path: root/extensions/
diff options
authorWillem de Bruijn <>2013-01-23 16:00:58 +0000
committerPablo Neira Ayuso <>2013-04-02 00:08:21 +0200
commite0a0dd703b3448f0f07fc59b7232bf1f1cce7b86 (patch)
tree27cad8d433a409d96b46269518d442048b725df5 /extensions/
parent71eddedcbf7aebe0cd05421d13b049dd710eaf7f (diff)
extensions: add libxt_bpf extension
Add user-space code to support the new BPF iptables extension. Pablo has mangled the original patch to: * include a copy of include/linux/netfilter/xt_bpf.h in the tree. * I have also remove the --bytecode-file option. The original proposal was to accept BPF code in a file in human readable format. Now, with the nfbpf_compile utility, it's very easy to generate the filter using tcpdump-like syntax. * I have remove the trailing comma in the backtick format, the parser works just fine for me here. * Fix error message if --bytecode is missing. Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'extensions/')
1 files changed, 34 insertions, 0 deletions
diff --git a/extensions/ b/extensions/
new file mode 100644
index 00000000..4120a23d
--- /dev/null
+++ b/extensions/
@@ -0,0 +1,34 @@
+Match using Linux Socket Filter. Expects a BPF program in decimal format. This
+is the format generated by the \fBnfbpf_compile\fP utility.
+\fB\-\-bytecode\fP \fIcode\fP
+Pass the code in backtick format as argument.
+The code format is similar to the output of the tcpdump -ddd command: one line
+that stores the number of instructions, followed by one line for each
+instruction. Instruction lines follow the pattern 'u16 u8 u8 u32' in decimal
+notation. Fields encode the operation, jump offset if true, jump offset if
+false and generic multiuse field 'K'. Comments are not supported.
+For example, to read only packets matching 'ip proto 6', insert the following,
+without the comments or trailing whitespace:
+4 # number of instructions
+48 0 0 9 # load byte ip->proto
+21 0 1 6 # jump equal IPPROTO_TCP
+6 0 0 1 # return pass (non-zero)
+6 0 0 0 # return fail (zero)
+You can pass this filter to the bpf match with the following command:
+iptables \-A OUTPUT \-m bpf \-\-bytecode '4,48 0 0 9,21 0 1 6,6 0 0 1,6 0 0 0' \-j ACCEPT
+Or instead, you can invoke the nfbpf_compile utility.
+iptables \-A OUTPUT \-m bpf \-\-bytecode "`nfbpf_compile RAW 'ip proto 6'`" \-j ACCEPT
+You may want to learn more about BPF from FreeBSD's bpf(4) manpage.