facebook / bpfilter

BPF-based packet filtering framework

BPF-based packet filtering framework

bpfilter.ko is an out-of-tree kernel module catching setsockopt() requests coming from iptables-legacy and converting the rules into BPF programs.

CONFIG_BPFILTER needs to be enabled.

To build the kernel module:

make \
	-C $SOURCE_DIR \
	O=$BUILD_DIR \
	M=$PATH_TO_BPFILTER_SOURCES

At present, the code statically sets the interface to which bpfilter is attached. However, there are plans to enhance this functionality in the future. As of now, you will need to make changes to PROG_IFINDEX in codegen.c if you want to modify the interface.

License

bpfilter is GPLv2 licensed, as found in the COPYING file.

bpfilter was originally developed by Dmitrii Banshchikov as a Linux kernel usermode helper.

bpfilter's Issues

Compiled bpfilter doesn't load: No such file or directory

Hello @qdeslandes,

I have just compiled the bpfilter module on both the linux-6.1.14 branch and the bpf-next branch, both times I get the following output in dmesg:

[    4.619942] bpfilter: Loaded bpfilter_umh pid 971
[    4.622811] bpfilter: generate forward packet assessment
[    4.622823] bpfilter: generate forward packet assessment
[    4.625250] bpfilter: failed to create TC hook: No such file or directory
[    4.625348] bpfilter: failed to load chain INPUT in table filter: processed 73 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 3
[    4.625455] bpfilter: failed to install new table 'filter': No such file or directory
[    4.625578] bpfilter: failed to created filter table: No such file or directory
[    4.625807] bpfilter: read fail 0

Would you happen to know if I did something wrong?

Thanks a lot,
Mr. Hax