// DOES NOT LOCK OR CHECK VALIDITY
// Assumes caller has already done this
// Wrapper for seccomp_rule_add_... functions
165223
func (f *ScmpFilter) addRuleWrapper(call ScmpSyscall, action ScmpAction, exact bool, length C.uint, cond C.scmp_cast_t) error {
	if length != 0 && cond == nil {
		return fmt.Errorf("null conditions list, but length is nonzero")
	}

	var retCode C.int
	if exact {
		retCode = C.seccomp_rule_add_exact_array(f.filterCtx, action.toNative(), C.int(call), length, cond)
	} else {
		retCode = C.seccomp_rule_add_array(f.filterCtx, action.toNative(), C.int(call), length, cond)
	}

	if syscall.Errno(-1*retCode) == syscall.EFAULT {
		return fmt.Errorf("unrecognized syscall %#x", int32(call))
	} else if syscall.Errno(-1*retCode) == syscall.EPERM {
		return fmt.Errorf("requested action matches default action of filter")
	} else if syscall.Errno(-1*retCode) == syscall.EINVAL {
		return fmt.Errorf("two checks on same syscall argument")
	} else if retCode != 0 {
		return syscall.Errno(-1 * retCode)
	}

	return nil
}
721911
func (g *Cloud) AddRuletoBetaSecurityPolicy(name string, spr *computebeta.SecurityPolicyRule) error {
	ctx, cancel := cloud.ContextWithCallTimeout()
	defer cancel()

	mc := newSecurityPolicyMetricContextWithVersion("add_rule", computeBetaVersion)
	return mc.Observe(g.c.BetaSecurityPolicies().AddRule(ctx, meta.GlobalKey(name), spr))
}
1011688
func (e *Enforcer) AddPolicySafe(params ...interface{}) (result bool, err error) {
	defer func() {
		if r := recover(); r != nil {
			err = fmt.Errorf("%v", r)
			result = false
		}
	}()

	result = e.AddNamedPolicy("p", params...)
	err = nil
	return
}
211598
func addValueFuncs(out map[string]reflect.Value, in FuncMap) {
	for name, fn := range in {
		v := reflect.ValueOf(fn)
		if v.Kind() != reflect.Func {
			panic("value for " + name + " not a function")
		}
		if !goodFunc(v.Type()) {
			panic(fmt.Errorf("can't install method/function %q with %d results", name, v.Type().NumOut()))
		}
		out[name] = v
	}
}
75838
func (b *FirewallModelBuilder) addSSHRules(c *fi.ModelBuilderContext, sgMap map[string]*openstacktasks.SecurityGroup) error {

	masterName := b.SecurityGroupName(kops.InstanceGroupRoleMaster)
	nodeName := b.SecurityGroupName(kops.InstanceGroupRoleNode)
	bastionName := b.SecurityGroupName(kops.InstanceGroupRoleBastion)
	masterSG := sgMap[masterName]
	nodeSG := sgMap[nodeName]
	bastionSG := sgMap[bastionName]

	sshIngress := &openstacktasks.SecurityGroupRule{
		Lifecycle:    b.Lifecycle,
		Direction:    s(string(rules.DirIngress)),
		Protocol:     s(string(rules.ProtocolTCP)),
		EtherType:    s(string(rules.EtherType4)),
		PortRangeMin: i(22),
		PortRangeMax: i(22),
	}

	if b.UsesSSHBastion() {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, bastionSG, nil, sshRule)
		}
		//Allow ingress ssh from the bastion on the masters and nodes
		addDirectionalGroupRule(c, masterSG, bastionSG, sshIngress)
		addDirectionalGroupRule(c, nodeSG, bastionSG, sshIngress)
	} else {
		for _, sshAccess := range b.Cluster.Spec.SSHAccess {
			sshRule := &openstacktasks.SecurityGroupRule{
				Lifecycle:      b.Lifecycle,
				Direction:      s(string(rules.DirIngress)),
				Protocol:       s(string(rules.ProtocolTCP)),
				EtherType:      s(string(rules.EtherType4)),
				PortRangeMin:   i(22),
				PortRangeMax:   i(22),
				RemoteIPPrefix: s(sshAccess),
			}
			addDirectionalGroupRule(c, masterSG, nil, sshRule)
			addDirectionalGroupRule(c, nodeSG, nil, sshRule)
		}
	}
	return nil
}
14586
func (c *ConfigPolicy) AddNewStringRule(ns []string, key string, req bool, opts ...stringRuleOpt) error {
	if key == "" {
		return ErrEmptyKey
	}
	rule := &rpc.StringRule{
		Required: req,
	}

