- GRAYBYTE UNDETECTABLE CODES -

403Webshell
Server IP : 184.154.167.98  /  Your IP : 18.117.10.173
Web Server : Apache
System : Linux pink.dnsnetservice.com 4.18.0-553.22.1.lve.1.el8.x86_64 #1 SMP Tue Oct 8 15:52:54 UTC 2024 x86_64
User : puertode ( 1767)
PHP Version : 8.2.26
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /lib/python3.6/site-packages/bcc/__pycache__/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /lib/python3.6/site-packages/bcc/__pycache__/table.cpython-36.pyc
3

:�)g��B@s4ddlmZyddlmZWn ek
r<ddlmZYnXddlmZddlZ	ddl
mZddlZddl
Z
ddlZddlZddlmZmZmZmZmZddlmZdd	lmZdZd
ZdZdZd
ZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/d Z0d!Z1d"Z2d#Z3d$Z4d%Z5ed&ed'ed(ed)ed*ed+ed,e d-e!d.e"d/e#d0e$d1e%d2e&d3e'd4e(d5e)d6e*d7e+d8e,d9e-d:e.d;e/d<e0d=e1d>e2d?e3d@e4dAe5dBiZ6dCa7dDZ8dEZ9dFdG�Z:d~dHdI�Z;dJdK�Z<dLdM�Z=dNdO�Z>dPdQ�Z?dRdS�Z@GdTdU�dUe�ZAGdVdW�dWeA�ZBGdXdY�dYeB�ZCGdZd[�d[eA�ZDGd\d]�d]eD�ZEGd^d_�d_eD�ZFGd`da�da�ZGGdbdc�dceD�ZHGddde�deeD�ZIGdfdg�dgeB�ZJGdhdi�dieJ�ZKGdjdk�dkeD�ZLGdldm�dmeA�ZMGdndo�doeA�ZNGdpdq�dqeD�ZOGdrds�dseD�ZPGdtdu�dueD�ZQGdvdw�dweD�ZRGdxdy�dyeB�ZSGdzd{�d{eA�ZTGd|d}�d}�ZUdS)�)�print_function)�MutableMapping)�strftimeN)�reduce�)�lib�_RAW_CB_TYPE�
_LOST_CB_TYPE�_RINGBUF_CB_TYPE�bcc_perf_buffer_opts)�get_online_cpus)�get_possible_cpus��������	�
���
����������������ZHASHZARRAYZ
PROG_ARRAYZPERF_EVENT_ARRAYZPERCPU_HASHZPERCPU_ARRAYZSTACK_TRACEZCGROUP_ARRAYZLRU_HASHZLRU_PERCPU_HASHZLPM_TRIEZ
ARRAY_OF_MAPSZHASH_OF_MAPSZDEVMAPZSOCKMAPZCPUMAPZXSKMAPZSOCKHASHZCGROUP_STORAGEZREUSEPORT_SOCKARRAYZPERCPU_CGROUP_STORAGEZQUEUEZSTACKZ
SK_STORAGEZDEVMAP_HASHZ
STRUCT_OPSZRINGBUFZ
INODE_STORAGEZTASK_STORAGE�(�AicCs\d}d}x6||||dks*||dkr,P|d7}|d7}q
W||krX|dd�d}|S)Nr�r�*�+����)�val�val_max�width�i�textr0r0�/usr/lib/python3.6/table.py�_starscs r7c
Cs�g}d}x$tt|��D]}||dkr|}qWd}d}xftt|��D]V}|dkrD||krD|d}i}||d<t|�d|d<t||�|d<|j|�|}qDWtd�||d�}	|r�|d|	|d<t|	�dS)	Nrrrzinterval-startzinterval-end�countz%Y-%m-%d %H:%M:%S)Zts�val_type�data)�range�len�int�appendr�print)
�valsr9�section_bucketZ	hist_listZmax_nonzero_idxr4�index�prevZlist_objZ	histogramr0r0r6�_print_json_histos(
rDcCsd}d}d}x,t|�D] \}}|dkr*|}||kr|}qW|dkrPd}d}	t}
nd}d}	ttd	�}
|dkrxt||�x�td|d�D]~}d|>d?}d|>d}||kr�|d8}||}
|r�|
r�t|	|||
|
t|
||
�f�d
}q�t|	|||
|
t|
||
�f�q�WdS)N�@rr� z#     %-19s : count     distributionz%10d -> %-10d : %-8d |%-*s|z-               %-29s : count     distributionz%20d -> %-20d : %-8d |%-*s|rFr/)�	enumerate�	stars_maxr=r?r;r7)r@r9�strip_leading_zero�
log2_dist_max�idx_maxr2r4�v�header�body�starsZlowZhighr1r0r0r6�_print_log2_hist�s<rPc
Cs�d}d}d}x,t|�D] \}}|dkr*|}||kr|}qWd}d}	t}
|dkrZt||�xdtd|d�D]R}||}|r�|r�t|	|||
t|||
�f�d}qjt|	|||
t|||
�f�qjWdS)NrErrz#     %-13s : count     distributionz        %-10d : %-8d |%-*s|Fr/)rGrHr?r;r7)r@r9rIrJrKr2r4rLrMrNrOr1r0r0r6�_print_linear_hist�s,

