Technical data

SunOS 5.5 STREAMS Modules pfmod(7M)
NAME pfmod − STREAMS Packet Filter Module
SYNOPSIS #include <sys/pfmod.h>
ioctl( fd, I_PUSH, "pfmod");
DESCRIPTION pfmod is a STREAMS module that subjects messages arriving on its read queue to a
packet filter and passes only those messages that the filter accepts on to its upstream
neighbor. Such filtering can be very useful for user-level protocol implementations and
for networking monitoring programs that wish to view only specific types of events.
Read-side Behavior pfmod applies the current packet filter to all M_DATA andM_PROTO messages arriving
on its read queue. The module prepares these messages for examination by first skipping
over all leadingM_PROTO message blocks to arrive at the beginning of the message’s
data portion. If there is no data portion, pfmod accepts the message and passes it along
to its upstream neighbor. Otherwise, the module ensures that the part of the message’s
data that the packet filter might examine lies in contiguous memory, calling the
pullupmsg(9F) utility routine if necessary to force contiguity. (Note: this action destroys
any sharing relationships that the subject message might have had with other messages.)
Finally, it applies the packet filter to the message’s data, passing the entire message
upstream to the next module if the filter accepts, and discarding the message otherwise.
See PACKET FILTERS below for details on how the filter works.
If there is no packet filter yet in effect, the module acts as if the filter exists but does noth-
ing, implyingthat all incoming messages are accepted. IOCTLS below describes how to
associate a packet filter with an instance of pfmod.
pfmod passes all other messages throughunaltered to its upper neighbor.
Write-side Behavior pfmod interceptsM_IOCTL messages for the ioctl described below. The module passes
all other messages through unaltered to its lower neighbor.
IOCTLS pfmod responds to the following ioctl.
PFIOCSETF This ioctl directs the module to replace its current packet filter, if any, with
the filter specified by the struct packetfilt pointer named by its final argu-
ment. This structure is defined in <sys/pfmod.h> as:
struct packetfilt {
u_char Pf_Priority; /∗ priority of filter ∗/
u_char Pf_FilterLen; /∗ length of filter cmd list ∗/
u_short Pf_Filter[ENMAXFILTERS]; /∗ filter command list ∗/
};
The Pf_Priority field is included only for compatibility with other packet filter implemen-
tations and is otherwise ignored. The packet filter itself is specified in the Pf_Filter array
as a sequence of two-byte commands, with the Pf_FilterLen field givingthe number of
commands in the sequence. This implementation restricts the maximum number of com-
mands in a filter (ENMAXFILTERS) to 255. The next section describes the available
modified 18 Sep 1992 7M-255