diff options
author | Willem de Bruijn <willemb@google.com> | 2016-12-08 17:09:38 -0500 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2016-12-10 14:04:28 +0100 |
commit | f17f9ace8a84f6986235fc2d0fedc1fd5148a3bd (patch) | |
tree | d6bb856a7278cb57c8280fb18f8685ae894b554a /extensions/libxt_bpf.man | |
parent | bb50942a62b2d76810babc0b1150895d9e5ef229 (diff) |
extensions: libxt_bpf: support ebpf pinned objects
Exercise the new kernel feature introduced in commit 2c16d6033264
("netfilter: xt_bpf: support ebpf") to load pinned eBPF programs.
The new interface allows instantiating a bpf match using
-m bpf --object-pinned ${PATH}
where ${PATH} points to a node in a bpf virtual filesystem. See
also the revised man page.
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'extensions/libxt_bpf.man')
-rw-r--r-- | extensions/libxt_bpf.man | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/extensions/libxt_bpf.man b/extensions/libxt_bpf.man index 302e0103..1d2aa9e6 100644 --- a/extensions/libxt_bpf.man +++ b/extensions/libxt_bpf.man @@ -1,8 +1,21 @@ -Match using Linux Socket Filter. Expects a BPF program in decimal format. This -is the format generated by the \fBnfbpf_compile\fP utility. +Match using Linux Socket Filter. Expects a path to an eBPF object or a cBPF +program in decimal format. +.TP +\fB\-\-object\-pinned\fP \fIpath\fP +Pass a path to a pinned eBPF object. +.PP +Applications load eBPF programs into the kernel with the bpf() system call and +BPF_PROG_LOAD command and can pin them in a virtual filesystem with BPF_OBJ_PIN. +To use a pinned object in iptables, mount the bpf filesystem using +.IP +mount \-t bpf bpf ${BPF_MOUNT} +.PP +then insert the filter in iptables by path: +.IP +iptables \-A OUTPUT \-m bpf \-\-object\-pinned ${BPF_MOUNT}/{PINNED_PATH} \-j ACCEPT .TP \fB\-\-bytecode\fP \fIcode\fP -Pass the BPF byte code format (described in the example below). +Pass the BPF byte code format as generated by the \fBnfbpf_compile\fP utility. .PP The code format is similar to the output of the tcpdump -ddd command: one line that stores the number of instructions, followed by one line for each |