parseFlags creates the flags, and attempts to parse args. On error, the returned flags is fully setup, but will not hold values for all the arguments.

Close releases any resources held It does not Rm()

withOffsets generates a new filter from filter, using a fixed set of offsets into the packet

newFilterWithMap creates a filter from a tcpdump / libpcap filter expression

checkActions checks that all programs return their expected action, and the packet isn't modified Packet is 0 padded to min ethernet length actions sh

CheckHookMap checks the given map against HookMapABI to have appropriate values Only checks Type, KeySize, ValueSize

tcpdumpExprToBPF converts a tcpdump / libpcap filter expression to cBPF using libpcap

addOffset adds an offset, checking for overflow

parsecBPF parses a string of cBPF 4 tuple instructions, formatted as: <length>,<opcode> <jt> <jf> <k>,...

Returns errFilterClosed if the filter has been closed

NewHook creates a new Hook, that can be Pin()'d to fileName. fileName must be inside a bpffs

no good way to check if a program is already attached, as Create() doesn't work on prog array maps We could check if values are present for keys, but

All valid LinkTypes

newProgram builds an eBPF program that copies packets matching a cBPF program to userspace via perf

unlimitLockedMemory removes any locked memory limits

Patch edits all programs in the spec that refer to hookMapSymbol to use this hook. This function is a no-op if called on a nil Hook.

Rm deletes files created by Pin()

allActions returns every action exposed by the map

newFilter creates a filter from a tcpdump / libpcap filter expression

newPcapWriter creates a pcapWriter with an pcap interface (metadata) per xdp action

parseInstruction parses a cBPF instruction, formatted as: <opcode> <jt> <jf> <k>

printFilter prints a filter in the standard / linux form to stdout

withOffset rewrites filter to use a fixed offset into the packet new filter will return on match, fall through on no match

* Return action, exposing the action and input packet to xdpcap hook. * * return xdpcap_exit(ctx, &hook, XDP_PASS) * * is equivalent to: * *

Pin persists the underlying map to a file, overwriting it if it already exists

Test CheckHookMap with valid and invalid HookMap ABI

Test loading an elf with a hook map using ebpf.CollectionSpec.LoadAndReplace(), which didn't always work: https://github.com/cilium/ebpf/commit/04b5c2

Test loading an elf with a hook map using ebpf.NewCollection().

Test loading an elf that uses a hook without an explicit hook map