⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
usr
/
lib
/
python3
/
dist-packages
/
bcc
/
__pycache__
/
View File Name :
table.cpython-312.pyc
f: d dl mZ d dlmZ d dlmZ d dlZ d dl m Z d dl Z d dl Z d dlZd dlZd dlZddlmZmZmZmZmZ ddlmZ dd lmZ dZd Zd Z d Z d Z dZ dZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d Z-d Z.d Z/d Z0d Z1d!Z2d"Z3d#Z4d$Z5d%Z6i ed&ed'e d(e d)e d*e d+e d,e!d-e"d.e#d/e$d0e%d1e&d2e'd3e(d4e)d5e*d6e+d7e,d8e-d9e.d:e/d;e0d<e1d=e2d>e3d?e4d@e5dAe6dBi Z7dCa8dDZ9dEZ:dF Z;dxdGZ<dxdHZ=dI Z>dJ Z?dK Z@dL ZAdM ZB G dN dOe ZC G dP dQeC ZD G dR dSeD ZE G dT dUeC ZF G dV dWeF ZG G dX dYeF ZH G dZ d[ ZI G d\ d]eF ZJ G d^ d_eF ZK G d` daeD ZL G db dceL ZM G dd deeF ZN G df dgeC ZO G dh dieC ZP G dj dkeF ZQ G dl dmeF ZR G dn doeF ZS G dp dqeF ZT G dr dseD ZU G dt dueC ZV G dv dw ZWy# e$ r d dlmZ Y w xY w)y )print_function)MutableMapping)strftimeN)reduce )lib _RAW_CB_TYPE _LOST_CB_TYPE_RINGBUF_CB_TYPEbcc_perf_buffer_opts)get_online_cpus)get_possible_cpus HASHARRAY PROG_ARRAYPERF_EVENT_ARRAY PERCPU_HASH PERCPU_ARRAY STACK_TRACE CGROUP_ARRAYLRU_HASHLRU_PERCPU_HASHLPM_TRIE ARRAY_OF_MAPS HASH_OF_MAPSDEVMAPSOCKMAPCPUMAPXSKMAPSOCKHASHCGROUP_STORAGEREUSEPORT_SOCKARRAYPERCPU_CGROUP_STORAGEQUEUESTACK SK_STORAGE DEVMAP_HASH STRUCT_OPSRINGBUF INODE_STORAGE TASK_STORAGE( A i c n d}d} ||| z |z dz kD s||dz kD rn |dz }|dz }"| |kD r|d d dz }|S )Nr r *+ )valval_maxwidthitexts +/usr/lib/python3/dist-packages/bcc/table.py_starsrV d sf A D w&!+ +UQY Q W}CRy3 K c t | |d S )N)section_bucket)_get_json_hist)valsval_typerY s rU get_json_histr] p s $ >>rW c b g }d}t t | D ] }| | dk7 s |} d}d}t t | D ]O }|dk7 s ||k s|dz }i }||d< t | dz |d< t | | |d< |j | |}Q t d ||d} |r |d | |d < | S ) Nr r r zinterval-startz interval-endcountz%Y-%m-%d %H:%M:%S)tsr\ data)rangelenintappendr ) r[ r\ rY hist_listmax_nonzero_idxrS indexprevlist_obj histograms rU rZ rZ s s IO 3t9 7a< O E D 3t9 6a?*AIEH)-H% &'*5zA~H^ $ #DG HW X &D 34(T]^I'5a'8 .#$ rW c d}d}d}t | D ] \ }}|dkD r|}||kD s|} |dk r d}d} t } nd}d} t t d z } |dkD rt ||z t d |d z D ]e }d |z d z } d |z d z } | | k( r| d z } | | } |r$| s't | | | | | t | || fz d }Ht | | | | | t | || fz g y ) N@ rM r z# %-19s : count distributionz%10d -> %-10d : %-8d |%-*s|z- %-29s : count distributionz%20d -> %-20d : %-8d |%-*s|r r F) enumerate stars_maxrd printrb rV )r[ r\ strip_leading_zero log2_dist_maxidx_maxrQ rS vheaderbodystarslowhighrP s rU _print_log2_histr{ s! MGG$1 q5A' w;! "}6,@,IM"{ fx 1gk "Av!mQ!| 4K 1HC1g dc4e $S'5 9 ; ; <%*" $#tS% gu57 7 8 #rW c D d}d}d}t | D ] \ }}|dkD r|}||kD s|} d}d} t } |dk\ rt ||z t d|dz D ]I }| | } |r#| s t | || | t | || fz d}-t | || | t | || fz K y )Nrm rM r z# %-13s : count distributionz %-10d : %-8d |%-*s|r F)ro rp rq rb rV ) r[ r\ rr rs rt rQ rS ru rv rw rx rP s rU _print_linear_histr} s MGG$1 q5A' w;! 3F (D E!| fx 1gk "1g dae $S'5 9 ; ; <%*"dae $S'5 9 ; ; < #rW c 4 t | S # t $ r Y yw xY w)Nz <unknown>) map_type_nameKeyError)ttypes rU get_table_type_namer s$ U## s c i dt j dt j dt j dt j dt j dt j dt j dt j d t j d t j d t j d t j d t j dt j dt j dt j dt j t j t j t j t j t j dz t j dz t j d}t j d }g }t j | j" j$ | j& }d}||k r t j( | j" j$ | j& | j+ }t j, d| }|j/ d }|j/ d } t j, d| rd } |j- | } |rA|j1 |||j/ d t3 |j/ d z f n|j1 ||| f |dz }||k r t? dt j@ fd |i S # t4 $ r6 t7 d| z t8 j: t9 j< d Y hw xY w) Nchars8z unsigned charu8zu8 *zchar *shorts16zunsigned shortu16rd s32enumz unsigned intu32longz unsigned longr )z long longs64zunsigned long longu64__int128zunsigned __int128zvoid *z (\S+(?: \S+)*) ?\[([0-9]+)\]$r z (.*)#(.*)r zenum .