[tinem]

I would like to have pf redirecting all (regardless of the protocol or origin) packets to my program, withouth touching anything thats inside the packets.
Then my program would do something with them (with the header AND the data) an send it back to pf who would then process it with other rules...
I can't find any documentation on how to do that so I would like just some pointers to where should I look...

I hope someone will understand what I want do to...
:roll:

[Kernel_Killer]

Sounds like you need the "keep state" rule and a few redirects. Can you be a bit more specific so that we might be able to provide some rules for you?

[frisco]

I've seen a similar request made to misc@ and i think the response was look at the way ftp-proxy(8) works.
http://www.openbsd.org/cgi-bin/man.cgi?query=ftp-proxy
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftp-proxy/

Also, something with bpf(4) might work.
http://www.openbsd.org/cgi-bin/man.cgi?query=bpf

[tinem]

I've seen a similar request made to misc@ and i think the response was look at the way ftp-proxy(8) works.
http://www.openbsd.org/cgi-bin/man.cgi?query=ftp-proxy
http://www.openbsd.org/cgi-bin/cvsweb/src/libexec/ftp-proxy/

Also, something with bpf(4) might work.
http://www.openbsd.org/cgi-bin/man.cgi?query=bpf

ftp-proxy works just for tcp, I dont see how to handle udp and icmp this way... or am I missing something?

bpf seems promising but is also very complicated... thats why I asked if it is possible to do it with pf... but are there any simle apps that do some raw packet manipulation from bpf so I can try to learn from that?

[bsdjunkie]

You may have to play with bpf. That will process the packets b4 its passed to pf so you can do anything you want to it. That or rewrite pf code to mangle the packets in the way your thinking of.

tcpdump relies heavily on bpf, so it may be a good place to look at code. Also, libpcap, libdnet and libnet may be a good starting area.