Global hooks are always added in INKPluginInit using INKHttpHookAdd. The two arguments of
INKHttpHookAdd are the hook ID and the
continuation to call when processing the event corresponding to the
hook. In blacklist-1.c, the global hook is added
as follows:
INKHttpHookAdd (INK_HTTP_OS_DNS_HOOK, contp);
Above, INK_HTTP_OS_DNS_HOOK is the ID for the origin
server DNS lookup hook and contp is the parent
continuation created earlier.
This means that the Blacklist plugin is called at every origin
server DNS lookup. When it is called, the handler function
blacklist_plugin receives INK_EVENT_HTTP_OS_DNS
and calls handle_dns to see if the request is
forbidden.