1.\" $NetBSD: pf.4,v 1.13 2018/08/01 13:30:13 maxv Exp $ 2.\" $OpenBSD: pf.4,v 1.59 2007/05/31 19:19:51 jmc Exp $ 3.\" 4.\" Copyright (C) 2001, Kjell Wooding. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the project nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.Dd August 1, 2018 31.Dt PF 4 32.Os 33.Sh NAME 34.Nm pf 35.Nd packet filter 36.Sh SYNOPSIS 37.Cd "pseudo-device pf" 38.Sh DESCRIPTION 39.Bf -symbolic 40The NetBSD version of PF is obsolete, and its use is strongly discouraged. 41Use 42.Xr npf 7 43instead. 44.Pp 45.Ef 46Packet filtering takes place in the kernel. 47A pseudo-device, 48.Pa /dev/pf , 49allows userland processes to control the 50behavior of the packet filter through an 51.Xr ioctl 2 52interface. 53There are commands to enable and disable the filter, load rulesets, 54add and remove individual rules or state table entries, 55and retrieve statistics. 56The most commonly used functions are covered by 57.Xr pfctl 8 . 58.Pp 59Manipulations like loading a ruleset that involve more than a single 60.Xr ioctl 2 61call require a so-called 62.Em ticket , 63which prevents the occurrence of 64multiple concurrent manipulations. 65.Pp 66Fields of 67.Xr ioctl 2 68parameter structures that refer to packet data (like 69addresses and ports) are generally expected in network byte-order. 70.Pp 71Rules and address tables are contained in so-called 72.Em anchors . 73When servicing an 74.Xr ioctl 2 75request, if the anchor field of the argument structure is empty, 76the kernel will use the default anchor (i.e., the main ruleset) 77in operations. 78Anchors are specified by name and may be nested, with components 79separated by 80.Sq / 81characters, similar to how file system hierarchies are laid out. 82The final component of the anchor path is the anchor under which 83operations will be performed. 84.Sh IOCTL INTERFACE 85.Nm 86supports the following 87.Xr ioctl 2 88commands, available through 89.Aq Pa net/pfvar.h : 90.Bl -tag -width xxxxxx 91.It Dv DIOCSTART 92Start the packet filter. 93.It Dv DIOCSTOP 94Stop the packet filter. 95.It Dv DIOCSTARTALTQ 96Start the ALTQ bandwidth control system (see 97.Xr altq 9 ) . 98.It Dv DIOCSTOPALTQ 99Stop the ALTQ bandwidth control system. 100.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp" 101.Bd -literal 102struct pfioc_pooladdr { 103 u_int32_t action; 104 u_int32_t ticket; 105 u_int32_t nr; 106 u_int32_t r_num; 107 u_int8_t r_action; 108 u_int8_t r_last; 109 u_int8_t af; 110 char anchor[MAXPATHLEN]; 111 struct pf_pooladdr addr; 112}; 113.Ed 114.Pp 115Clear the buffer address pool and get a 116.Va ticket 117for subsequent 118.Dv DIOCADDADDR , 119.Dv DIOCADDRULE , 120and 121.Dv DIOCCHANGERULE 122calls. 123.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp" 124.Pp 125Add the pool address 126.Va addr 127to the buffer address pool to be used in the following 128.Dv DIOCADDRULE 129or 130.Dv DIOCCHANGERULE 131call. 132All other members of the structure are ignored. 133.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr" 134.Bd -literal 135struct pfioc_rule { 136 u_int32_t action; 137 u_int32_t ticket; 138 u_int32_t pool_ticket; 139 u_int32_t nr; 140 char anchor[MAXPATHLEN]; 141 char anchor_call[MAXPATHLEN]; 142 struct pf_rule rule; 143}; 144.Ed 145.Pp 146Add 147.Va rule 148at the end of the inactive ruleset. 149This call requires a 150.Va ticket 151obtained through a preceding 152.Dv DIOCXBEGIN 153call and a 154.Va pool_ticket 155obtained through a 156.Dv DIOCBEGINADDRS 157call. 158.Dv DIOCADDADDR 159must also be called if any pool addresses are required. 160The optional 161.Va anchor 162name indicates the anchor in which to append the rule. 163.Va nr 164and 165.Va action 166are ignored. 167.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa" 168Add an ALTQ discipline or queue. 