net/bone-kmods: Add port

[dave_freedave.net]

Summary

These are netgraph kernel modules I maintain outside src.
While I still have other modules I'm working on, but the existing modules have been stable for months.

I saw 292993 go by recently. Not the first issue with vnet(9) + netgraph(4) with if_vmove. And this port has the wormhole which removes the need for if_vmove entirely would be another solution for users.

Test Plan

I run these nodes and test them on stable/14, stable/15, and CURRENT. However they require patches for stable/14 and the port requires at least stable/15.

Rather than repeat myself you can look at the old src review: D50244

[adamw]

Why the name "bong"?

net/bong-kmods/Makefile

21 ↗

(On Diff #176891)

Why a hash instead of tagging a release?

23 ↗

(On Diff #176891)

What are these MAKE_ARGS doing?

[glebius]

Dave, I'm very sorry for not looking at your earlier submissions. Trust me, this is not a reluctance to add them to the src, but just a lack of time. Would you like me to review your nodes on github or would you prefer to refresh the phabricator revisions where you suggested the nodes to add to src? I will try to find some time.

[dave_freedave.net]

In D56743#1299960, @adamw wrote:

Why the name "bong"?

[B]ag [O]f [N]et{G]raph.
Didn't even get my own acronym right the first time!

[dave_freedave.net]

In D56743#1299966, @glebius wrote:

Dave, I'm very sorry for not looking at your earlier submissions. Trust me, this is not a reluctance to add them to the src, but just a lack of time. Would you like me to review your nodes on github or would you prefer to refresh the phabricator revisions where you suggested the nodes to add to src? I will try to find some time.

I tagged so you and zlei for awareness so the next time a vnet + netgraph + if_vmove comes along you have an alternate to point people at. I would love for you to take a look as I value your opinion!

But bong-kmods has 2 nodes I never put up for review: ng_pcap(4) and ng_ula4tag(4). And I have 3 more more to make ... I feel like ports are a good place for these to at least start.

[dave_freedave.net]

net/bong-kmods/Makefile

23 ↗

(On Diff #176891)

What are these MAKE_ARGS doing?

I need to verify they are needed again. But uidfix doesn't do the permissions for MANINSTALL which get's used to "build" (gzip) and install man pages from /usr/share/mk/bsd.*.mk machinery.

Will verify necessary, and if not remove.

[adamw]

In D56743#1300024, @dave_freedave.net wrote:

In D56743#1299960, @adamw wrote:

Why the name "bong"?

[B]ag [O]f [N]et{G]raph.
Didn't even get my own acronym right the first time!

"Bag of Netgraph"... That's really clever! I like that a lot.

I just want to make sure that you've thought through and are okay with the implications. I'd suggest at least putting its name in the descr so people know it's not just named after drug paraphernalia.

[dave_freedave.net]

• removed GH_TAGNAME, gave calver release tag
• removed MAKE_ARGS, not required
• update pkg-descr, add the acronym that explains port name

[dave_freedave.net]

poudriere testport -j FreeBSD15 -p local net/bong-kmods output:

bong-kmods-2026.05.03.1500506.log25 KBDownload

@adamw You will notice this in my make.conf from log above:

.if ${OSVERSION:U0} > 1600000
net_bong-kmods_SET+=»   INVARIANTS
.endif

That is so my kernel builds don't get confused but so that poudriere(8) builds for CURRENT automatically set INVARIANTS because that is the default way CURRENT builds. But any kernel can have INVARIANTS enabled. I didn't see any better option from 286717 to handle this.

[dave_freedave.net]

If the only outstanding issue is the name, I am fine renaming the port.

[adamw]

In D56743#1302161, @dave_freedave.net wrote:

If the only outstanding issue is the name, I am fine renaming the port.

Closing the loop here: I sent you an email a minute ago letting you know that I've been pretty sick and haven't been paying enough attention to my checklist.

I like the descr change you made. I personally wouldn't name stuff designed for corporate environments "bong" (any more than I'd name them "methpipe") BUT the good news is that you're not me and you already did the important thing, which is hear my concern and reflect on it.

If you are confident about the name, then let me know and I'll get these committed! If you are on the fence, here are some things that come to mind:

• bone (Bag of Netgraph Extensions)
• bongo (Bag of NetGraph O-something-word)
• Ignore this list completely because you just emailed me and said you're happy with the current name!

net/bong-kmods/Makefile

36 ↗

(On Diff #177063)

The more I think about it, the more I'm concerned about this approach: the produced package--even on current--will always be built without INVARIANTS.

