[netgraph] ng_bpf filter large list of IP addresses

[Reshad Patuck]

Hey,
​
I have tried to write some c code to add a bpf filter to my ng_bpf node, but its just segfaulting.
My c is not good enough to debug this.
​
What baffles me is that when I load a filter for 250 IP addresses using the command in this link https://paste.ee/d/BHOoG/3 it loads fine.
If I use 'ngctl -f' with the file in this link https://paste.ee/d/BHOoG/2 I get an error saying 'ngctl: send msg: Invalid argument; ngctl: line 1: error in file'
The BPF filter and arguments in that command are exactly the same.
​
My problem is that I need to load thousands of IP addresses in a blocking filter, which I am not able to pass over a command line because the list becomes too long and I hit either the kern.argmax limit of 262144 bytes or the LINE_MAX (2048) for ngctl.
​
I can share the c code I am using to attempt this using NgSendAsciiMsg(), but I don't think that would be too useful.
​
I am open to hiring someone as a consultant to help write a program/script preferably in python or c to accomplish this.
If anyone can help with this or knows someone who can, please feel free to contact me.
​
Best regards,
​
Reshad


On 1 April 2018 11:07:44 PM IST, Eugene Grosbein <eugen at grosbein.net> wrote:
>31.03.2018 20:46, Reshad Patuck wrote:
> ​
>> Please let me know what I am doing wrong with the ngctl config file
>and
>> if there is another way, maybe something more direct to load a binary
>bpf filter directly into ng_bpf.
>
>There is also netgraph(3) - Netgraph User Library. You can use it
>within your C code
>to send binary or text (ASCII) control messages directly to ng_bpf
>without limitations
>of ngctl's own parser.
>
>You can get an example of NgSendAsciiMsg() usage in ngctl's sources:
>
>https://svnweb.freebsd.org/base/head/usr.sbin/ngctl/msg.c?view=markup