bend-osdev-bpf

Search uses release 0.1.0.0 · 317 definitions

Releases (1)

type BpfInputWhat a filter runs over: bytes, and the byte order its loads use
def bpf_packeta packet: loads are big-endian (network order)
type BpfState
type BpfStepwhat an instruction leads to: skip some instructions and go on, answer, or fail
def bpf_init
def bpf_get_a
def bpf_set_a
def bpf_set_x
def bpf_set_a.m
def bpf_set_x.m
def bpf_tax
def bpf_txa
def bpf_neg
def bpf_step.ofa step that goes on to the next instruction, or ends the program with 0
def bpf_load.at
def bpf_load
def bpf_load.indX + k does not wrap: an offset past 2^32 is outside the input
def bpf_load.msh.fin
def bpf_load.msh
def bpf_len
def bpf_mem.get
def bpf_mem.set
def bpf_mem.lda
def bpf_mem.ldx
def bpf_mem.st
def bpf_mem.stx
def bpf_scratcha scratch access goes on only if its index is in range
def bpf_src
def bpf_shl
def bpf_shr
def bpf_div
def bpf_mod
def bpf_aluA op v, or None for a division or modulo by zero
def bpf_test
def bpf_jsel
def bpf_exec
def bpf_run.go
def bpf_runthe program's answer for this input

def show_run
def show_ok
def show_act
def rarpbpf(4), EXAMPLES: accept only Reverse ARP requests, as BPF_STMT and BPF_JUMP lines (0x8035 = 32821, ETHERTYPE_REVARP; 3, REVARP_REQUEST)
def run_raw.go
def run_raw
def hostsbpf(4): accept IP packets between 128.3.112.15 and 128.3.112.35
def fingerbpf(4): accept TCP finger packets (port 79), skipping IP fragments
def pkt_rarp
def pkt_arp
def pkt_ip
def pkt_finger
def pkt_web
def pkt_frag
def pkt_finger_opts
def pkt_run
def exampleseccomp(2), EXAMPLES: install_filter(59, AUDIT_ARCH_X86_64, 99): execve (59) fails with errno 99, other calls are allowed, and another architecture or an x32 call kills the process
def sc_call
def sc
def ret_only
def denya filter that answers ERRNO(e) for system call nr and ALLOW otherwise
def big.lastA full-size program, as a regression test for long inputs: 4096 instructions (BPF_MAXINSNS), stored as Octets, read back, prepared and run on 64 KB of pseudo-random bytes (a linear congruential generator).
def big.block
def big.progblocks 0 to j, the last ending in ret a (top is the last block's j)
def big.packet
def big.run
def big.prep
def big.read
def huge.readUntrusted input of 32768 instructions (256 KB): refused by bpf_of_octets at its default limit (8 * BPF_MAXINSNS bytes) before the rest is read, and, read with a higher limit, decoded and refused by validation as too long
def main

def add_succ
def add_zero
def g_count
def F_count
def g_checkthe tail form, from any verdict so far, with n the length
def F_check
def ops_leach pass of bpf_validate_with runs only once the one before it holds
def ops_r
def mem_l
def valid_allwhat bpf_validate's success gives a run: the checks of every instruction, and at least one instruction
def valid_nonempty
def go_stop
def go_app
def skip_app
def decode_go
def rev_rr
def app_nil
def rev_twicereversing twice gives the list back
def g_encode
def F_encode
def dec.afterwhat the tail form ends with, given the instructions decoded so far (acc, last first) and what the structural form answers for the rest
def dec.after2
def dec_step
def g_decode
def dec_nil
def F_decode
def nat.lt_not_le
def fin_done
def sc_l