Basic Filter Conditions

Macros
#define	NPF_IFACE_MATCH(_name, _iface)
	Statically define an "interface match" packet filter condition.
#define	NPF_IFACE_UNMATCH(_name, _iface)
	Statically define an "interface unmatch" packet filter condition.
#define	NPF_ORIG_IFACE_MATCH(_name, _iface)
	Statically define an "orig interface match" packet filter condition.
#define	NPF_ORIG_IFACE_UNMATCH(_name, _iface)
	Statically define an "orig interface unmatch" packet filter condition.
#define	NPF_SIZE_MIN(_name, _size)
	Statically define a "data minimum size" packet filter condition.
#define	NPF_SIZE_MAX(_name, _size)
	Statically define a "data maximum size" packet filter condition.
#define	NPF_SIZE_BOUNDS(_name, _min_size, _max_size)
	Statically define a "data bounded size" packet filter condition.
#define	NPF_IP_SRC_ADDR_ALLOWLIST(_name, _ip_addr_array, _ip_addr_num, _af)
	Statically define a "ip address allowlist" packet filter condition.
#define	NPF_IP_SRC_ADDR_BLOCKLIST(_name, _ip_addr_array, _ip_addr_num, _af)
	Statically define a "ip address blocklist" packet filter condition.

Detailed Description

Macro Definition Documentation

NPF_IFACE_MATCH

#define NPF_IFACE_MATCH	(		_name,
			_iface
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_iface_match, \
        }

Statically define an "interface match" packet filter condition.

Parameters

_name	Name of the condition
_iface	Interface to match

NPF_IFACE_UNMATCH

#define NPF_IFACE_UNMATCH	(		_name,
			_iface
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_iface_unmatch, \
        }

Statically define an "interface unmatch" packet filter condition.

Parameters

_name	Name of the condition
_iface	Interface to exclude

NPF_IP_SRC_ADDR_ALLOWLIST

#define NPF_IP_SRC_ADDR_ALLOWLIST	(		_name,
			_ip_addr_array,
			_ip_addr_num,
			_af
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_ip _name = { \
                .addr_family = _af, \
                .ipaddr = (_ip_addr_array), \
                .ipaddr_num = _ip_addr_num, \
                .test.fn = npf_ip_src_addr_match, \
        }

Statically define a "ip address allowlist" packet filter condition.

This tests if the packet source ip address matches any of the ip addresses contained in the provided set.

Parameters

_name	Name of the condition
_ip_addr_array	Array of struct in_addr or struct in6_addr items to test against
_ip_addr_num	number of IP addresses in the array
_af	Addresses family type (AF_INET / AF_INET6) in the array

NPF_IP_SRC_ADDR_BLOCKLIST

#define NPF_IP_SRC_ADDR_BLOCKLIST	(		_name,
			_ip_addr_array,
			_ip_addr_num,
			_af
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_ip _name = { \
                .addr_family = _af, \
                .ipaddr = (_ip_addr_array), \
                .ipaddr_num = _ip_addr_num, \
                .test.fn = npf_ip_src_addr_unmatch, \
        }

Statically define a "ip address blocklist" packet filter condition.

This tests if the packet source ip address matches any of the ip addresses contained in the provided set.

Parameters

_name	Name of the condition
_ip_addr_array	Array of struct in_addr or struct in6_addr items to test against
_ip_addr_num	number of IP addresses in the array
_af	Addresses family type (AF_INET / AF_INET6) in the array

NPF_ORIG_IFACE_MATCH

#define NPF_ORIG_IFACE_MATCH	(		_name,
			_iface
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_orig_iface_match, \
        }

Statically define an "orig interface match" packet filter condition.

Parameters

_name	Name of the condition
_iface	Interface to match

NPF_ORIG_IFACE_UNMATCH

#define NPF_ORIG_IFACE_UNMATCH	(		_name,
			_iface
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_iface _name = { \
                .iface = (_iface), \
                .test.fn = npf_orig_iface_unmatch, \
        }

Statically define an "orig interface unmatch" packet filter condition.

Parameters

_name	Name of the condition
_iface	Interface to exclude

NPF_SIZE_BOUNDS

#define NPF_SIZE_BOUNDS	(		_name,
			_min_size,
			_max_size
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_size_bounds _name = { \
                .min = (_min_size), \
                .max = (_max_size), \
                .test.fn = npf_size_inbounds, \
        }

Statically define a "data bounded size" packet filter condition.

Parameters

_name	Name of the condition
_min_size	Lower bound of the packet's data size
_max_size	Higher bound of the packet's data size

NPF_SIZE_MAX

#define NPF_SIZE_MAX	(		_name,
			_size
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_size_bounds _name = { \
                .min = 0, \
                .max = (_size), \
                .test.fn = npf_size_inbounds, \
        }

Statically define a "data maximum size" packet filter condition.

Parameters

_name	Name of the condition
_size	Higher bound of the packet's data size

NPF_SIZE_MIN

#define NPF_SIZE_MIN	(		_name,
			_size
	)

#include <include/zephyr/net/net_pkt_filter.h>

Value:

        struct npf_test_size_bounds _name = { \
                .min = (_size), \
                .max = SIZE_MAX, \
                .test.fn = npf_size_inbounds, \
        }

Statically define a "data minimum size" packet filter condition.

Parameters

_name	Name of the condition
_size	Lower bound of the packet's data size