Add (again) support for divert sockets. They allow you to:

- queue packets from pf(4) to a userspace application
- reinject packets from the application into the kernel stack.

The divert socket can be bound to a special "divert port" and will
receive every packet diverted to that port by pf(4).

The pf syntax is pretty simple, e.g.:

pass on em0 inet proto tcp from any to any port 80 divert-packet port 1

A lot of discussion have happened since my last commit that resulted
in many changes and improvements.
I would *really* like to thank everyone who took part in the discussion
especially canacar@ who spotted out which are the limitations of this approach.

OpenBSD divert(4) is meant to be compatible with software running on
top of FreeBSD's divert sockets even though they are pretty different and will
become even more with time.

discusses with many, but mainly reyk@ canacar@ deraadt@ dlg@ claudio@ beck@
tested by reyk@ and myself
ok reyk@ claudio@ beck@
manpage help and ok by jmc@

1 files changed, 8 insertions, 2 deletions

diff --git a/lib/libc/gen/sysctl.3 b/lib/libc/gen/sysctl.3
index 439a8325751..e75bb503167 100644
--- a/lib/libc/gen/sysctl.3
+++ b/lib/libc/gen/sysctl.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: sysctl.3,v 1.189 2009/09/08 17:52:17 michele Exp $
+.\"	$OpenBSD: sysctl.3,v 1.190 2009/10/04 16:08:37 michele Exp $
 .\"
 .\" Copyright (c) 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -27,7 +27,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 8 2009 $
+.Dd $Mdocdate: October 4 2009 $
 .Dt SYSCTL 3
 .Os
 .Sh NAME
@@ -1128,6 +1128,8 @@ The currently defined protocols and names are:
 .It carp	allow	integer	yes
 .It carp	log	integer	yes
 .It carp	preempt	integer	yes
+.It divert	recvspace	integer	yes
+.It divert	sendspace	integer	yes
 .It esp	enable	integer	yes
 .It esp	udpencap	integer	yes
 .It esp	udpencap_port	integer	yes
@@ -1240,6 +1242,10 @@ another active master.
 If set to any other value, carp will become master of the virtual host if it
 believes it can send advertisements more frequently than the current master.
 Disabled by default.
+.It Li divert.recvspace
+Returns the default divert receive buffer size.
+.It Li divert.sendspace
+Returns the default divert send buffer size.
 .It Li esp.enable
 If set to 1, enable the Encapsulating Security Payload
 .Pq ESP