Class: SeccompTools::BPF

Inherits:
Object
  • Object
show all
Defined in:
lib/seccomp-tools/bpf.rb

Overview

Define the struct sock_filter, while more powerful.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(raw, arch, line) ⇒ BPF

Instantiate a SeccompTools::BPF object.

Parameters:

  • raw (String) —

    One struct sock_filter in bytes, should exactly 8 bytes.

  • arch (Symbol) —

    Architecture, for showing constant names in decompile.

  • line (Integer) —

    Line number of this filter.



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/seccomp-tools/bpf.rb', line 34

def initialize(raw, arch, line)
  if raw.is_a?(String)
    io = ::StringIO.new(raw)
    @code = io.read(2).unpack1('S')
    @jt = io.read(1).ord
    @jf = io.read(1).ord
    @k = io.read(4).unpack1('L')
  else
    @code = raw[:code]
    @jt = raw[:jt]
    @jf = raw[:jf]
    @k = raw[:k]
  end
  @arch = arch
  @line = line
  @contexts = Set.new
end

Instance Attribute Details

#arch ⇒ Symbol (readonly)

Returns Architecture.

Returns:

  • (Symbol) —

    Architecture.



23
24
25
 
# File 'lib/seccomp-tools/bpf.rb', line 23

def arch
  @arch
end

#code ⇒ Integer (readonly)

Returns BPF code.

Returns:

  • (Integer) —

    BPF code.



15
16
17
 
# File 'lib/seccomp-tools/bpf.rb', line 15

def code
  @code
end

#contexts ⇒ Set<Context>

Returns Possible contexts before this instruction.

Returns:

  • (Set<Context>) —

    Possible contexts before this instruction.



25
26
27
 
# File 'lib/seccomp-tools/bpf.rb', line 25

def contexts
  @contexts
end

#jf ⇒ Integer (readonly)

Returns BPF JF.

Returns:

  • (Integer) —

    BPF JF.



19
20
21
 
# File 'lib/seccomp-tools/bpf.rb', line 19

def jf
  @jf
end

#jt ⇒ Integer (readonly)

Returns BPF JT.

Returns:

  • (Integer) —

    BPF JT.



17
18
19
 
# File 'lib/seccomp-tools/bpf.rb', line 17

def jt
  @jt
end

#k ⇒ Integer (readonly)

Returns BPF K.

Returns:

  • (Integer) —

    BPF K.



21
22
23
 
# File 'lib/seccomp-tools/bpf.rb', line 21

def k
  @k
end

#line ⇒ Integer (readonly)

Returns Line number.

Returns:

  • (Integer) —

    Line number.



13
14
15
 
# File 'lib/seccomp-tools/bpf.rb', line 13

def line
  @line
end

Instance Method Details

#asm ⇒ String

Convert to raw bytes.

Returns:

  • (String) —

    Raw bpf bytes.



62
63
64
 
# File 'lib/seccomp-tools/bpf.rb', line 62

def asm
  [code].pack('S*') + [jt, jf].pack('C*') + [k].pack('L')
end

#branch(context) {|pc, ctx| ... } ⇒ void

This method returns an undefined value.

Parameters:

  • context (Context) —

    Current context.

Yield Parameters:

  • pc (Integer) —

    Program counter after this instruction.

  • ctx (Context) —

    Context after this instruction.



87
88
89
 
# File 'lib/seccomp-tools/bpf.rb', line 87

def branch(context, &block)
  inst.branch(context).each(&block)
end

#command ⇒ Symbol

Command according to code.

Returns:



69
70
71
 
# File 'lib/seccomp-tools/bpf.rb', line 69

def command
  Const::BPF::COMMAND.invert[code & 7]
end

#decompile ⇒ String

Decompile.

Returns:

  • (String) —

    Decompile string.



76
77
78
 
# File 'lib/seccomp-tools/bpf.rb', line 76

def decompile
  inst.decompile
end

#disasm ⇒ String

Pretty display the disassemble result.

Returns:

  • (String) 


54
55
56
57
 
# File 'lib/seccomp-tools/bpf.rb', line 54

def disasm
  format(' %04d: 0x%02x 0x%02x 0x%02x 0x%08x  %s',
         line, code, jt, jf, k, decompile)
end

#inst ⇒ SeccompTools::Instruction::Base

Corresponding instruction object.

Returns:



93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/seccomp-tools/bpf.rb', line 93

def inst
  @inst ||= case command
            when :alu  then SeccompTools::Instruction::ALU
            when :jmp  then SeccompTools::Instruction::JMP
            when :ld   then SeccompTools::Instruction::LD
            when :ldx  then SeccompTools::Instruction::LDX
            when :misc then SeccompTools::Instruction::MISC
            when :ret  then SeccompTools::Instruction::RET
            when :st   then SeccompTools::Instruction::ST
            when :stx  then SeccompTools::Instruction::STX
            end.new(self)
end