Is there a straightforward way to determine whether the kernel was compiled with INVARIANTS? I honestly don't know the answer to that.

[dave_freedave.net]

Ok wow, I like "bone" I mean I don't really want to change it on github but I now that seems like a great idea...

net/bong-kmods/Makefile

36 ↗

(On Diff #177063)

Nobody found a way for 286717 to know.

It is tricksy. Because you can build with INVARIANTS for any version of FreeBSD. That is just default for CURRENT. And it would be nice if official packages for CURRENT built with INVARIANTS (as default kernels have that).

I would love a better solution if you know of one.

[adamw]

net/bong-kmods/Makefile

36 ↗

(On Diff #177063)

One approach could be adding an @invariants FLAVOR, so that users on *any* version could install bong-kmods or bong-kmods-invariants as needed.

Or you could set it up as a MASTER/SLAVE thing, where bong-kmods/Makefile has OPTIONS_EXCLUDE= INVARIANTS and bong-kmods-invariants/Makefile has OPTIONS_SLAVE= INVARIANTS.

Or you could say it's not worth doing all that.

[dave_freedave.net]

s/bong/bone/g

[dave_freedave.net]

I don't know that its worth doing flavors. It would be nice if official FreeBSD16 ports enabled INVARIANTS but not essential.

[dave_freedave.net]

change from options to flavor for invariants.

[dave_freedave.net]

Switch to new mono repo for bone-kmods/bone-utils

I like using invariants to make the two flavors of bone-kmods. Not much really changed here.

[dave_freedave.net]

update DISTVERSION

[dave_freedave.net]

Anything more needed for this and D56744 ?

I am running bone-kmods-invariants on my CURRENT, bone-kmods on stable/15, and both have bone-utils.
I think the kmods packages should stay separate so that the kmods end up in FreeBSD-ports-kmods and the utilities stay in FreeBSD-ports.

[dave_freedave.net]

poudriere testport -j FreeBSD15 -p local net/bone-kmods

bone-kmods-2026.05.16.1500506.log26 KBDownload

poudriere testport -j FreeBSD15 -p local net/bone-kmods@invariants

bone-kmods-invariants-2026.05.16.1500506.log26 KBDownload

attaching recent poudriere test builds.

[arrowd]

net/bone-kmods/pkg-descr

9

"a way to tag VLAN traffic" maybe?

[dave_freedave.net]

net/bone-kmods/pkg-descr

9

Well its traffic coming in that is untagged for a VLAN. And what this does is look at the destination address. If it is ULA or IPv4 (and its configurable, defaults to both) it inserts a tag.

That is the trick for taking a /64 GUA and having a separately routable ULA/IPv4. Some bad ASCII art may help (looks ok in preview if it doesn't work when I save I'll remove it):

                          GUA
                        +------------+
  ULA + IPv4            |  ng_eiface |        ULA + IPv4
 +--------------+       | EIFACE=gw0 |      +---------------+
 | ng_eiface    |       +-----+------+      | ng_eiface     |
 | EIFACE1=lan0 |       ether |             | EIFACE2=wifi0 |
 +-------+------+             |             +------+--------+
   ether |                    |                    | ether
         |                    | nomatch            |
         |               +----+----+               |
         |     vl${TAG1} | ng_vlan | vl${TAG2}     |
         +---------------+ VLAN=   +---------------+
                         | vlan0   |
                         +----+----+
                              | downstream
                              |
                         link |
     +------------------------+------------------------+
     | ng_bridge         BRIDGE=br0                    |
     +---+-----------------------------------------+---+
         | link                               link |
         |                                         |
   untag |                                         | untag
   +-----+------+                           +------+-----+
   | ng_ula4tag |                           | ng_ula4tag |
   | tag${TAG1} |                           | tag${TAG2} |
   +-----+------+                           +------+-----+
         | tag                                 tag |
   lower |                                         | lower
+--------+------+                           +------+--------+
| ng_ether      |                           | ng_ether      |
| ETHERDEV1=em1 |                           | ETHERDEV2=em2 |
| ETHER1=br0em1 |                           | ETHER2=br0em2 |
+--------+------+                           +------+--------+
         |                                         |
         V                                         V
        LAN                                       WiFi

That's actually ripped directly from the man page.