fn append_condition(
        condition: SeccompCondition,
        accumulator: &mut Vec<Vec<sock_filter>>,
        rule_len: &mut usize,
        offset: &mut u8,
    ) {
        // Tries to detect whether prepending the current condition will produce an unjumpable
        // offset (since BPF jumps are a maximum of 255 instructions, which is std::u8::MAX).
        if offset.checked_add(CONDITION_MAX_LEN + 1).is_none() {
            // If that is the case, three additional helper jumps are prepended and the offset
            // is reset to 1.
            //
            // - The first jump continues the evaluation of the condition chain by jumping to
            //   the next condition or the action of the rule if the last condition was matched.
            // - The second, jumps out of the rule, to the next rule or the default action of
            //   the filter in case of the last rule in the rule chain of a syscall.
            // - The third jumps out of the rule chain of the syscall, to the rule chain of the
            //   next syscall number to be checked or the default action of the filter in the
            //   case of the last rule chain.
            let helper_jumps = vec![
                BPF_STMT(BPF_JMP + BPF_JA, 2),
                BPF_STMT(BPF_JMP + BPF_JA, u32::from(*offset) + 1),
                BPF_STMT(BPF_JMP + BPF_JA, u32::from(*offset) + 1),
            ];
            *rule_len += helper_jumps.len();
            accumulator.push(helper_jumps);
            *offset = 1;
        }

        let condition = condition.into_bpf(*offset);
        *rule_len += condition.len();
        // Safe to unwrap since we checked that condition length is less than `CONDITION_MAX_LEN`.
        *offset += u8::try_from(condition.len()).unwrap();
        accumulator.push(condition);
    }
/// Appends a condition of the rule to an accumulator.
///
/// The length of the rule and offset to the next rule are updated.
///
/// # Arguments
///
/// * `condition` - The condition added to the rule.
/// * `accumulator` - Accumulator of BPF statements that compose the BPF program.
/// * `rule_len` - Number of conditions in the rule.
/// * `offset` - Offset (in number of BPF statements) to the next rule.
Appends a condition of the rule to an accumulator.
The length of the rule and offset to the next rule are updated.
Appends a condition of the rule to an accumulator . The length of the rule and offset to the next rule are updated .
fn append_condition(
        condition: SeccompCondition,
        accumulator: &mut Vec<Vec<sock_filter>>,
        rule_len: &mut usize,
        offset: &mut u8,
    ) {
        // Tries to detect whether prepending the current condition will produce an unjumpable
        // offset (since BPF jumps are a maximum of 255 instructions, which is std::u8::MAX).
        if offset.checked_add(CONDITION_MAX_LEN + 1).is_none() {
            // If that is the case, three additional helper jumps are prepended and the offset
            // is reset to 1.
            //
            // - The first jump continues the evaluation of the condition chain by jumping to
            //   the next condition or the action of the rule if the last condition was matched.
            // - The second, jumps out of the rule, to the next rule or the default action of
            //   the filter in case of the last rule in the rule chain of a syscall.
            // - The third jumps out of the rule chain of the syscall, to the rule chain of the
            //   next syscall number to be checked or the default action of the filter in the
            //   case of the last rule chain.
            let helper_jumps = vec![
                BPF_STMT(BPF_JMP + BPF_JA, 2),
                BPF_STMT(BPF_JMP + BPF_JA, u32::from(*offset) + 1),
                BPF_STMT(BPF_JMP + BPF_JA, u32::from(*offset) + 1),
            ];
            *rule_len += helper_jumps.len();
            accumulator.push(helper_jumps);
            *offset = 1;
        }
        let condition = condition.into_bpf(*offset);
        *rule_len += condition.len();
        // Safe to unwrap since we checked that condition length is less than `CONDITION_MAX_LEN`.
        *offset += u8::try_from(condition.len()).unwrap();
        accumulator.push(condition);
    }
fn append_condition ( condition : SeccompCondition , accumulator : & mut Vec < Vec < sock_filter > > , rule_len : & mut usize , offset : & mut u8 , ) { // Tries to detect whether prepending the current condition will produce an unjumpable // offset (since BPF jumps are a maximum of 255 instructions, which is std::u8::MAX). if offset . checked_add ( CONDITION_MAX_LEN + 1 ) . is_none ( ) { // If that is the case, three additional helper jumps are prepended and the offset // is reset to 1. // // - The first jump continues the evaluation of the condition chain by jumping to //   the next condition or the action of the rule if the last condition was matched. // - The second, jumps out of the rule, to the next rule or the default action of //   the filter in case of the last rule in the rule chain of a syscall. // - The third jumps out of the rule chain of the syscall, to the rule chain of the //   next syscall number to be checked or the default action of the filter in the //   case of the last rule chain. let helper_jumps = vec ! [ BPF_STMT ( BPF_JMP BPF_JA 2 ) BPF_STMT ( BPF_JMP BPF_JA u32 from ( offset ) 1 ) BPF_STMT ( BPF_JMP BPF_JA u32 from ( offset ) 1 ) ] ; * rule_len += helper_jumps . len ( ) ; accumulator . push ( helper_jumps ) ; * offset = 1 ; } let condition = condition . into_bpf ( * offset ) ; * rule_len += condition . len ( ) ; // Safe to unwrap since we checked that condition length is less than `CONDITION_MAX_LEN`. * offset += u8 :: try_from ( condition . len ( ) ) . unwrap ( ) ; accumulator . push ( condition ) ; }
Appends a condition of the rule to an accumulator.
Appends a condition of the rule to an accumulator .
condition
SeccompCondition
accumulator
&mut Vec<Vec<sock_filter>>
rule_len
&mut usize
offset
&mut u8
condition
SeccompCondition
accumulator
&mut Vec<Vec<sock_filter>>
rule_len
&mut usize
offset
&mut u8