divert-reply / bindany


SO_BINDANY
Allows privileged processes to bind to a non-local IP address.
  s = socket(af, p == IPPROTO_TCP ? 
    SOCK_STREAM : SOCK_DGRAM, p);
  ...

  v = 1;
  setsockopt(s, SOL_SOCKET, SO_BINDANY, &v, sizeof(v));
  ...

  bind(s, (struct sockaddr *)ss, ss->ss_len);

divert-reply
Receive replies for sockets that are bound to a non-local socket.
  pass out on em0 inet proto tcp to port 80 divert-reply