Home
last modified time | relevance | path

Searched refs:verdict (Results 1 – 25 of 69) sorted by relevance

123

/linux/tools/testing/selftests/bpf/progs/
H A Dtest_sockmap_listen.c66 int verdict; in prog_stream_verdict() local
69 verdict = bpf_sk_redirect_map(skb, &sock_map, zero, 0); in prog_stream_verdict()
71 verdict = bpf_sk_redirect_hash(skb, &sock_hash, &zero, 0); in prog_stream_verdict()
73 count = bpf_map_lookup_elem(&verdict_map, &verdict); in prog_stream_verdict()
77 return verdict; in prog_stream_verdict()
85 int verdict; in prog_skb_verdict() local
88 verdict = bpf_sk_redirect_map(skb, &sock_map, zero, in prog_skb_verdict()
91 verdict = bpf_sk_redirect_hash(skb, &sock_hash, &zero, in prog_skb_verdict()
94 count = bpf_map_lookup_elem(&verdict_map, &verdict); in prog_skb_verdict()
98 return verdict; in prog_skb_verdict()
[all …]
H A Dtest_skmsg_load_helpers.c30 int verdict = SK_PASS; in prog_msg_verdict_common() local
41 verdict = SK_DROP; in prog_msg_verdict_common()
43 return verdict; in prog_msg_verdict_common()
/linux/drivers/net/ethernet/amazon/ena/
H A Dena_xdp.h84 u32 verdict = ENA_XDP_PASS; in ena_xdp_execute() local
92 verdict = bpf_prog_run_xdp(xdp_prog, xdp); in ena_xdp_execute()
94 switch (verdict) { in ena_xdp_execute()
98 trace_xdp_exception(rx_ring->netdev, xdp_prog, verdict); in ena_xdp_execute()
100 verdict = ENA_XDP_DROP; in ena_xdp_execute()
116 verdict = ENA_XDP_TX; in ena_xdp_execute()
121 verdict = ENA_XDP_REDIRECT; in ena_xdp_execute()
124 trace_xdp_exception(rx_ring->netdev, xdp_prog, verdict); in ena_xdp_execute()
126 verdict = ENA_XDP_DROP; in ena_xdp_execute()
129 trace_xdp_exception(rx_ring->netdev, xdp_prog, verdict); in ena_xdp_execute()
[all …]
/linux/tools/testing/selftests/net/netfilter/
H A Dnf_queue.c27 uint32_t verdict; member
174 .verdict = htonl(verd), in nfq_build_verdict()
329 opts.queue_num, opts.verdict); in mainloop()
339 opts.queue_num, opts.verdict); in mainloop()
350 nlh = nfq_build_verdict(buf, id, opts.queue_num, opts.verdict); in mainloop()
382 opts.verdict = atoi(optarg); in parse_opts()
383 if (opts.verdict > 0xffff) { in parse_opts()
388 opts.verdict <<= 16; in parse_opts()
389 opts.verdict |= NF_QUEUE; in parse_opts()
419 if (opts.verdict != NF_ACCEPT && (opts.verdict >> 16 == opts.queue_num)) { in parse_opts()
[all …]
/linux/net/netfilter/
H A Dnft_synproxy.c61 regs->verdict.code = NF_STOLEN; in nft_synproxy_eval_v4()
67 regs->verdict.code = NF_STOLEN; in nft_synproxy_eval_v4()
69 regs->verdict.code = NF_DROP; in nft_synproxy_eval_v4()
92 regs->verdict.code = NF_STOLEN; in nft_synproxy_eval_v6()
98 regs->verdict.code = NF_STOLEN; in nft_synproxy_eval_v6()
100 regs->verdict.code = NF_DROP; in nft_synproxy_eval_v6()
117 regs->verdict.code = NFT_BREAK; in nft_synproxy_do_eval()
123 regs->verdict.code = NF_DROP; in nft_synproxy_do_eval()
131 regs->verdict.code = NF_DROP; in nft_synproxy_do_eval()
136 regs->verdict.code = NF_DROP; in nft_synproxy_do_eval()
[all …]
H A Dnfnetlink_queue.c273 unsigned int verdict, i = *index; in nf_iterate()
278 verdict = nf_hook_entry_hookfn(hook, skb, state); in nf_iterate()
279 if (verdict != NF_ACCEPT) { in nf_iterate()
281 if (verdict != NF_REPEAT) in nf_iterate()
282 return verdict; in nf_iterate()
363 static void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict) in nf_reinject()
388 if (verdict == NF_REPEAT) in nf_reinject()
389 verdict = nf_hook_entry_hookfn(hook_entry, skb, &entry->state); in nf_reinject()
391 if (verdict == NF_ACCEPT) { in nf_reinject()
393 verdict in nf_reinject()
272 unsigned int verdict, i = *index; nf_iterate() local
362 nf_reinject(struct nf_queue_entry * entry,unsigned int verdict) nf_reinject() argument
484 nfqnl_reinject(struct nf_queue_entry * entry,unsigned int verdict) nfqnl_reinject() argument
1659 unsigned int verdict; verdicthdr_get() local
1685 unsigned int verdict, maxid; nfqnl_recv_verdict_batch() local
1798 unsigned int verdict; nfqnl_recv_verdict() local
[all...]
