path: root/extensions/
Commit message (Collapse)AuthorAgeFilesLines
* extensions: libxt_bpf: support ebpf pinned objectsWillem de Bruijn2016-12-101-3/+16
| | | | | | | | | | | | | | | Exercise the new kernel feature introduced in commit 2c16d6033264 ("netfilter: xt_bpf: support ebpf") to load pinned eBPF programs. The new interface allows instantiating a bpf match using -m bpf --object-pinned ${PATH} where ${PATH} points to a node in a bpf virtual filesystem. See also the revised man page. Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>
* extensions/ clarify BPF code generation with tcpdumpWillem de Bruijn2016-08-121-0/+13
| | | | | | | | | | | | | | | | | | | The xt_bpf module applies BPF bytecode to the packet. Depending on where the module is invoked, the kernel may pass a packet with or without link layer header. Iptables has no such header. A common `tcpdump -ddd <string>` compilation command may revert to a physical device that generates code for packets starting from the mac layer up (e.g., E10MB data link type: Ethernet). Clarify in the man page that when using this tool for code generation, a suitable target device must be chosen. Netfilter Bugzilla Bug #1048 Reported-by: Lorenzo Pistone <> Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>
* extensions: libxt_bpf: clarify --bytecode argumentPablo Neira Ayuso2013-04-191-1/+1
| | | | | | | | | Mart Frauenlob suggested a change to explain the --bytecode better. I have added some reference to the example bytecode in the format that this argument accepts. Reported-by: Mart Frauenlob <> Signed-off-by: Pablo Neira Ayuso <>
* extensions: add libxt_bpf extensionWillem de Bruijn2013-04-021-0/+34
Add user-space code to support the new BPF iptables extension. Pablo has mangled the original patch to: * include a copy of include/linux/netfilter/xt_bpf.h in the tree. * I have also remove the --bytecode-file option. The original proposal was to accept BPF code in a file in human readable format. Now, with the nfbpf_compile utility, it's very easy to generate the filter using tcpdump-like syntax. * I have remove the trailing comma in the backtick format, the parser works just fine for me here. * Fix error message if --bytecode is missing. Signed-off-by: Willem de Bruijn <> Signed-off-by: Pablo Neira Ayuso <>