net: filter: add a callback to allow classic post-verifier transformations
authorNicolas Schichan <nschichan@freebox.fr>
Wed, 6 May 2015 14:12:27 +0000 (16:12 +0200)
committerDavid S. Miller <davem@davemloft.net>
Sat, 9 May 2015 21:35:05 +0000 (17:35 -0400)
commit4ae92bc77ac8e620f7c8d59b5882a4cb0d1c4ef1
treed8a3a893390631cfaf0547929b8b89c715501b08
parent0e00a0f73f9c7f5e9f02d064ed0165a3aeeb2de5
net: filter: add a callback to allow classic post-verifier transformations

This is in preparation for use by the seccomp code, the rationale is
not to duplicate additional code within the seccomp layer, but instead,
have it abstracted and hidden within the classic BPF API.

As an interim step, this now also makes bpf_prepare_filter() visible
(not as exported symbol though), so that seccomp can reuse that code
path instead of reimplementing it.

Joint work with Daniel Borkmann.

Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Kees Cook <keescook@chromium.org>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/filter.h
net/core/filter.c