Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
NG_BPF(4)		 BSD Kernel Interfaces Manual		     NG_BPF(4)

NAME
     ng_bpf -- Berkeley	packet filter netgraph node type

SYNOPSIS
     #include <net/bpf.h>
     #include <netgraph/ng_bpf.h>

DESCRIPTION
     The bpf node type allows Berkeley Packet Filter (see bpf(4)) filters to
     be	applied	to data	travelling through a Netgraph network.	Each node al-
     lows an arbitrary number of connections to	arbitrarily named hooks.  With
     each hook is associated a bpf(4) filter program which is applied to in-
     coming data only, a destination hook for matching packets,	a destination
     hook for non-matching packets, and	various	statistics counters.

     A bpf(4) program returns an unsigned integer, which is normally inter-
     preted as the length of the prefix	of the packet to return.  In the con-
     text of this node type, returning zero is considered a non-match, in
     which case	the entire packet is delivered out the non-match destination
     hook.  Returning a	value greater than zero	causes the packet to be	trun-
     cated to that length and delivered	out the	match destination hook.	 Ei-
     ther or both destination hooks may	be the empty string, or	may not	exist,
     in	which case the packet is dropped.

     New hooks are initially configured	to drop	all packets.  A	new filter
     program may be installed using the	NGM_BPF_SET_PROGRAM control message.

HOOKS
     This node type supports any number	of hooks having	arbitrary names.

CONTROL	MESSAGES
     This node type supports the generic control messages, plus	the following:

     NGM_BPF_SET_PROGRAM
	  This command sets the	filter program that will be applied to incom-
	  ing data on a	hook.  The following structure must be supplied	as an
	  argument:

	      struct ng_bpf_hookprog {
		char		thisHook[NG_HOOKLEN+1];	  /* name of hook */
		char		ifMatch[NG_HOOKLEN+1];	  /* match dest	hook */
		char		ifNotMatch[NG_HOOKLEN+1]; /* !match dest hook */
		int32_t		bpf_prog_len;		  /* #isns in program */
		struct bpf_insn	bpf_prog[0];		  /* bpf program */
	      };

	  The hook to be updated is specified in thisHook.  The	BPF program is
	  the sequence of instructions in the bpf_prog array; there must be
	  bpf_prog_len of them.	 Matching and non-matching incoming packets
	  are delivered	out the	hooks named ifMatch and	ifNotMatch, respec-
	  tively.  The program must be a valid bpf(4) program or else EINVAL
	  is returned.

     NGM_BPF_GET_PROGRAM
	  This command takes an	ASCII string argument, the hook	name, and re-
	  turns	the corresponding struct ng_bpf_hookprog as shown above.

     NGM_BPF_GET_STATS
	  This command takes an	ASCII string argument, the hook	name, and re-
	  turns	the statistics associated with the hook	as a struct
	  ng_bpf_hookstat.

     NGM_BPF_CLR_STATS
	  This command takes an	ASCII string argument, the hook	name, and
	  clears the statistics	associated with	the hook.

     NGM_BPF_GETCLR_STATS
	  This command is identical to NGM_BPF_GET_STATS, except that the sta-
	  tistics are also atomically cleared.

SHUTDOWN
     This node shuts down upon receipt of a NGM_SHUTDOWN control message, or
     when all hooks have been disconnected.

EXAMPLES
     It	is possible to configure a node	from the command line, using
     tcpdump(1)	to generate raw	BPF instructions which are then	fed into an
     awk(1) script to create the ASCII form of a NGM_BPF_SET_PROGRAM control
     message, as demonstrated here:

	 #!/bin/sh

	 PATTERN="tcp dst port 80"
	 NODEPATH="my_node:"
	 INHOOK="hook1"
	 MATCHHOOK="hook2"
	 NOTMATCHHOOK="hook3"

	 cat > /tmp/bpf.awk << xxENDxx
	 {
	   if (!init) {
	     printf "bpf_prog_len=%d bpf_prog=[", \$1;
	     init=1;
	   } else {
	     printf " {	code=%d	jt=%d jf=%d k=%d }", \$1, \$2, \$3, \$4;
	   }
	 }
	 END {
	   print " ]"
	 }
	 xxENDxx

	 BPFPROG=`tcpdump -s 8192 -ddd ${PATTERN} | awk	-f /tmp/bpf.awk`

	 ngctl msg ${NODEPATH} setprogram { thisHook=\"${INHOOK}\" \
	   ifMatch=\"${MATCHHOOK}\" \
	   ifNotMatch=\"${NOTMATCHHOOK}\" \
	   ${BPFPROG} }	}

BUGS
     When built	as a loadable kernel module, this module includes the file
     net/bpf_filter.c.	Although loading the module should fail	if
     net/bpf_filter.c already exists in	the kernel, currently it does not, and
     the duplicate copies of the file do not interfere.	 However, this may
     change in the future.

HISTORY
     The ng_bpf	node type was implemented in FreeBSD 4.0.

SEE ALSO
     bpf(4), netgraph(4), ngctl(8)

AUTHORS
     Archie Cobbs <archie@FreeBSD.org>

BSD			       December	2, 1999				   BSD

NAME | SYNOPSIS | DESCRIPTION | HOOKS | CONTROL MESSAGES | SHUTDOWN | EXAMPLES | BUGS | HISTORY | SEE ALSO | AUTHORS

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=ng_bpf&sektion=4&manpath=FreeBSD+5.0-RELEASE>

home | help