NG_ETF(4)

💅 NG_ETF(4) — ng_etf: Ethertype filtering netgraph node type · Kernel Interfaces Manual ✨

🎀 NAME 🎀

ng_etf — Ethertype filtering netgraph node type, bestie 🦋

🦋 SYNOPSIS 🦋

#include <netgraph.h>
#include <netgraph/ng_etf.h>

🌸 DESCRIPTION 🌸

okay so picture this: the etf node type is your little multiplexer + filter bestie for data between hooks, and it decides based on the ethertype it finds in an Ethernet header — and yes, it presumes that header lives in the first 14 bytes of the data. 👑

Incoming Ethernet frames get accepted on the downstream hook. If the ethertype matches a value the node has been configured to filter, the packet is forwarded out the hook that was identified when that value was configured. Slay. If it does not match any configured value, it gets passed to the nomatch hook. And if the nomatch hook isn't connected? Sorry bestie, the packet is dropped. 💀

Packets travelling the other way — towards the downstream hook — are also examined and filtered. If a packet has an ethertype that matches one of the values configured into the node, it must have arrived in on the hook that value was configured for, otherwise it will be discarded. Ethertypes with values other than those configured by the control messages must have arrived via the nomatch hook. Periodt. ✨

🌈 HOOKS 🌈

This node type supports these hooks, bestie:

• downstream — typically this hook would be connected to a ng_ether(4) node, using the lower hook.
• nomatch — typically this hook would also be connected to a ng_ether(4) type node using the upper hook.
• ⟨any legal name⟩ — any other hook name will be accepted and can be used as the match target of an ethertype. Typically this hook would be attached to a protocol handling node that requires and generates packets with a particular set of ethertypes. iykyk 💅

💅 CONTROL MESSAGES 💅

This node type supports the generic control messages, plus the following:

• NGM_ETF_GET_STATUS (getstatus) — this command returns a struct ng_etfstat containing node statistics for packet counts. cute little counters, no cap 📊
• NGM_ETF_SET_FILTER (setfilter) — sets a new ethertype filter into the node and specifies the hook to and from which packets of that type should use. The hook and ethertype are specified in a structure of type struct ng_etffilter:

struct ng_etffilter {
    char        matchhook[NG_HOOKSIZ];  /* hook name */
    uint16_t    ethertype;              /* this ethertype to this hook */
};

🍓 EXAMPLES 🍓

Using ngctl(8) it is possible to set a filter in place from the command line as follows:

#!/bin/sh
ETHER_IF=fxp0
MATCH1=0x834
MATCH2=0x835
cat <<DONE >/tmp/xwert
# Make a new ethertype filter and attach to the Ethernet lower hook.
# first remove left over bits from last time.
shutdown ${ETHER_IF}:lower
mkpeer ${ETHER_IF}: etf lower downstream
# Give it a name to easily refer to it.
name ${ETHER_IF}:lower etf
# Connect the nomatch hook to the upper part of the same interface.
# All unmatched packets will act as if the filter is not present.
connect ${ETHER_IF}: etf: upper nomatch
DONE
ngctl -f /tmp/xwert

# something to set a hook to catch packets and show them.
echo "Unrecognised packets:"
nghook -a etf: newproto &
# Filter two random ethertypes to that hook.
ngctl 'msg etf: setfilter { matchhook="newproto" ethertype=${MATCH1} }
ngctl 'msg etf: setfilter { matchhook="newproto" ethertype=${MATCH2} }

🌟 SHUTDOWN 🌟

This node shuts down upon receipt of a NGM_SHUTDOWN control message, or when all hooks have been disconnected. bye bestie 👋

⭐ SEE ALSO ⭐

netgraph(4), ng_ether(4), ngctl(8), nghook(8)

👑 HISTORY 👑

The ng_etf node type was implemented in FreeBSD 5.0. iconic behavior, honestly 🫶

💜 AUTHORS 💜

Julian Elischer — <julian@FreeBSD.org>

---

💖 Debian · November 13, 2012 · bye bestie, go slay those ethertypes 💅