1.\" Copyright (c) 1999 Whistle Communications, Inc. 2.\" All rights reserved. 3.\" 4.\" Subject to the following obligations and disclaimer of warranty, use and 5.\" redistribution of this software, in source or object code forms, with or 6.\" without modifications are expressly permitted by Whistle Communications; 7.\" provided, however, that: 8.\" 1. Any and all reproductions of the source or object code must include the 9.\" copyright notice above and the following disclaimer of warranties; and 10.\" 2. No rights are granted, in any manner or form, to use Whistle 11.\" Communications, Inc. trademarks, including the mark "WHISTLE 12.\" COMMUNICATIONS" on advertising, endorsements, or otherwise except as 13.\" such appears in the above copyright notice or in the software. 14.\" 15.\" THIS SOFTWARE IS BEING PROVIDED BY WHISTLE COMMUNICATIONS "AS IS", AND 16.\" TO THE MAXIMUM EXTENT PERMITTED BY LAW, WHISTLE COMMUNICATIONS MAKES NO 17.\" REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, REGARDING THIS SOFTWARE, 18.\" INCLUDING WITHOUT LIMITATION, ANY AND ALL IMPLIED WARRANTIES OF 19.\" MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. 20.\" WHISTLE COMMUNICATIONS DOES NOT WARRANT, GUARANTEE, OR MAKE ANY 21.\" REPRESENTATIONS REGARDING THE USE OF, OR THE RESULTS OF THE USE OF THIS 22.\" SOFTWARE IN TERMS OF ITS CORRECTNESS, ACCURACY, RELIABILITY OR OTHERWISE. 23.\" IN NO EVENT SHALL WHISTLE COMMUNICATIONS BE LIABLE FOR ANY DAMAGES 24.\" RESULTING FROM OR ARISING OUT OF ANY USE OF THIS SOFTWARE, INCLUDING 25.\" WITHOUT LIMITATION, ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 26.\" PUNITIVE, OR CONSEQUENTIAL DAMAGES, PROCUREMENT OF SUBSTITUTE GOODS OR 27.\" SERVICES, LOSS OF USE, DATA OR PROFITS, HOWEVER CAUSED AND UNDER ANY 28.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30.\" THIS SOFTWARE, EVEN IF WHISTLE COMMUNICATIONS IS ADVISED OF THE POSSIBILITY 31.\" OF SUCH DAMAGE. 32.\" 33.\" Author: Archie Cobbs <archie@FreeBSD.org> 34.\" 35.\" $FreeBSD$ 36.\" $Whistle: ng_bpf.8,v 1.2 1999/12/03 01:57:12 archie Exp $ 37.\" 38.Dd May 30, 2007 39.Dt NG_BPF 4 40.Os 41.Sh NAME 42.Nm ng_bpf 43.Nd Berkeley packet filter netgraph node type 44.Sh SYNOPSIS 45.In sys/types.h 46.In net/bpf.h 47.In netgraph.h 48.In netgraph/ng_bpf.h 49.Sh DESCRIPTION 50The 51.Nm bpf 52node type allows Berkeley Packet Filter (see 53.Xr bpf 4 ) 54filters to be applied to data travelling through a Netgraph network. 55Each node allows an arbitrary number of connections to arbitrarily 56named hooks. 57With each hook is associated a 58.Xr bpf 4 59filter program which is applied to incoming data only, a destination hook 60for matching packets, a destination hook for non-matching packets, 61and various statistics counters. 62.Pp 63A 64.Xr bpf 4 65program returns an unsigned integer, which is normally interpreted as 66the length of the prefix of the packet to return. 67In the context of this 68node type, returning zero is considered a non-match, in which case the 69entire packet is delivered out the non-match destination hook. 70Returning a value greater than zero causes the packet to be truncated 71to that length and delivered out the match destination hook. 72Either or both destination hooks may be the empty string, or may 73not exist, in which case the packet is dropped. 74.Pp 75New hooks are initially configured to drop all packets. 76A new filter program may be installed using the 77.Dv NGM_BPF_SET_PROGRAM 78control message. 