rQcCs"yt|Stk
rdSXdS)Nz	<unknown>)�
map_type_name�KeyError)�ttyper0r0r6�get_table_type_name�srUc
Cs�tjtjtjtjtjtjtjtjtjtjtjtjtjtjtjtjtj	tj
tj
tjtjtj
dtjdtjd�}t
jd�}g}tj|jj|j�}d}x�||k�rrtj|jj|j|�j�}t
jd|�}|jd�}|jd�}	t
jd|	�r�d}	|j|	�}yD|�r |j|||jd�t|jd��f�n|j|||	f�Wn2tk
�rftd	|	tjd
�tjd�YnX|d7}q�Wtdtj fd|i�S)
Nr)�charZs8z
unsigned char�u8zu8 *zchar *ZshortZs16zunsigned short�u16r=Zs32�enumzunsigned int�u32Zlongz
unsigned longz	long longZs64zunsigned long longZu64Z__int128zunsigned __int128zvoid *z([^ ]+) ?\[([0-9]+)\]$rz	(.*)#(.*)rzenum .*rYzGType: '%s' not recognized. Please define the data with ctypes manually.)�filer,�_fields_)!�ctZc_charZc_ubyteZc_char_pZc_shortZc_ushort�c_int�c_uintZc_longZc_ulongZ
c_longlongZc_ulonglongZc_void_p�re�compilerZbpf_perf_event_fields�bpf�module�_nameZbpf_perf_event_field�decode�match�groupr>r=rSr?�sys�stderr�exit�type�	Structure)
Z	event_mapZ
ct_mappingZ
array_typeZfields�
num_fieldsr4Zfield�mZ
field_nameZ
field_typer0r0r6�_get_event_class�s\




(roc	Ks8tj|j|�}d}|tkr.t|||||�}�n�|tkrJt|||||�}�n�|tkrft|||||�}�n�|t	kr�t
||||||�}�n�|tkr�t|||||f|�}�nz|t
kr�t|||||f|�}�nZ|tkr�t|||||�}�n>|tkr�t|||||�}�n"|tk�rt|||||�}�n|tk�r6t|||||�}n�|tk�rRt|||||�}n�|tk�rnt|||||�}n�|tk�r�t|||||�}n�|tk�r�t|||||�}nx|tk�r�t |||||�}n\|t!k�r�t"|||||�}n@|t#k�s�|t$k�rt%||||�}n|t&k�rt'||||||�}|dk�r4t(d|��|S)z|Table(bpf, map_id, map_fd, keytype, leaftype, **kwargs)

    Create a python object out of a reference to a bpf table handleNzUnknown table type %d))r�bpf_table_type_idrc�BPF_MAP_TYPE_HASH�	HashTable�BPF_MAP_TYPE_ARRAY�Array�BPF_MAP_TYPE_PROG_ARRAY�	ProgArray�BPF_MAP_TYPE_PERF_EVENT_ARRAY�PerfEventArray�BPF_MAP_TYPE_PERCPU_HASH�
PerCpuHash�BPF_MAP_TYPE_PERCPU_ARRAY�PerCpuArray�BPF_MAP_TYPE_LPM_TRIE�LpmTrie�BPF_MAP_TYPE_STACK_TRACE�
StackTrace�BPF_MAP_TYPE_LRU_HASH�LruHash�BPF_MAP_TYPE_LRU_PERCPU_HASH�
LruPerCpuHash�BPF_MAP_TYPE_CGROUP_ARRAY�CgroupArray�BPF_MAP_TYPE_DEVMAP�DevMap�BPF_MAP_TYPE_CPUMAP�CpuMap�BPF_MAP_TYPE_XSKMAP�XskMap�BPF_MAP_TYPE_ARRAY_OF_MAPS�
MapInMapArray�BPF_MAP_TYPE_HASH_OF_MAPS�MapInMapHash�BPF_MAP_TYPE_QUEUE�BPF_MAP_TYPE_STACK�
QueueStack�BPF_MAP_TYPE_RINGBUF�RingBuf�	Exception)	rb�map_id�map_fd�keytype�leaftype�name�kwargsrT�tr0r0r6�Table
sR









r�c@seZdZdDdd�Zdd�Zdd�Zdd	�Zd
d�Zdd
�Zdd�Z	dd�Z
dd�Zdd�Zdd�Z
dd�Zdd�Zdd�ZdEdd �ZdFd!d"�Zd#d$�ZdGd%d&�Zd'd(�Zd)d*�ZdHd,d-�Zd.d/�Zd0d1�Zd2d3�Zd4d5�ZGd6d7�d7e�Zd8d9�Zd:d;�ZdId>d?�Z dJd@dA�Z!dKdBdC�Z"dS)L�	TableBaseNcCsn||_||_||_||_||_tj|jj|j�|_tj	|jj|j�|_
i|_||_t
tj|jj|j��|_dS)N)rbr�r��Key�LeafrrprcrT�bpf_table_flags_id�flags�_cbsrdr=�bpf_table_max_entries_id�max_entries)�selfrbr�r�r�r�r�r0r0r6�__init__?szTableBase.__init__cCs|jS)N)r�)r�r0r0r6�get_fdLszTableBase.get_fdcCsNtjtj|j�d�}tj|jj|j|t	|�tj
|��}|dkrHtd��|jS)NrrzCould not printf key)
r]�create_string_buffer�sizeofr�rZbpf_table_key_snprintfrbrcr�r<�byrefr��value)r��key�buf�resr0r0r6�key_sprintfOszTableBase.key_sprintfcCsNtjtj|j�d�}tj|jj|j|t	|�tj
|��}|dkrHtd��|jS)NrrzCould not printf leaf)
r]r�r�r�r�bpf_table_leaf_snprintfrbrcr�r<r�r�r�)r��leafr�r�r0r0r6�leaf_sprintfWszTableBase.leaf_sprintfcCs8|j�}tj|jj|j|tj|��}|dkr4td��|S)NrzCould not scanf key)	r�rZbpf_table_key_sscanfrbrcr�r]r�r�)r�Zkey_strr�r�r0r0r6�	key_scanf_szTableBase.key_scanfcCs8|j�}tj|jj|j|tj|��}|dkr4td��|S)NrzCould not scanf leaf)	r�r�bpf_table_leaf_sscanfrbrcr�r]r�r�)r��leaf_strr�r�r0r0r6�
leaf_scanfgszTableBase.leaf_scanfcCs4|j�}tj|jtj|�tj|��}|dkr0t�|S)Nr)r�r�bpf_lookup_elemr�r]r�rS)r�r�r�r�r0r0r6�__getitem__os
zTableBase.__getitem__cCsDtj|jtj|�tj|�d�}|dkr@tjtj��}td|��dS)NrzCould not update table: %s)	r�bpf_update_elemr�r]r��os�strerror�	get_errnor�)r�r�r�r��errstrr0r0r6�__setitem__vszTableBase.__setitem__cCs$tj|jtj|��}|dkr t�dS)Nr)rZbpf_delete_elemr�r]r�rS)r�r�r�r0r0r6�__delitem__|szTableBase.__delitem__ccs6x0|D](}y||VWqtk
r,YqXqWdS)N)rS)r�r�r0r0r6�
itervalues�s

