o Make it possible to reconfigure pfil(9) configuration with a tool.
This allows to change order of hooks, rehook filter from one filtering point to a different one. Disconnect/connect hook on input/output only. Prepend/append a hook. Whatever you imagine.
o Make it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in Cisco or Juniper. None of existing packet filters yet support that, however limited usage is already possible, e.g. default ruleset can be moved to single interface.
o Make it possible to create pfil heads, that provide not an mbuf pointer
but memory pointer with length. As example create such in Mellanox driver. Note: Mellanox driver isn't going to be touched on first commit. Code provided in review as example only! (for now)
o Sync pfil hooks epoch(9)
All together this allows for lots of possibilities assuming packet filters
and drivers are also improved.
For now, this patch allows to do the following:
./pfilctl unlink -io ipfw:default inet
./pfilctl unlink -io ipfw:default6 inet6
./pfilctl unlink -io ipfw:default-link ethernet
./pfilctl link -i ipfw:default-link mce0
This effectively moves default ipfw ruleset to input of mce0. Packets
to be filtered at the most early point. Without modifications to ipfw
this change allows to improve packet drop rate nearly twice. And even
more with a small patch that learns ipfw on how to process void * pointer
instead of mbuf.
Branch with history: https://github.com/glebius/FreeBSD/tree/pfil