	for _, opt := range opts {
		opt(rule)
	}
	k := strings.Join(ns, ".") // Method used in daemon/ctree
	if c.stringRules[k] == nil {
		c.stringRules[k] = &rpc.StringPolicy{
			Rules: map[string]*rpc.StringRule{},
			Key:   ns,
		}
	}
	c.stringRules[k].Rules[key] = rule
	return nil
}
531289
func (p *PacketFilter) AddIPRule(sourceNetwork string, description string, isAllow bool) (*PacketFilterExpression, error) {

	exp := p.createIPRule(sourceNetwork, description, isAllow)
	p.Expression = append(p.Expression, exp)
	return exp, nil
}
1150102
func (oc *OpCommon) AddRefBlock(ptr data.BlockPointer) {
	oc.RefBlocks = append(oc.RefBlocks, ptr)
}
711586
func (p *PacketFilter) AddFragmentRule(sourceNetwork string, description string, isAllow bool) (*PacketFilterExpression, error) {

	exp := p.createFragmentRule(sourceNetwork, description, isAllow)
	p.Expression = append(p.Expression, exp)
	return exp, nil
}
891606
func (rs *RuleSet) Add(rule *Rule) {
	for _, exist := range *rs {
		if exist.Equal(rule) {
			return
		}
	}
	*rs = append(*rs, rule)
}
360
func (f *fieldHolder) AddFunc(fn func() (string, interface{}, error)) error {
	for {
		key, rawVal, err := fn()
		if err != nil {
			// fn is done giving us data
			break
		}
		f.AddField(key, rawVal)
	}
	return nil
}
1336811
func (c *controllerImpl) addExpectationLocked(
	o MockObject,
	methodName string,
	exp *InternalExpectation) {
	// Get the existing list.
	existing := c.getExpectationsLocked(o, methodName)

	// Store a modified list.
	id := o.Oglemock_Id()
	c.expectationsByObject[id][methodName] = append(existing, exp)
}
421305
func (s *SSL) SetVerifyCallback(verify_cb VerifyCallback) {
	s.SetVerify(s.VerifyMode(), verify_cb)
}
708616
func (vl *Validator) SetValidationFunc(name string, vf ValidationFunc) {
	if vl.funcs == nil {
		vl.funcs = make(map[string]ValidationFunc)
	}
	vl.funcs[name] = vf
}
274049
func (cc *ChainStructure) AddToConditionalFuncs(cf ConditionCallStructure) {
	cc.chainf = append(cc.chainf, cf)
}
1052069
func (c *CSS) AddRuleWithParams(v *CSSAddRuleParams) (*CSSCSSRule, error) {
	resp, err := gcdmessage.SendCustomReturn(c.target, c.target.GetSendCh(), &gcdmessage.ParamRequest{Id: c.target.GetId(), Method: "CSS.addRule", Params: v})
	if err != nil {
		return nil, err
	}

	var chromeData struct {
		Result struct {
			Rule *CSSCSSRule
		}
	}

	if resp == nil {
		return nil, &gcdmessage.ChromeEmptyResponseErr{}
	}

	// test if error first
	cerr := &gcdmessage.ChromeErrorResponse{}
	json.Unmarshal(resp.Data, cerr)
	if cerr != nil && cerr.Error != nil {
		return nil, &gcdmessage.ChromeRequestErr{Resp: cerr}
	}

	if err := json.Unmarshal(resp.Data, &chromeData); err != nil {
		return nil, err
	}

	return chromeData.Result.Rule, nil
}
784602
func (a *App) SeccompOverride() (mode string, errno string, set []string, e error) {
	if a.SeccompFilter == "" {
		return
	}
	for _, i := range strings.Split(a.SeccompFilter, ",") {
		kv := strings.Split(i, "=")
		if len(kv) == 2 {
			switch kv[0] {
			case "mode":
				if kv[1] != "remove" && kv[1] != "retain" {
					e = ErrInvalidSeccompMode
				}
				mode = kv[1]
			case "errno":
				errno = kv[1]
			default:
				e = ErrInvalidSeccompOverride
			}
		} else {
			set = append(set, i)
		}
	}
	return
}