netinet/kpi_ipfilter.h Kernel.framework

ipf_pktopts Options for outgoing packets. The options need to be preserved when re-injecting a packet.

@typedef ipf_input_func @discussion ipf_input_func is used to filter incoming ip packets. The IP filter is called for packets from all interfaces. The filter is called between when the general IP processing is handled and when the packet is passed up to the next layer protocol such as udp or tcp. In the case of encapsulation, such as UDP in ESP (IPsec), your filter will be called once for ESP and then again for UDP. This will give your filter an opportunity to process the ESP header as well as the decrypted packet. Offset and protocol are used to determine where in the packet processing is currently occuring. If you're only interested in TCP or UDP packets, just return 0 if protocol doesn't match TCP or UDP. @param cookie The cookie specified when your filter was attached. @param data The reassembled ip packet, data will start at the ip header. @param offset An offset to the next header (udp/tcp/icmp/esp/etc...). @param protocol The protocol type (udp/tcp/icmp/etc...) of the IP packet @result Return: 0 - The caller will continue with normal processing of the packet. EJUSTRETURN - The caller will stop processing the packet, the packet will not be freed. Anything Else - The caller will free the packet and stop processing.

typedef errno_t (*)(void *, mbuf_t *, int, u_int8_t) ipf_input_func;

@typedef ipf_output_func @discussion ipf_output_func is used to filter outbound ip packets. The IP filter is called for packets to all interfaces. The filter is called before fragmentation and IPsec processing. If you need to change the destination IP address, call ipf_inject_output and return EJUSTRETURN. @param cookie The cookie specified when your filter was attached. @param data The ip packet, will contain an IP header followed by the rest of the IP packet. @result Return: 0 - The caller will continue with normal processing of the packet. EJUSTRETURN - The caller will stop processing the packet, the packet will not be freed. Anything Else - The caller will free the packet and stop processing.

typedef errno_t (*)(void *, mbuf_t *, ipf_pktopts_t) ipf_output_func;

@typedef ipf_detach_func @discussion ipf_detach_func is called to notify your filter that it has been detached. @param cookie The cookie specified when your filter was attached.

typedef void (*ipf_detach_func)(void *cookie)

@typedef ipf_filter @discussion This structure is used to define an IP filter for use with the ipf_addv4 or ipf_addv6 function. @field cookie A kext defined cookie that will be passed to all filter functions. @field name A filter name used for debugging purposes. @field ipf_input The filter function to handle inbound packets. @field ipf_output The filter function to handle outbound packets. @field ipf_detach The filter function to notify of a detach.

__NKE_API_DEPRECATED
extern errno_t ipf_addv4(const struct ipf_filter *filter, ipfilter_t *filter_ref)

@function ipf_addv4 @discussion Attaches an IPv4 ip filter. @param filter A structure defining the filter. @param filter_ref A reference to the filter used to detach it. @result 0 on success otherwise the errno error.

__NKE_API_DEPRECATED
extern errno_t ipf_addv6(const struct ipf_filter *filter, ipfilter_t *filter_ref)

@function ipf_addv6 @discussion Attaches an IPv6 ip filter. @param filter A structure defining the filter. @param filter_ref A reference to the filter used to detach it. @result 0 on success otherwise the errno error.

__NKE_API_DEPRECATED
extern errno_t ipf_remove(ipfilter_t filter_ref)

@function ipf_remove @discussion Detaches an IPv4 or IPv6 filter. @param filter_ref The reference to the filter returned from ipf_addv4 or ipf_addv6. @result 0 on success otherwise the errno error.

__NKE_API_DEPRECATED
extern errno_t ipf_inject_input(mbuf_t data, ipfilter_t filter_ref)

@function ipf_inject_input @discussion Inject an IP packet as though it had just been reassembled in ip_input. When re-injecting a packet intercepted by the filter's ipf_input function, an IP filter can pass its reference to avoid processing the packet twice. This also prevents ip filters installed before this filter from getting a chance to process the packet. If the filter modified the packet, it should not specify the filter ref to give other filters a chance to process the new packet. Caller is responsible for freeing mbuf chain in the event that ipf_inject_input returns an error. @param data The complete IPv4 or IPv6 packet, receive interface must be set. @param filter_ref The reference to the filter injecting the data @result 0 on success otherwise the errno error.

__NKE_API_DEPRECATED
extern errno_t ipf_inject_output(
	mbuf_t data,
	ipfilter_t filter_ref,
	ipf_pktopts_t options
)

@function ipf_inject_output @discussion Inject an IP packet as though it had just been sent to ip_output. When re-injecting a packet intercepted by the filter's ipf_output function, an IP filter can pass its reference to avoid processing the packet twice. This also prevents ip filters installed before this filter from getting a chance to process the packet. If the filter modified the packet, it should not specify the filter ref to give other filters a chance to process the new packet. @param data The complete IPv4 or IPv6 packet. @param filter_ref The reference to the filter injecting the data @param options Output options for the packet @result 0 on success otherwise the errno error. ipf_inject_output will always free the mbuf.