169.Bd -literal 170struct pfioc_altq { 171 u_int32_t action; 172 u_int32_t ticket; 173 u_int32_t nr; 174 struct pf_altq altq; 175}; 176.Ed 177.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr" 178Get a 179.Va ticket 180for subsequent 181.Dv DIOCGETRULE 182calls and the number 183.Va nr 184of rules in the active ruleset. 185.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr" 186Get a 187.Va rule 188by its number 189.Va nr 190using the 191.Va ticket 192obtained through a preceding 193.Dv DIOCGETRULES 194call. 195If 196.Va action 197is set to 198.Dv PF_GET_CLR_CNTR , 199the per-rule statistics on the requested rule are cleared. 200.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp" 201Get a 202.Va ticket 203for subsequent 204.Dv DIOCGETADDR 205calls and the number 206.Va nr 207of pool addresses in the rule specified with 208.Va r_action , 209.Va r_num , 210and 211.Va anchor . 212.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp" 213Get the pool address 214.Va addr 215by its number 216.Va nr 217from the rule specified with 218.Va r_action , 219.Va r_num , 220and 221.Va anchor 222using the 223.Va ticket 224obtained through a preceding 225.Dv DIOCGETADDRS 226call. 227.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa" 228Get a 229.Va ticket 230for subsequent 231.Dv DIOCGETALTQ 232calls and the number 233.Va nr 234of queues in the active list. 235.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa" 236Get the queueing discipline 237.Va altq 238by its number 239.Va nr 240using the 241.Va ticket 242obtained through a preceding 243.Dv DIOCGETALTQS 244call. 245.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq" 246Get the statistics on a queue. 247.Bd -literal 248struct pfioc_qstats { 249 u_int32_t ticket; 250 u_int32_t nr; 251 void *buf; 252 int nbytes; 253 u_int8_t scheduler; 254}; 255.Ed 256.Pp 257This call fills in a pointer to the buffer of statistics 258.Va buf , 259of length 260.Va nbytes , 261for the queue specified by 262.Va nr . 263.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr" 264.Bd -literal 265struct pfioc_ruleset { 266 u_int32_t nr; 267 char path[MAXPATHLEN]; 268 char name[PF_ANCHOR_NAME_SIZE]; 269}; 270.Ed 271.Pp 272Get the number 273.Va nr 274of rulesets (i.e., anchors) directly attached to the anchor named by 275.Va path 276for use in subsequent 277.Dv DIOCGETRULESET 278calls. 279Nested anchors, since they are not directly attached to the given 280anchor, will not be included. 281This ioctl returns 282.Er EINVAL 283if the given anchor does not exist. 284.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr" 285Get a ruleset (i.e., an anchor) 286.Va name 287by its number 288.Va nr 289from the given anchor 290.Va path , 291the maximum number of which can be obtained from a preceding 292.Dv DIOCGETRULESETS 293call. 294This ioctl returns 295.Er EINVAL 296if the given anchor does not exist or 297.Er EBUSY 298if another process is concurrently updating a ruleset. 299.It Dv DIOCADDSTATE Fa "struct pfioc_state *ps" 300Add a state entry. 301.Bd -literal 302struct pfioc_state { 303 u_int32_t nr; 304 struct pf_state state; 305}; 306.Ed 307.It Dv DIOCGETSTATE Fa "struct pfioc_state *ps" 308Extract the entry with the specified number 309.Va nr 310from the state table. 311.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk" 312Remove matching entries from the state table. 313This ioctl returns the number of killed states in 314.Va psk_af . 315.Bd -literal 316struct pfioc_state_kill { 317 sa_family_t psk_af; 318 int psk_proto; 319 struct pf_rule_addr psk_src; 320 struct pf_rule_addr psk_dst; 321 char psk_ifname[IFNAMSIZ]; 322}; 323.Ed 324.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk" 325Clear all states. 326It works like 327.Dv DIOCKILLSTATES , 328but ignores the 329.Va psk_af , 330.Va psk_proto , 331.Va psk_src , 332and 333.Va psk_dst 334fields of the 335.Vt pfioc_state_kill 336structure. 