zTableBase.itervaluesccs:x4|D],}y|||fVWqtk
r0YqXqWdS)N)rS)r�r�r0r0r6�	iteritems�s

zTableBase.iteritemscCsdd�|j�D�S)NcSsg|]}|�qSr0r0)�.0�itemr0r0r6�
<listcomp>�sz#TableBase.items.<locals>.<listcomp>)r�)r�r0r0r6�items�szTableBase.itemscCsdd�|j�D�S)NcSsg|]}|�qSr0r0)r�r�r0r0r6r��sz$TableBase.values.<locals>.<listcomp>)r�)r�r0r0r6�values�szTableBase.valuescCs x|j�D]}|j|�q
WdS)N)�keysr�)r��kr0r0r6�clear�szTableBase.clearFcCszd}}|r$|r$tjd�ddfS|s0|j}n|dksB||jkrJtd��|rZ|j|�}|rj|j|�}tj|�||fS)a�Allocate keys and/or values arrays. Useful for in items_*_batch.

        Args:
            alloc_k (bool): True to allocate keys array, False otherwise.
            Default is False.
            alloc_v (bool): True to allocate values array, False otherwise.
            Default is False.
            count (int): number of elements in the array(s) to allocate. If
            count is None then it allocates the maximum number of elements i.e
            self.max_entries.

        Returns:
            tuple: (count, keys, values). Where count is ct.c_uint32,
            and keys and values an instance of ct.Array
        Raises:
            ValueError: If count is less than 1 or greater than
            self.max_entries.
        NrrzWrong count)r]�c_uint32r��
ValueErrorr�r�)r��alloc_k�alloc_vr8r�r�r0r0r6�_alloc_keys_values�szTableBase._alloc_keys_valuescCsvd}xF||gD]:}|rt|tj�s&t�t|�}|dks@||jkrtd��qW|rl|rlt|�t|�krltd��tj|�S)a�Check if the given keys or values have the right type and size.

        Args:
            keys (ct.Array): keys array to check
            values (ct.Array): values array to check
        Returns:
            ct.c_uint32 : the size of the array(s)
        Raises:
            ValueError: If length of arrays is less than 1 or greater than
            self.max_entries, or when both arrays length are different.
            TypeError: If the keys and values are not an instance of ct.Array
        rrzArray's length is wrongz(keys array length != values array length)�
isinstancer]rt�	TypeErrorr<r�r�r�)r�r�r�Zarr_len�elemr0r0r6�_sanity_check_keys_values�s
z#TableBase._sanity_check_keys_valuesccs(x"|jdd�D]\}}||fVqWdS)aLook up all the key-value pairs in the map.

        Args:
            None
        Yields:
            tuple: The tuple of (key,value) for every entries that have
            been looked up.
        Notes: lookup batch on a keys subset is not supported by the kernel.
        F)�deleteN)�)_items_lookup_and_optionally_delete_batch)r�r�rLr0r0r6�items_lookup_batch�s
zTableBase.items_lookup_batchcCsh|dk	rP|j|d�}tj|jtj|�tj|��}|dkrdtdtjtj	����nx|j
�D]}dSWdS)a�Delete the key-value pairs related to the keys given as parameters.
        Note that if no key are given, it is faster to call
        lib.bpf_lookup_and_delete_batch than create keys array and then call
        lib.bpf_delete_batch on these keys.

        Args:
            ct_keys (ct.Array): keys array to delete. If an array of keys is
            given then it deletes all the related keys-values.
            If keys is None (default) then it deletes all entries.
        Yields:
            tuple: The tuple of (key,value) for every entries that have
            been deleted.
        Raises:
            Exception: If bpf syscall return value indicates an error.
        N)r�rz#BPF_MAP_DELETE_BATCH has failed: %s)r�rZbpf_delete_batchr�r]r�r�r�r�r��items_lookup_and_delete_batch)r��ct_keys�ct_cntr��_r0r0r6�items_delete_batch�szTableBase.items_delete_batchcCsT|j||d�}tj|jtj|�tj|�tj|��}|dkrPtdtjtj	����dS)aqUpdate all the key-value pairs in the map provided.
        The arrays must be the same length, between 1 and the maximum number
        of entries.

        Args:
            ct_keys (ct.Array): keys array to update
            ct_values (ct.Array): values array to update
        Raises:
            Exception: If bpf syscall return value indicates an error.
        )r�r�rz#BPF_MAP_UPDATE_BATCH has failed: %sN)
r�rZbpf_update_batchr�r]r�r�r�r�r�)r�r��	ct_valuesr�r�r0r0r6�items_update_batchszTableBase.items_update_batchccs(x"|jdd�D]\}}||fVqWdS)a?Look up and delete all the key-value pairs in the map.

