in_ebpf: initial version of loader plugin

.github/workflows/unit-tests.yaml

@@ -54,7 +54,7 @@ jobs:
       - name: Setup environment
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc-7 g++-7 clang-6.0 libsystemd-dev gcovr libyaml-dev
+          sudo apt-get install -y gcc-7 g++-7 clang-6.0 libsystemd-dev gcovr libyaml-dev libbpf-dev
           sudo ln -s /usr/bin/llvm-symbolizer-6.0 /usr/bin/llvm-symbolizer || true
 
       - uses: actions/checkout@v4
@@ -140,7 +140,7 @@ jobs:
       - name: Setup environment
         run: |
           sudo apt-get update
-          sudo apt-get install -y gcc-9 g++-9 clang-12 cmake flex bison libsystemd-dev gcovr libyaml-dev
+          sudo apt-get install -y gcc-9 g++-9 clang-12 cmake flex bison libsystemd-dev gcovr libyaml-dev libbpf-dev
           sudo ln -s /usr/bin/llvm-symbolizer-12 /usr/bin/llvm-symbolizer || true
 
       - name: Build and test with actuated runners
@@ -193,7 +193,7 @@ jobs:
             --volume "/etc/machine-id:/etc/machine-id"
           install: |
             apt-get update
-            apt-get install -y gcc-7 g++-7 clang-6.0 libyaml-dev cmake flex bison libssl-dev #libsystemd-dev
+            apt-get install -y gcc-7 g++-7 clang-6.0 libyaml-dev cmake flex bison libssl-dev libbpf-dev #libsystemd-dev
             ln -s /usr/bin/llvm-symbolizer-6.0 /usr/bin/llvm-symbolizer || true
 
             update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-7 90

CMakeLists.txt

@@ -1032,6 +1032,36 @@ else()
   set(FLB_ARROW OFF)
 endif()
 
+# EBPF Support
+# ============
+if (FLB_IN_EBPF)
+  find_package(PkgConfig)
+
+  # Check for libbpf with pkg-config
+  pkg_check_modules(LIBBPF libbpf>=0.5.0)
+
+  if (LIBBPF_FOUND)
+    message(STATUS "libbpf found: ${LIBBPF_LIBRARIES}")
+    include_directories(${LIBBPF_INCLUDE_DIRS})
+    list(APPEND EXTRA_LIBS ${LIBBPF_LIBRARIES})
+  else()
+    # Manually find the library if pkg-config fails
+    find_library(LIBBPF_LIBRARY NAMES bpf REQUIRED)
+    if (LIBBPF_LIBRARY)
+      message(STATUS "Found libbpf: ${LIBBPF_LIBRARY}")
+      list(APPEND EXTRA_LIBS ${LIBBPF_LIBRARY})
+    else()
+      if (FLB_SYSTEM_LINUX)
+        message(FATAL_ERROR "libbpf is required on Linux. Please install libbpf or ensure it is in your library path.")
+      else()
+        message(STATUS "libbpf is not found. Disabling eBPF support.")
+        set(FLB_IN_EBPF OFF)
+      endif()
+    endif()
+  endif()
+
+endif()
+
 # Pthread Local Storage
 # =====================
 # By default we expect the compiler already support thread local storage

cmake/plugins_options.cmake

@@ -61,6 +61,7 @@ DEFINE_OPTION(FLB_IN_WINLOG                   "Enable Windows Log input plugin"
 DEFINE_OPTION(FLB_IN_WINDOWS_EXPORTER_METRICS "Enable windows exporter metrics input plugin" ON)
 DEFINE_OPTION(FLB_IN_WINEVTLOG                "Enable Windows EvtLog input plugin"           OFF)
 DEFINE_OPTION(FLB_IN_WINSTAT                  "Enable Windows Stat input plugin"             OFF)
+DEFINE_OPTION(FLB_IN_EBPF                     "Enable Linux eBPF input plugin"               OFF)
 
 # Processors
 # ==========

cmake/windows-setup.cmake

@@ -53,6 +53,7 @@ if(FLB_WINDOWS_DEFAULTS)
   set(FLB_IN_STORAGE_BACKLOG    Yes)
   set(FLB_IN_EMITTER            Yes)
   set(FLB_IN_PODMAN_METRICS      No)
+  set(FLB_IN_EBPF		 No)
   set(FLB_IN_ELASTICSEARCH      Yes)
   set(FLB_IN_SPLUNK             Yes)
   set(FLB_IN_PROMETHEUS_REMOTE_WRITE Yes)

dockerfiles/Dockerfile.centos7

@@ -24,6 +24,7 @@ RUN cmake3 -DCMAKE_INSTALL_PREFIX=/opt/fluent-bit/ -DCMAKE_INSTALL_SYSCONFDIR=/e
     -DFLB_OUT_KAFKA=On \
     -DFLB_JEMALLOC=On \
     -DFLB_CHUNK_TRACE=On \
+    -DFLB_IN_EBPF=Off \
     -DFLB_OUT_PGSQL=On ../
 
 RUN make -j "$(getconf _NPROCESSORS_ONLN)"

plugins/CMakeLists.txt

@@ -207,6 +207,7 @@ if(${CMAKE_SYSTEM_NAME} MATCHES "Linux")
   REGISTER_IN_PLUGIN("in_docker_events")
   REGISTER_IN_PLUGIN("in_podman_metrics")
   REGISTER_IN_PLUGIN("in_process_exporter_metrics")
+  REGISTER_IN_PLUGIN("in_ebpf")
 endif()
 
 if(${CMAKE_SYSTEM_NAME} MATCHES "Linux" OR ${CMAKE_SYSTEM_NAME} MATCHES "Darwin")

plugins/in_ebpf/CMakeLists.txt

@@ -0,0 +1,6 @@
+set(src
+  in_ebpf.c
+)
+
+FLB_PLUGIN(in_ebpf "${src}" "")
+target_link_libraries(flb-plugin-in_ebpf -lbpf -lelf -lz)