summaryrefslogtreecommitdiff
path: root/static/freebsd/man4/ng_patch.4 3.html
diff options
context:
space:
mode:
authorJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 19:55:43 -0400
committerJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 19:55:43 -0400
commitac5e55f5f2af5b92794c2aded46c6bae85b5f5ed (patch)
tree9367490586c84cba28652e443e3166d66c33b0d9 /static/freebsd/man4/ng_patch.4 3.html
parent253e67c8b3a72b3a4757fdbc5845297628db0a4a (diff)
docs: Added All FreeBSD Manuals
Diffstat (limited to 'static/freebsd/man4/ng_patch.4 3.html')
-rw-r--r--static/freebsd/man4/ng_patch.4 3.html237
1 files changed, 237 insertions, 0 deletions
diff --git a/static/freebsd/man4/ng_patch.4 3.html b/static/freebsd/man4/ng_patch.4 3.html
new file mode 100644
index 00000000..1490fef3
--- /dev/null
+++ b/static/freebsd/man4/ng_patch.4 3.html
@@ -0,0 +1,237 @@
+<table class="head">
+ <tr>
+ <td class="head-ltitle">NG_PATCH(4)</td>
+ <td class="head-vol">Device Drivers Manual</td>
+ <td class="head-rtitle">NG_PATCH(4)</td>
+ </tr>
+</table>
+<div class="manual-text">
+<section class="Sh">
+<h1 class="Sh" id="NAME"><a class="permalink" href="#NAME">NAME</a></h1>
+<p class="Pp"><code class="Nm">ng_patch</code> &#x2014; <span class="Nd">trivial
+ mbuf data modifying netgraph node type</span></p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="SYNOPSIS"><a class="permalink" href="#SYNOPSIS">SYNOPSIS</a></h1>
+<p class="Pp"><code class="In">#include
+ &lt;<a class="In">netgraph/ng_patch.h</a>&gt;</code></p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="DESCRIPTION"><a class="permalink" href="#DESCRIPTION">DESCRIPTION</a></h1>
+<p class="Pp">The <code class="Nm">patch</code> node performs data modification
+ of packets passing through it. Modifications are restricted to a subset of C
+ language operations on unsigned integers of 8, 16, 32 or 64 bit size. These
+ are: set to new value (=), addition (+=), subtraction (-=), multiplication
+ (*=), division (/=), negation (= -), bitwise AND (&amp;=), bitwise OR (|=),
+ bitwise eXclusive OR (^=), shift left (&lt;&lt;=), shift right (&gt;&gt;=).
+ A negation operation is the one exception: integer is treated as signed and
+ second operand (the <var class="Va">value</var>) is not used. If there is
+ more than one modification operation, they are applied to packets
+ sequentially in the order they were specified by the user. The data payload
+ of a packet is viewed as an array of bytes, with a zero offset corresponding
+ to the very first byte of packet headers, and the
+ <var class="Va">length</var> bytes beginning from
+ <var class="Va">offset</var> as a single integer in network byte order. An
+ additional offset can be optionally requested at configuration time to
+ account for packet type.</p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="HOOKS"><a class="permalink" href="#HOOKS">HOOKS</a></h1>
+<p class="Pp">This node type has two hooks:</p>
+<dl class="Bl-tag">
+ <dt id="in"><var class="Va">in</var></dt>
+ <dd>Packets received on this hook are modified according to rules specified in
+ the configuration and then forwarded to the <var class="Ar">out</var>
+ hook, if it exists. Otherwise they are reflected back to the
+ <var class="Ar">in</var> hook.</dd>
+ <dt id="out"><var class="Va">out</var></dt>
+ <dd>Packets received on this hook are forwarded to the
+ <var class="Ar">in</var> hook without any changes.</dd>
+</dl>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="CONTROL_MESSAGES"><a class="permalink" href="#CONTROL_MESSAGES">CONTROL
+ MESSAGES</a></h1>
+<p class="Pp">This node type supports the generic control messages, plus the
+ following:</p>
+<dl class="Bl-tag">
+ <dt id="NGM_PATCH_SETDLT"><a class="permalink" href="#NGM_PATCH_SETDLT"><code class="Dv">NGM_PATCH_SETDLT</code></a>
+ (<code class="Ic">setdlt</code>)</dt>
+ <dd>Sets the data link type on the <var class="Va">in</var> hook (to help
+ calculate relative offset). Currently, supported types are
+ <code class="Cm">DLT_RAW</code> (raw IP datagrams, no offset applied, the
+ default) and <code class="Cm">DLT_EN10MB</code> (Ethernet). DLT_
+ definitions can be found in