        Args:
            None
        Yields:
            tuple: The tuple of (key,value) for every entries that have
            been looked up and deleted.
        Notes: lookup and delete batch on a keys subset is not supported by
        the kernel.
        T)r�N)r�)r�r�rLr0r0r6r� sz'TableBase.items_lookup_and_delete_batchTc
	cs4|dkrtj}d}n
tj}d}|jddd�\}}}tjd�}}d}	x�|j|	|_||j|	rftj|�ndtj|�tj|tj	|j
�|	�tj|tj	|j�|	�tj|��}
tj�}|	|j7}	|
dkr�|t
jkr�td|tj|�f��|
dkr�P|	|jkr�P|jdkrFPqFWx&td|	�D]}||||fV�qWdS)a�Look up and optionally delete all the key-value pairs in the map.

        Args:
            delete (bool) : look up and delete the key-value pairs when True,
            else just look up.
        Yields:
            tuple: The tuple of (key,value) for every entries that have
            been looked up and deleted.
        Raises:
            Exception: If bpf syscall return value indicates an error.
        Notes: lookup and delete batch on a keys subset is not supported by
        the kernel.
        TZBPF_MAP_LOOKUP_AND_DELETE_BATCHZBPF_MAP_LOOKUP_BATCH)r�r�rNz%s has failed: %s)rZbpf_lookup_and_delete_batchZbpf_lookup_batchr�r]r�r�r�r�r�r�r�r��errno�ENOENTr�r�r�r;)
r�r�Z	bpf_batchZbpf_cmdZct_buf_sizer�r�Zct_out_batchr�Ztotalr�Zerrcoder4r0r0r6r�/s<


z3TableBase._items_lookup_and_optionally_delete_batchcCs&x t|j��D]}|j�||<qWdS)N)�listr�r�)r�r�r0r0r6�zerofszTableBase.zerocCs
tj|�S)N)r��Iter)r�r0r0r6�__iter__nszTableBase.__iter__cCs|j�S)N)r�)r�r0r0r6�iterqszTableBase.itercCs|j�S)N)r�)r�r0r0r6r�rszTableBase.keysc@s,eZdZdd�Zdd�Zdd�Zdd�Zd	S)
zTableBase.ItercCs||_d|_dS)N)�tabler�)r�r�r0r0r6r�uszTableBase.Iter.__init__cCs|S)Nr0)r�r0r0r6r�xszTableBase.Iter.__iter__cCs|j�S)N)�next)r�r0r0r6�__next__zszTableBase.Iter.__next__cCs|jj|j�|_|jS)N)r�r�r�)r�r0r0r6r�|szTableBase.Iter.nextN)�__name__�
__module__�__qualname__r�r�r�r�r0r0r0r6r�tsr�cCs^|j�}|dkr0tj|jtj|�tj|j��}ntj|jtj|�tj|��}|dkrZt��|S)Nr)	r�rZbpf_get_first_keyr�r]r�r�Zbpf_get_next_key�
StopIteration)r�r�Znext_keyr�r0r0r6r��szTableBase.nextc
Cs�|jjdd}|jjdd}|dkrHt|jj�dkrH|jjdd}xX|j�D]L\}}t||�}	|rp||	�}	|j|	dgt�}
||	<t||�}|j|
|<qRWt|j	��}|r�||�}x|D]}	|j
|	�q�WdS)NrrZ__pad_1rr)r�r\r<r��getattr�get�log2_index_maxr�r�r�r>)
r��tmp�buckets�	bucket_fn�bucket_sort_fn�f1�f2r�rL�bucketr@ZslotZbuckets_lstr0r0r6�decode_c_struct�s 


zTableBase.decode_c_structr��
Bucket ptrc
Cs�t|j�tj�rfi}g}|j||||�xr|D]2}||}	|rL|||�f}
n||f}
t|	||
�q.Wn6dgt}	x |j�D]\}}|j|	|j<qzWt|	|�dS)a.print_json_hist(val_type="value", section_header="Bucket ptr",
                                   section_print_fn=None, bucket_fn=None,
                                   bucket_sort_fn=None):

                Prints a table as a json histogram. The table must be stored as
                log2. The val_type argument is optional, and is a column header.
                If the histogram has a secondary key, the dictionary will be split by secondary key
                If section_print_fn is not None, it will be passed the bucket value
                to format into a string as it sees fit. If bucket_fn is not None,
                it will be used to produce a bucket value for the histogram keys.
                If bucket_sort_fn is not None, it will be used to sort the buckets
                before iterating them, and it is useful when there are multiple fields
                in the secondary key.
                The maximum index allowed is log2_index_max (65), which will
                accommodate any 64-bit integer in the histogram.
                rN)	r�r�r]rlr�rDr�r�r�)
r�r9�section_header�section_print_fnr�r�r�r�r�r@rAr�rLr0r0r6�print_json_hist�s

zTableBase.print_json_histc
Cs�t|j�tj�rvi}g}|j||||�x�|D]B}	||	}
|rTtd|||	�f�ntd||	f�t|
||�q.Wn8dgt}
x |j�D]\}}|j	|
|j	<q�Wt|
||�dS)a�print_log2_hist(val_type="value", section_header="Bucket ptr",
                           section_print_fn=None, bucket_fn=None,
                           strip_leading_zero=None, bucket_sort_fn=None):

