1.\" 2.\" Copyright (c) 2000 Alfred Perlstein 3.\" 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE DEVELOPERS ``AS IS'' AND ANY EXPRESS OR 16.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18.\" IN NO EVENT SHALL THE DEVELOPERS BE LIABLE FOR ANY DIRECT, INDIRECT, 19.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25.\" 26.\" $FreeBSD$ 27.\" " 28.Dd June 25, 2000 29.Dt ACCEPT_FILTER 9 30.Os 31.Sh NAME 32.Nm accept_filter , 33.Nm accept_filt_add , 34.Nm accept_filt_del , 35.Nm accept_filt_generic_mod_event , 36.Nm accept_filt_get 37.Nd filter incoming connections 38.Sh SYNOPSIS 39.In sys/types.h 40.In sys/module.h 41.In sys/socket.h 42.Fd #define ACCEPT_FILTER_MOD 43.In sys/socketvar.h 44.Ft int 45.Fn accept_filt_add "struct accept_filter *filt" 46.Ft int 47.Fn accept_filt_del "char *name" 48.Ft int 49.Fn accept_filt_generic_mod_event "module_t mod" "int event" "void *data" 50.Ft struct accept_filter * 51.Fn accept_filt_get "char *name" 52.Sh DESCRIPTION 53Accept filters allow an application to request 54that the kernel pre-process incoming connections. 55An accept filter is requested via the 56.Xr setsockopt 2 57system call, passing in an 58.Fa optname 59of 60.Dv SO_ACCEPTFILTER . 61.Sh IMPLEMENTATION NOTES 62A module that wants to be an accept filter 63must provide a 64.Vt "struct accept_filter" 65to the system: 66.Bd -literal 67struct accept_filter { 68 char accf_name[16]; 69 void (*accf_callback)(struct socket *so, void *arg, int waitflag); 70 void * (*accf_create)(struct socket *so, char *arg); 71 void (*accf_destroy)(struct socket *so); 72 SLIST_ENTRY(accept_filter) accf_next; /* next on the list */ 73}; 74.Ed 75.Pp 76The module should register it with the function 77.Fn accept_filt_add , 78passing a pointer to a 79.Vt "struct accept_filter" , 80allocated with 81.Xr malloc 9 . 82.Pp 83The fields of 84.Vt "struct accept_filter" 85are as follows: 86.Bl -tag -width ".Va accf_callback" 87.It Va accf_name 88Name of the filter; 89this is how it will be accessed from userland. 90.It Va accf_callback 91The callback that the kernel will do 92once the connection is established. 93It is the same as a socket upcall 94and will be called when the connection is established 95and whenever new data arrives on the socket, 96unless the callback modifies the socket's flags. 97.It Va accf_create 98Called whenever a 99.Xr setsockopt 2 100installs the filter onto 101a listening socket. 102.It Va accf_destroy 103Called whenever the user removes the accept filter on the socket. 104.El 105.Pp 106The 107.Fn accept_filt_del 108function 109passed the same string used in 110.Va accept_filter.accf_name 111during registration with 112.Fn accept_filt_add , 113the kernel will then disallow and further userland use of the filter. 114.Pp 115The 116.Fn accept_filt_get 117function is used internally to locate which accept filter to use via the 118.Xr setsockopt 2 119system call. 120.Pp 121The 122.Fn accept_filt_generic_mod_event 123function provides a simple way to avoid duplication of code 124for accept filters which do not use the argument field to load 125and unload themselves. 126This function can be used in the 127.Vt moduledata_t 128struct for the 129.Xr DECLARE_MODULE 9 130macro. 131.Sh SEE ALSO 132.Xr setsockopt 2 , 133.Xr accf_data 9 , 134.Xr accf_dns 9 , 135.Xr accf_http 9 , 136.Xr malloc 9 137.Sh HISTORY 138The accept filter mechanism was introduced in 139.Fx 4.0 . 140.Sh AUTHORS 141This manual page was written by 142.An -nosplit 143.An Alfred Perlstein , 144.An Sheldon Hearn 145and 146.An Jeroen Ruigrok van der Werven. 147.Pp 148The accept filter concept was pioneered by 149.An David Filo 150at Yahoo!\& 151and refined to be a loadable module system by 152.An Alfred Perlstein . 153