+ <code class="In">&lt;<a class="In">net/bpf.h</a>&gt;</code>. If you want
+ to work on the link layer header you must use no additional offset by
+ specifying <code class="Cm">DLT_RAW</code>. If
+ <code class="Cm">EN10MB</code> is specified, then the optional additional
+ offset will take into account the Ethernet header and a QinQ header if
+ present.</dd>
+ <dt id="NGM_PATCH_GETDLT"><a class="permalink" href="#NGM_PATCH_GETDLT"><code class="Dv">NGM_PATCH_GETDLT</code></a>
+ (<code class="Ic">getdlt</code>)</dt>
+ <dd>This control message returns the data link type of the
+ <var class="Va">in</var> hook.</dd>
+ <dt id="NGM_PATCH_SETCONFIG"><a class="permalink" href="#NGM_PATCH_SETCONFIG"><code class="Dv">NGM_PATCH_SETCONFIG</code></a>
+ (<code class="Ic">setconfig</code>)</dt>
+ <dd>This command sets the sequence of modify operations that will be applied
+ to incoming data on a hook. The following <var class="Vt">struct
+ ng_patch_config</var> must be supplied as an argument:
+ <div class="Bd Pp Bd-indent Li">
+ <pre>struct ng_patch_op {
+ uint32_t offset;
+ uint16_t length; /* 1,2,4 or 8 bytes */
+ uint16_t mode;
+ uint64_t value;
+};
+/* Patching modes */
+#define NG_PATCH_MODE_SET 1
+#define NG_PATCH_MODE_ADD 2
+#define NG_PATCH_MODE_SUB 3
+#define NG_PATCH_MODE_MUL 4
+#define NG_PATCH_MODE_DIV 5
+#define NG_PATCH_MODE_NEG 6
+#define NG_PATCH_MODE_AND 7
+#define NG_PATCH_MODE_OR 8
+#define NG_PATCH_MODE_XOR 9
+#define NG_PATCH_MODE_SHL 10
+#define NG_PATCH_MODE_SHR 11
+
+struct ng_patch_config {
+ uint32_t count;
+ uint32_t csum_flags;
+ uint32_t relative_offset;
+ struct ng_patch_op ops[];
+};</pre>
+ </div>
+ <p class="Pp">The <var class="Va">csum_flags</var> can be set to any
+ combination of CSUM_IP, CSUM_TCP, CSUM_SCTP and CSUM_UDP (other values
+ are ignored) for instructing the IP stack to recalculate the
+ corresponding checksum before transmitting packet on output interface.
+ The <code class="Nm">ng_patch</code> node does not do any checksum
+ correction by itself.</p>
+ <p class="Pp">The <var class="Va">offset</var> value for the
+ <var class="Vt">ng_patch_op</var> structure is calculated from zero by
+ default (the first byte of packet headers). If
+ <var class="Va">relative_offset</var> is enabled (set to 1) during
+ configuration, the operation will have an additional amount added to the
+ offset based on the data link type.</p>
+ </dd>
+ <dt id="NGM_PATCH_GETCONFIG"><a class="permalink" href="#NGM_PATCH_GETCONFIG"><code class="Dv">NGM_PATCH_GETCONFIG</code></a>
+ (<code class="Ic">getconfig</code>)</dt>
+ <dd>This control message returns the current set of modify operations, in the
+ form of a <var class="Vt">struct ng_patch_config</var>.</dd>
+ <dt id="NGM_PATCH_GET_STATS"><a class="permalink" href="#NGM_PATCH_GET_STATS"><code class="Dv">NGM_PATCH_GET_STATS</code></a>
+ (<code class="Ic">getstats</code>)</dt>
+ <dd>Returns the node's statistics as a <var class="Vt">struct
+ ng_patch_stats</var>.</dd>
+ <dt id="NGM_PATCH_CLR_STATS"><a class="permalink" href="#NGM_PATCH_CLR_STATS"><code class="Dv">NGM_PATCH_CLR_STATS</code></a>
+ (<code class="Ic">clrstats</code>)</dt>
+ <dd>Clears the node's statistics.</dd>
+ <dt id="NGM_PATCH_GETCLR_STATS"><a class="permalink" href="#NGM_PATCH_GETCLR_STATS"><code class="Dv">NGM_PATCH_GETCLR_STATS</code></a>
+ (<code class="Ic">getclrstats</code>)</dt>
+ <dd>This command is identical to <code class="Dv">NGM_PATCH_GET_STATS</code>,
+ except that the statistics are also atomically cleared.</dd>
+</dl>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="SHUTDOWN"><a class="permalink" href="#SHUTDOWN">SHUTDOWN</a></h1>
+<p class="Pp">This node shuts down upon receipt of a
+ <code class="Dv">NGM_SHUTDOWN</code> control message, or when all hooks have
+ been disconnected.</p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="EXAMPLES"><a class="permalink" href="#EXAMPLES">EXAMPLES</a></h1>
+<p class="Pp">This <code class="Nm">ng_patch</code> node was designed to modify
+ TTL and TOS/DSCP fields in IP packets. As an example, suppose you have two
+ adjacent simplex links to a remote network (e.g. satellite), so that the
