| ng_bpf.4 (122758) | ng_bpf.4 (131530) |
|---|---|
| 1.\" Copyright (c) 1999 Whistle Communications, Inc. 2.\" All rights reserved. 3.\" 4.\" Subject to the following obligations and disclaimer of warranty, use and 5.\" redistribution of this software, in source or object code forms, with or 6.\" without modifications are expressly permitted by Whistle Communications; 7.\" provided, however, that: 8.\" 1. Any and all reproductions of the source or object code must include the --- 18 unchanged lines hidden (view full) --- 27.\" SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY 31.\" OF SUCH DAMAGE. 32.\" 33.\" Author: Archie Cobbs <archie@FreeBSD.org> 34.\" | 1.\" Copyright (c) 1999 Whistle Communications, Inc. 2.\" All rights reserved. 3.\" 4.\" Subject to the following obligations and disclaimer of warranty, use and 5.\" redistribution of this software, in source or object code forms, with or 6.\" without modifications are expressly permitted by Whistle Communications; 7.\" provided, however, that: 8.\" 1. Any and all reproductions of the source or object code must include the --- 18 unchanged lines hidden (view full) --- 27.\" SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY 31.\" OF SUCH DAMAGE. 32.\" 33.\" Author: Archie Cobbs <archie@FreeBSD.org> 34.\" |
| 35.\" $FreeBSD: head/share/man/man4/ng_bpf.4 122758 2003-11-15 15:26:35Z harti $ | 35.\" $FreeBSD: head/share/man/man4/ng_bpf.4 131530 2004-07-03 18:29:24Z ru $ |
| 36.\" $Whistle: ng_bpf.8,v 1.2 1999/12/03 01:57:12 archie Exp $ 37.\" 38.Dd December 2, 1999 39.Dt NG_BPF 4 40.Os 41.Sh NAME 42.Nm ng_bpf 43.Nd Berkeley packet filter netgraph node type 44.Sh SYNOPSIS 45.In net/bpf.h 46.In netgraph/ng_bpf.h 47.Sh DESCRIPTION 48The 49.Nm bpf 50node type allows Berkeley Packet Filter (see 51.Xr bpf 4 ) 52filters to be applied to data travelling through a Netgraph network. 53Each node allows an arbitrary number of connections to arbitrarily | 36.\" $Whistle: ng_bpf.8,v 1.2 1999/12/03 01:57:12 archie Exp $ 37.\" 38.Dd December 2, 1999 39.Dt NG_BPF 4 40.Os 41.Sh NAME 42.Nm ng_bpf 43.Nd Berkeley packet filter netgraph node type 44.Sh SYNOPSIS 45.In net/bpf.h 46.In netgraph/ng_bpf.h 47.Sh DESCRIPTION 48The 49.Nm bpf 50node type allows Berkeley Packet Filter (see 51.Xr bpf 4 ) 52filters to be applied to data travelling through a Netgraph network. 53Each node allows an arbitrary number of connections to arbitrarily |
| 54named hooks. With each hook is associated a | 54named hooks. 55With each hook is associated a |
| 55.Xr bpf 4 56filter program which is applied to incoming data only, a destination hook 57for matching packets, a destination hook for non-matching packets, 58and various statistics counters. 59.Pp 60A 61.Xr bpf 4 62program returns an unsigned integer, which is normally interpreted as | 56.Xr bpf 4 57filter program which is applied to incoming data only, a destination hook 58for matching packets, a destination hook for non-matching packets, 59and various statistics counters. 60.Pp 61A 62.Xr bpf 4 63program returns an unsigned integer, which is normally interpreted as |
| 63the length of the prefix of the packet to return. In the context of this | 64the length of the prefix of the packet to return. 65In the context of this |
| 64node type, returning zero is considered a non-match, in which case the 65entire packet is delivered out the non-match destination hook. 66Returning a value greater than zero causes the packet to be truncated 67to that length and delivered out the match destination hook. 68Either or both destination hooks may be the empty string, or may 69not exist, in which case the packet is dropped. 70.Pp 71New hooks are initially configured to drop all packets. 72A new filter program may be installed using the 73.Dv NGM_BPF_SET_PROGRAM 74control message. 75.Sh HOOKS 76This node type supports any number of hooks having arbitrary names. 77.Sh CONTROL MESSAGES 78This node type supports the generic control messages, plus the following: 79.Bl -tag -width foo 80.It Dv NGM_BPF_SET_PROGRAM 81This command sets the filter program that will be applied to incoming | 66node type, returning zero is considered a non-match, in which case the 67entire packet is delivered out the non-match destination hook. 68Returning a value greater than zero causes the packet to be truncated 69to that length and delivered out the match destination hook. 70Either or both destination hooks may be the empty string, or may 71not exist, in which case the packet is dropped. 72.Pp 73New hooks are initially configured to drop all packets. 74A new filter program may be installed using the 75.Dv NGM_BPF_SET_PROGRAM 76control message. 77.Sh HOOKS 78This node type supports any number of hooks having arbitrary names. 79.Sh CONTROL MESSAGES 80This node type supports the generic control messages, plus the following: 81.Bl -tag -width foo 82.It Dv NGM_BPF_SET_PROGRAM 83This command sets the filter program that will be applied to incoming |
| 82data on a hook. The following structure must be supplied as an argument: | 84data on a hook. 85The following structure must be supplied as an argument: |
| 83.Bd -literal -offset 4n 84struct ng_bpf_hookprog { 85 char thisHook[NG_HOOKSIZ]; /* name of hook */ 86 char ifMatch[NG_HOOKSIZ]; /* match dest hook */ 87 char ifNotMatch[NG_HOOKSIZ]; /* !match dest hook */ 88 int32_t bpf_prog_len; /* #isns in program */ 89 struct bpf_insn bpf_prog[0]; /* bpf program */ 90}; --- 5 unchanged lines hidden (view full) --- 96.Dv bpf_prog 97array; there must be 98.Dv bpf_prog_len 99of them. 100Matching and non-matching incoming packets are delivered out the hooks named 101.Dv ifMatch 102and 103.Dv ifNotMatch , | 86.Bd -literal -offset 4n 87struct ng_bpf_hookprog { 88 char thisHook[NG_HOOKSIZ]; /* name of hook */ 89 char ifMatch[NG_HOOKSIZ]; /* match dest hook */ 90 char ifNotMatch[NG_HOOKSIZ]; /* !match dest hook */ 91 int32_t bpf_prog_len; /* #isns in program */ 92 struct bpf_insn bpf_prog[0]; /* bpf program */ 93}; --- 5 unchanged lines hidden (view full) --- 99.Dv bpf_prog 100array; there must be 101.Dv bpf_prog_len 102of them. 103Matching and non-matching incoming packets are delivered out the hooks named 104.Dv ifMatch 105and 106.Dv ifNotMatch , |
| 104respectively. The program must be a valid | 107respectively. 108The program must be a valid |
| 105.Xr bpf 4 106program or else 107.Er EINVAL 108is returned. 109.It Dv NGM_BPF_GET_PROGRAM 110This command takes an 111.Tn ASCII 112string argument, the hook name, and returns the --- 80 unchanged lines hidden --- | 109.Xr bpf 4 110program or else 111.Er EINVAL 112is returned. 113.It Dv NGM_BPF_GET_PROGRAM 114This command takes an 115.Tn ASCII 116string argument, the hook name, and returns the --- 80 unchanged lines hidden --- |