bpftool: Allow to select sections and filter probes

[vadorovsky]

This pull request introduces two changes in bpftool feature syntax:

• ability to select a specific section of probes to execute and print
• ability to filter in and filter out probes with regular expressions to execute and print

The only exception in terms of executing is the syscall_config probe, which is always executed, but if the other section was provided as an argument, syscall_config check will perform silently without printing and exit bpftool if the bpf() syscall is not available (because in that case running any probe has no sense).

Syntax of the bpftool feature after this change is:

bpftool feature probe [COMPONENT] section [SECTION] [filter_in PATTERN] [filter_out PATTERN] [macros [prefix PREFIX]]
COMPONENT := { kernel | dev NAME }
SECTION := { all | system_config | syscall_config | program_types | map_types | helpers | misc }

Please review per commit.

Fixes cilium/cilium#10048

[vadorovsky]

The only problem with this PR and the reason why it's WIP - glibc regex library works weird for me. Filtering out those two patterns separately (bpftool feature kernel filter_out trace and bpftool feature kernel filter_out perf) works perfect. Trying to filter them out all together (I tried bpftool feature kernel filter_out "trace|perf", bpftool feature kernel filter_out "(trace|perf)", bpftool feature kernel filter_out ".*(trace|perf).*) doesn't work at all and none of patterns get filtered out.

[qmonnet]

Looks good overall. There are some minor improvements to bring here and there, see the comments.

I had not thought of the prog types probes being required for probing the helpers. It is unfortunate because it complicates things for the helpers, and makes the code less readable by passing print_program_types everywhere. Your approach is good I think, although we can have some weird stuff like bpftool feature probe filter_out prog which says that no helper is supported whatsoever. Maybe we should still probe for the prog types internally even if they are filtered out?

Two additional generic comments, not sure if worth addressing, mostly recommendations for the future:

• I would keep the most important arguments at the beginning of the function definitions when adding new ones (e.g. probe_prog_type(type, print_program_types) instead of probe_prog_type(print_program_types, type).
• I would try to use verbs in function names (thinking of section_program_types and similar).

Regarding the regex library, I managed to get multiple matches with e.g.:

bpftool feature probe filter_in "\(trace\|perf\)"

Also don't forget bash completion along with the man page :)

[vadorovsky]

Maybe we should still probe for the prog types internally even if they are filtered out?

I will try that. If it will not generate any unwanted dmesg entries, then that's a good idea.