+ packets expiring in between will generate unwanted ICMP-replies which have
+ to go forth, not back. Thus you need to raise TTL of every packet entering
+ link by 2 to ensure the TTL will not reach zero there. To achieve this you
+ can set an <a class="Xr">ipfw(8)</a> rule to use the
+ <code class="Cm">netgraph</code> action to inject packets which are going to
+ the simplex link into the patch node, by using the following
+ <a class="Xr">ngctl(8)</a> script:</p>
+<div class="Bd Pp Bd-indent Li">
+<pre>/usr/sbin/ngctl -f- &lt;&lt;-SEQ
+ mkpeer ipfw: patch 200 in
+ name ipfw:200 ttl_add
+ msg ttl_add: setconfig { count=1 csum_flags=1 ops=[ \
+ { mode=2 value=3 length=1 offset=8 } ] }
+SEQ
+/sbin/ipfw add 150 netgraph 200 ip from any to simplex.remote.net</pre>
+</div>
+<p class="Pp">Here the &#x201C;<code class="Li">ttl_add</code>&#x201D; node of
+ type <code class="Nm">ng_patch</code> is configured to add (mode
+ <code class="Dv">NG_PATCH_MODE_ADD</code>) a <var class="Va">value</var> of
+ 3 to a one-byte TTL field, which is 9th byte of IP packet header.</p>
+<p class="Pp">Another example would be two consecutive modifications of packet
+ TOS field: say, you need to clear the
+ <code class="Dv">IPTOS_THROUGHPUT</code> bit and set the
+ <code class="Dv">IPTOS_MINCOST</code> bit. So you do:</p>
+<div class="Bd Pp Bd-indent Li">
+<pre>/usr/sbin/ngctl -f- &lt;&lt;-SEQ
+ mkpeer ipfw: patch 300 in
+ name ipfw:300 tos_chg
+ msg tos_chg: setconfig { count=2 csum_flags=1 ops=[ \
+ { mode=7 value=0xf7 length=1 offset=1 } \
+ { mode=8 value=0x02 length=1 offset=1 } ] }
+SEQ
+/sbin/ipfw add 160 netgraph 300 ip from any to any not dst-port 80</pre>
+</div>
+<p class="Pp">This first does <code class="Dv">NG_PATCH_MODE_AND</code> clearing
+ the fourth bit and then <code class="Dv">NG_PATCH_MODE_OR</code> setting the
+ third bit.</p>
+<p class="Pp">In both examples the <var class="Va">csum_flags</var> field
+ indicates that IP checksum (but not TCP or UDP checksum) should be
+ recalculated before transmit.</p>
+<p class="Pp">Note: one should ensure that packets are returned to ipfw after
+ processing inside <a class="Xr">netgraph(4)</a>, by setting appropriate
+ <a class="Xr">sysctl(8)</a> variable:</p>
+<div class="Bd Pp Bd-indent Li">
+<pre>sysctl net.inet.ip.fw.one_pass=0</pre>
+</div>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="SEE_ALSO"><a class="permalink" href="#SEE_ALSO">SEE
+ ALSO</a></h1>
+<p class="Pp"><a class="Xr">netgraph(4)</a>, <a class="Xr">ng_ipfw(4)</a>,
+ <a class="Xr">ngctl(8)</a></p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="HISTORY"><a class="permalink" href="#HISTORY">HISTORY</a></h1>
+<p class="Pp">The <code class="Nm">ng_patch</code> node type was implemented in
+ <span class="Ux">FreeBSD 8.1</span>.</p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="AUTHORS"><a class="permalink" href="#AUTHORS">AUTHORS</a></h1>
+<p class="Pp"><span class="An">Maxim Ignatenko</span>
+ &#x27E8;gelraen.ua@gmail.com&#x27E9;.</p>
+<p class="Pp">Relative offset code by
+ <br/>
+ <span class="An">DMitry Vagin</span></p>
+<p class="Pp">This manual page was written by
+ <br/>
+ <span class="An">Vadim Goncharov</span>
+ &#x27E8;vadimnuclight@tpu.ru&#x27E9;.</p>
+</section>
+<section class="Sh">
+<h1 class="Sh" id="BUGS"><a class="permalink" href="#BUGS">BUGS</a></h1>
+<p class="Pp">The node blindly tries to apply every patching operation to each
+ packet (except those which offset if greater than length of the packet), so
+ be sure that you supply only the right packets to it (e.g. changing bytes in
+ the ARP packets meant to be in IP header could corrupt them and make your
+ machine unreachable from the network).</p>
+<p class="Pp" id="!!!"><a class="permalink" href="#!!!"><i class="Em">!!!
+ WARNING !!!</i></a></p>
+<p class="Pp">The output path of the IP stack assumes correct fields and lengths
+ in the packets - changing them by to incorrect values can cause
+ unpredictable results including kernel panics.</p>
+</section>
+</div>
+<table class="foot">
+ <tr>
+ <td class="foot-date">November 17, 2015</td>
+ <td class="foot-os">FreeBSD 15.0</td>
+ </tr>
+</table>