\u00e4rjestamine. <\/p>\n

Toetatakse funktsioonide asendamise v\u00f5i muutmise, k\u00e4itlejate (hook-ide) ja filtrite kinnitamise operatsioone, s\u00fcsteemikallutuste parameetrite \u00fcmbersuunamist, blokeerimist v\u00f5i asendamist, sisenemise ja v\u00e4ljumise j\u00e4lgimist ning k\u00e4itleja asendamist mis tahes koodis asuvas offset'is. Bpftime saab kinnitada igasugusele t\u00f6\u00f6tavale protsessile s\u00fcsteemis ilma vajaduseta neid \u00fcmber k\u00e4ivitada v\u00f5i uuesti ehitada. Bpftime'i asendamine protsessides v\u00f5ib toimuda aktiveeritud protsesside jaoks ptrace'i kaudu ning laaditavate jaoks LD_PRELOAD'i kaudu. <\/p>\n

Bpftime'i koostisosana areneb runtime, mis v\u00f5imaldab eBPF programme kinnitada s\u00fcsteemikallutuste j\u00e4lgimispunktidele ja uprobe'ile. virtuiaalmasin<\/a> eBPF JIT, etten eraldatud eBPF programmide t\u00e4itmiseks kasutaja protsessi tasandil (lisaks AOT kompileerimise toele); taustaprotsess tuuma suhtlemiseks ja tuuma uprobe alams\u00fcsteemiga \u00fchilduvuse korraldamiseks (bpftime toetab eBPF laadimise re\u017eiimi kasutaja ruumi tuumast, et tagada koost\u00f6\u00f6 tuuma eBPF programmidega, mida kasutatakse n\u00e4iteks kprobe t\u00f6\u00f6tlemiseks v\u00f5i v\u00f5rgufiltrite rakendamiseks). <\/p>\n

eBPF virtuaalne masin on v\u00e4lja t\u00f6\u00f6tatud plug-in teegina ja pakub API-d, mis sarnaneb ubpf-ile, v\u00f5imaldades kasutada seda eBPF funktsionaalsuse integreerimiseks teistesse projektidesse. Mitme protsessi andmete kogumiseks toetatakse \u00fchiselt kasutatavate eBPF Map'ide loomist, mis asuvad jagatud m\u00e4lus. Koos bpftime'iga saab kasutada ka tuumas kirjutatud t\u00fc\u00fcpilisi eBPF t\u00f6\u00f6tlejaid ning kompilatsiooniks saab kasutada standardseid t\u00f6\u00f6riistu, mis p\u00f5hinevad clang'il ja libbpf'il. <\/p>\n

bpftime'i kasutades saavad kasutaja ruumis t\u00f6\u00f6tada sellised j\u00e4lgimiss\u00fcsteemid nagu BCC, bpftrace ja Deepflow. N\u00e4iteks on n\u00e4idatud BCC raamistiku sslsniff skripti kasutamist kr\u00fcpteeritud nginx'i liikluse anal\u00fc\u00fcsimiseks ja salvestamiseks. Testides v\u00e4henes nginx'i j\u00f5udlus sslsniffi t\u00f6\u00f6tlemisel tuumas 58%, samas kui t\u00f6\u00f6tleja viimisega kasutaja ruumi oli see 12,3%. <\/p>\n

Protsesside j\u00e4lgimise arhitektuur, mis kasutab originaalset eBPF'i tuumas:

\"Projekt<\/center> <\/p>\n

Kasutaja ruumis bpftime'i kasutamise j\u00e4lgimise arhitektuur:

\"Projekt<\/center> <\/p>\n

H\u00fcbriids\u00fcsteem, kus bpftime t\u00f6\u00f6tab koos eBPF'iga tuumas, n\u00e4iteks v\u00f5rgufilterite seadistamiseks v\u00f5i eraldi t\u00f6\u00f6tlejate kasutamiseks kasutaja ruumis:

\"Projekt<\/center> <\/p>\n

Tuleviku plaanide seas on m\u00e4rgitud: vigade asendamise (Fault Injection) v\u00f5imalus; kuumade patchide (Hot Patching) rakendamine t\u00f6\u00f6loogika muutmiseks v\u00f5i viga parandamiseks binaarses kogumises; Nginx'i mooduli loomine, mis v\u00f5imaldab luua laiendusi eBPF programmide kaudu (n\u00e4iteks d\u00fcnaamilise marsruudi valiku, vahem\u00e4lu rakendamise, turvapoliitikate rakendamise ja koormuse tasakaalustamise jaoks); FUSE alams\u00fcsteemi v\u00f5imaluste laiendamine (n\u00e4iteks eBPF programmidena laienduste loomine failis\u00fcsteemi jaoks vahem\u00e4lu v\u00f5i juurdep\u00e4\u00e4su juhtimise jaoks).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 bpftime, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 runtime \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 eBPF \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. Bpftime \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0446\u0435\u043b\u0438\u043a\u043e\u043c \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f eBPF-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438 \u0438 \u0432\u043c\u0435\u0448\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u0430 \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0442\u0430\u043a\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438, \u043a\u0430\u043a uprobe \u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u043e\u0432. \u041e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044e \u043b\u0438\u0448\u043d\u0438\u0445 \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430 bpftime \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0434\u0435\u0441\u044f\u0442\u0438\u043a\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u043d\u0430\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u0440\u0430\u0441\u0445\u043e\u0434\u043e\u0432 \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":113050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113049","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Projekt bpftime arendab eBPF-i rakendust, mis t\u00f6\u00f6tab kasutaja ruumis | ProHoster","description":"Esitletakse projekti bpftime, mis arendab runtime'i ja virtuaalmasina, et k\u00e4itada eBPF t\u00f6\u00f6tlejat kasutaja ruumis.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 bpftime \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e eBPF, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0443\u044e \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f | ProHoster","og:description":"\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0435\u043a\u0442 bpftime, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 runtime \u0438 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u043c\u0430\u0448\u0438\u043d\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 eBPF \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-bpftime-razvivaet-realizacziyu-ebpf-rabotayushhuyu-v-prostranstve-polzovatelya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-22T15:28:04+00:00","article:modified_time":"2024-01-22T15:28:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113049"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113049\/revisions"}],"predecessor-version":[{"id":164070,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113049\/revisions\/164070"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/113050"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}