FreeBSD Manual Pages
NG_BPF(4) BSD Kernel Interfaces Manual NG_BPF(4) NAME ng_bpf -- Berkeley packet filter netgraph node type SYNOPSIS #include <net/bpf.h> #include <netgraph/ng_bpf.h> DESCRIPTION The bpf node type allows Berkeley Packet Filter (see bpf(4)) filters to be applied to data travelling through a Netgraph network. Each node al- lows an arbitrary number of connections to arbitrarily named hooks. With each hook is associated a bpf(4) filter program which is applied to in- coming data only, a destination hook for matching packets, a destination hook for non-matching packets, and various statistics counters. A bpf(4) program returns an unsigned integer, which is normally inter- preted as the length of the prefix of the packet to return. In the con- text of this node type, returning zero is considered a non-match, in which case the entire packet is delivered out the non-match destination hook. Returning a value greater than zero causes the packet to be trun- cated to that length and delivered out the match destination hook. Ei- ther or both destination hooks may be the empty string, or may not exist, in which case the packet is dropped. New hooks are initially configured to drop all packets. A new filter program may be installed using the NGM_BPF_SET_PROGRAM control message. HOOKS This node type supports any number of hooks having arbitrary names. CONTROL MESSAGES This node type supports the generic control messages, plus the following: NGM_BPF_SET_PROGRAM This command sets the filter program that will be applied to incom- ing data on a hook. The following structure must be supplied as an argument: struct ng_bpf_hookprog { char thisHook[NG_HOOKLEN+1]; /* name of hook */ char ifMatch[NG_HOOKLEN+1]; /* match dest hook */ char ifNotMatch[NG_HOOKLEN+1]; /* !match dest hook */ int32_t bpf_prog_len; /* #isns in program */ struct bpf_insn bpf_prog[0]; /* bpf program */ }; The hook to be updated is specified in thisHook. The BPF program is the sequence of instructions in the bpf_prog array; there must be bpf_prog_len of them. Matching and non-matching incoming packets are delivered out the hooks named ifMatch and ifNotMatch, respec- tively. The program must be a valid bpf(4) program or else EINVAL is returned. NGM_BPF_GET_PROGRAM This command takes an ASCII string argument, the hook name, and re- turns the corresponding struct ng_bpf_hookprog as shown above. NGM_BPF_GET_STATS This command takes an ASCII string argument, the hook name, and re- turns the statistics associated with the hook as a struct ng_bpf_hookstat. NGM_BPF_CLR_STATS This command takes an ASCII string argument, the hook name, and clears the statistics associated with the hook. NGM_BPF_GETCLR_STATS This command is identical to NGM_BPF_GET_STATS, except that the sta- tistics are also atomically cleared. SHUTDOWN This node shuts down upon receipt of a NGM_SHUTDOWN control message, or when all hooks have been disconnected. EXAMPLES It is possible to configure a node from the command line, using tcpdump(1) to generate raw BPF instructions which are then fed into an awk(1) script to create the ASCII form of a NGM_BPF_SET_PROGRAM control message, as demonstrated here: #!/bin/sh PATTERN="tcp dst port 80" NODEPATH="my_node:" INHOOK="hook1" MATCHHOOK="hook2" NOTMATCHHOOK="hook3" cat > /tmp/bpf.awk << xxENDxx { if (!init) { printf "bpf_prog_len=%d bpf_prog=[", \$1; init=1; } else { printf " { code=%d jt=%d jf=%d k=%d }", \$1, \$2, \$3, \$4; } } END { print " ]" } xxENDxx BPFPROG=`tcpdump -s 8192 -ddd ${PATTERN} | awk -f /tmp/bpf.awk` ngctl msg ${NODEPATH} setprogram { thisHook=\"${INHOOK}\" \ ifMatch=\"${MATCHHOOK}\" \ ifNotMatch=\"${NOTMATCHHOOK}\" \ ${BPFPROG} } } BUGS When built as a loadable kernel module, this module includes the file net/bpf_filter.c. Although loading the module should fail if net/bpf_filter.c already exists in the kernel, currently it does not, and the duplicate copies of the file do not interfere. However, this may change in the future. HISTORY The ng_bpf node type was implemented in FreeBSD 4.0. SEE ALSO bpf(4), netgraph(4), ngctl(8) AUTHORS Archie Cobbs <archie@FreeBSD.org> BSD December 2, 1999 BSD
NAME | SYNOPSIS | DESCRIPTION | HOOKS | CONTROL MESSAGES | SHUTDOWN | EXAMPLES | BUGS | HISTORY | SEE ALSO | AUTHORS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=ng_bpf&sektion=4&manpath=FreeBSD+5.1-RELEASE>