*zGType: '%s' not recognized. Please define the data with ctypes manually.)filerK _fields_)!ctc_charc_ubytec_char_pc_shortc_ushortc_intc_uintc_longc_ulong c_longlong c_ulonglongc_void_precompiler bpf_perf_event_fieldsbpfmodule_namebpf_perf_event_fielddecodematchgroupre rd r rq sysstderrexittype Structure) event_map ct_mapping array_typefields num_fieldsrS fieldm field_name field_types rU _get_event_classr s bii bii bjj bjj bkk bkk bjj bjj bkk bkk bhh bhh bhh bii bii bii!" bjj#$ !mm mm nn nn !}}q 0 !~~ 1 kk1J8 <=J F**9==+?+? QJ A j.(( )=)=yPQRYY[ HH\5 )WWQZ WWQZ 88J + J Z ( z:aggaj+ACPQ O+S TU z:j+A BC Q+ j., R\\Oj&%9 :: [ %(ZZ 1 HHQK s AL <MMc t j | j | }d}|t k( rt | |||| }n|t k( rt | |||| }n|t k( rt | |||| }n|t k( rt | ||||| }nl|t k( rt | ||||fi |}nQ|t k( rt | ||||fi |}n6|t k( rt! | |||| }n |t" k( rt% | |||| }n|t& k( rt) | |||| }n|t* k( rt- | |||| }n|t. k( rt1 | |||| }n|t2 k( rt5 | |||| }n|t6 k( rt9 | |||| }n|t: k( rt= | |||| }nl|t> k( rtA | |||| }nS|tB k( rtE | |||| }n:|tF k( s |tH k( rtK | ||| }n|tL k( rtO | ||||| }|dk( rtQ d|z |S )z|Table(bpf, map_id, map_fd, keytype, leaftype, **kwargs) Create a python object out of a reference to a bpf table handleNzUnknown table type %d))r bpf_table_type_idr BPF_MAP_TYPE_HASH HashTableBPF_MAP_TYPE_ARRAYArrayBPF_MAP_TYPE_PROG_ARRAY ProgArray BPF_MAP_TYPE_PERF_EVENT_ARRAYPerfEventArrayBPF_MAP_TYPE_PERCPU_HASH PerCpuHashBPF_MAP_TYPE_PERCPU_ARRAY PerCpuArrayBPF_MAP_TYPE_LPM_TRIELpmTrieBPF_MAP_TYPE_STACK_TRACE StackTraceBPF_MAP_TYPE_LRU_HASHLruHash BPF_MAP_TYPE_LRU_PERCPU_HASH LruPerCpuHashBPF_MAP_TYPE_CGROUP_ARRAY CgroupArrayBPF_MAP_TYPE_DEVMAPDevMapBPF_MAP_TYPE_CPUMAPCpuMapBPF_MAP_TYPE_XSKMAPXskMapBPF_MAP_TYPE_ARRAY_OF_MAPS MapInMapArrayBPF_MAP_TYPE_HASH_OF_MAPS MapInMapHashBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK QueueStackBPF_MAP_TYPE_RINGBUFRingBuf Exception) r map_idmap_fdkeytypeleaftypenamekwargsr ts rU Tabler s6 ! !#**f 5E A !! c667H = $ $ #vvw 9 ) ) c667H = / / 34 H * * sFFGX H H + + VVWh I& I ' ' C( ; * * sFFGX > ' ' C( ; . . #vvw A + + VVWh ? % % 3 : % % 3 : % % 3 : , , #vvw A + + ffgx @ $ $1C(C sFFH 5 & & C(D ADy/%788 HrW c e Zd Zd"dZd Zd Zd Zd Zd Zd Z d Z d Z d Z d Z d Zd Zd Zd#dZd$dZd Zd"dZd Zd Zd%dZd Zd Zd Zd Z G d d e Z d Z e fd Z d&d Z! d'd Z" d'd!Z#y)( TableBaseNc || _ || _ || _ || _ || _ t j | j j | j | _ t j | j j | j | _ i | _ || _ t t j | j j | j | _ y N)r r r KeyLeafr r r r bpf_table_flags_idflags_cbsr rd bpf_table_max_entries_id max_entries)selfr r r r r r s rU __init__zTableBase.__init__C s **488??DKKH ++DHHOOT[[I s ; ;DHHOO rW c | j S r )r r s rU get_fdzTableBase.get_fdP s {{rW c J t j t j | j dz }t j | j j | j |t | t j | }|dk r t d |j S )Nr r zCould not printf key) r create_string_buffersizeofr r bpf_table_key_snprintfr r r rc byrefr value)r keybufress rU key_sprintfzTableBase.key_sprintfS su %%bii&9A&=>(( $++s),S288C=B 7 23 3yyrW c J t j t j | j dz }t j | j j | j |t | t j | }|dk r t d |j S Nr r zCould not printf leaf r r r r r bpf_table_leaf_snprintfr r r rc r r r r leafr r s rU leaf_sprintfzTableBase.leaf_sprintf[ u %%bii &:Q&>?))$((//4;;*-c(BHHTND 7 34 4yyrW c | j }t j | j j | j |t j | }|dk r t d |S )Nr zCould not scanf key) r r bpf_table_key_sscanfr r r r r r )r key_strr r s rU key_scanfzTableBase.key_scanfc sR hhj&&txx W')xx}6 7 12 2 rW c | j }t j | j j | j |t j | }|dk r t d |S Nr zCould not scanf leaf r r bpf_table_leaf_sscanfr r r r r r r leaf_strr r s rU leaf_scanfzTableBase.leaf_scanfk R yy{''h(*8 7 23 3 rW c | j }t j | j t j | t j | }|dk rt |S Nr r r bpf_lookup_elemr r r r r r r r s rU __getitem__zTableBase.__getitem__s sF yy{!!