feat: more link inspection support

internal/cmd/gentypes/main.go

@@ -222,6 +222,7 @@ import (
 		{"XdpAction", "xdp_action"},
 		{"TcxActionBase", "tcx_action_base"},
 		{"PerfEventType", "bpf_perf_event_type"},
+		{"NetfilterInetHook", "nf_inet_hooks"},
 	}
 
 	sort.Slice(enums, func(i, j int) bool {
@@ -230,32 +231,75 @@ import (
 
 	var nenums uint32
 	enumTypes := make(map[string]btf.Type)
-	for _, o := range enums {
-		debugln("enum", o.goType)
-
-		var t *btf.Enum
-		if err := spec.TypeByName(o.cType, &t); err != nil {
-			return nil, err
-		}
 
+	outputEnum := func(goType string, t *btf.Enum) error {
 		// Add the enum as a predeclared type so that generated structs
 		// refer to the Go types.
 		if name := gf.Names[t]; name != "" {
-			return nil, fmt.Errorf("type %q is already declared as %s", o.cType, name)
+			return fmt.Errorf("type %q is already declared as %s", goType, name)
 		}
-		gf.Names[t] = o.goType
-		enumTypes[o.goType] = t
+		gf.Names[t] = goType
+		enumTypes[goType] = t
 
-		decl, err := gf.TypeDeclaration(o.goType, t)
+		decl, err := gf.TypeDeclaration(goType, t)
 		if err != nil {
-			return nil, fmt.Errorf("generate %q: %w", o.goType, err)
+			return fmt.Errorf("generate %q: %w", goType, err)
 		}
 
 		w.WriteString(decl)
 		w.WriteRune('\n')
 
 		nenums++
+		return nil
 	}
+
+	for _, o := range enums {
+		debugln("enum", o.goType)
+
+		var t *btf.Enum
+		if err := spec.TypeByName(o.cType, &t); err != nil {
+			return nil, err
+		}
+		if err := outputEnum(o.goType, t); err != nil {
+			return nil, err
+		}
+	}
+
+	// Unnamed enums
+	// We can't identify them by name, so instead, we specify a prefix that all enum values must share
+	untypedEnums := []struct {
+		goType string
+		prefix string
+	}{
+		{"NetfilterProtocolFamily", "NFPROTO_"},
+	}
+
+	for _, o := range untypedEnums {
+		debugln("enum", o.goType)
+		for anyType, err := range spec.All() {
+			if err != nil {
+				return nil, err
+			}
+			enum, ok := anyType.(*btf.Enum)
+			if !ok {
+				continue
+			}
+			var prefixMatches = true
+			for _, value := range enum.Values {
+				if !strings.HasPrefix(value.Name, o.prefix) {
+					prefixMatches = false
+					break
+				}
+			}
+			if !prefixMatches || len(enum.Values) == 0 {
+				continue
+			}
+			if err := outputEnum(o.goType, enum); err != nil {
+				return nil, err
+			}
+		}
+	}
+
 	fmt.Printf("Generated %d enums\n", nenums)
 
 	// Assorted structs
@@ -560,6 +604,8 @@ import (
 					return rename("flags", "netfilter_flags")(m.Type.(*btf.Struct))
 				}, "netfilter"),
 				flattenAnon,
+				replace(enumTypes["NetfilterProtocolFamily"], "pf"),
+				replace(enumTypes["NetfilterInetHook"], "hooknum"),
 			},
 		},
 		{
@@ -751,6 +797,8 @@ import (
 			[]patch{
 				choose(3, "netfilter"),
 				flattenAnon,
+				replace(enumTypes["NetfilterProtocolFamily"], "pf"),
+				replace(enumTypes["NetfilterInetHook"], "hooknum"),
 			},
 		},
 		{"NetkitLinkInfo",
@@ -768,6 +816,16 @@ import (
 				replace(uint64Ptr, "cookies"),
 			},
 		},
+		{"UprobeMultiLinkInfo",
+			[]patch{
+				choose(3, "uprobe_multi"),
+				flattenAnon,
+				replace(bytePtr, "path"),
+				replace(uint64Ptr, "offsets"),
+				replace(uint64Ptr, "ref_ctr_offsets"),
+				replace(uint64Ptr, "cookies"),
+			},
+		},
 		{"PerfEventLinkInfo",
 			[]patch{
 				choose(3, "perf_event"),
@@ -788,6 +846,39 @@ import (
 				replace(bytePtr, "func_name"),
 			},
 		},
+		{"UprobeLinkInfo",
+			[]patch{
+				choose(3, "perf_event"),
+				flattenAnon,
+				renameNth(3, "perf_event_type"),
+				replace(enumTypes["PerfEventType"], "perf_event_type"),
+				choose(4, "uprobe"),
+				flattenAnon,
+				replace(bytePtr, "file_name"),
+			},
+		},
+		{"TracepointLinkInfo",
+			[]patch{
+				choose(3, "perf_event"),
+				flattenAnon,
+				renameNth(3, "perf_event_type"),
+				replace(enumTypes["PerfEventType"], "perf_event_type"),
+				choose(4, "tracepoint"),
+				flattenAnon,
+				replace(bytePtr, "tp_name"),
+			},
+		},
+		{"EventLinkInfo",
+			[]patch{
+				choose(3, "perf_event"),
+				flattenAnon,
+				renameNth(3, "perf_event_type"),
+				replace(enumTypes["PerfEventType"], "perf_event_type"),
+				choose(4, "event"),
+				flattenAnon,
+				renameNth(5, "event_type"),
+			},
+		},
 	}
 
