facebook/bpfilter

BPF-based packet filtering framework

BPF-based packet filtering framework

bpfilter is a daemon and shared library aiming to translate packets filtering rules into BPF programs.

Build from sources

bpfilter requires an up-to-date system running Linux 6.4+ and libbpf 1.2+. Build dependencies are the following on Fedora 38:

sudo dnf install -y \
    cmake libbpf-devel \
    libcmocka-devel clang-tools-extra lcov \
    doxygen python3-sphinx python3-breathe python3-furo pkgconf

Quick Start

Run from the source directory:

# Build bpfilter and libbpfilter
cmake -S . -B build
make -C build -j
# Run unit tests
make -C build test

bpfilter daemon will be in $BUILD/src/bpfilter, and libbpfilter.so will be in $BUILD/lib/libbpfilter.so.

License

bpfilter is GPLv2 licensed, as found in the COPYING file.

bpfilter was originally developed by Dmitrii Banshchikov as a Linux kernel usermode helper.

bpfilter's Issues

Compiled bpfilter doesn't load: No such file or directory

Hello @qdeslandes,

I have just compiled the bpfilter module on both the linux-6.1.14 branch and the bpf-next branch, both times I get the following output in dmesg:

[    4.619942] bpfilter: Loaded bpfilter_umh pid 971
[    4.622811] bpfilter: generate forward packet assessment
[    4.622823] bpfilter: generate forward packet assessment
[    4.625250] bpfilter: failed to create TC hook: No such file or directory
[    4.625348] bpfilter: failed to load chain INPUT in table filter: processed 73 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 3
[    4.625455] bpfilter: failed to install new table 'filter': No such file or directory
[    4.625578] bpfilter: failed to created filter table: No such file or directory
[    4.625807] bpfilter: read fail 0

Would you happen to know if I did something wrong?

Thanks a lot,
Mr. Hax

Document minimum-known linux kernel version requirement

Potentially pairs with the new README.md note about libbpf 1.0 requirement.
This could also simply be a listing of the the earliest known-working/developer-tested version(s) of the kernel.

As of PR #12 I can't build on my kernel 5.15.x-based system. It seems the bpf_dynptr was introduced to bpf-next in May 2022. Guessing that puts a minimum kernel for dynptr somewhere around 5.18 or 5.19, which is past that of stock Ubuntu, RHEL, and SLE/SUSE releases according to wikipedia. libbpf 1.0.0 was August 22, 2022, so if libbpf and kernel need to move in-step, perhaps the required kernel is 6.0 or newer?

Totally understand if maintainers want to focus on current kernel releases rather than optional configs and work-around for old kernels, but might help avoid further "issue" reports to document a known minimum.

Provide usage examples in README.md to confirm operation

The original kernel introduction of bpfilter includes a series of usage examples via iptables ping and bpftool. A similar example set of commands (and perhaps expected log output from the bpfilter daemon) would be a huge help in confirming things are hooked in properly after building/loading the binary.