337.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi" 338Specify the interface for which statistics are accumulated. 339.Bd -literal 340struct pfioc_if { 341 char ifname[IFNAMSIZ]; 342}; 343.Ed 344.It Dv DIOCGETSTATUS Fa "struct pf_status *s" 345Get the internal packet filter statistics. 346.Bd -literal 347struct pf_status { 348 u_int64_t counters[PFRES_MAX]; 349 u_int64_t lcounters[LCNT_MAX]; 350 u_int64_t fcounters[FCNT_MAX]; 351 u_int64_t scounters[SCNT_MAX]; 352 u_int64_t pcounters[2][2][3]; 353 u_int64_t bcounters[2][2]; 354 u_int64_t stateid; 355 u_int32_t running; 356 u_int32_t states; 357 u_int32_t src_nodes; 358 u_int32_t since; 359 u_int32_t debug; 360 u_int32_t hostid; 361 char ifname[IFNAMSIZ]; 362 u_int8_t pf_chksum[MD5_DIGEST_LENGTH]; 363}; 364.Ed 365.It Dv DIOCCLRSTATUS 366Clear the internal packet filter statistics. 367.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl" 368Look up a state table entry by source and destination addresses and ports. 369.Bd -literal 370struct pfioc_natlook { 371 struct pf_addr saddr; 372 struct pf_addr daddr; 373 struct pf_addr rsaddr; 374 struct pf_addr rdaddr; 375 u_int16_t sport; 376 u_int16_t dport; 377 u_int16_t rsport; 378 u_int16_t rdport; 379 sa_family_t af; 380 u_int8_t proto; 381 u_int8_t direction; 382}; 383.Ed 384.It Dv DIOCSETDEBUG Fa "u_int32_t *level" 385Set the debug level. 386.Bd -literal 387enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, 388 PF_DEBUG_NOISY }; 389.Ed 390.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps" 391Get state table entries. 392.Bd -literal 393struct pfioc_states { 394 int ps_len; 395 union { 396 caddr_t psu_buf; 397 struct pf_state *psu_states; 398 } ps_u; 399#define ps_buf ps_u.psu_buf 400#define ps_states ps_u.psu_states 401}; 402.Ed 403.Pp 404If 405.Va ps_len 406is non-zero on entry, as many states as possible that can fit into this 407size will be copied into the supplied buffer 408.Va ps_states . 409On exit, 410.Va ps_len 411is always set to the total size required to hold all state table entries 412(i.e., it is set to 413.Li sizeof(struct pf_state) * nr ) . 414.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr" 415Add or remove the 416.Va rule 417in the ruleset specified by 418.Va rule.action . 419.Pp 420The type of operation to be performed is indicated by 421.Va action , 422which can be any of the following: 423.Bd -literal 424enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 425 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 426 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 427.Ed 428.Pp 429.Va ticket 430must be set to the value obtained with 431.Dv PF_CHANGE_GET_TICKET 432for all actions except 433.Dv PF_CHANGE_GET_TICKET . 434.Va pool_ticket 435must be set to the value obtained with the 436.Dv DIOCBEGINADDRS 437call for all actions except 438.Dv PF_CHANGE_REMOVE 439and 440.Dv PF_CHANGE_GET_TICKET . 441.Va anchor 442indicates to which anchor the operation applies. 443.Va nr 444indicates the rule number against which 445.Dv PF_CHANGE_ADD_BEFORE , 446.Dv PF_CHANGE_ADD_AFTER , 447or 448.Dv PF_CHANGE_REMOVE 449actions are applied. 450.\" It Dv DIOCCHANGEALTQ Fa "struct pfioc_altq *pcr" 451.It Dv DIOCCHANGEADDR Fa "struct pfioc_pooladdr *pca" 452Add or remove the pool address 453.Va addr 454from the rule specified by 455.Va r_action , 456.Va r_num , 457and 458.Va anchor . 459.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt" 460.Bd -literal 461struct pfioc_tm { 462 int timeout; 463 int seconds; 464}; 465.Ed 466.Pp 467Set the state timeout of 468.Va timeout 469to 470.Va seconds . 471The old value will be placed into 472.Va seconds . 473For possible values of 474.Va timeout , 475consult the 476.Dv PFTM_* 477values in 478.Aq Pa net/pfvar.h . 479.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt" 480Get the state timeout of 481.Va timeout . 