tree e7be56bbf797e1632d65cbb98f9f557b2bf1a2e8
parent 5a406b0cdfa948c7d949b270374737b17ee1679f
author Willem de Bruijn <willemb@google.com> 1358493450 +0000
committer Pablo Neira Ayuso <pablo@netfilter.org> 1358767219 +0100

netfilter: x_tables: add xt_bpf match

Support arbitrary linux socket filter (BPF) programs as x_tables
match rules. This allows for very expressive filters, and on
platforms with BPF JIT appears competitive with traditional
hardcoded iptables rules using the u32 match.

The size of the filter has been artificially limited to 64
instructions maximum to avoid bloating the size of each rule
using this new match.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>