kernel - Are Berkeley Packet Filter opcode values implementation defined? -
are berkeley packet filter opcode values implementation defined?
i thought of tcpdump/libpcap authoritative in bpf arena. noticed linux kernel , tcpdump read bpf filters differently. bpf mnemonics , behavior same, actual opcode values seem different. went looking on internets "the standard", i've found has mnemonics.
no, other instructions bpf interpreters/jits support others don't, have same binary values. compare, example, current libpcap pcap/bpf.h with, @ least, linux linux/bpf_common.h , linux/filter.h in 3.19 kernel, , note comment in linux/filter.h reads:
/* * try , keep these values , structures similar bsd, * bpf code definitions need match can share filters */
and code in libpcap uses same compiler generate bpf code linux kernel, *bsd/os x/solaris 11/etc. kernels, , userland bpf interpreter, small code changes deal fetching packet metadata (rather packet data).
Comments
Post a Comment