NAME¶

SYNOPSIS¶

DESCRIPTION¶

HOOKS¶

in

Packets received on this hook are modified according to rules specified in the configuration and then forwarded to the out hook, if it exists. Otherwise they are reflected back to the in hook.

out

Packets received on this hook are forwarded to the in hook without any changes.

CONTROL MESSAGES¶

NGM_PATCH_SETDLT (setdlt)

Sets the data link type on the in hook (to help calculate relative offset). Currently, supported types are DLT_RAW (raw IP datagrams , no offset applied, the default) and DLT_EN10MB (Ethernet). DLT_ definitions can be found in <net/bpf.h>. If you want to work on the link layer header you must use no additional offset by specifying DLT_RAW. If EN10MB is specified, then the optional additional offset will take into account the Ethernet header and a QinQ header if present.

NGM_PATCH_GETDLT (getdlt)

This control message returns the data link type of the in hook.

NGM_PATCH_SETCONFIG (setconfig)

This command sets the sequence of modify operations that will be applied to incoming data on a hook. The following struct ng_patch_config must be supplied as an argument:

struct ng_patch_op {
	uint32_t	offset;
	uint16_t	length; /* 1,2,4 or 8 bytes */
	uint16_t	mode;
	uint64_t	value;
};
/* Patching modes */
#define NG_PATCH_MODE_SET	1
#define NG_PATCH_MODE_ADD	2
#define NG_PATCH_MODE_SUB	3
#define NG_PATCH_MODE_MUL	4
#define NG_PATCH_MODE_DIV	5
#define NG_PATCH_MODE_NEG	6
#define NG_PATCH_MODE_AND	7
#define NG_PATCH_MODE_OR	8
#define NG_PATCH_MODE_XOR	9
#define NG_PATCH_MODE_SHL	10
#define NG_PATCH_MODE_SHR	11

struct ng_patch_config {
	uint32_t	count;
	uint32_t	csum_flags;
	uint32_t	relative_offset;
	struct ng_patch_op ops[];
};
    

The csum_flags can be set to any combination of CSUM_IP, CSUM_TCP, CSUM_SCTP and CSUM_UDP (other values are ignored) for instructing the IP stack to recalculate the corresponding checksum before transmitting packet on output interface. The ng_patch node does not do any checksum correction by itself.

NGM_PATCH_GETCONFIG (getconfig)

This control message returns the current set of modify operations, in the form of a struct ng_patch_config.

NGM_PATCH_GET_STATS (getstats)

Returns the node's statistics as a struct ng_patch_stats.

NGM_PATCH_CLR_STATS (clrstats)

Clears the node's statistics.

NGM_PATCH_GETCLR_STATS (getclrstats)

This command is identical to NGM_PATCH_GET_STATS, except that the statistics are also atomically cleared.

SHUTDOWN¶

EXAMPLES¶

/usr/sbin/ngctl -f- <<-SEQ
	mkpeer ipfw: patch 200 in
	name ipfw:200 ttl_add
	msg ttl_add: setconfig { count=1 csum_flags=1 ops=[	\
		{ mode=2 value=3 length=1 offset=8 } ] }
SEQ
/sbin/ipfw add 150 netgraph 200 ip from any to simplex.remote.net

Here the “ttl_add” node of type ng_patch is configured to add (mode NG_PATCH_MODE_ADD) a value of 3 to a one-byte TTL field, which is 9th byte of IP packet header.

Another example would be two consecutive modifications of packet TOS field: say, you need to clear the IPTOS_THROUGHPUT bit and set the IPTOS_MINCOST bit. So you do:

/usr/sbin/ngctl -f- <<-SEQ
	mkpeer ipfw: patch 300 in
	name ipfw:300 tos_chg
	msg tos_chg: setconfig { count=2 csum_flags=1 ops=[	\
		{ mode=7 value=0xf7 length=1 offset=1 }		\
		{ mode=8 value=0x02 length=1 offset=1 } ] }
SEQ
/sbin/ipfw add 160 netgraph 300 ip from any to any not dst-port 80

This first does NG_PATCH_MODE_AND clearing the fourth bit and then NG_PATCH_MODE_OR setting the third bit.

In both examples the csum_flags field indicates that IP checksum (but not TCP or UDP checksum) should be recalculated before transmit.

Note: one should ensure that packets are returned to ipfw after processing inside netgraph(4), by setting appropriate sysctl(8) variable:

sysctl net.inet.ip.fw.one_pass=0

SEE ALSO¶

HISTORY¶

AUTHORS¶

Relative offset code by
DMitry Vagin

This manual page was written by
Vadim Goncharov ⟨vadimnuclight@tpu.ru⟩.

BUGS¶

!!! WARNING !!!

The output path of the IP stack assumes correct fields and lengths in the packets - changing them by to incorrect values can cause unpredictable results including kernel panics.