482The value will be placed into the 483.Va seconds 484field. 485.It Dv DIOCCLRRULECTRS 486Clear per-rule statistics. 487.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl" 488Set the hard limits on the memory pools used by the packet filter. 489.Bd -literal 490struct pfioc_limit { 491 int index; 492 unsigned limit; 493}; 494 495enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, 496 PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; 497.Ed 498.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl" 499Get the hard 500.Va limit 501for the memory pool indicated by 502.Va index . 503.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io" 504Clear all tables. 505All the ioctls that manipulate radix tables 506use the same structure described below. 507For 508.Dv DIOCRCLRTABLES , 509.Va pfrio_ndel 510contains on exit the number of tables deleted. 511.Bd -literal 512struct pfioc_table { 513 struct pfr_table pfrio_table; 514 void *pfrio_buffer; 515 int pfrio_esize; 516 int pfrio_size; 517 int pfrio_size2; 518 int pfrio_nadd; 519 int pfrio_ndel; 520 int pfrio_nchange; 521 int pfrio_flags; 522 u_int32_t pfrio_ticket; 523}; 524#define pfrio_exists pfrio_nadd 525#define pfrio_nzero pfrio_nadd 526#define pfrio_nmatch pfrio_nadd 527#define pfrio_naddr pfrio_size2 528#define pfrio_setflag pfrio_size2 529#define pfrio_clrflag pfrio_nadd 530.Ed 531.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io" 532Create one or more tables. 533On entry, 534.Va pfrio_buffer 535must point to an array of 536.Vt struct pfr_table 537containing at least 538.Vt pfrio_size 539elements. 540.Vt pfrio_esize 541must be the size of 542.Vt struct pfr_table . 543On exit, 544.Va pfrio_nadd 545contains the number of tables effectively created. 546.Bd -literal 547struct pfr_table { 548 char pfrt_anchor[MAXPATHLEN]; 549 char pfrt_name[PF_TABLE_NAME_SIZE]; 550 u_int32_t pfrt_flags; 551 u_int8_t pfrt_fback; 552}; 553.Ed 554.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io" 555Delete one or more tables. 556On entry, 557.Va pfrio_buffer 558must point to an array of 559.Vt struct pfr_table 560containing at least 561.Vt pfrio_size 562elements. 563.Vt pfrio_esize 564must be the size of 565.Vt struct pfr_table . 566On exit, 567.Va pfrio_ndel 568contains the number of tables effectively deleted. 569.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io" 570Get the list of all tables. 571On entry, 572.Va pfrio_buffer[pfrio_size] 573contains a valid writeable buffer for 574.Vt pfr_table 575structures. 576On exit, 577.Va pfrio_size 578contains the number of tables written into the buffer. 579If the buffer is too small, the kernel does not store anything but just 580returns the required buffer size, without error. 581.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io" 582This call is like 583.Dv DIOCRGETTABLES 584but is used to get an array of 585.Vt pfr_tstats 586structures. 587.Bd -literal 588struct pfr_tstats { 589 struct pfr_table pfrts_t; 590 u_int64_t pfrts_packets 591 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 592 u_int64_t pfrts_bytes 593 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 594 u_int64_t pfrts_match; 595 u_int64_t pfrts_nomatch; 596 long pfrts_tzero; 597 int pfrts_cnt; 598 int pfrts_refcnt[PFR_REFCNT_MAX]; 599}; 600#define pfrts_name pfrts_t.pfrt_name 601#define pfrts_flags pfrts_t.pfrt_flags 602.Ed 603.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io" 604Clear the statistics of one or more tables. 605On entry, 606.Va pfrio_buffer 607must point to an array of 608.Vt struct pfr_table 609containing at least 610.Vt pfrio_size 611elements. 612.Vt pfrio_esize 613must be the size of 614.Vt struct pfr_table . 615On exit, 616.Va pfrio_nzero 617contains the number of tables effectively cleared. 618.