$++rxx}bhhtnM 7N rW c t j | j t j | t j | d }|dk r5t j t j }t d|z y )Nr zCould not update table: %s r bpf_update_elemr r r osstrerror get_errnor )r r r r errstrs rU __setitem__zTableBase.__setitem__z s] !!$++rxx}bhhtnaP 7[[ 0F 86 AB B rW c t j | j t j | }|dk rt y r )r bpf_delete_elemr r r r )r r r s rU __delitem__zTableBase.__delitem__ s1 !!$++rxx}= 7N rW c # H K | D ] } | | y # t $ r Y w xY wwr r r r s rU itervalueszTableBase.itervalues s1 C 3i s "" " "c # L K | D ] } || | f y # t $ r Y w xY wwr r) r* s rU iteritemszTableBase.iteritems s7 C DI&& s $ $ !$!$c H | j D cg c] }| c}S c c}w r )r- )r items rU itemszTableBase.items s# !% !12!1!1222 c H | j D cg c] }| c}S c c}w r r+ r r s rU valueszTableBase.values # #'??#45#4%#4555r1 c P | j D ] }| j | y r )keysr' r ks rU clearzTableBase.clear s A Q rW c & dx}}|s|st j d ddfS |s | j }n |dk s|| j kD r t d |r | j |z }|r | j |z }t j | ||fS )a Allocate keys and/or values arrays. Useful for in items_*_batch. Args: alloc_k (bool): True to allocate keys array, False otherwise. Default is False. alloc_v (bool): True to allocate values array, False otherwise. Default is False. count (int): number of elements in the array(s) to allocate. If count is None then it allocates the maximum number of elements i.e self.max_entries. Returns: tuple: (count, keys, values). Where count is ct.c_uint32, and keys and values an instance of ct.Array Raises: ValueError: If count is less than 1 or greater than self.max_entries. Nr r z Wrong count)r c_uint32r ValueErrorr r )r alloc_kalloc_vr_ r8 r5 s rU _alloc_keys_valuesz TableBase._alloc_keys_values s & vwKKND$/ /$$E QY%$"2"22 ]+ + $DHHu$'D 'dii%'*F E"D&11rW c ( d}||fD ]O }|st |t j st t | }|dk s|| j kD sFt d |r$|r"t | t | k7 r t d t j | S )a Check if the given keys or values have the right type and size. Args: keys (ct.Array): keys array to check values (ct.Array): values array to check Returns: ct.c_uint32 : the size of the array(s) Raises: ValueError: If length of arrays is less than 1 or greater than self.max_entries, or when both arrays length are different. TypeError: If the keys and values are not an instance of ct.Array r r zArray's length is wrongz(keys array length != values array length) isinstancer r TypeErrorrc r r> r= )r r8 r5 arr_lenelems rU _sanity_check_keys_valuesz#TableBase._sanity_check_keys_values s 6ND!$1#O d)Q;'D,<,<"<$%>?? # F4yCK' !KLL{{7##rW c # L K | j d D ] \ }}||f yw)a Look up all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up. Notes: lookup batch on a keys subset is not supported by the kernel. FdeleteN)_items_lookup_and_optionally_delete_batchr r: ru s rU items_lookup_batchz TableBase.items_lookup_batch s1 BB%BPDAqQK Q "$c X || j | }t j | j t j | t j | }|dk7 r3t dt j t j z y| j D ] } y y)a Delete the key-value pairs related to the keys given as parameters. Note that if no key are given, it is faster to call lib.bpf_lookup_and_delete_batch than create keys array and then call lib.bpf_delete_batch on these keys. Args: ct_keys (ct.Array): keys array to delete. If an array of keys is given then it deletes all the related keys-values. If keys is None (default) then it deletes all entries. Yields: tuple: The tuple of (key,value) for every entries that have been deleted. Raises: Exception: If bpf syscall return value indicates an error. N)r8 r z#BPF_MAP_DELETE_BATCH has failed: %s) rG r bpf_delete_batchr r r r r r! r" items_lookup_and_delete_batch)r ct_keysct_cntr _s rU items_delete_batchz TableBase.items_delete_batch s 333AF&&t{{')xx'8')xx'7)C q E"$++blln"=!> ? ? 