BPF_MTAP(9)

NAME
bpf_filter, bpf_mfilter, bpf_validate, bpf_mtap, bpf_mtap_hdr, bpf_mtap_af, bpf_mtap_ether - BPF kernel API

SYNOPSIS
#include <net/bpf.h>
u_int
bpf_filter(const struct bpf_insn *pc, const u_char *pkt, u_int wirelen, u_int pktlen);
u_int
bpf_mfilter(const struct bpf_insn *pc, const struct mbuf *m, u_int wirelen);
int
bpf_validate(struct bpf_insn *pc, int len);
int
bpf_mtap(caddr_t bpf, const struct mbuf *m, u_int direction);
int
bpf_mtap_hdr(caddr_t bpf, caddr_t hdr, u_int hdrlen, const struct mbuf *m, u_int direction, void (*cpfn)(const void *, void *, size_t));
int
bpf_mtap_af(caddr_t bpf, u_int32_t af, const struct mbuf *m, u_int direction);
int
bpf_mtap_ether(caddr_t bpf, const struct mbuf *m, u_int direction);

DESCRIPTION
The BPF kernel API provides functions for evaluating BPF instructions against packets, and incoming linkage from device drivers. A packet is parsed by the filters associated with each interface and, if accepted, stashed into the corresponding buffer.

bpf_filter() executes the BPF program referenced by pc against the packet buffer starting at pkt of pktlen bytes in length. wirelen is the length of the original packet on the wire.

bpf_mfilter() executes the BPF program referenced by pc against the packet in the mbuf m. wirelen is the length of the original packet on the wire.

bpf_validate() tests if the BPF program referenced by pc is valid. len specifies the number of instructions in pc.

bpf_tap() runs the filters on the BPF interface referenced by bpf in the direction direction against the packet in the pkt buffer.

bpf_mtap() runs the filters on the BPF interface referenced by bpf in the direction direction against the packet in mbuf chain m.

bpf_mtap_hdr() runs the filters on the BPF interface referenced by bpf in the direction direction against the packet in mbuf chain m. The header referenced by hdr will be prefixed to the packet during filter evaluation. A custom packet copy function may be provided via cpfn. If cpfn is NULL an internal function for copying mbuf payloads will be used.

bpf_mtap_af() runs the filters on the BPF interface referenced by bpf in the direction direction against the packet in mbuf chain m. The address family specified by af will be prepended to the packet before matching occurs.

bpf_mtap_ether() runs the filters on the BPF interface referenced by bpf in the direction direction against an Ethernet packet in the mbuf m. If the mbuf is flagged with M_VLANTAG an Ethernet VLAN header is constructed using m->m_pkthdr.ether_vtag and m->m_pkthdr.pf.prio before matching occurs.

CONTEXT
bpf_filter(), bpf_mfilter(), and bpf_validate() can be called from process context, or from an interrupt context.

bpf_mtap(), bpf_mtap(), bpf_mtap_hdr(), bpf_mtap_af(), and bpf_mtap_ether() can be called from process context, or from an interrupt context at or below IPL_NET.

RETURN VALUES
bpf_filter(), and bpf_mfilter() return -1 (cast to an unsigned integer) if the filter program is NULL, or the result of the filter program. Filter programs should return the maximum number of bytes of the packet to capture, or 0 if the packet does not match the filter program.

bpf_validate() returns a non-zero value if the BPF program is valid, otherwise 0.

bpf_mtap(), bpf_mtap_hdr(), bpf_mtap_af(), and bpf_mtap_ether() return 1 if the packet matched a filter that indicates the packet should be dropped, otherwise 0.

SEE ALSO
mbuf(9), spl(9)