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io" 619Clear all addresses in a table. 620On entry, 621.Va pfrio_table 622contains the table to clear. 623On exit, 624.Va pfrio_ndel 625contains the number of addresses removed. 626.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io" 627Add one or more addresses to a table. 628On entry, 629.Va pfrio_table 630contains the table ID and 631.Va pfrio_buffer 632must point to an array of 633.Vt struct pfr_addr 634containing at least 635.Vt pfrio_size 636elements to add to the table. 637.Vt pfrio_esize 638must be the size of 639.Vt struct pfr_addr . 640On exit, 641.Va pfrio_nadd 642contains the number of addresses effectively added. 643.Bd -literal 644struct pfr_addr { 645 union { 646 struct in_addr _pfra_ip4addr; 647 struct in6_addr _pfra_ip6addr; 648 } pfra_u; 649 u_int8_t pfra_af; 650 u_int8_t pfra_net; 651 u_int8_t pfra_not; 652 u_int8_t pfra_fback; 653}; 654#define pfra_ip4addr pfra_u._pfra_ip4addr 655#define pfra_ip6addr pfra_u._pfra_ip6addr 656.Ed 657.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io" 658Delete one or more addresses from a table. 659On entry, 660.Va pfrio_table 661contains the table ID and 662.Va pfrio_buffer 663must point to an array of 664.Vt struct pfr_addr 665containing at least 666.Vt pfrio_size 667elements to delete from the table. 668.Vt pfrio_esize 669must be the size of 670.Vt struct pfr_addr . 671On exit, 672.Va pfrio_ndel 673contains the number of addresses effectively deleted. 674.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io" 675Replace the content of a table by a new address list. 676This is the most complicated command, which uses all the structure members. 677.Pp 678On entry, 679.Va pfrio_table 680contains the table ID and 681.Va pfrio_buffer 682must point to an array of 683.Vt struct pfr_addr 684containing at least 685.Vt pfrio_size 686elements which become the new contents of the table. 687.Vt pfrio_esize 688must be the size of 689.Vt struct pfr_addr . 690Additionally, if 691.Va pfrio_size2 692is non-zero, 693.Va pfrio_buffer[pfrio_size..pfrio_size2] 694must be a writeable buffer, into which the kernel can copy the 695addresses that have been deleted during the replace operation. 696On exit, 697.Va pfrio_ndel , 698.Va pfrio_nadd , 699and 700.Va pfrio_nchange 701contain the number of addresses deleted, added, and changed by the 702kernel. 703If 704.Va pfrio_size2 705was set on entry, 706.Va pfrio_size2 707will point to the size of the buffer used, exactly like 708.Dv DIOCRGETADDRS . 709.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io" 710Get all the addresses of a table. 711On entry, 712.Va pfrio_table 713contains the table ID and 714.Va pfrio_buffer[pfrio_size] 715contains a valid writeable buffer for 716.Vt pfr_addr 717structures. 718On exit, 719.Va pfrio_size 720contains the number of addresses written into the buffer. 721If the buffer was too small, the kernel does not store anything but just 722returns the required buffer size, without returning an error. 723.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io" 724This call is like 725.Dv DIOCRGETADDRS 726but is used to get an array of 727.Vt pfr_astats 728structures. 729.Bd -literal 730struct pfr_astats { 731 struct pfr_addr pfras_a; 732 u_int64_t pfras_packets 733 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 734 u_int64_t pfras_bytes 735 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 736 long pfras_tzero; 737}; 738.Ed 739.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io" 740Clear the statistics of one or more addresses. 741On entry, 742.Va pfrio_table 743contains the table ID and 744.Va pfrio_buffer 745must point to an array of 746.Vt struct pfr_addr 747containing at least 748.Vt pfrio_size 749elements to be cleared from the table. 750.Vt pfrio_esize 751must be the size of 752.Vt struct pfr_addr . 