H A Dnft_xfrm.c129 regs->verdict.code = NFT_BREAK; in nft_xfrm_state_get_key()
158 regs->verdict.code = NFT_BREAK; in nft_xfrm_state_get_key()
169 regs->verdict.code = NFT_BREAK; in nft_xfrm_get_eval_in()
185 regs->verdict.code = NFT_BREAK; in nft_xfrm_get_eval_out()
199 regs->verdict.code = NFT_BREAK; in nft_xfrm_get_eval_out()
217 regs->verdict.code = NFT_BREAK; in nft_xfrm_get_eval()
H A Dnft_tproxy.c35 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v4()
41 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v4()
80 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v4()
102 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v6()
109 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v6()
153 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval_v6()
182 regs->verdict.code = NFT_BREAK; in nft_tproxy_eval()
H A Dnft_osf.c32 regs->verdict.code = NFT_BREAK; in nft_osf_eval()
37 regs->verdict.code = NFT_BREAK; in nft_osf_eval()
44 regs->verdict.code = NFT_BREAK; in nft_osf_eval()
48 regs->verdict.code = NFT_BREAK; in nft_osf_eval()
H A Dnft_compat.c92 regs->verdict.code = NFT_CONTINUE; in nft_target_eval_xt()
95 regs->verdict.code = ret; in nft_target_eval_xt()
119 regs->verdict.code = NF_ACCEPT; in nft_target_eval_bridge()
122 regs->verdict.code = NF_DROP; in nft_target_eval_bridge()
125 regs->verdict.code = NFT_CONTINUE; in nft_target_eval_bridge()
128 regs->verdict.code = NFT_RETURN; in nft_target_eval_bridge()
131 regs->verdict.code = ret; in nft_target_eval_bridge()
431 regs->verdict.code = NF_DROP; in __nft_match_eval()
437 regs->verdict.code = NFT_CONTINUE; in __nft_match_eval()
440 regs->verdict.code = NFT_BREAK; in __nft_match_eval()
H A Dnf_queue.c253 unsigned int index, unsigned int verdict) in nf_queue() argument
257 ret = __nf_queue(skb, state, index, verdict >> NF_VERDICT_QBITS); in nf_queue()
260 (verdict & NF_VERDICT_FLAG_QUEUE_BYPASS)) in nf_queue()
/linux/net/ipv4/netfilter/
H A Diptable_mangle.c39 unsigned int ret, verdict; in ipt_mangle_out() local
54 verdict = ret & NF_VERDICT_MASK; in ipt_mangle_out()
56 if (verdict != NF_DROP && verdict != NF_STOLEN) { in ipt_mangle_out()
H A Darp_tables.c200 unsigned int verdict = NF_DROP; in arpt_do_table() local
250 v = ((struct xt_standard_target *)t)->verdict; in arpt_do_table()
254 verdict = (unsigned int)(-v) - 1; in arpt_do_table()
269 verdict = NF_DROP; in arpt_do_table()
281 verdict = t->u.kernel.target->target(skb, &acpar); in arpt_do_table()
283 if (verdict == XT_CONTINUE) { in arpt_do_table()
298 return verdict; in arpt_do_table()
347 t->verdict < 0) || visited) { in mark_source_chains()
374 int newpos = t->verdict; in mark_source_chains()
451 unsigned int verdict; in check_underflow() local
[all …]
/linux/Documentation/bpf/
H A Dmap_sockmap.rst14 the result of a BPF (verdict) program with the help of the BPF helpers
29 and a verdict program. The parser program determines how much data has been
30 parsed and therefore how much data needs to be queued to come to a verdict. The
31 verdict program is essentially the redirect program and can return a verdict
39 parse or verdict program. If adding a sock object to a map would result
64 There are additional helpers available to use with the parser and verdict
67 bytes the given verdict should apply to. The helper ``bpf_msg_cork_bytes()``
68 handles a different case where a BPF program cannot reach a verdict on a msg
90 the message ``msg`` is allowed to pass (i.e., if the verdict BPF program
136 If the ``map`` has BPF programs (parser and verdict), those will be inherited
[all …]
H A Dsigning.rst9 including the BPF LSM - use the resulting verdict to enforce policy. It is
19 before - but it records a verdict (see `The verdict`_) that an LSM can gate on.
