Support arbitrary linux socket filter (BPF) programs as x_tables match rules. This allows for very expressive filters, and on platforms with BPF JIT appears competitive with traditional hardcoded iptables rules using the u32 match. The size of the filter has been artificially limited to 64 instructions maximum to avoid bloating the size of each rule using this new match.
Showing the changes to include/uapi/linux (1 of 4 files). Show all
Unified · Split
| @@ -0,0 +1,17 @@ | ||
| 1 | +#ifndef _XT_BPF_H | |
| 2 | +#define _XT_BPF_H | |
| 3 | + | |
| 4 | +#include <linux/filter.h> | |
| 5 | +#include <linux/types.h> | |
| 6 | + | |
| 7 | +#define XT_BPF_MAX_NUM_INSTR 64 | |
| 8 | + | |
| 9 | +struct xt_bpf_info { | |
| 10 | + __u16 bpf_program_num_elem; | |
| 11 | + struct sock_filter bpf_program[XT_BPF_MAX_NUM_INSTR]; | |
| 12 | + | |
| 13 | + /* only used in the kernel */ | |
| 14 | + struct sk_filter *filter __attribute__((aligned(8))); | |
| 15 | +}; | |
| 16 | + | |
| 17 | +#endif /*_XT_BPF_H */ | |