Add additional example to ng_bpf(4)

[markus_stoffdv.at]

Summary

Include a practical example that shows how ng_bpf can be used to prevent spoofing.

[donner]

May you please provide a full context diff?
See https://wiki.freebsd.org/Phabricator

Okay from my side, final words come from "manpages".

share/man/man4/ng_bpf.4

182 ↗

(On Diff #77242)

May you use "documentation" IP space? See RFC 5737

[markus_stoffdv.at]

Now using documentation IP space and full context diff.

[pi]

There are two ways to check man pages:

textproc/igor, it reports:

$ igor ng_bpf.4
ng_bpf.4:38:date not today, September 20, 2020:.Dd [April 29, 2020]
ng_bpf.4:173:blank line:

and mandoc -Tlint, which reports:

$ mandoc -Tlint ng_bpf.4
mandoc: ng_bpf.4:173:1: WARNING: blank line in fill mode, using .sp
mandoc: ng_bpf.4:117:2: STYLE: useless macro: Tn
mandoc: ng_bpf.4:124:2: STYLE: useless macro: Tn
mandoc: ng_bpf.4:130:2: STYLE: useless macro: Tn

Can you fix them ?

[markus_stoffdv.at]

In D26488#589643, @pi wrote:

There are two ways to check man pages:

textproc/igor, it reports:

$ igor ng_bpf.4
ng_bpf.4:38:date not today, September 20, 2020:.Dd [April 29, 2020]
ng_bpf.4:173:blank line:

and mandoc -Tlint, which reports:

$ mandoc -Tlint ng_bpf.4
mandoc: ng_bpf.4:173:1: WARNING: blank line in fill mode, using .sp
mandoc: ng_bpf.4:117:2: STYLE: useless macro: Tn
mandoc: ng_bpf.4:124:2: STYLE: useless macro: Tn
mandoc: ng_bpf.4:130:2: STYLE: useless macro: Tn

Can you fix them ?

Sure. Here you go.

[pi]

The EXAMPLES section mentions tcpdump to generate BPF instructions that are fed into awk -- I do not see the awk(1) call in the example ? Is awk really needed for the example ?

[donner]

share/man/man4/ng_bpf.4

143 ↗

(On Diff #77260)

This awk script exists in an older version of the man page.
It was rewritten to shell starting with 7.1-RELEASE, but this comment was not modified.

[pi]

1. about awk: So the mention of awk(1) can be removed from the EXAMPLES section ?

2. tcpdump wants to operate on some interface, as far as I can see, even it that interface will not be used ?

So running it as normal user gives this error:

$ tcpdump -s 8192 -p -ddd tcp dst port 80
tcpdump: igb0: You don't have permission to capture on that device

So this script needs to be run as root, right ? Can this be mentioned somewhere ? Any options to avoid running this as root ?

[pi]

The change is fine, with or without removing awk(1), and the root requirement is implicit, you can't modify hooks as normal user anyway (or can you?).

[markus_stoffdv.at]

In D26488#589662, @pi wrote:

The change is fine, with or without removing awk(1), and the root requirement is implicit, you can't modify hooks as normal user anyway (or can you?).

I'm glad to hear that. As it isn't any effort, I've removed the awk reference anyway.

[• hselasky]

Looks good to me.

[bcr]

Also good from manpages (again).