779 :rW c P | j || }t j | j t j | t j | t j | }|dk7 r3t dt j t j z y)aq Update all the key-value pairs in the map provided. The arrays must be the same length, between 1 and the maximum number of entries. Args: ct_keys (ct.Array): keys array to update ct_values (ct.Array): values array to update Raises: Exception: If bpf syscall return value indicates an error. )r8 r5 r z#BPF_MAP_UPDATE_BATCH has failed: %sN) rG r bpf_update_batchr r r r r r! r" )r rS ct_valuesrT r s rU items_update_batchz TableBase.items_update_batch s //WY/O""4;;#%88G#4#%88I#6#%88F#3% 1H A kk",,. 9 : ; ; rW c # L K | j d D ] \ }}||f yw)a? Look up and delete all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Notes: lookup and delete batch on a keys subset is not supported by the kernel. TrI NrK rM s rU rR z'TableBase.items_lookup_and_delete_batch$ s1 BB$BODAqQK PrO c # Z K |du rt j }d}nt j }d}| j dd \ }}}t j d x}}d} |j | z |_ || j | rt j | ndt j | t j |t j | j | z t j |t j | j | z t j | } t j } | |j z } | dk7 r6| t j k7 r#t |dt! j" | | dk7 rn"| |j k( rn|j dk( rnVt% d| D ]h } || } || }t' | t j( s| j | } t' |t j( s| j | }| |f j yw)a Look up and optionally delete all the key-value pairs in the map. Args: delete (bool) : look up and delete the key-value pairs when True, else just look up. Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Raises: Exception: If bpf syscall return value indicates an error. Notes: lookup and delete batch on a keys subset is not supported by the kernel. T BPF_MAP_LOOKUP_AND_DELETE_BATCHBPF_MAP_LOOKUP_BATCH)r? r@ r Nz has failed: )r bpf_lookup_and_delete_batchbpf_lookup_batchrA r r= r r r r r r r" errnoENOENTr r r! rb rC r )r rJ bpf_batchbpf_cmd ct_buf_sizerS rY ct_out_batchrT totalr errcoderS r: ru s rU rL z3TableBase._items_lookup_and_optionally_delete_batch3 s T>77I7G,,I,G +/*A*A$JN +B +P' Wi " A. v&,,u4FLDKK6;BHH\ 2 HH\ 2 HHWbii.AE.I J HHY $))0Du0L M HHV , C llnG V\\ !EqW 4 w79{{77K!M N N ax )))||q 1 4 q% A A! A a .HHQK a .IIaLa&L !s H)H+c f t | j D ] }| j | |< y r )listr8 r r9 s rU zerozTableBase.zerop s( diik"AiikDG #rW c , t j | S r )r Iterr s rU __iter__zTableBase.__iter__x s ~~d##rW c " | j S r rn r s rU iterzTableBase.iter{ 4==?*rW c " | j S r rp r s rU r8 zTableBase.keys| rr rW c $ e Zd Zd Zd Zd Zd Zy)TableBase.Iterc || _ d | _ y r )tabler )r rw s rU r zTableBase.Iter.__init__ s DJDHrW c | S r rO r s rU rn zTableBase.Iter.__iter__ KrW c " | j S r nextr s rU __next__zTableBase.Iter.__next__ 99; rW c n | j j | j | _ | j S r )rw r| r r s rU r| zTableBase.Iter.next s# zztxx0DH88OrW N__name__ __module__ __qualname__r rn r} r| rO rW rU rm ru ~ s rW rm c z | j }|Rt j | j t j | t j | j }nGt j | j t j | t j | }|dk r t |S r ) r r bpf_get_first_keyr r r r bpf_get_next_key StopIteration)r r next_keyr s rU r| zTableBase.next s 88: ;'' RXXh5G(* $(((;=C &&t{{BHHSM')xx'9;C 7 / !rW c 8 | j j d d }| j j d d }|dk( r>t | j j dk( r | j j d d }| j D ]Q \ }} t || } |r || } |j | dg|z x} || < t || } | j | | < S t |j } |r || } | D ] } |j | y )Nr r __pad_1r r ) r r rc r0 getattrgetr rj r8 re )r tmpbuckets bucket_fnbucket_sort_fn index_maxf1f2r: ru bucketr[ slot buckets_lsts rU decode_c_structzTableBase.decode_c_struct s XX q !! $ XX q !! $ ?s488#4#4 5 :""1%a(BJJLDAq Q^F"6*!$!y !A AD3v;1b>DDJ ! 