bpf_dsl: move more implementation details out of bpf_dsl.h

sandbox/linux/bpf_dsl/bpf_dsl.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 #define SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_
 
 #include <stdint.h>
 
 #include <utility>
 #include <vector>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "sandbox/linux/bpf_dsl/cons.h"
 #include "sandbox/linux/bpf_dsl/trap_registry.h"
 #include "sandbox/sandbox_export.h"
 
-namespace sandbox {
-class ErrorCode;
-class Verifier;
-namespace bpf_dsl {
-class PolicyCompiler;
-}
-}
-
 // The sandbox::bpf_dsl namespace provides a domain-specific language
 // to make writing BPF policies more expressive.  In general, the
 // object types all have value semantics (i.e., they can be copied
 // around, returned from or passed to function calls, etc. without any
 // surprising side effects), though not all support assignment.
 //
 // An idiomatic and demonstrative (albeit silly) example of this API
 // would be:
 //
 //      #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
@@ skipping 83 matching lines @@
   virtual ResultExpr EvaluateSyscall(int sysno) const = 0;
 
   // Optional overload for specifying alternate behavior for invalid
   // system calls.  The default is to return ENOSYS.
   virtual ResultExpr InvalidSyscall() const;
 
   // Helper method so policies can just write Trap(func, aux).
   static ResultExpr Trap(TrapRegistry::TrapFnc trap_func, const void* aux);
 
  private:
-  friend PolicyCompiler;
-  friend Verifier;
-
-  // Private methods used for compiling and verifying policies.
-  ErrorCode EvaluateSyscall(PolicyCompiler* pc, int sysno) const;
-  ErrorCode InvalidSyscall(PolicyCompiler* pc) const;
-  bool HasUnsafeTraps() const;
-
   DISALLOW_COPY_AND_ASSIGN(SandboxBPFDSLPolicy);
 };
 
 // Allow specifies a result that the system call should be allowed to
 // execute normally.
 SANDBOX_EXPORT ResultExpr Allow();
 
 // Error specifies a result that the system call should fail with
 // error number |err|.  As a special case, Error(0) will result in the
 // system call appearing to have succeeded, but without having any
@@ skipping 219 matching lines @@
 
 template <typename T>
 ResultExpr Caser<T>::Default(ResultExpr result) const {
   return elser_.Else(result);
 }
 
 }  // namespace bpf_dsl
 }  // namespace sandbox
 
 #endif  // SANDBOX_LINUX_BPF_DSL_BPF_DSL_H_