Building objects compile rules without loading them.

$ moat build rules.moat -o rules.o [--emit-c rules.c] [--backend c]

• -o writes the BPF object.
• --emit-c writes the generated C. It works without -o; with neither, build stops with "nothing to do".
• --backend c generates C and compiles it with clang, from $MOAT_CLANG or the path. The default backend writes BPF bytecode directly and needs no compiler.

test, bench, load and reload accept --backend c too. Both backends produce the same program with the same maps, and moat's tests check that they give every packet the same verdict, so a program built one way can be reloaded built the other way without losing sets or variables.

The object

moat writes the object the way clang does: the program in section xdp, the functions it calls in .text, and maps described with BTF in .maps. ip, bpftool and other libbpf based loaders accept it as well. The generated C is self-contained and can be compiled by hand:

$ clang -O2 -g -target bpf -mcpu=v3 -c rules.c

-mcpu=v3 is needed for the atomic operations rate limits use.

Exit codes: 1 errors in the rules, 2 wrong usage or an output that cannot be written, 3 clang refused the C.