Use the Source Luke!
ether_input(ifp, eh, m)
struct ifnet *ifp;
struct ether_header *eh;
struct mbuf *m;
{
struct ether_header save_eh;
/* Check for a BPF tap */
if (ifp->if_bpf != NULL) {
struct m_hdr mh;
/* This kludge is OK; BPF treats the "mbuf" as read-only
*/
mh.mh_next = m;
mh.mh_data = (char *)eh;
mh.mh_len = ETHER_HDR_LEN;
bpf_mtap(ifp, (struct mbuf *)&mh);
}
ifp->if_ibytes += m->m_pkthdr.len + sizeof (*eh);
/* Handle ng_ether(4) processing, if any */
if (ng_ether_input_p != NULL) {
(*ng_ether_input_p)(ifp, &m, eh);
if (m == NULL)
return;
}
/* Check for bridging mode */
if (BDG_ACTIVE(ifp) ) {
struct ifnet *bif;
[...]
as you see, bpf copies are taken before netgraph processing..
and non-netgraph bridging occurs after that.
On Thu, 27 Jun 2002, Arthur Peet wrote:
> G'day.
>
> Can anyone explain the relationship between BPF and netgraph sockets? I am
> trying to intercept packets destined for a process which is using BPF for
> read and write operations on an interface (and drop not-so-good
> packets). I can see all packets on the interface (using NgRecvData),
> however I am unable to drop the bad packets (by not calling my NgSendData
> function) as the process using BPF seems to be bypassing the netgraph
> functions.
>
> Thanks,
>
> -Art
>
>
>
> To Unsubscribe: send mail to [EMAIL PROTECTED]
> with "unsubscribe freebsd-net" in the body of the message
>
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