388:& (5K!F NN6 " "rW c t | j t j rLi }g }| j |||| |D ]. }|| } |r | || f} n||f} t t | || 0 ydgt z } | j D ] \ } } | j | | j < t t | | y)a. print_json_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, bucket_sort_fn=None): Prints a table as a json histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, the dictionary will be split by secondary key If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram. r N) rC r r r r rq rZ log2_index_maxr0 r ) r r\ section_headersection_print_fnr r r r r r[ rY r: ru s rU print_json_histzTableBase.print_json_hist s $ dhhj",, /CG gy. I!6{#&46Fv6N%ON&4f%=NnT8^DE " 3 'D 1 !QWW % .x0 1rW c t | j t j r]i }g }| j |||| |D ]? } || } |rt d|d || nt d|d| t | || A ydgt z } | j D ] \ } } | j | | j < t | || y)a print_log2_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None): Prints a table as a log2 histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram. = r N) rC r r r r rq r{ r r0 r r r\ r r r rr r r r r r[ r: ru s rU print_log2_histzTableBase.print_log2_hist s , dhhj",, /CG gy. I!6{# (02 3 @A x1CD " 3 'D 1 !QWW % T8-? @rW c t | j t j rbi }g }| j ||||t |D ]? } || } |rt d|d || nt d|d| t | || A ydgt z } | j D ] \ } } | j | | j < ! t | || y# t $ r t d| j t fz w xY w)a print_linear_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None) Prints a table as a linear histogram. This is intended to span integer ranges, eg, from 0 to 100. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is linear_index_max (1025), which is hoped to be sufficient for integer ranges spanned. r r r z5Index in print_linear_hist() of %d exceeds max of %d.N) rC r r r r linear_index_maxrq r} r0 r IndexErrorr s rU print_linear_histzTableBase.print_linear_hist s , dhhj",, /CG gy.JZ [!6{# (02 3 @A"43EF " 3))D 1M$%GGDM % tX/A B " M % '-12:J0K&L M MMs ,C(C=r )FFN)NN)T)r Bucket ptrNNN)r r NNNN)$r r r r r r r r r r r$ r' r+ r- r0 r5 r; rA rG rN rV rZ rR rL rk rn rq r8 objectrm r| r r r r r rO rW rU r r A s C 36 !2F $< <;* ;z"$ +* v R` #. @LNR"2H @LFJ &AP BNFJ -CrW r c $ e Zd Z fdZd Z xZS )r c , t t | |i | y r )superr r r argsr __class__s rU r zHashTable.__init__, i'88rW c " d}| D ] }|dz } |S Nr r rO r rS r: s rU __len__zHashTable.__len__/ AqAvqrW r r r r r __classcell__r s @rU r r + s 9rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zLruHash.__init__5 gt%t6v6rW r r r r r r s @rU r r 4 s 7 7rW r c j e Zd Z fdZd Zd Z fdZ fdZ fdZd Z d Z G d d e Z xZ S ) ArrayBasec , t t | |i | y r )r r r r s rU r zArrayBase.__init__9 r rW c t |t r$|dk rt | |z }| j | }t |t j s t d |j t | k\ r t d |S )Nr z#Array index must be an integer typezArray index out of range)rC rd rc r r _SimpleCDatar r r* s rU _normalize_keyzArrayBase._normalize_key< sh c3 Qw$i#o((3-C#r/ BC C 99D ! 78 8 rW c | j S r )r r s rU r zArrayBase.__len__G s rW c L | j | }t t | | S r )r r r r r r r s rU r zArrayBase.__getitem__J s% !!#&Y1#66rW c P | j | }t t | || y r )r r r r$ r r r r s rU r$ zArrayBase.__setitem__N s$ !!#& i*35rW c N | j | }t t | | y r )r r r r' r s rU r' zArrayBase.__delitem__R s" !!#& i*3/rW c | j | }| j }t j | j t j | t j | d }|dk r t d y )Nr zCould not clear item)r r r r r r r r r s rU clearitemzArrayBase.clearitemV s_ !!#&yy{!!$++rxx}bhhtnaP 7 23 3 rW c B t j | | j S r )r rm r r s rU rn zArrayBase.__iter__] s ~~dDHH--rW c $ e Zd Zd Zd Zd Zd Zy)ArrayBase.Iterc . || _ || _ d| _ y NrM )r rw rS )r rw r s rU r zArrayBase.Iter.__init__a s DH DJDFrW c | S r rO r s rU rn zArrayBase.Iter.__iter__f ry rW c " | j S r r{ r s rU r} zArrayBase.Iter.__next__h r~ rW c | xj dz c_ | j t | j k( r t | j | j S Nr )rS rc rw r r r s rU r| zArrayBase.Iter.nextj s> FFaKFvvTZZ (#o%88DFF# #rW Nr rO rW rU rm r ` s $rW rm )r r r r r r r r$ r' r rn r rm r r s @rU r r 8 s< 9 7604.$v $ $rW r c $ e Zd Z fdZd Z xZS )r c , t t | |i | y r )r r r r s rU r zArray.__init__q s eT#T4V4rW c & | j | y r r r* s rU r' zArray.__delitem__t srW )r r r r r' r r s @rU r r p s 5 rW r c ( e Zd Z fdZ fdZ xZS )r c , t t | |i | y r )r r r r s rU r zProgArray.__init__y r rW c t |t r| j | }t || j j r| j |j }t t | # || y r ) rC rd r r Functionfdr r r$ r s rU r$ zProgArray.