BPF context structure field offsets.
This namespace provides pre-defined offsets for common BPF context structures, eliminating the need to manually look up kernel headers.
IMPORTANT NOTES:
Byte Order: Some fields are in NETWORK byte order (big-endian), while others are in HOST byte order (native). This is documented for each field that requires attention.
Architecture: These offsets assume 64-bit systems where
__bpf_md_ptr expands to 8 bytes.
Kernel Version: Based on Linux 6.x kernel structures. While kernel developers try to maintain ABI stability, always verify against your target kernel version.
Structures included:
bpf-sock-ops - bpf_sock_ops for SOCK_OPS programsbpf-sock - bpf_sock for socket programssk-msg - sk_msg_md for SK_MSG programs (from socket.clj)sk-buff - __sk_buff for TC/socket filter programs (from tc.clj)xdp-md - xdp_md for XDP programs (from xdp.clj)bpf-sk-lookup - bpf_sk_lookup for SK_LOOKUP programsUsage: (require '[clj-ebpf.ctx :as ctx]) (dsl/ldx :w :r2 :r1 (:local-port ctx/bpf-sock-ops)) ; Load local port
See also:
BPF context structure field offsets. This namespace provides pre-defined offsets for common BPF context structures, eliminating the need to manually look up kernel headers. IMPORTANT NOTES: 1. **Byte Order**: Some fields are in NETWORK byte order (big-endian), while others are in HOST byte order (native). This is documented for each field that requires attention. 2. **Architecture**: These offsets assume 64-bit systems where `__bpf_md_ptr` expands to 8 bytes. 3. **Kernel Version**: Based on Linux 6.x kernel structures. While kernel developers try to maintain ABI stability, always verify against your target kernel version. Structures included: - `bpf-sock-ops` - bpf_sock_ops for SOCK_OPS programs - `bpf-sock` - bpf_sock for socket programs - `sk-msg` - sk_msg_md for SK_MSG programs (from socket.clj) - `sk-buff` - __sk_buff for TC/socket filter programs (from tc.clj) - `xdp-md` - xdp_md for XDP programs (from xdp.clj) - `bpf-sk-lookup` - bpf_sk_lookup for SK_LOOKUP programs Usage: (require '[clj-ebpf.ctx :as ctx]) (dsl/ldx :w :r2 :r1 (:local-port ctx/bpf-sock-ops)) ; Load local port See also: - clj-ebpf.dsl.tc for __sk_buff access functions - clj-ebpf.dsl.xdp for xdp_md access functions - clj-ebpf.dsl.socket for sk_msg_md access functions
bpf_sk_lookup structure field offsets.
BYTE ORDER NOTES:
See clj-ebpf.dsl.sk-lookup for access functions.
bpf_sk_lookup structure field offsets. BYTE ORDER NOTES: - local_ip4, remote_ip4, local_ip6, remote_ip6: NETWORK byte order - local_port, remote_port: HOST byte order for both (!) See clj-ebpf.dsl.sk-lookup for access functions.
Get offset for bpf_sk_lookup field.
Get offset for bpf_sk_lookup field.
bpf_sock structure field offsets.
BYTE ORDER NOTES:
Usage: ;; Load source port (host byte order) (dsl/ldx :w :r2 :r1 (:src-port ctx/bpf-sock))
;; Load destination port (network byte order - may need ntohs) (dsl/ldx :w :r2 :r1 (:dst-port ctx/bpf-sock))
bpf_sock structure field offsets. BYTE ORDER NOTES: - src_ip4, dst_ip4, src_ip6, dst_ip6: NETWORK byte order - dst_port: NETWORK byte order - src_port: HOST byte order (!) Usage: ;; Load source port (host byte order) (dsl/ldx :w :r2 :r1 (:src-port ctx/bpf-sock)) ;; Load destination port (network byte order - may need ntohs) (dsl/ldx :w :r2 :r1 (:dst-port ctx/bpf-sock))
bpf_sock_ops structure field offsets for SOCK_OPS programs.
BYTE ORDER NOTES:
Usage: ;; Load operation code (dsl/ldx :w :r2 :r1 (:op ctx/bpf-sock-ops))
;; Load local port (host byte order - no conversion needed) (dsl/ldx :w :r2 :r1 (:local-port ctx/bpf-sock-ops))
;; Load remote port (network byte order - may need ntohs) (dsl/ldx :w :r2 :r1 (:remote-port ctx/bpf-sock-ops))
bpf_sock_ops structure field offsets for SOCK_OPS programs. BYTE ORDER NOTES: - remote_ip4, local_ip4, remote_ip6, local_ip6: NETWORK byte order - remote_port: NETWORK byte order - local_port: HOST byte order (!) Usage: ;; Load operation code (dsl/ldx :w :r2 :r1 (:op ctx/bpf-sock-ops)) ;; Load local port (host byte order - no conversion needed) (dsl/ldx :w :r2 :r1 (:local-port ctx/bpf-sock-ops)) ;; Load remote port (network byte order - may need ntohs) (dsl/ldx :w :r2 :r1 (:remote-port ctx/bpf-sock-ops))
Ethernet header size: 14 bytes
Ethernet header size: 14 bytes
Ethernet header field offsets.
Ethernet header field offsets.
Minimum IPv4 header size (no options): 20 bytes
Minimum IPv4 header size (no options): 20 bytes
__sk_buff structure field offsets.
BYTE ORDER NOTES:
See clj-ebpf.dsl.tc for access functions.
__sk_buff structure field offsets. BYTE ORDER NOTES: - remote_ip4, local_ip4, remote_ip6, local_ip6: NETWORK byte order - remote_port: NETWORK byte order - local_port: HOST byte order (!) See clj-ebpf.dsl.tc for access functions.
Get offset for __sk_buff field.
Get offset for __sk_buff field.
sk_msg_md structure field offsets.
BYTE ORDER NOTES:
See clj-ebpf.dsl.socket for access functions.
sk_msg_md structure field offsets. BYTE ORDER NOTES: - remote_ip4, local_ip4, remote_ip6, local_ip6: NETWORK byte order - remote_port: NETWORK byte order - local_port: HOST byte order (!) See clj-ebpf.dsl.socket for access functions.
(sock-offset field)Get offset for bpf_sock field.
Parameters:
Returns offset in bytes.
Get offset for bpf_sock field. Parameters: - field: Field keyword Returns offset in bytes.
(sock-ops-offset field)Get offset for bpf_sock_ops field.
Parameters:
Returns offset in bytes.
Get offset for bpf_sock_ops field. Parameters: - field: Field keyword Returns offset in bytes.
SOCK_OPS operation codes (op field values).
SOCK_OPS operation codes (op field values).
Minimum TCP header size (no options): 20 bytes
Minimum TCP header size (no options): 20 bytes
xdp_md structure field offsets.
See clj-ebpf.dsl.xdp for access functions.
xdp_md structure field offsets. See clj-ebpf.dsl.xdp for access functions.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |