path: root/extensions/
diff options
authorWillem de Bruijn <>2016-12-08 17:09:38 -0500
committerPablo Neira Ayuso <>2016-12-10 14:04:28 +0100
commitf17f9ace8a84f6986235fc2d0fedc1fd5148a3bd (patch)
treed6bb856a7278cb57c8280fb18f8685ae894b554a /extensions/
parentbb50942a62b2d76810babc0b1150895d9e5ef229 (diff)
extensions: libxt_bpf: support ebpf pinned objects
Exercise the new kernel feature introduced in commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") to load pinned eBPF programs. The new interface allows instantiating a bpf match using -m bpf --object-pinned ${PATH} where ${PATH} points to a node in a bpf virtual filesystem. See also the revised man page. Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>
Diffstat (limited to 'extensions/')
1 files changed, 16 insertions, 3 deletions
diff --git a/extensions/ b/extensions/
index 302e0103..1d2aa9e6 100644
--- a/extensions/
+++ b/extensions/
@@ -1,8 +1,21 @@
-Match using Linux Socket Filter. Expects a BPF program in decimal format. This
-is the format generated by the \fBnfbpf_compile\fP utility.
+Match using Linux Socket Filter. Expects a path to an eBPF object or a cBPF
+program in decimal format.
+\fB\-\-object\-pinned\fP \fIpath\fP
+Pass a path to a pinned eBPF object.
+Applications load eBPF programs into the kernel with the bpf() system call and
+BPF_PROG_LOAD command and can pin them in a virtual filesystem with BPF_OBJ_PIN.
+To use a pinned object in iptables, mount the bpf filesystem using
+mount \-t bpf bpf ${BPF_MOUNT}
+then insert the filter in iptables by path:
+iptables \-A OUTPUT \-m bpf \-\-object\-pinned ${BPF_MOUNT}/{PINNED_PATH} \-j ACCEPT
\fB\-\-bytecode\fP \fIcode\fP
-Pass the BPF byte code format (described in the example below).
+Pass the BPF byte code format as generated by the \fBnfbpf_compile\fP utility.
The code format is similar to the output of the tcpdump -ddd command: one line
that stores the number of instructions, followed by one line for each