179 above this keeps the verdict binary: a signed program cannot use a map its
184 The verdict
188 state. The outcome is recorded in ``prog->aux->sig.verdict``:
206 There is deliberately no "instructions verified but metadata not" verdict: a
208 recorded with a weaker verdict. ``BPF_SIG_VERIFIED`` therefore always means the
212 Alongside the verdict the kernel records which keyring validated the signature;
218 Signing only *records* a verdict; an LSM turns it into policy. The verdict and
232 optional signature verification, so the verdict and keyring fields are final - the
[all …]
/linux/net/ipv6/netfilter/
H A Dip6table_mangle.c35 unsigned int ret, verdict; in ip6t_mangle_out() local
50 verdict = ret & NF_VERDICT_MASK; in ip6t_mangle_out()
52 if (verdict != NF_DROP && verdict != NF_STOLEN && in ip6t_mangle_out()
H A Dip6_tables.c197 t->verdict < 0) { in get_chainname_rulenum()
255 unsigned int verdict = NF_DROP; in ip6t_do_table() local
336 v = ((struct xt_standard_target *)t)->verdict; in ip6t_do_table()
340 verdict = (unsigned int)(-v) - 1; in ip6t_do_table()
353 verdict = NF_DROP; in ip6t_do_table()
366 verdict = t->u.kernel.target->target(skb, &acpar); in ip6t_do_table()
367 if (verdict == XT_CONTINUE) in ip6t_do_table()
379 else return verdict; in ip6t_do_table()
417 t->verdict < 0) || visited) { in mark_source_chains()
443 int newpos = t->verdict; in mark_source_chains()
[all …]
/linux/tools/testing/selftests/bpf/prog_tests/
H A Dsockmap_basic.c158 int err, map, verdict; in test_skmsg_helpers() local
164 verdict = bpf_program__fd(skel->progs.prog_msg_verdict); in test_skmsg_helpers()
167 err = bpf_prog_attach(verdict, map, BPF_SK_MSG_VERDICT, 0); in test_skmsg_helpers()
171 err = bpf_prog_detach2(verdict, map, BPF_SK_MSG_VERDICT); in test_skmsg_helpers()
334 int err, map, verdict; in test_sockmap_skb_verdict_attach() local
340 verdict = bpf_program__fd(skel->progs.prog_skb_verdict); in test_sockmap_skb_verdict_attach()
343 err = bpf_prog_attach(verdict, map, first, 0); in test_sockmap_skb_verdict_attach()
347 err = bpf_prog_attach(verdict, map, second, 0); in test_sockmap_skb_verdict_attach()
350 err = bpf_prog_detach2(verdict, map, first); in test_sockmap_skb_verdict_attach()
451 int n, err, map, verdict, c1 = -1, p1 = -1; in test_sockmap_skb_verdict_shutdown() local
[all …]
H A Dsockmap_listen.c729 int verdict = bpf_program__fd(skel->progs.prog_stream_verdict); in test_skb_redir_to_connected() local
738 err = xbpf_prog_attach(verdict, sock_map, BPF_SK_SKB_STREAM_VERDICT, 0); in test_skb_redir_to_connected()
745 xbpf_prog_detach2(verdict, sock_map, BPF_SK_SKB_STREAM_VERDICT); in test_skb_redir_to_connected()
754 int verdict = bpf_program__fd(skel->progs.prog_msg_verdict); in test_msg_redir_to_connected() local
