Difference between revisions of "Pf"
(This exists now)
Latest revision as of 12:32, 16 June 2020
pf, PF, or PacketFilter, is a very thoroughly documented, very mature packet filter. The Wikipedia page below is a great place to start, and there's no point in copy-pasting existing text here.
pf is available on all darwin variants and is used across the system for tasks requiring packet manipulation, redirection, etc.
Examples of usage in iOS include Airdrop, Tethering, and the system VPN.
The command-line utility 'pfctl' is also included with iOS, located in /sbin/.
The closest thing pf provides to a public API is PacketFilter.framework. PacketFilter.framework is written in C, not Obj-C, and has no public Headers. However, opening it in your disassembler of choice will make it very easy to understand.
Jonathan Levin's *OS Internals, Volume 1 Chapter 16 contains the best research to date on any of these components:
Although much research still needs to be done, the contents of this chapter are invaluable for anyone interested in low level, non-destructive packet filtering.