 	sort.Slice(linkInfoExtraTypes, func(i, j int) bool {

internal/sys/syscall.go

@@ -72,10 +72,30 @@ func (i *KprobeMultiLinkInfo) info() (unsafe.Pointer, uint32) {
 	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
 }
 
+func (i *UprobeMultiLinkInfo) info() (unsafe.Pointer, uint32) {
+	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
+}
+
+func (i *RawTracepointLinkInfo) info() (unsafe.Pointer, uint32) {
+	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
+}
+
 func (i *KprobeLinkInfo) info() (unsafe.Pointer, uint32) {
 	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
 }
 
+func (i *UprobeLinkInfo) info() (unsafe.Pointer, uint32) {
+	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
+}
+
+func (i *TracepointLinkInfo) info() (unsafe.Pointer, uint32) {
+	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
+}
+
+func (i *EventLinkInfo) info() (unsafe.Pointer, uint32) {
+	return unsafe.Pointer(i), uint32(unsafe.Sizeof(*i))
+}
+
 var _ Info = (*BtfInfo)(nil)
 
 func (i *BtfInfo) info() (unsafe.Pointer, uint32) {

internal/sys/types.go

@@ -587,6 +587,18 @@ const (
 	__MAX_BPF_MAP_TYPE                            MapType = 34
 )
 
+type NetfilterInetHook uint32
+
+const (
+	NF_INET_PRE_ROUTING  NetfilterInetHook = 0
+	NF_INET_LOCAL_IN     NetfilterInetHook = 1
+	NF_INET_FORWARD      NetfilterInetHook = 2
+	NF_INET_LOCAL_OUT    NetfilterInetHook = 3
+	NF_INET_POST_ROUTING NetfilterInetHook = 4
+	NF_INET_NUMHOOKS     NetfilterInetHook = 5
+	NF_INET_INGRESS      NetfilterInetHook = 5
+)
+
 type ObjType uint32
 
 const (
@@ -697,6 +709,19 @@ const (
 	XDP_REDIRECT XdpAction = 4
 )
 
+type NetfilterProtocolFamily uint32
+
+const (
+	NFPROTO_UNSPEC   NetfilterProtocolFamily = 0
+	NFPROTO_INET     NetfilterProtocolFamily = 1
+	NFPROTO_IPV4     NetfilterProtocolFamily = 2
+	NFPROTO_ARP      NetfilterProtocolFamily = 3
+	NFPROTO_NETDEV   NetfilterProtocolFamily = 5
+	NFPROTO_BRIDGE   NetfilterProtocolFamily = 7
+	NFPROTO_IPV6     NetfilterProtocolFamily = 10
+	NFPROTO_NUMPROTO NetfilterProtocolFamily = 11
+)
+
 type BtfInfo struct {
 	_         structs.HostLayout
 	Btf       TypedPointer[uint8]
@@ -955,8 +980,8 @@ type LinkCreateNetfilterAttr struct {
 	TargetFd       uint32
 	AttachType     AttachType
 	Flags          uint32
-	Pf             uint32
-	Hooknum        uint32
+	Pf             NetfilterProtocolFamily
+	Hooknum        NetfilterInetHook
 	Priority       int32
 	NetfilterFlags uint32
 	_              [32]byte
@@ -1541,6 +1566,21 @@ type CgroupLinkInfo struct {
 	_          [36]byte
 }
 