753On exit, 754.Va pfrio_nzero 755contains the number of addresses effectively cleared. 756.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io" 757Test if the given addresses match a table. 758On entry, 759.Va pfrio_table 760contains the table ID and 761.Va pfrio_buffer 762must point to an array of 763.Vt struct pfr_addr 764containing at least 765.Vt pfrio_size 766elements, each of which will be tested for a match in the table. 767.Vt pfrio_esize 768must be the size of 769.Vt struct pfr_addr . 770On exit, the kernel updates the 771.Vt pfr_addr 772array by setting the 773.Va pfra_fback 774member appropriately. 775.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io" 776Change the 777.Dv PFR_TFLAG_CONST 778or 779.Dv PFR_TFLAG_PERSIST 780flags of a table. 781On entry, 782.Va pfrio_buffer 783must point to an array of 784.Vt struct pfr_table 785containing at least 786.Vt pfrio_size 787elements. 788.Va pfrio_esize 789must be the size of 790.Vt struct pfr_table . 791.Va pfrio_setflag 792must contain the flags to add, while 793.Va pfrio_clrflag 794must contain the flags to remove. 795On exit, 796.Va pfrio_nchange 797and 798.Va pfrio_ndel 799contain the number of tables altered or deleted by the kernel. 800Yes, tables can be deleted if one removes the 801.Dv PFR_TFLAG_PERSIST 802flag of an unreferenced table. 803.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io" 804Defines a table in the inactive set. 805On entry, 806.Va pfrio_table 807contains the table ID and 808.Va pfrio_buffer[pfrio_size] 809contains an array of 810.Vt pfr_addr 811structures to put in the table. 812A valid ticket must also be supplied to 813.Va pfrio_ticket . 814On exit, 815.Va pfrio_nadd 816contains 0 if the table was already defined in the inactive list 817or 1 if a new table has been created. 818.Va pfrio_naddr 819contains the number of addresses effectively put in the table. 820.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io" 821.Bd -literal 822struct pfioc_trans { 823 int size; /* number of elements */ 824 int esize; /* size of each element in bytes */ 825 struct pfioc_trans_e { 826 int rs_num; 827 char anchor[MAXPATHLEN]; 828 u_int32_t ticket; 829 } *array; 830}; 831.Ed 832.Pp 833Clear all the inactive rulesets specified in the 834.Vt pfioc_trans_e 835array. 836For each ruleset, a ticket is returned for subsequent "add rule" ioctls, 837as well as for the 838.Dv DIOCXCOMMIT 839and 840.Dv DIOCXROLLBACK 841calls. 842.Pp 843Ruleset types, identified by 844.Va rs_num , 845include the following: 846.Pp 847.Bl -tag -width PF_RULESET_FILTER -offset ind -compact 848.It Dv PF_RULESET_SCRUB 849Scrub (packet normalization) rules. 850.It Dv PF_RULESET_FILTER 851Filter rules. 852.It Dv PF_RULESET_NAT 853NAT (Network Address Translation) rules. 854.It Dv PF_RULESET_BINAT 855Bidirectional NAT rules. 856.It Dv PF_RULESET_RDR 857Redirect rules. 858.It Dv PF_RULESET_ALTQ 859ALTQ disciplines. 860.It Dv PF_RULESET_TABLE 861Address tables. 862.El 863.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io" 864Atomically switch a vector of inactive rulesets to the active rulesets. 865This call is implemented as a standard two-phase commit, which will either 866fail for all rulesets or completely succeed. 867All tickets need to be valid. 868This ioctl returns 869.Er EBUSY 870if another process is concurrently updating some of the same rulesets. 871.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io" 872Clean up the kernel by undoing all changes that have taken place on the 873inactive rulesets since the last 874.Dv DIOCXBEGIN . 875.Dv DIOCXROLLBACK 876will silently ignore rulesets for which the ticket is invalid. 877.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid" 878Set the host ID, which is used by 879.Xr pfsync 4 880to identify which host created state table entries. 