Daniel Borkmann 7d1d65cb84
net: sched: cls_bpf: add BPF-based classifier ...
This work contains a lightweight BPF-based traffic classifier that can
serve as a flexible alternative to ematch-based tree classification, i.e.
now that BPF filter engine can also be JITed in the kernel. Naturally, tc
actions and policies are supported as well with cls_bpf. Multiple BPF
programs/filter can be attached for a class, or they can just as well be
written within a single BPF program, that's really up to the user how he
wishes to run/optimize the code, e.g. also for inversion of verdicts etc.
The notion of a BPF program's return/exit codes is being kept as follows:
0: No match
-1: Select classid given in "tc filter ..." command
else: flowid, overwrite the default one
As a minimal usage example with iproute2, we use a 3 band prio root qdisc
on a router with sfq each as leave, and assign ssh and icmp bpf-based
filters to band 1, http traffic to band 2 and the rest to band 3. For the
first two bands we load the bytecode from a file, in the 2nd we load it
inline as an example:
echo 1 > /proc/sys/net/core/bpf_jit_enable
tc qdisc del dev em1 root
tc qdisc add dev em1 root handle 1: prio bands 3 priomap 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
tc qdisc add dev em1 parent 1:1 sfq perturb 16
tc qdisc add dev em1 parent 1:2 sfq perturb 16
tc qdisc add dev em1 parent 1:3 sfq perturb 16
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/ssh.bpf flowid 1:1
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/icmp.bpf flowid 1:1
tc filter add dev em1 parent 1: bpf run bytecode-file /etc/tc/http.bpf flowid 1:2
tc filter add dev em1 parent 1: bpf run bytecode "`bpfc -f tc -i misc.ops`" flowid 1:3
BPF programs can be easily created and passed to tc, either as inline
'bytecode' or 'bytecode-file'. There are a couple of front-ends that can
compile opcodes, for example:
1) People familiar with tcpdump-like filters:
tcpdump -iem1 -ddd port 22 | tr '\n' ',' > /etc/tc/ssh.bpf
2) People that want to low-level program their filters or use BPF
extensions that lack support by libpcap's compiler:
bpfc -f tc -i ssh.ops > /etc/tc/ssh.bpf
ssh.ops example code:
ldh [12]
jne #0x800, drop
ldb [23]
jneq #6 , drop
ldh [20]
jset #0x1fff, drop
ldxb 4 * ([14] & 0xf)
ldh [%x + 14]
jeq #0x16, pass
ldh [%x + 16]
jne #0x16, drop
pass: ret #-1
drop: ret #0
It was chosen to load bytecode into tc, since the reverse operation,
tc filter list dev em1, is then able to show the exact commands again.
Possible follow-up work could also include a small expression compiler
for iproute2. Tested with the help of bmon. This idea came up during
the Netfilter Workshop 2013 in Copenhagen. Also thanks to feedback from
Eric Dumazet!
Signed-off-by: Daniel Borkmann <dborkman@redhat.com >
Cc: Thomas Graf <tgraf@suug.ch >
Signed-off-by: David S. Miller <davem@davemloft.net >
2013-10-29 17:33:17 -04:00
2012-10-13 10:46:49 +01:00
2013-04-23 13:25:51 -04:00
2013-09-21 15:43:12 +02:00
2013-09-08 14:34:22 -05:00
2013-04-08 06:53:15 -03:00
2012-11-09 16:28:37 -05:00
2012-10-09 09:48:44 +01:00
2012-10-09 09:48:45 +01:00
2012-10-11 17:27:54 -04:00
2013-10-14 18:01:01 +02:00
2012-10-09 09:48:56 +01:00
2013-08-02 12:33:54 -07:00
2013-08-02 12:33:54 -07:00
2013-04-02 12:25:57 +02:00
2012-10-09 09:49:02 +01:00
2013-03-13 15:21:49 -07:00
2012-10-09 09:49:03 +01:00
2012-10-09 09:49:04 +01:00
2013-10-02 16:39:11 -04:00
2012-10-09 09:49:06 +01:00
2013-07-16 15:33:02 -07:00
2013-08-02 12:33:54 -07:00
2012-10-13 10:46:48 +01:00
2013-03-13 15:21:48 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-13 15:21:48 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-05-07 22:27:15 -04:00
2012-10-13 10:46:48 +01:00
2013-02-08 20:42:18 +01:00
2013-04-26 16:08:16 +10:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-07-01 15:10:53 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-01 08:16:01 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-01-21 15:40:35 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-28 19:26:38 -07:00
2013-03-20 13:23:21 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-15 12:12:36 -07:00
2013-06-25 15:50:04 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-05 20:46:06 -04:00
2012-10-13 10:46:48 +01:00
2013-08-02 12:33:54 -07:00
2013-08-20 16:53:58 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-02 16:35:50 +01:00
2012-10-16 18:49:15 -07:00
2013-03-27 14:37:47 +00:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-05-27 22:42:50 -07:00
2012-11-09 06:41:46 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-03 10:40:23 -07:00
2013-08-16 22:05:14 -04:00
2013-03-20 13:15:45 -04:00