+type EventLinkInfo struct {
+	_             structs.HostLayout
+	Type          LinkType
+	Id            LinkID
+	ProgId        uint32
+	_             [4]byte
+	PerfEventType PerfEventType
+	_             [4]byte
+	Config        uint64
+	EventType     uint32
+	_             [4]byte
+	Cookie        uint64
+	_             [16]byte
+}
+
 type IterLinkInfo struct {
 	_             structs.HostLayout
 	Type          LinkType
@@ -1598,8 +1638,8 @@ type NetfilterLinkInfo struct {
 	Id       LinkID
 	ProgId   uint32
 	_        [4]byte
-	Pf       uint32
-	Hooknum  uint32
+	Pf       NetfilterProtocolFamily
+	Hooknum  NetfilterInetHook
 	Priority int32
 	Flags    uint32
 	_        [32]byte
@@ -1647,6 +1687,21 @@ type TcxLinkInfo struct {
 	_          [40]byte
 }
 
+type TracepointLinkInfo struct {
+	_             structs.HostLayout
+	Type          LinkType
+	Id            LinkID
+	ProgId        uint32
+	_             [4]byte
+	PerfEventType PerfEventType
+	_             [4]byte
+	TpName        TypedPointer[uint8]
+	NameLen       uint32
+	_             [4]byte
+	Cookie        uint64
+	_             [16]byte
+}
+
 type TracingLinkInfo struct {
 	_           structs.HostLayout
 	Type        LinkType
@@ -1659,6 +1714,38 @@ type TracingLinkInfo struct {
 	_           [36]byte
 }
 
+type UprobeLinkInfo struct {
+	_             structs.HostLayout
+	Type          LinkType
+	Id            LinkID
+	ProgId        uint32
+	_             [4]byte
+	PerfEventType PerfEventType
+	_             [4]byte
+	FileName      TypedPointer[uint8]
+	NameLen       uint32
+	Offset        uint32
+	Cookie        uint64
+	RefCtrOffset  uint64
+	_             [8]byte
+}
+
+type UprobeMultiLinkInfo struct {
+	_             structs.HostLayout
+	Type          LinkType
+	Id            LinkID
+	ProgId        uint32
+	_             [4]byte
+	Path          TypedPointer[uint8]
+	Offsets       TypedPointer[uint64]
+	RefCtrOffsets TypedPointer[uint64]
+	Cookies       TypedPointer[uint64]
+	PathSize      uint32
+	Count         uint32
+	Flags         uint32
+	Pid           uint32
+}
+
 type XDPLinkInfo struct {
 	_       structs.HostLayout
 	Type    LinkType

link/kprobe_multi.go

@@ -156,12 +156,30 @@ func (kml *kprobeMultiLink) Update(_ *ebpf.Program) error {
 func (kml *kprobeMultiLink) Info() (*Info, error) {
 	var info sys.KprobeMultiLinkInfo
 	if err := sys.ObjInfo(kml.fd, &info); err != nil {
-		return nil, fmt.Errorf("kprobe multi link info: %s", err)
+		return nil, fmt.Errorf("kprobe multi link info: %w", err)
+	}
+	var addrs = make([]uint64, info.Count)
+	var cookies = make([]uint64, info.Count)
+	info = sys.KprobeMultiLinkInfo{
+		Addrs:   sys.SlicePointer(addrs),
+		Cookies: sys.SlicePointer(cookies),
+		Count:   uint32(len(addrs)),
+	}
+	if err := sys.ObjInfo(kml.fd, &info); err != nil {
+		return nil, fmt.Errorf("kprobe multi link info: %w", err)
+	}
+	if info.Addrs.IsNil() {
+		addrs = nil
+	}
+	if info.Cookies.IsNil() {
+		cookies = nil
 	}
 	extra := &KprobeMultiInfo{
-		count:  info.Count,
-		flags:  info.Flags,
-		missed: info.Missed,
+		Count:   info.Count,
+		Flags:   info.Flags,
+		Missed:  info.Missed,
+		addrs:   addrs,
+		cookies: cookies,
 	}
 
 	return &Info{