881.It Dv DIOCOSFPFLUSH 882Flush the passive OS fingerprint table. 883.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io" 884.Bd -literal 885struct pf_osfp_ioctl { 886 struct pf_osfp_entry { 887 SLIST_ENTRY(pf_osfp_entry) fp_entry; 888 pf_osfp_t fp_os; 889 char fp_class_nm[PF_OSFP_LEN]; 890 char fp_version_nm[PF_OSFP_LEN]; 891 char fp_subtype_nm[PF_OSFP_LEN]; 892 } fp_os; 893 pf_tcpopts_t fp_tcpopts; 894 u_int16_t fp_wsize; 895 u_int16_t fp_psize; 896 u_int16_t fp_mss; 897 u_int16_t fp_flags; 898 u_int8_t fp_optcnt; 899 u_int8_t fp_wscale; 900 u_int8_t fp_ttl; 901 int fp_getnum; 902}; 903.Ed 904.Pp 905Add a passive OS fingerprint to the table. 906Set 907.Va fp_os.fp_os 908to the packed fingerprint, 909.Va fp_os.fp_class_nm 910to the name of the class (Linux, Windows, etc), 911.Va fp_os.fp_version_nm 912to the name of the version (NT, 95, 98), and 913.Va fp_os.fp_subtype_nm 914to the name of the subtype or patchlevel. 915The members 916.Va fp_mss , 917.Va fp_wsize , 918.Va fp_psize , 919.Va fp_ttl , 920.Va fp_optcnt , 921and 922.Va fp_wscale 923are set to the TCP MSS, the TCP window size, the IP length, the IP TTL, 924the number of TCP options, and the TCP window scaling constant of the 925TCP SYN packet, respectively. 926.Pp 927The 928.Va fp_flags 929member is filled according to the 930.Aq Pa net/pfvar.h 931include file 932.Dv PF_OSFP_* 933defines. 934The 935.Va fp_tcpopts 936member contains packed TCP options. 937Each option uses 938.Dv PF_OSFP_TCPOPT_BITS 939bits in the packed value. 940Options include any of 941.Dv PF_OSFP_TCPOPT_NOP , 942.Dv PF_OSFP_TCPOPT_SACK , 943.Dv PF_OSFP_TCPOPT_WSCALE , 944.Dv PF_OSFP_TCPOPT_MSS , 945or 946.Dv PF_OSFP_TCPOPT_TS . 947.Pp 948The 949.Va fp_getnum 950member is not used with this ioctl. 951.Pp 952The structure's slack space must be zeroed for correct operation; 953.Xr memset 3 954the whole structure to zero before filling and sending to the kernel. 955.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io" 956Get the passive OS fingerprint number 957.Va fp_getnum 958from the kernel's fingerprint list. 959The rest of the structure members will come back filled. 960Get the whole list by repeatedly incrementing the 961.Va fp_getnum 962number until the ioctl returns 963.Er EBUSY . 964.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn" 965.Bd -literal 966struct pfioc_src_nodes { 967 int psn_len; 968 union { 969 caddr_t psu_buf; 970 struct pf_src_node *psu_src_nodes; 971 } psn_u; 972#define psn_buf psn_u.psu_buf 973#define psn_src_nodes psn_u.psu_src_nodes 974}; 975.Ed 976.Pp 977Get the list of source nodes kept by sticky addresses and source 978tracking. 979The ioctl must be called once with 980.Va psn_len 981set to 0. 982If the ioctl returns without error, 983.Va psn_len 984will be set to the size of the buffer required to hold all the 985.Va pf_src_node 986structures held in the table. 987A buffer of this size should then be allocated, and a pointer to this buffer 988placed in 989.Va psn_buf . 990The ioctl must then be called again to fill this buffer with the actual 991source node data. 992After that call, 993.Va psn_len 994will be set to the length of the buffer actually used. 995.It Dv DIOCCLRSRCNODES 996Clear the tree of source tracking nodes. 997.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io" 998Get the list of interfaces and interface drivers known to 999.Nm . 1000All the ioctls that manipulate interfaces 1001use the same structure described below: 1002.Bd -literal 1003struct pfioc_iface { 1004 char pfiio_name[IFNAMSIZ]; 1005 void *pfiio_buffer; 1006 int pfiio_esize; 1007 int pfiio_size; 1008 int pfiio_nzero; 1009 int pfiio_flags; 1010}; 1011.Ed 1012.Pp 1013If not empty, 1014.Va pfiio_name 1015can be used to restrict the search to a specific interface or driver. 