add an absolute value function

ebpfcat/ebpf.py

@@ -460,6 +460,9 @@ class Expression:
     def __neg__(self):
         return Negate(self.ebpf, self)
 
+    def __abs__(self):
+        return Absolute(self.ebpf, self)
+
     def __bool__(self):
         raise AssembleError("Expression only has a value at execution time")
 
@@ -615,6 +618,23 @@ class Negate(Expression):
         return self.arg.contains(no)
 
 
+class Absolute(Expression):
+    def __init__(self, ebpf, arg):
+        self.ebpf = ebpf
+        self.arg = arg
+
+    @contextmanager
+    def calculate(self, dst, long, signed, force=False):
+        with self.arg.calculate(dst, long, True, force) as \
+                (dst, long, signed):
+            with self.ebpf.r[dst] < 0:
+                self.ebpf.r[dst] = -self.ebpf.r[dst]
+            yield dst, long, True
+
+    def contains(self, no):
+        return self.arg.contains(no)
+
+
 class Sum(Binary):
     """represent the sum of one register and a constant value
 

ebpfcat/ebpf_test.py

@@ -583,6 +583,14 @@ class Tests(TestCase):
             Instruction(opcode=O.LONG+O.REG+O.MOV, dst=7, src=1, off=0, imm=0),
             Instruction(opcode=O.LONG+O.NEG, dst=7, src=0, off=0, imm=0)])
 
+    def test_absolute(self):
+        e = EBPF()
+        e.r7 = abs(e.r1)
+        self.assertEqual(e.opcodes, [
+            Instruction(opcode=O.LONG+O.REG+O.MOV, dst=7, src=1, off=0, imm=0),
+            Instruction(opcode=O.JGE, dst=7, src=0, off=1, imm=0),
+            Instruction(opcode=O.LONG+O.NEG, dst=7, src=0, off=0, imm=0)])
+
     def test_jump_data(self):
         e = EBPF()
         t1 = e.jumpIf(e.r1 > 0)