        Prints a table as a log2 histogram. The table must be stored as
        log2. The val_type argument is optional, and is a column header.
        If the histogram has a secondary key, multiple tables will print
        and section_header can be used as a header description for each.
        If section_print_fn is not None, it will be passed the bucket value
        to format into a string as it sees fit. If bucket_fn is not None,
        it will be used to produce a bucket value for the histogram keys.
        If the value of strip_leading_zero is not False, prints a histogram
        that is omitted leading zeros from the beginning.
        If bucket_sort_fn is not None, it will be used to sort the buckets
        before iterating them, and it is useful when there are multiple fields
        in the secondary key.
        The maximum index allowed is log2_index_max (65), which will
        accommodate any 64-bit integer in the histogram.
        z
%s = %sz
%s = %rrN)
r�r�r]rlr�r?rPr�r�r�)
r�r9r�r�r�rIr�r�r�r�r@r�rLr0r0r6�print_log2_hist�s

zTableBase.print_log2_histc
Cs�t|j�tj�rvi}g}|j||||�x�|D]B}	||	}
|rTtd|||	�f�ntd||	f�t|
||�q.Wnddgt}
xL|j�D]@\}}y|j	|
|j	<Wq�t
k
r�t
d|j	tf��Yq�Xq�Wt|
||�dS)a�print_linear_hist(val_type="value", section_header="Bucket ptr",
                           section_print_fn=None, bucket_fn=None,
                           strip_leading_zero=None, bucket_sort_fn=None)

        Prints a table as a linear histogram. This is intended to span integer
        ranges, eg, from 0 to 100. The val_type argument is optional, and is a
        column header.  If the histogram has a secondary key, multiple tables
        will print and section_header can be used as a header description for
        each.  If section_print_fn is not None, it will be passed the bucket
        value to format into a string as it sees fit. If bucket_fn is not None,
        it will be used to produce a bucket value for the histogram keys.
        If the value of strip_leading_zero is not False, prints a histogram
        that is omitted leading zeros from the beginning.
        If bucket_sort_fn is not None, it will be used to sort the buckets
        before iterating them, and it is useful when there are multiple fields
        in the secondary key.
        The maximum index allowed is linear_index_max (1025), which is hoped
        to be sufficient for integer ranges spanned.
        z
%s = %sz
%s = %rrz#Index in print_linear_hist() of %d zexceeds max of %d.Nz5Index in print_linear_hist() of %d exceeds max of %d.)r�r�r]rlr�r?rQ�linear_index_maxr�r��
IndexError)
r�r9r�r�r�rIr�r�r�r�r@r�rLr0r0r6�print_linear_hist�s&

zTableBase.print_linear_hist)N)FFN)NN)N)T)r�r�NNN)r�r�NNNN)r�r�NNNN)#r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r��objectr�r�r�r�r�r�r0r0r0r6r�=sH

	
#


7
#
&r�cs$eZdZ�fdd�Zdd�Z�ZS)rrcstt|�j||�dS)N)�superrrr�)r��argsr�)�	__class__r0r6r�"szHashTable.__init__cCsd}x|D]}|d7}q
W|S)Nrrr0)r�r4r�r0r0r6�__len__%s
zHashTable.__len__)r�r�r�r�r�
__classcell__r0r0)rr6rr!srrcseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r�+szLruHash.__init__)r�r�r�r�rr0r0)rr6r�*sr�cspeZdZ�fdd�Zdd�Zdd�Z�fdd�Z�fd	d
�Z�fdd�Zd
d�Z	dd�Z
Gdd�de�Z�Z
S)�	ArrayBasecstt|�j||�dS)N)rrr�)r�rr�)rr0r6r�/szArrayBase.__init__cCsVt|t�r(|dkrt|�|}|j|�}t|tj�s<td��|jt|�krRtd��|S)Nrz#Array index must be an integer typezArray index out of range)r�r=r<r�r]Z_SimpleCDatar�r�)r�r�r0r0r6�_normalize_key2s

zArrayBase._normalize_keycCs|jS)N)r�)r�r0r0r6r=szArrayBase.__len__cs|j|�}tt|�j|�S)N)rrrr�)r�r�)rr0r6r�@s
zArrayBase.__getitem__cs |j|�}tt|�j||�dS)N)rrrr�)r�r�r�)rr0r6r�Ds
zArrayBase.__setitem__cs|j|�}tt|�j|�dS)N)rrrr�)r�r�)rr0r6r�Hs
zArrayBase.__delitem__cCsD|j|�}|j�}tj|jtj|�tj|�d�}|dkr@td��dS)NrzCould not clear item)rr�rr�r�r]r�r�)r�r�r�r�r0r0r6�	clearitemLs

zArrayBase.clearitemcCstj||j�S)N)rr�r�)r�r0r0r6r�SszArrayBase.__iter__c@s,eZdZdd�Zdd�Zdd�Zdd�Zd	S)
zArrayBase.ItercCs||_||_d|_dS)Nrr/)r�r�r4)r�r�r�r0r0r6r�WszArrayBase.Iter.__init__cCs|S)Nr0)r�r0r0r6r�\szArrayBase.Iter.__iter__cCs|j�S)N)r�)r�r0r0r6r�^szArrayBase.Iter.__next__cCs0|jd7_|jt|j�kr$t��|j|j�S)Nr)r4r<r�r�r�)r�r0r0r6r�`szArrayBase.Iter.nextN)r�r�r�r�r�r�r�r0r0r0r6r�Vsr�)r�r�r�r�rrr�r�r�rr�rr�rr0r0)rr6r.srcs$eZdZ�fdd�Zdd�Z�ZS)rtcstt|�j||�dS)N)rrtr�)r�rr�)rr0r6r�gszArray.__init__cCs|j|�dS)N)r)r�r�r0r0r6r�jszArray.__delitem__)r�r�r�r�r�rr0r0)rr6rtfsrtcs(eZdZ�fdd�Z�fdd�Z�ZS)rvcstt|�j||�dS)N)rrvr�)r�rr�)rr0r6r�oszProgArray.__init__csDt|t�r|j|�}t||jj�r.|j|j�}tt|�j||�dS)N)	r�r=r�rbZFunction�fdrrvr�)r�r�r�)rr0r6r�rs