79.Sh HOOKS 80This node type supports any number of hooks having arbitrary names. 81.Sh CONTROL MESSAGES 82This node type supports the generic control messages, plus the following: 83.Bl -tag -width foo 84.It Dv NGM_BPF_SET_PROGRAM 85This command sets the filter program that will be applied to incoming 86data on a hook. 87The following structure must be supplied as an argument: 88.Bd -literal -offset 4n 89struct ng_bpf_hookprog { 90 char thisHook[NG_HOOKSIZ]; /* name of hook */ 91 char ifMatch[NG_HOOKSIZ]; /* match dest hook */ 92 char ifNotMatch[NG_HOOKSIZ]; /* !match dest hook */ 93 int32_t bpf_prog_len; /* #isns in program */ 94 struct bpf_insn bpf_prog[]; /* bpf program */ 95}; 96.Ed 97.Pp 98The hook to be updated is specified in 99.Dv thisHook . 100The BPF program is the sequence of instructions in the 101.Dv bpf_prog 102array; there must be 103.Dv bpf_prog_len 104of them. 105Matching and non-matching incoming packets are delivered out the hooks named 106.Dv ifMatch 107and 108.Dv ifNotMatch , 109respectively. 110The program must be a valid 111.Xr bpf 4 112program or else 113.Er EINVAL 114is returned. 115.It Dv NGM_BPF_GET_PROGRAM 116This command takes an 117.Tn ASCII 118string argument, the hook name, and returns the 119corresponding 120.Dv "struct ng_bpf_hookprog" 121as shown above. 122.It Dv NGM_BPF_GET_STATS 123This command takes an 124.Tn ASCII 125string argument, the hook name, and returns the 126statistics associated with the hook as a 127.Dv "struct ng_bpf_hookstat" . 128.It Dv NGM_BPF_CLR_STATS 129This command takes an 130.Tn ASCII 131string argument, the hook name, and clears the 132statistics associated with the hook. 133.It Dv NGM_BPF_GETCLR_STATS 134This command is identical to 135.Dv NGM_BPF_GET_STATS , 136except that the statistics are also atomically cleared. 137.El 138.Sh SHUTDOWN 139This node shuts down upon receipt of a 140.Dv NGM_SHUTDOWN 141control message, or when all hooks have been disconnected. 142.Sh EXAMPLES 143It is possible to configure a node from the command line, using 144.Xr tcpdump 1 145to generate raw BPF instructions which are then fed into an 146.Xr awk 1 147script to create the ASCII form of a 148.Dv NGM_BPF_SET_PROGRAM 149control message, as demonstrated here: 150.Bd -literal -offset 4n 151#!/bin/sh 152 153PATTERN="tcp dst port 80" 154NODEPATH="my_node:" 155INHOOK="hook1" 156MATCHHOOK="hook2" 157NOTMATCHHOOK="hook3" 158 159cat > /tmp/bpf.awk << xxENDxx 160{ 161 if (!init) { 162 printf "bpf_prog_len=%d bpf_prog=[", \\$1; 163 init=1; 164 } else { 165 printf " { code=%d jt=%d jf=%d k=%d }", \\$1, \\$2, \\$3, \\$4; 166 } 167} 168END { 169 print " ]" 170} 171xxENDxx 172 173BPFPROG=`tcpdump -s 8192 -ddd ${PATTERN} | awk -f /tmp/bpf.awk` 174 175ngctl msg ${NODEPATH} setprogram { thisHook=\\"${INHOOK}\\" \\ 176 ifMatch=\\"${MATCHHOOK}\\" \\ 177 ifNotMatch=\\"${NOTMATCHHOOK}\\" \\ 178 ${BPFPROG} } 179.Ed 180.Sh SEE ALSO 181.Xr bpf 4 , 182.Xr netgraph 4 , 183.Xr ngctl 8 184.Sh HISTORY 185The 186.Nm 187node type was implemented in 188.Fx 4.0 . 189.Sh AUTHORS 190.An Archie Cobbs Aq archie@FreeBSD.org 191.Sh BUGS 192When built as a loadable kernel module, this module includes the file 193.Pa net/bpf_filter.c . 194Although loading the module should fail if 195.Pa net/bpf_filter.c 196already exists in the kernel, currently it does not, and the duplicate 197copies of the file do not interfere. 198However, this may change in the future. 199