1 .\" $NetBSD: pfil.9,v 1.22 2003/07/01 13:04:06 wiz Exp $
3 .\" Copyright (c) 2019 Gleb Smirnoff <glebius@FreeBSD.org>
4 .\" Copyright (c) 1996 Matthew R. Green
5 .\" All rights reserved.
7 .\" Redistribution and use in source and binary forms, with or without
8 .\" modification, are permitted provided that the following conditions
10 .\" 1. Redistributions of source code must retain the above copyright
11 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\" 3. The name of the author may not be used to endorse or promote products
16 .\" derived from this software without specific prior written permission.
18 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 .\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 .\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 .\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 .\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
23 .\" BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 .\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
25 .\" AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26 .\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37 .Nm pfil_head_register ,
38 .Nm pfil_head_unregister ,
41 .Nd packet filter interface
47 .Fn pfil_head_register "struct pfil_head_args *args"
49 .Fn pfil_head_unregister "struct pfil_head_t *head"
51 .Fn pfil_add_hook "struct pfil_hook_args *"
53 .Fn pfil_remove_hook "pfil_hook_t"
55 .Fn pfil_link "struct pfil_link_args *args"
57 .Fn pfil_run_hooks "phil_head_t *" "pfil_packet_t" "struct ifnet *" "int" "struct inpcb *"
61 framework allows for a specified function or a list of functions
62 to be invoked for every incoming or outgoing packet for a particular
64 These hooks may be used to implement a firewall or perform packet
67 Packet filtering points, for historical reasons named
70 .Fn pfil_head_register .
71 The function is supplied with special versioned
72 .Vt struct pfil_head_args
73 structure that specifies type and features of the head as well as
75 If the filtering point to be ever destroyed, the subsystem that
76 created it must unregister it with call to
77 .Fn pfil_head_unregister .
79 Packet filtering systems may register arbitrary number of filters,
80 for historical reasons named
82 To register a new hook
84 with special versioned
85 .Vt struct pfil_hook_args
87 The structure specifies type and features of the hook, pointer to
88 the actual filtering function and user readable name of the filtering
89 module and ruleset name.
90 Later hooks can be removed with
101 The function is supplied with versioned
102 .Vt struct pfil_link_args
103 structure that specifies either literal names of hook and head or
107 is called by filtering modules to autoregister their default ruleset
108 and default filtering points.
109 It also serves on the kernel side of
113 configuration with help of
117 For every packet traveling through a
119 the latter shall invoke
121 The function can accept either
126 In case if a hooked filtering module cannot understand
130 will provide it with a fake one.
133 are performed in network
135 .Sh HEADS (filtering points)
136 By default kernel creates the following heads:
137 .Bl -tag -width "ethernet"
146 Default rulesets are automatically linked to these heads to preserve
147 historical behavavior.
156 interface first appeared in
160 interface was imported into
164 the interface was significantly rewritten.