759 err = xbpf_prog_attach(verdict, sock_map, BPF_SK_MSG_VERDICT, 0); in test_msg_redir_to_connected()
765 xbpf_prog_detach2(verdict, sock_map, BPF_SK_MSG_VERDICT); in test_msg_redir_to_connected()
849 int verdict = bpf_program__fd(skel->progs.prog_stream_verdict); in test_skb_redir_to_listening() local
858 err = xbpf_prog_attach(verdict, sock_map, BPF_SK_SKB_STREAM_VERDICT, 0); in test_skb_redir_to_listening()
865 xbpf_prog_detach2(verdict, sock_map, BPF_SK_SKB_STREAM_VERDICT); in test_skb_redir_to_listening()
874 int verdict = bpf_program__fd(skel->progs.prog_msg_verdict); in test_msg_redir_to_listening() local
[all …]
H A Dns_current_pid_tgid.c124 int verdict, map, server_fd = -1, client_fd = -1; in test_current_pid_tgid_sk_msg() local
145 verdict = bpf_program__fd(skel->progs.sk_msg); in test_current_pid_tgid_sk_msg()
147 err = bpf_prog_attach(verdict, map, BPF_SK_MSG_VERDICT, 0); in test_current_pid_tgid_sk_msg()
H A Dcgroup_attach_override.c13 static int prog_load(int verdict) in prog_load() argument
16 BPF_MOV64_IMM(BPF_REG_0, verdict), /* r0 = verdict */ in prog_load()
H A Dsockmap_strp.c50 int verdict, parser; in sockmap_strp_init() local
62 verdict = bpf_program__fd(strp->progs.prog_skb_verdict_pass); in sockmap_strp_init()
64 verdict = bpf_program__fd(strp->progs.prog_skb_verdict); in sockmap_strp_init()
70 err = bpf_prog_attach(verdict, *out_map, BPF_SK_SKB_STREAM_VERDICT, 0); in sockmap_strp_init()
/linux/net/netfilter/ipvs/
H A Dip_vs_core.c1035 unsigned int verdict = NF_DROP; in handle_response_icmp() local
1078 verdict = NF_ACCEPT; in handle_response_icmp()
1083 return verdict; in handle_response_icmp()
1541 int verdict = ip_vs_out_icmp_v6(ipvs, skb, &related, in ip_vs_out_hook() local
1545 return verdict; in ip_vs_out_hook()
1551 int verdict = ip_vs_out_icmp(ipvs, skb, &related, in ip_vs_out_hook() local
1555 return verdict; in ip_vs_out_hook()
1649 int *verdict, struct ip_vs_conn **cpp, in ip_vs_try_to_schedule() argument
1660 if (!pp->conn_schedule(ipvs, af, skb, pd, verdict, cpp, iph)) in ip_vs_try_to_schedule()
1674 *verdict = NF_ACCEPT; in ip_vs_try_to_schedule()
[all …]
H A Dip_vs_proto_udp.c33 int *verdict, struct ip_vs_conn **cpp, in udp_conn_schedule() argument
51 *verdict = NF_DROP; in udp_conn_schedule()
70 *verdict = NF_DROP; in udp_conn_schedule()
81 *verdict = ip_vs_leave(svc, skb, pd, iph); in udp_conn_schedule()
83 *verdict = NF_DROP; in udp_conn_schedule()
/linux/net/bridge/
H A Dbr_input.c272 unsigned int verdict, i; in nf_hook_bridge_pre() local
291 verdict = nf_hook_entry_hookfn(&e->hooks[i], skb, &state); in nf_hook_bridge_pre()
292 switch (verdict & NF_VERDICT_MASK) { in nf_hook_bridge_pre()
303 ret = nf_queue(skb, &state, i, verdict); in nf_hook_bridge_pre()

123