__setitem__| sQ dC 99T?D dDHH - - .99TWW%D i*35rW r r r r r$ r r s @rU r r x s 96 6rW r c * e Zd Zd Zd Zd Zd Zd Zy)FileDescc 6 ||dk r t d || _ y )Nr zInvalid file descriptor)r r )r r s rU r zFileDesc.__init__ s JBF 56 6rW c | j 7| j dk\ r't j | j d | _ y y y r )r r closer s rU clean_upzFileDesc.clean_up s5 GG dggl HHTWW DG '3 rW c $ | j y r r r s rU __del__zFileDesc.__del__ rW c | S r rO r r r s rU __enter__zFileDesc.__enter__ s rW c $ | j y r r r s rU __exit__zFileDesc.__exit__ r rW N)r r r r r r r r rO rW rU r r s rW r c ( e Zd Z fdZ fdZ xZS )r c , t t | |i | y r )r r r r s rU r zCgroupArray.__init__ s k4)4:6:rW c t |t r$t t | || j | y t |t rdt t j |t j 5 }t t | || j |j d d d y t d # 1 sw Y y xY w)Nz1Cgroup array key must be either FD or cgroup path) rC rd r r r$ r strr r openO_RDONLYr r )r r r fr s rU r$ zCgroupArray.__setitem__ s dC +t 0diio F c ""''$ 45k44S$))ADD/J 65 OP P 65s 3.B55B>r r s @rU r r s ;Q QrW r c R e Zd Z fdZd Z fdZd Zd dZd Zd dZ d dZ xZ S ) r c H t t | |i | i | _ d | _ y r )r r r _open_key_fds _event_classr s rU r zPerfEventArray.__init__ s' nd,d=f= rW c ^ t | j j }|D ] }| |= y r )rj r r8 )r r8 r s rU r zPerfEventArray.__del__ s, D&&++-.CS rW c || j vry t t | | t | |f}|| j j v rQt j | j j | | j j |= | j |= n"t j | j | | j |= y r ) r r r r' idr perf_buffersr perf_reader_freer bpf_close_perf_event_fd)r r key_idr s rU r' zPerfEventArray.__delitem__ s d(( ( nd/4T(C TXX** * !6!6v!> ?%%f- # ' '(:(:3(? @ s #rW c | j dk( rt | | _ t j |t j | j j S )a event(data) When perf buffers are opened to receive custom perf event, the underlying event data struct which is defined in C in the BPF program can be deduced via this function. This avoids redundant definitions in Python. Nr r r castPOINTERcontentsr ra s rU eventzPerfEventArray.event E $ 0 6D wwtRZZ(9(9 :;DDDrW c x ||dz z dk7 r t d t D ] }| j ||||| y)az open_perf_buffers(callback) Opens a set of per-cpu ring buffer to receive custom perf event data from the bpf program. The callback will be invoked for each event submitted from the kernel, up to millions per second. Use page_cnt to change the size of the per-cpu ring buffer. The value must be a power of two and defaults to 8. r r z+Perf buffer page_cnt must be a power of twoN)r r _open_perf_buffer)r callbackpage_cntlost_cb wakeup_eventsrS s rU open_perf_bufferz PerfEventArray.open_perf_buffer sD x!| $ ) IJ J "A " "1h'= Q #rW c , fd}fd}t | }r t | nt j d t } t } d| _ | _ || _ t j || d |t j | } | s t d t j | } | j | | | j < | | j j t# | f< || f| j$ < d| j& < y )Nc || y # t $ r4}|j t j k( r t n|Y d }~y d }~ww xY wr IOErrorra EPIPEr )rU ra sizeer cpus rU raw_cb_z1PerfEventArray._open_perf_buffer.<locals>.raw_cb_ sC dD) 77ekk)FG s A *AA c | y # t $ r4}|j t j k( r t n|Y d }~y d }~ww xY wr r )rU lostr r s rU lost_cb_z2PerfEventArray._open_perf_buffer.<locals>.lost_cb_ s> 77ekk)FG s A *AA rM zCould not open perf buffer)r r r r r pidr r r bpf_open_perf_buffer_optsr r perf_reader_fdr r r r r r r ) r r r r r r r r fnlost_fnoptsreaderr s `` ` rU r z PerfEventArray._open_perf_buffer s ' "-4-)"''$ :V#% *..r7D(BHHUYN[ 89 9 ' "iimTXXc]17 r$xo. g #"$3 rW c t j |||| }|dk r t d | j | | | j | < || j |< y )Nr zbpf_open_perf_event failed)r bpf_open_perf_eventr r r r )r r typconfigr r s rU _open_perf_eventz PerfEventArray._open_perf_event sU $ $S&#s ; 6 89 9 "iimTXXc]"$3 rW c J t D ] }| j |||| y)zopen_perf_event(typ, config) Configures the table such that calls from the bpf program to table.perf_read(CUR_CPU_IDENTIFIER) will return the hardware counter denoted by event ev on the local cpu. N)r r$ )r r" r# r rS s rU open_perf_eventz PerfEventArray.open_perf_event s% !"A ! !!S&# 6 #rW )r Nr )rM ) r r r r r r' r r r r$ r& r r s @rU r r s. ! $ ER %D%7rW r c J e Zd Z fdZ fdZd Z fdZd Zd Zd Z xZ S )r c j |j dd | _ t t | |i | | j | _ t t | _ t j | j dz | _ | j dk( r | j | j z | _ y | j t j k( r#t j | j z | _ y | j t j k( r#t j | j z | _ y t# d Nreducerr r z Leaf must be aligned to 8 bytes)popr* r r r r sLeafrc r total_cpur r alignmentr c_uint64r c_int64r r s rU r zPerCpuHash.