add BIOCSETFNR, which is like BIOCSETF but doesnt reset the buffer or stats.

from Matthew Luckie <mjl@luckie.org.nz> via tech@
deraadt@ likes it.

restrict the maximum wait time you can set via BIOCSWTIMEOUT to 5 minutes.

this is avoids passing excessively large values to timeout_add_nsec.

Reported-by: syzbot+f650785d4f2b3fe28284@syzkaller.ap

restrict the maximum wait time you can set via BIOCSWTIMEOUT to 5 minutes.

this is avoids passing excessively large values to timeout_add_nsec.

Reported-by: syzbot+f650785d4f2b3fe28284@syzkaller.appspotmail.com

show more ...

document BIOC[SGD]WTIMEOUT

.Li -> .Vt where appropriate;
from josiah frentsos, tweaked by schwarze

ok schwarze

Document BPF_RND. Missed part of the xBPF commit (bpf_filter.c -r1.34).

from dlg, ok kn tb jmatthew

document EINVAL for denorm timeval in BIOCSRTIMEOUT; ok jmc

reflect recent bpf changes

document BIOCSRTIMEOUT errors; ok deraadt@ millert@

extend BIOCSFILDROP so it can be configured to not capture packets.

BIOCSFILDROP was already able to be used as a quick and dirty
firewall, which is especially useful when you you want to filter
non

extend BIOCSFILDROP so it can be configured to not capture packets.

BIOCSFILDROP was already able to be used as a quick and dirty
firewall, which is especially useful when you you want to filter
non-ip things. however, capturing the packets you're dropping is a
lot of overhead when you just want to drop stuff. this extends
fildrop so you can tell bpf not to capture the packets it drops.

ok sthen@ mikeb@ claudio@ visa@

show more ...

Only one bpf device is required; pointed out by and ok jmc

BIOCGDIRFILT is allowed when locked, from Guy Harris

The BPF paper referenced in the SEE ALSO section was most likely an unpublished
draft. Replace it with the authors' 1993 Winter USENIX paper, which is a more
authoritative reference on BPF.

ok dera

The BPF paper referenced in the SEE ALSO section was most likely an unpublished
draft. Replace it with the authors' 1993 Winter USENIX paper, which is a more
authoritative reference on BPF.

ok deraadt@ jmc@ millert@

show more ...

Use .An in the AUTHORS section where appropriate;
from Kaspars at Bankovskis dot net

do not abuse .Cd for userland stuff; use .In or .Fd

obvious .Pa fixes; found with mandocdb(8)

some Bx/Ox conversion;
From: Jan Stary

remove SIOCGIFADDR; from natex, documentation/6352;
ok claudio

bpf can handle variable length headers; some wording improvements;
mostly from Guy Harris; ok jmc@

convert to new .Dd format;

document BIOCGDIRFILT/BIOCSDIRFILT ioctls
sync/sort the list of allowed ioctls under BIOCLOCK too

re-implement the bpf "filter drop" option that it actually works. the
bpf FILDROP interface exists for about one year but the required
interface to the drivers was missing - so it was useless. this n

re-implement the bpf "filter drop" option that it actually works. the
bpf FILDROP interface exists for about one year but the required
interface to the drivers was missing - so it was useless. this new
approach based on a design by henning@ uses a new mbuf flag to mark
filtered packets and to drop them in the generic network stack input
routines (like ether_input).

for example; after some additional testing, this could be used by
dhclient to filter everything except DHCP packets (track tech@
for a corresponding dhclient diff). the "filter dropped" packets won't
reach the network stack. so it's probably some kind of a very basic
application layer packet filter ;).

ok canacar@, discussed with henning@ and others

show more ...

comment out the "filter drop" option because it has never been fully
implemented and is not useable at all.

ok henning@

- sync to reality w.r.t. available ioctls and their arguments
- tweak layout of ioctl section
- other minor (mdoc, punctuation) fixes

ok jmc

new sentence, new line;

add support for BIOCGDLTLIST and BIOCSDLT, see bpf(4)

ok canacar@, fgsch@, tested by some other people