1016.Va pfiio_buffer[pfiio_size] 1017is the user-supplied buffer for returning the data. 1018On entry, 1019.Va pfiio_size 1020contains the number of 1021.Vt pfi_kif 1022entries that can fit into the buffer. 1023The kernel will replace this value by the real number of entries it wants 1024to return. 1025.Va pfiio_esize 1026should be set to 1027.Li sizeof(struct pfi_kif) . 1028.Pp 1029The data is returned in the 1030.Vt pfi_kif 1031structure described below: 1032.Bd -literal 1033struct pfi_kif { 1034 RB_ENTRY(pfi_kif) pfik_tree; 1035 char pfik_name[IFNAMSIZ]; 1036 u_int64_t pfik_packets[2][2][2]; 1037 u_int64_t pfik_bytes[2][2][2]; 1038 u_int32_t pfik_tzero; 1039 int pfik_flags; 1040 struct pf_state_tree_lan_ext pfik_lan_ext; 1041 struct pf_state_tree_ext_gwy pfik_ext_gwy; 1042 TAILQ_ENTRY(pfi_kif) pfik_w_states; 1043 void *pfik_ah_cookie; 1044 struct ifnet *pfik_ifp; 1045 struct ifg_group *pfik_group; 1046 int pfik_states; 1047 int pfik_rules; 1048 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; 1049}; 1050.Ed 1051.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io" 1052Set the user setable flags (described above) of the 1053.Nm 1054internal interface description. 1055The filtering process is the same as for 1056.Dv DIOCIGETIFACES . 1057.Bd -literal 1058#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */ 1059.Ed 1060.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io" 1061Works as 1062.Dv DIOCSETIFFLAG 1063above but clears the flags. 1064.El 1065.Sh FILES 1066.Bl -tag -width /dev/pf -compact 1067.It Pa /dev/pf 1068packet filtering device. 1069.El 1070.Sh EXAMPLES 1071The following example demonstrates how to use the 1072.Dv DIOCNATLOOK 1073command to find the internal host/port of a NATed connection: 1074.Bd -literal 1075#include \*[Lt]sys/types.h\*[Gt] 1076#include \*[Lt]sys/socket.h\*[Gt] 1077#include \*[Lt]sys/ioctl.h\*[Gt] 1078#include \*[Lt]sys/fcntl.h\*[Gt] 1079#include \*[Lt]net/if.h\*[Gt] 1080#include \*[Lt]netinet/in.h\*[Gt] 1081#include \*[Lt]net/pfvar.h\*[Gt] 1082#include \*[Lt]err.h\*[Gt] 1083#include \*[Lt]stdio.h\*[Gt] 1084#include \*[Lt]stdlib.h\*[Gt] 1085 1086u_int32_t 1087read_address(const char *s) 1088{ 1089 int a, b, c, d; 1090 1091 sscanf(s, "%i.%i.%i.%i", \*[Am]a, \*[Am]b, \*[Am]c, \*[Am]d); 1092 return htonl(a \*[Lt]\*[Lt] 24 | b \*[Lt]\*[Lt] 16 | c \*[Lt]\*[Lt] 8 | d); 1093} 1094 1095void 1096print_address(u_int32_t a) 1097{ 1098 a = ntohl(a); 1099 printf("%d.%d.%d.%d", a \*[Gt]\*[Gt] 24 \*[Am] 255, a \*[Gt]\*[Gt] 16 \*[Am] 255, 1100 a \*[Gt]\*[Gt] 8 \*[Am] 255, a \*[Am] 255); 1101} 1102 1103int 1104main(int argc, char *argv[]) 1105{ 1106 struct pfioc_natlook nl; 1107 int dev; 1108 1109 if (argc != 5) { 1110 printf("%s \*[Lt]gwy addr\*[Gt] \*[Lt]gwy port\*[Gt] \*[Lt]ext addr\*[Gt] \*[Lt]ext port\*[Gt]\\n", 1111 argv[0]); 1112 return 1; 1113 } 1114 1115 dev = open("/dev/pf", O_RDWR); 1116 if (dev == -1) 1117 err(1, "open(\\"/dev/pf\\") failed"); 1118 1119 memset(\*[Am]nl, 0, sizeof(struct pfioc_natlook)); 1120 nl.saddr.v4.s_addr = read_address(argv[1]); 1121 nl.sport = htons(atoi(argv[2])); 1122 nl.daddr.v4.s_addr = read_address(argv[3]); 1123 nl.dport = htons(atoi(argv[4])); 1124 nl.af = AF_INET; 1125 nl.proto = IPPROTO_TCP; 1126 nl.direction = PF_IN; 1127 1128 if (ioctl(dev, DIOCNATLOOK, \*[Am]nl)) 1129 err(1, "DIOCNATLOOK"); 1130 1131 printf("internal host "); 1132 print_address(nl.rsaddr.v4.s_addr); 1133 printf(":%u\\n", ntohs(nl.rsport)); 1134 return 0; 1135} 1136.Ed 1137.Sh SEE ALSO 1138.Xr ioctl 2 , 1139.Xr bridge 4 , 1140.Xr pflog 4 , 1141.Xr pfsync 4 , 1142.Xr pfctl 8 , 1143.Xr altq 9 1144.Sh HISTORY 1145The 1146.Nm 1147packet filtering mechanism first appeared in 1148.Ox 3.0 . 1149.Sh CAVEATS 1150The following functionality is missing from 1151.Nm 1152in this version of 1153.Nx : 1154.Bl -bullet -offset indent 1155.It 1156The 1157.Em group 1158keyword is not supported. 1159.El 1160