__init__ s zz)T2 j$($9&9YY . 014::.2 >>Q T^^3DI zzRYY& KK$.. 8 rxx' JJ 7 !BCCrW c t t | | }| j dk( r|}|S | j | j z }t d| j D ] }|| ||< |S r )r r r r. r, r- rb r r resultretrS r s rU getvaluezPerCpuHash.getvalue$ sl z44S9 >>Q C /4::.1C1dnn- A . rW c | j r%t | j | j | S | j | S r r* r r5 r* s rU r zPerCpuHash.__getitem__. s2 <<$,, c(:; ;==% %rW c . t t | || y r )r r r$ r s rU r$ zPerCpuHash.__setitem__4 s j$+C6rW c t | j t j r t d | j t | j | S Nz6Leaf must be an integer type for default sum functionsrC r r r r r, sumr5 r* s rU r< zPerCpuHash.sum7 ? diik2<< 0 UV Vzz#dmmC 0122rW c t | j t j r t d | j t | j | S Nz6Leaf must be an integer type for default max functionsrC r r r r r, maxr5 r* s rU rA zPerCpuHash.max< r= rW c V | j | }|j | j z S r r< r r- r r r3 s rU averagezPerCpuHash.averageA " # ||dnn,,rW ) r r r r r5 r r$ r< rA rE r r s @rU r r s' D$& 73 3 -rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zLruPerCpuHash.__init__F mT+T<V<rW r r s @rU r r E = =rW r c P e Zd Z fdZ fdZd Z fdZd Zd Zd Z d Z xZ S ) r c j |j dd | _ t t | |i | | j | _ t t | _ t j | j dz | _ | j dk( r | j | j z | _ y | j t j k( r#t j | j z | _ y | j t j k( r#t j | j z | _ y t# d r) )r+ r* r r r r r, rc r r- r r r. r r/ r r0 r r s rU r zPerCpuArray.__init__J s zz)T2 k4)4:6:YY . 014::.2 >>Q T^^3DI zzRYY& KK$.. 8 rxx' JJ 7 !BCCrW c t t | | }| j dk( r|}|S | j | j z }t d| j D ] }|| ||< |S r )r r r r. r, r- rb r2 s rU r5 zPerCpuArray.getvalue\ sl {D5c: >>Q C /4::.1C1dnn- A . rW c | j r%t | j | j | S | j | S r r7 r* s rU r zPerCpuArray.__getitem__f s2 LL$,, c(:; ;==% %rW c . t t | || y r )r r r$ r s rU r$ zPerCpuArray.__setitem__l s k4,S$7rW c & | j | y r r r* s rU r' zPerCpuArray.__delitem__o r rW c t | j t j r t d | j t | j | S r: r; r* s rU r< zPerCpuArray.sums r= rW c t | j t j r t d | j t | j | S r? r@ r* s rU rA zPerCpuArray.maxx r= rW c V | j | }|j | j z S r rC rD s rU rE zPerCpuArray.average} rF rW ) r r r r r5 r r$ r' r< rA rE r r s @rU r r I s, D$& 8 3 3 -rW r c $ e Zd Z fdZd Z xZS )r c , t t | |i | y r )r r r r s rU r zLpmTrie.__init__ r rW c t r )NotImplementedErrorr s rU r zLpmTrie.__len__ s !!rW r r s @rU r r s 7"rW r c \ e Zd ZdZdZdZdZdZ fdZ G d de Z d d Z d Z d Z xZS ) r rn r r r c , t t | |i | y r )r r r r s rU r zStackTrace.__init__ s j$($9&9rW c & e Zd ZddZd Zd Zd Zy)StackTrace.StackWalkerNc < || _ d| _ || _ || _ y r )stacknresolver )r r^ r r` s rU r z StackTrace.StackWalker.__init__ s DJDF"DL DJrW c | S r rO r s rU rn z StackTrace.StackWalker.__iter__ ry rW c " | j S r r{ r s rU r} z StackTrace.StackWalker.__next__ r~ rW c | xj dz c_ | j t j k( r t | j t j z rg| j j | j }|j t j k( s |j t j k( r-t | j j | j }|dk( rKt j j d r | j dk7 r| j dk7 r t | j r| j | S |S )Nr r ppcr )r_ r MAX_DEPTHr r BPF_F_STACK_BUILD_IDr^ tracestatusBPF_STACK_BUILD_ID_IPBPF_STACK_BUILD_ID_EMPTYipplatformmachine startswithr` )r addrs rU r| zStackTrace.StackWalker.next s FFaKFvv---#o%zzJ ; ;;ZZ%%dff-d @ @@ C CC%'ZZ]]466*d qy("2"2"4"?"?"F466UV;[_[a[aef[f'/))- 4<<% ?4 ?rW r r rO rW rU StackWalkerr\ s @rW rp c h t j | | j | | j | S r )r rp r r )r stack_idr` s rU walkzStackTrace.walk s) %%d488H+=&> GTTrW c " d}| D ] }|dz } |S r rO r s rU r zStackTrace.