zProgArray.__setitem__)r�r�r�r�r�rr0r0)rr6rvnsrvc@s4eZdZdd�Zdd�Zdd�Zdd�Zd	d
�ZdS)�FileDesccCs"|dks|dkrtd��||_dS)NrzInvalid file descriptor)r�r	)r�r	r0r0r6r�zszFileDesc.__init__cCs*|jdk	r&|jdkr&tj|j�d|_dS)Nr)r	r��close)r�r0r0r6�clean_upszFileDesc.clean_upcCs|j�dS)N)r)r�r0r0r6�__del__�szFileDesc.__del__cOs|S)Nr0)r�rr�r0r0r6�	__enter__�szFileDesc.__enter__cOs|j�dS)N)r)r�rr�r0r0r6�__exit__�szFileDesc.__exit__N)r�r�r�r�rr
rrr0r0r0r6r
ys
r
cs(eZdZ�fdd�Z�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szCgroupArray.__init__cstt|t�r$tt|�j||j|��nLt|t�rhttj	|tj
��� }tt|�j||j|j��WdQRXntd��dS)Nz1Cgroup array key must be either FD or cgroup path)
r�r=rr�r�r��strr
r��open�O_RDONLYr	r�)r�r�r��f)rr0r6r��s

&zCgroupArray.__setitem__)r�r�r�r�r�rr0r0)rr6r��sr�csZeZdZ�fdd�Zdd�Z�fdd�Zdd�Zddd
�Zdd�Zdd�Z	dd�Z
�ZS)rxcs"tt|�j||�i|_d|_dS)N)rrxr��
_open_key_fds�_event_class)r�rr�)rr0r6r��szPerfEventArray.__init__cCs&t|jj��}x|D]
}||=qWdS)N)r�rr�)r�r�r�r0r0r6r
�s
zPerfEventArray.__del__csx||jkrdStt|�j|�t|�|f}||jjkr\tj|jj|�|jj|=|j	|=ntj
|j|�|j|=dS)N)rrrxr��idrb�perf_buffersrZperf_reader_freer�Zbpf_close_perf_event_fd)r�r�Zkey_id)rr0r6r��s


zPerfEventArray.__delitem__cCs*|jdkrt|�|_tj|tj|j��jS)a	event(data)

        When perf buffers are opened to receive custom perf event,
        the underlying event data struct which is defined in C in
        the BPF program can be deduced via this function. This avoids
        redundant definitions in Python.
        N)rror]�cast�POINTER�contents)r�r:r0r0r6�event�s

zPerfEventArray.eventrNrcCs>||d@dkrtd��x t�D]}|j|||||�q WdS)azopen_perf_buffers(callback)

        Opens a set of per-cpu ring buffer to receive custom perf event
        data from the bpf program. The callback will be invoked for each
        event submitted from the kernel, up to millions per second. Use
        page_cnt to change the size of the per-cpu ring buffer. The value
        must be a power of two and defaults to 8.
        rrz+Perf buffer page_cnt must be a power of twoN)r�r�_open_perf_buffer)r��callback�page_cnt�lost_cb�
wakeup_eventsr4r0r0r6�open_perf_buffer�s
zPerfEventArray.open_perf_bufferc
s���fdd�}�fdd�}t|�}�r.t|�n
tjdt�}	t�}
d|
_�|
_||
_tj	||	d|tj
|
��}|svtd��tj|�}|j
|�||j��<||jjt|��f<||	f|j�<d|j�<dS)	NcsPy��||�Wn:tk
rJ}z|jtjkr6t�n|�WYdd}~XnXdS)N)�IOErrorr��EPIPErj)r�r:�size�e)r�cpur0r6�raw_cb_�sz1PerfEventArray._open_perf_buffer.<locals>.raw_cb_csLy�|�Wn:tk
rF}z|jtjkr2t�n|�WYdd}~XnXdS)N)r"r�r#rj)r�Zlostr%)rr0r6�lost_cb_�sz2PerfEventArray._open_perf_buffer.<locals>.lost_cb_rzCould not open perf bufferr/r/)rr	r]rr�pidr&r rZbpf_open_perf_buffer_optsr�r�Zperf_reader_fdr�r�rbrrr�r)
r�r&rrrr r'r(�fnZlost_fnZopts�readerr	r0)rr&rr6r�s 
z PerfEventArray._open_perf_buffercCsBtj||d|�}|dkr td��|j|�||j|�<||j|<dS)Nrrzbpf_open_perf_event failedr/)rZbpf_open_perf_eventr�r�r�r)r�r&�typ�configr	r0r0r6�_open_perf_event�s
zPerfEventArray._open_perf_eventcCs"xt�D]}|j|||�qWdS)z�open_perf_event(typ, config)

