cypcap.bpf module

BPF Constants and utility functions.

Instruction classes:

cypcap.bpf.CLASS(code: int) → int

Get instruction class.

cypcap.bpf.LD = 0

cypcap.bpf.LDX = 1

cypcap.bpf.ST = 2

cypcap.bpf.STX = 3

cypcap.bpf.ALU = 4

cypcap.bpf.JMP = 5

cypcap.bpf.RET = 6

cypcap.bpf.MISC = 7

ld/ldx fields:

cypcap.bpf.SIZE(code: int) → int

Get ld/ldx size.

cypcap.bpf.W = 0

cypcap.bpf.H = 8

cypcap.bpf.B = 16

cypcap.bpf.MODE(code: int) → int

Get ld/ldx mode.

cypcap.bpf.IMM = 0

cypcap.bpf.ABS = 32

cypcap.bpf.IND = 64

cypcap.bpf.MEM = 96

cypcap.bpf.LEN = 128

cypcap.bpf.MSH = 160

alu/jmp fields:

cypcap.bpf.OP(code: int) → int

Get alu/jmp op.

cypcap.bpf.ADD = 0

cypcap.bpf.SUB = 16

cypcap.bpf.MUL = 32

cypcap.bpf.DIV = 48

cypcap.bpf.OR = 64

cypcap.bpf.AND = 80

cypcap.bpf.LSH = 96

cypcap.bpf.RSH = 112

cypcap.bpf.NEG = 128

cypcap.bpf.MOD = 144

cypcap.bpf.XOR = 160

cypcap.bpf.JA = 0

cypcap.bpf.JEQ = 16

cypcap.bpf.JGT = 32

cypcap.bpf.JGE = 48

cypcap.bpf.JSET = 64

cypcap.bpf.SRC(code: int) → int

Get alu/jmp src.

cypcap.bpf.K = 0

cypcap.bpf.X = 8

ret - BPF_K and BPF_X also apply:

cypcap.bpf.RVAL(code: int) → int

Get return value src.

cypcap.bpf.A = 16

misc:

cypcap.bpf.MISCOP(code: int) → int

Get misc op.

cypcap.bpf.TAX = 0

cypcap.bpf.TXA = 128

utils:

cypcap.bpf.STMT(code, k)

Create a BPF statement instruction tuple.

cypcap.bpf.JUMP(code, jt, jf, k)

Create a BPF jump instruction tuple.

cypcap.bpf.MEMWORDS = 16

Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).