1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
// shunt - BPF program for the snoop socket
//
// SPDX-License-Identifier: GPL-3.0-or-later
// Copyright (c) 2026 Dirk Brenken (dev@brenken.org)
//
// GENERATED - do not edit.
//
// Expression: udp src port 53 or (vlan and udp src port 53)
// Link type: EN10MB (br-lan)
// Instructions: 52
// tcpdump version 4.99.6
// libpcap version 1.10.6 (64-bit time_t, with TPACKET_V3)
// 64-bit build, 64-bit time_t
//
// Take it whole. The vlan primitive prefixes `ld #0; st M[0];
// st M[1]` and the later branches read those scratch slots, so
// dropping the preamble or splicing the two halves breaks the
// tagged path silently. Without `vlan` the program would start
// at `ldh [12]` and be 16 instructions instead of 52.
//
// Return style, not export style, and that is load bearing:
// snoop.uc loads this with require() at open() time so the
// module itself stays loadable without the constant, and
// require() only accepts return style - export syntax fails to
// compile outside an import.
return {
BPF: [
[ 0, 0, 0, 0 ],
[ 2, 0, 0, 0 ],
[ 2, 0, 0, 1 ],
[ 40, 0, 0, 12 ],
[ 21, 0, 4, 34525 ],
[ 48, 0, 0, 20 ],
[ 21, 0, 10, 17 ],
[ 40, 0, 0, 54 ],
[ 21, 41, 8, 53 ],
[ 21, 0, 7, 2048 ],
[ 48, 0, 0, 23 ],
[ 21, 0, 5, 17 ],
[ 40, 0, 0, 20 ],
[ 69, 3, 0, 8191 ],
[ 177, 0, 0, 14 ],
[ 72, 0, 0, 14 ],
[ 21, 33, 0, 53 ],
[ 48, 0, 0, 4294963248 ],
[ 21, 7, 0, 1 ],
[ 0, 0, 0, 4 ],
[ 2, 0, 0, 0 ],
[ 2, 0, 0, 1 ],
[ 40, 0, 0, 12 ],
[ 21, 2, 0, 33024 ],
[ 21, 1, 0, 34984 ],
[ 21, 0, 25, 37120 ],
[ 97, 0, 0, 1 ],
[ 72, 0, 0, 12 ],
[ 21, 0, 6, 34525 ],
[ 97, 0, 0, 0 ],
[ 80, 0, 0, 20 ],
[ 21, 0, 19, 17 ],
[ 97, 0, 0, 0 ],
[ 72, 0, 0, 54 ],
[ 21, 15, 16, 53 ],
[ 21, 0, 15, 2048 ],
[ 97, 0, 0, 0 ],
[ 80, 0, 0, 23 ],
[ 21, 0, 12, 17 ],
[ 97, 0, 0, 0 ],
[ 72, 0, 0, 20 ],
[ 69, 9, 0, 8191 ],
[ 97, 0, 0, 0 ],
[ 80, 0, 0, 14 ],
[ 84, 0, 0, 15 ],
[ 100, 0, 0, 2 ],
[ 12, 0, 0, 0 ],
[ 7, 0, 0, 0 ],
[ 72, 0, 0, 14 ],
[ 21, 0, 1, 53 ],
[ 6, 0, 0, 262144 ],
[ 6, 0, 0, 0 ],
]
};
|