        Configures the table such that calls from the bpf program to
        table.perf_read(CUR_CPU_IDENTIFIER) will return the hardware
        counter denoted by event ev on the local cpu.
        N)rr.)r�r,r-r4r0r0r6�open_perf_event�szPerfEventArray.open_perf_event)rNr)r�r�r�r�r
r�rr!rr.r/rr0r0)rr6rx�s
"rxcsTeZdZ�fdd�Z�fdd�Zdd�Z�fdd�Zd	d
�Zdd�Zd
d�Z	�Z
S)rzcs�|jdd�|_tt|�j||�|j|_tt��|_	t
j|j�d|_|jdkr`|j|j	|_n@|jt
j
kr|t
j|j	|_n$|jt
jkr�t
j|j	|_ntd��dS)N�reducerrrzLeaf must be aligned to 8 bytes)�popr0rrzr�r��sLeafr<r
�	total_cpur]r��	alignmentr_�c_uint64r^�c_int64r�)r�rr�)rr0r6r�s
zPerCpuHash.__init__csTtt|�j|�}|jdkr |}n0|j|j�}x td|j�D]}||||<q<W|S)Nr)rrzr�r4r2r3r;)r�r��result�retr4)rr0r6�getvalues
zPerCpuHash.getvaluecCs&|jrt|j|j|��S|j|�SdS)N)r0rr9)r�r�r0r0r6r�$szPerCpuHash.__getitem__cstt|�j||�dS)N)rrzr�)r�r�r�)rr0r6r�*szPerCpuHash.__setitem__cCs,t|j�tj�rtd��|jt|j|���S)Nz6Leaf must be an integer type for default sum functions)r�r�r]rlr�r2�sumr9)r�r�r0r0r6r:-szPerCpuHash.sumcCs,t|j�tj�rtd��|jt|j|���S)Nz6Leaf must be an integer type for default max functions)r�r�r]rlr�r2�maxr9)r�r�r0r0r6r;2szPerCpuHash.maxcCs|j|�}|j|jS)N)r:r�r3)r�r�r7r0r0r6�average7s
zPerCpuHash.average)r�r�r�r�r9r�r�r:r;r<rr0r0)rr6rzs
rzcseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r�<szLruPerCpuHash.__init__)r�r�r�r�rr0r0)rr6r�;sr�cs\eZdZ�fdd�Z�fdd�Zdd�Z�fdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
�ZS)r|cs�|jdd�|_tt|�j||�|j|_tt��|_	t
j|j�d|_|jdkr`|j|j	|_n@|jt
j
kr|t
j|j	|_n$|jt
jkr�t
j|j	|_ntd��dS)Nr0rrzLeaf must be aligned to 8 bytes)r1r0rr|r�r�r2r<r
r3r]r�r4r_r5r^r6r�)r�rr�)rr0r6r�@s
zPerCpuArray.__init__csTtt|�j|�}|jdkr |}n0|j|j�}x td|j�D]}||||<q<W|S)Nr)rr|r�r4r2r3r;)r�r�r7r8r4)rr0r6r9Rs
zPerCpuArray.getvaluecCs&|jrt|j|j|��S|j|�SdS)N)r0rr9)r�r�r0r0r6r�\szPerCpuArray.__getitem__cstt|�j||�dS)N)rr|r�)r�r�r�)rr0r6r�bszPerCpuArray.__setitem__cCs|j|�dS)N)r)r�r�r0r0r6r�eszPerCpuArray.__delitem__cCs,t|j�tj�rtd��|jt|j|���S)Nz6Leaf must be an integer type for default sum functions)r�r�r]rlr�r2r:r9)r�r�r0r0r6r:iszPerCpuArray.sumcCs,t|j�tj�rtd��|jt|j|���S)Nz6Leaf must be an integer type for default max functions)r�r�r]rlr�r2r;r9)r�r�r0r0r6r;nszPerCpuArray.maxcCs|j|�}|j|jS)N)r:r�r3)r�r�r7r0r0r6r<ss
zPerCpuArray.average)r�r�r�r�r9r�r�r�r:r;r<rr0r0)rr6r|?s
r|cs$eZdZ�fdd�Zdd�Z�ZS)r~cstt|�j||�dS)N)rr~r�)r�rr�)rr0r6r�xszLpmTrie.__init__cCst�dS)N)�NotImplementedError)r�r0r0r6r{szLpmTrie.__len__)r�r�r�r�rrr0r0)rr6r~wsr~csZeZdZdZdZdZdZdZ�fdd�ZGdd	�d	e	�Z
ddd�Zd
d�Zdd�Z
�ZS)r��rrrrcstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szStackTrace.__init__c@s.eZdZd
dd�Zdd�Zdd�Zdd	�ZdS)zStackTrace.StackWalkerNcCs||_d|_||_||_dS)Nrr/)�stack�n�resolver�)r�r?r�rAr0r0r6r��szStackTrace.StackWalker.__init__cCs|S)Nr0)r�r0r0r6r��szStackTrace.StackWalker.__iter__cCs|j�S)N)r�)r�r0r0r6r��szStackTrace.StackWalker.__next__cCs�|jd7_|jtjkr t��|jtj@rZ|jj|j}|jtj	ksR|jtj
krht��n|jj|j}|dkrvt��|jr�|j|�S|S)Nrr)
r@r��	MAX_DEPTHr�r��BPF_F_STACK_BUILD_IDr?ZtraceZstatus�BPF_STACK_BUILD_ID_IP�BPF_STACK_BUILD_ID_EMPTYZiprA)r�Zaddrr0r0r6r��szStackTrace.StackWalker.next)N)r�r�r�r�r�r�r�r0r0r0r6�StackWalker�s
rFNcCstj||j|�|j|�S)N)r�rFr�r�)r�Zstack_idrAr0r0r6�walk�szStackTrace.walkcCsd}x|D]}|d7}q
W|S)Nrrr0)r�r4r�r0r0r6r�s
zStackTrace.__len__cCsdS)Nr0)r�r0r0r6r��szStackTrace.clearrF)N)r�r�r�rBrCrEZBPF_STACK_BUILD_ID_VALIDrDr�rrFrGrr�rr0r0)rr6r�s
r�cseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szDevMap.__init__)r�r�r�r�rr0r0)rr6r��sr�cseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szCpuMap.__init__)r�r�r�r�rr0r0)rr6r��sr�cseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szXskMap.__init__)r�r�r�r�rr0r0)rr6r��sr�cseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szMapInMapArray.__init__)r�r�r�r�rr0r0)rr6r��sr�cseZdZ�fdd�Z�ZS)r�cstt|�j||�dS)N)rr�r�)r�rr�)rr0r6r��szMapInMapHash.__init__)r�r�r�r�rr0r0)rr6r��sr�csFeZdZ�fdd�Zdd�Zdd�Zdd�Zd	d
�Zddd
�Z�Z	S)r�cs"tt|�j||�d|_d|_dS)N)rr�r�Z_ringbufr)r�rr�)rr0r6r��szRingBuf.__init__cCsdS)Nr0)r�r�r0r0r6Z	__delitem�szRingBuf.__delitemcCsdS)Nr0)r�r0r0r6r
�szRingBuf.__del__cCsdS)Nrr0)r�r0r0r6r�szRingBuf.__len__cCs*|jdkrt|�|_tj|tj|j��jS)aevent(data)

        When ring buffers are opened to receive custom event,
        the underlying event data struct which is defined in C in
        the BPF program can be deduced via this function. This avoids
        redundant definitions in Python.
        N)rror]rrr)r�r:r0r0r6r�s

z
RingBuf.eventNcs4�fdd�}t|�}|jj|j||�||jd<dS)z�open_ring_buffer(callback)

        Opens a ring buffer to receive custom event data from the bpf program.
        The callback will be invoked for each event submitted from the kernel,
        up to millions per second.
        csny.�|||�}yt|�}Wnd}YnXWn:tk
rh}z|jtjkrTt�n|�WYdd}~XnX|S)Nr)r=r"r�r#rj)�ctxr:r$r8r%)rr0r6�ringbuf_cb_�sz-RingBuf.open_ring_buffer.<locals>.ringbuf_cb_rN)r
rbZ_open_ring_bufferr�r�)r�rrHrIr*r0)rr6�open_ring_buffer�szRingBuf.open_ring_buffer)N)
r�r�r�r�Z_RingBuf__delitemr
rrrJrr0r0)rr6r��sr�c@sReZdZdZdd�Zdd�Zdd�Zdd	d
�Zdd�Zd
d�Z	dd�Z
dd�ZdS)r�rcCs\||_||_||_||_tj|jj|j�|_tj|jj|j�|_	t
tj|jj|j��|_dS)N)
rbr�r�r�rrprcrTr�r�r=r�r�)r�rbr�r�r�r0r0r6r�szQueueStack.__init__cCsNtjtj|j�d�}tj|jj|j|t	|�tj
|��}|dkrHtd��|jS)NrrzCould not printf leaf)
r]r�r�r�rr�rbrcr�r<r�r�r�)r�r�r�r�r0r0r6r�szQueueStack.leaf_sprintfcCs8|j�}tj|jj|j|tj|��}|dkr4td��|S)NrzCould not scanf leaf)	r�rr�rbrcr�r]r�r�)r�r�r�r�r0r0r6r�szQueueStack.leaf_scanfrcCs>tj|jdtj|�|�}|dkr:tjtj��}td|��dS)NrzCould not push to table: %s)	rr�r�r]r�r�r�r�r�)r�r�r�r�r�r0r0r6�pushszQueueStack.pushcCs2|j�}tj|jdtj|��}|dkr.td��|S)NrzCould not pop from table)r�rZbpf_lookup_and_deleter�r]r�rS)r�r�r�r0r0r6r1$s
zQueueStack.popcCs2|j�}tj|jdtj|��}|dkr.td��|S)NrzCould not peek table)r�rr�r�r]r�rS)r�r�r�r0r0r6�peek+s
zQueueStack.peekccs@|j}x4|r:y|j�V|d8}Wqtk
r6dSXqWdS)Nr)r�r1rS)r�Zcntr0r0r6r�2s
zQueueStack.itervaluescCsdd�|j�D�S)NcSsg|]}|�qSr0r0)r�r�r0r0r6r�=sz%QueueStack.values.<locals>.<listcomp>)r�)r�r0r0r6r�<szQueueStack.valuesN)r)r�r�r�Z	BPF_EXISTr�r�r�rKr1rLr�r�r0r0r0r6r�s


r�)N)VZ
__future__r�collections.abcr�ImportError�collectionsZtimerZctypesr]�	functoolsrr�r�r`rhZlibbccrrr	r
rZutilsrr
rqrsrurwryr{rr�r�r�r}r�r�r�ZBPF_MAP_TYPE_SOCKMAPr�r�ZBPF_MAP_TYPE_SOCKHASHZBPF_MAP_TYPE_CGROUP_STORAGEZ BPF_MAP_TYPE_REUSEPORT_SOCKARRAYZ"BPF_MAP_TYPE_PERCPU_CGROUP_STORAGEr�r�ZBPF_MAP_TYPE_SK_STORAGEZBPF_MAP_TYPE_DEVMAP_HASHZBPF_MAP_TYPE_STRUCT_OPSr�ZBPF_MAP_TYPE_INODE_STORAGEZBPF_MAP_TYPE_TASK_STORAGErRrHr�r�r7rDrPrQrUror�r�rrr�rrtrvr
r�rxrzr�r|r~r�r�r�r�r�r�r�r�r0r0r0r6�<module>s�
&;0g	8l4849

Youez - 2016 - github.com/yon3zu
LinuXploit