2013-07-27 20:24:36 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-10 18:56:29 -04:00
2012-10-13 10:46:48 +01:00
2013-05-01 14:37:21 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-06-11 02:51:03 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-11-19 22:21:03 +00:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-03 22:11:44 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-06-24 16:39:05 -07:00
2013-10-03 15:36:38 -04:00
2013-08-02 12:33:54 -07:00
2013-05-08 13:13:30 -07:00
2012-10-13 10:46:48 +01:00
2013-03-28 01:20:42 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-10-19 18:58:46 -04:00
2012-10-13 10:46:48 +01:00
2013-08-29 16:43:29 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-13 15:10:22 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-21 12:21:45 -07:00
2012-11-20 13:43:28 -05:00
2013-02-10 20:37:22 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-04 13:12:43 -04:00
2012-10-13 10:46:48 +01:00
2013-09-04 13:12:43 -04:00
2012-10-23 14:57:52 -04:00
2012-10-13 10:46:48 +01:00
2013-09-15 07:13:39 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-06-26 18:01:46 +09:00
2013-08-26 16:37:08 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-02-27 19:10:21 -08:00
2012-10-13 10:46:48 +01:00
2012-11-16 01:47:40 -05:00
2013-08-29 15:32:08 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-17 12:31:15 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-07 20:19:02 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-26 12:46:01 +03:00
2013-08-26 15:36:58 +03:00
2012-10-13 10:46:48 +01:00
2013-09-04 13:12:43 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-05-04 15:48:44 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-21 14:05:31 -03:00
2012-10-13 10:46:48 +01:00
2012-12-11 14:42:48 +00:00
2013-02-05 18:23:47 -02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-12-14 13:05:23 +10:30
2012-10-13 10:46:48 +01:00
2013-01-21 13:55:14 -05:00
2013-01-21 13:55:14 -05:00
2013-07-09 10:33:25 -07:00
2013-01-04 16:11:45 -08:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-02-27 19:10:22 -08:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-17 12:23:46 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-12-04 13:08:10 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-04-19 14:57:58 -04:00
2013-04-19 14:57:57 -04:00
2012-10-13 10:46:48 +01:00
2013-08-14 01:12:58 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-23 16:06:03 +02:00
2012-10-13 10:46:48 +01:00
2013-09-03 16:32:26 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-11-16 10:15:35 -08:00
2013-08-26 14:03:13 -07:00
2013-04-29 13:21:30 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-28 11:28:10 -06:00
2012-10-13 10:46:48 +01:00
2013-09-20 09:45:11 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-10-29 17:33:17 -04:00
2013-09-20 14:41:03 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-11-01 11:41:34 -04:00
2013-07-03 16:08:01 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-07-25 19:30:03 +10:00
2012-10-13 10:46:48 +01:00
2013-04-12 16:54:38 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-06-19 23:06:51 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-07-24 17:53:38 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-06 11:14:33 -07:00
2013-08-27 16:02:18 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-12-19 18:07:39 -05:00
2012-10-13 10:46:48 +01:00
2013-08-16 15:37:26 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-12-06 01:22:31 +00:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-07-24 17:54:48 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-22 16:19:59 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-06-17 15:53:00 -07:00
2013-06-17 15:53:00 -07:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-07-31 10:33:05 +02:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-21 12:36:33 -04:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-08-18 07:13:36 -03:00
2013-08-18 08:13:51 -03:00
2013-08-18 07:23:07 -03:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-09-04 11:28:04 -06:00
2013-05-02 13:40:15 +03:00
2013-08-18 08:17:35 -03:00
2012-10-13 10:46:48 +01:00
2013-04-02 16:42:58 +10:30
2012-10-13 10:46:48 +01:00
2013-07-09 10:47:45 +09:30
2013-07-03 13:09:06 -07:00
2013-03-20 14:06:06 +10:30
2013-08-02 12:33:54 -07:00
2013-05-20 12:08:09 +09:30
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-03-08 12:24:48 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-01-31 19:56:35 -05:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2012-10-13 10:46:48 +01:00
2013-02-27 19:10:10 -08:00
2013-03-06 07:02:45 +01:00
7d1d65cb84