BSD包过滤器（BPF）的研究与改进

【作者】 王汉江；

【导师】 朱淼良；

【作者基本信息】 浙江大学 ， 计算机应用， 2004， 硕士

【摘要】 Unix的发展受到了BSD的重大影响，BSD可谓是传统和正宗的Unix，这一点可以在BSD的历史中看出来。 Unix已经成为高性能的网络的代名词，而许多Unix系统的TCP／IP模块的实现都是以BSD的TCP／IP源代码为起点的。现在免费开放源代码的BSD Unix主要有：FreeBSD，NetBSD，OpenBSD，它们的许可比GNU／Linux采用的GPL更宽松。 BSD包过滤器(BSD Packet Filter，简称BPF)位于BSD Unix的内核中，它独立于TCP／IP协议栈，为应用程序访问数据链路层提供了一个原始接口，被广泛地运用在网络监控及其它软件中，如tcpdump。BPF的过滤器是由假想的过滤器虚拟机实现的，对BPF的编程，可以通过ioctl系统调用和过滤器虚拟机的指令集来直接编程，也可以通过libpcap提供的库函数来编程，它能访问许多种操作系统内核提供的包过滤设施(BPF是其中重要的一种)。 BPF还存在几个问题，其中一个问题是：在以太网的情况下，如果一个进程把网卡设置成混杂模式，另一个打开一个BPF文件但没有请求混杂模式的进程在此网卡上监听的时候，也会收到混杂模式下不是给本机的数据包。目前为补救这个问题，在对BPF编程时，应用程序都要假定以太网卡已经被设置成了混杂模式，从而应该在它的过滤程序中添加许多专门的语句来过滤混杂模式下的外部数据包，这样做虽然能大致解决(并没有完全解决)此问题，却给对BPF的编程造成了相当大的麻烦。本文对BPF在FreeBSD 4.7上进行了改进，解决了此问题，从而也使BPF为应用程序提供了一个更友好的接口。更多还原

【Abstract】 The evolution of Unix was heavily impacted by BSD system, BSD system can be called traditional and authentic Unix, this can be seen in the BSD history.Unix has become synonymous with high quality networking, and many Unix systems’ TCP/IP modules adopted BSD’s TCP/IP source code as their start point. There are mainly three open source BSD systems: FreeBSD, NetBSD, OpenBSD, their licenses are looser than GPL, which is used by GNU/Linux.BSD Packet Filter (BPF) lies in the kernel of BSD Unix, it is independent of the TCP/IP stack, and gives user mode processes a raw interface to access data link layer, it has been widely used in network monitors and other softwares, such as tcpdump. The filter in BPF was implemented by a pseudo machine, which consists of an accumulator, an index register, a scratch memory store, and an implicit program counter. BPF can be directly programmed via ioctl system call and the pseudo machine instruction set, it can also be programmed by using libpcap function library, which can access many kinds of packet capture facilities provided by OSes(BPF is the important one in them).There are several problems in BPF yet, one is: a BPF file that does not request promiscuous mode may receive promiscuously received packets as a side effect of another file requesting this mode on the same hardware interface. Though the problem can be remedied by all BPF files assuming that the interface has been set into promiscuous mode and utilizing a filter to reject foreign packets, this has not thoroughly solved the problem and will trouble programmers to add many special instructions. This paper includes a solution to this BPF’s problem, and the solution has been implemented on FreeBSD 4.7, as a result, it also makes BPF provide a better interface to application program.更多还原