__len__ r rW c y r rO r s rU r; zStackTrace.clear rW r )r r r re rf rj BPF_STACK_BUILD_ID_VALIDri r r rp rs r r; r r s @rU r r sD I ! : @f @@U rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zDevMap.__init__ fd$d5f5rW r r s @rU r r 6 6rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zCpuMap.__init__ rz rW r r s @rU r r r{ rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zXskMap.__init__ rz rW r r s @rU r r r{ rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zMapInMapArray.__init__ rI rW r r s @rU r r rJ rW r c e Zd Z fdZ xZS )r c , t t | |i | y r )r r r r s rU r zMapInMapHash.__init__ s lD*D;F;rW r r s @rU r r s < <rW r c > e Zd Z fdZd Zd Zd Zd ZddZ xZ S )r c H t t | |i | d | _ d | _ y r )r r r _ringbufr r s rU r zRingBuf.__init__ s& gt%t6v6 rW c y r rO r* s rU __delitemzRingBuf.__delitem rv rW c y r rO r s rU r zRingBuf.__del__ rv rW c yr rO r s rU r zRingBuf.__len__ s rW c | j dk( rt | | _ t j |t j | j j S )a event(data) When ring buffers are opened to receive custom event, the underlying event data struct which is defined in C in the BPF program can be deduced via this function. This avoids redundant definitions in Python. Nr r s rU r z RingBuf.event r rW c fd}t | }| j j | j || || j d< y)zopen_ring_buffer(callback) Opens a ring buffer to receive custom event data from the bpf program. The callback will be invoked for each event submitted from the kernel, up to millions per second. c | || } t | }|S # d}Y |S xY w# t $ r5}|j t j k( r t n|Y d }~S d }~ww xY wr )rd r ra r r )ctxra r r4 r r s rU ringbuf_cb_z-RingBuf.open_ring_buffer.<locals>.ringbuf_cb_ su sD$/ c(C J C J 77ekk)FG J s$ % "% % A#*A A#r N)r r _open_ring_bufferr r )r r r r r s ` rU open_ring_bufferzRingBuf.open_ring_buffer s; " k * ""4;;C8 ! rW r ) r r r r _RingBuf__delitemr r r r r r s @rU r r s" ! E rW r c B e Zd ZdZd Zd Zd Zd dZd Zd Z d Z d Z y ) r r c || _ || _ || _ || _ t j | j j | j | _ t j | j j | j | _ t t j | j j | j | _ y r ) r r r r r r r r r r rd r r )r r r r r s rU r zQueueStack.__init__ s **488??DKKH ++DHHOOT[[I s ; ;DHHOO rW c J t j t j | j dz }t j | j j | j |t | t j | }|dk r t d |j S r r r s rU r zQueueStack.leaf_sprintf r rW c | j }t j | j j | j |t j | }|dk r t d |S r r r s rU r zQueueStack.leaf_scanf! r rW c t j | j d t j | | }|dk r5t j t j }t d|z y )Nr zCould not push to table: %sr )r r r r r# s rU pushzQueueStack.push) sU !!$++tRXXd^UK 7[[ 0F 9F BC C rW c | j }t j | j d t j | }|dk r t d |S )Nr zCould not pop from table)r r bpf_lookup_and_deleter r r r r r r s rU r+ zQueueStack.pop/ sE yy{'' T288D>J 756 6 rW c | j }t j | j d t j | }|dk r t d |S )Nr zCould not peek tabler r s rU peekzQueueStack.peek6 sE yy{!!$++tRXXd^D 712 2 rW c # ~ K | j }|r | j |dz }|ry y # t $ r Y y w xY wwr )r r+ r )r cnts rU r+ zQueueStack.itervalues= sF hhj!q s =. == :=:=c H | j D cg c] }| c}S c c}w r r3 r4 s rU r5 zQueueStack.valuesG r6 r1 N)r ) r r r BPF_EXISTr r r r r+ r r+ r5 rO rW rU r r s0 I D 6rW r r )X __future__r collections.abcr ImportError collectionstimer ctypesr functoolsr r ra r r rl libbccr r r r r utilsr r r r r r r r r r r r r r r r BPF_MAP_TYPE_SOCKMAPr r BPF_MAP_TYPE_SOCKHASHBPF_MAP_TYPE_CGROUP_STORAGE BPF_MAP_TYPE_REUSEPORT_SOCKARRAY"BPF_MAP_TYPE_PERCPU_CGROUP_STORAGEr r BPF_MAP_TYPE_SK_STORAGEBPF_MAP_TYPE_DEVMAP_HASHBPF_MAP_TYPE_STRUCT_OPSr BPF_MAP_TYPE_INODE_STORAGEBPF_MAP_TYPE_TASK_STORAGEr rp r r rV r] rZ r{ r} r r r r r r r r r r r r r r r r r r r r r r r r rO rW rU <module>r sZ &+. \ \ " $ ! ! #% %' " v \ "#5 m ~ m ~ : !"3 : ~ ) ! " # $ : !1$&;&(?\ m\) ~; @ ?2$8L<:8;v- `gC gCT 7i 76$ 6$p I 6 6 ( Q) Q i7Y i7X2- 2-h=J =6-) 6-p"i "3 3 j6Y 66Y 66Y 6=I =<9 <7i 7r=6 =6s' +**+s G G*)G*