1.\" $NetBSD: npf-params.7,v 1.9 2023/02/12 13:21:28 kardel Exp $ 2.\" 3.\" Copyright (c) 2019 Mindaugas Rasiukevicius <rmind at netbsd org> 4.\" All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 15.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 19.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25.\" SUCH DAMAGE. 26.\" 27.Dd May 31, 2020 28.Dt NPF-PARAMS 7 29.Os 30.Sh NAME 31.Nm npf-params 32.Nd tunable NPF parameters 33.Sh DESCRIPTION 34NPF supports a set of dynamically tunable parameters. 35.Pp 36All parameter values are integers and should generally be between 37zero and 38.Dv INT_MAX , 39unless specified otherwise. 40Some parameters values can be negative; such values would typically 41have a special meaning. 42Enable/disable switches should be represented as boolean values 0 ("off") 43or 1 ("on"). 44.Sh PARAMETERS 45.Bl -tag -width "123456" 46.\" --- 47.Bl -tag -width "123456" 48.It Li bpf.jit 49BPF just-in-time compilation: enables or disables 50.Xr bpfjit 4 51support. 52Some machine architectures are not presently supported by 53.Xr bpfjit 4 . 54Setting this parameter to off stops NPF from trying to enable this 55functionality, and generating a warning if it is unable to do so. 56Default: 1. 57.El 58.\" --- 59.Bl -tag -width "123456" 60.It Li ip4.reassembly 61Perform IPv4 reassembly before inspecting the packet. 62Fragmentation is considered very harmful, so most networks are expected 63to prevent it; reassembly is enabled by default. 64However, while the packet should generally be reassembled at the receiver, 65reassembly by the packet filter may be necessary in order to perform state 66tracking. 67Default: 1. 68.It Li ip6.reassembly 69Perform IPv6 reassembly before inspecting the packet. 70Discouraged in general but not prohibited by RFC 8200. 71Default: 0. 72.El 73.\" --- 74.Bl -tag -width "123456" 75.It Li gc.step 76Number of connection state items to process in one garbage collection 77(G/C) cycle. 78Must be positive number. 79Default: 256. 80.It Li gc.interval_min 81The lower bound for the sleep time of the G/C worker. 82The worker is self-tuning and will wake up more frequently if there are 83connections to expire; it will wake up less frequently, diverging towards 84the upper bound, if it does not encounter expired connections. 85Default: 50 (in milliseconds). 86.It Li gc.interval_max 87The upper bound for the sleep time of the G/C worker. 88Default: 5000 (in milliseconds). 89.El 90.\" --- 91.It Li state.key 92The connection state is uniquely identified by an n-tuple. 93The state behavior can be controlled by including (excluding) 94some of the information in (from) the keys. 95.Bl -tag -width "123456" 96.It Li interface 97Include interface identifier into the keys, making the connection 98state strictly per-interface. 99Default: 1. 100.It Li direction 101Include packet direction into the keys. 102Default: 1. 103.El 104.\" --- 105.It Li state.generic 106Generic state tracking parameters for non-TCP flows. 107All timeouts are in seconds and must be zero or positive. 108.Bl -tag -width "123456" 109.It Li timeout.new 110Timeout for new ("unsynchronized") state. 111Default: 30. 112.It Li timeout.established 113Timeout for established ("synchronized") state. 114Default: 60. 115.It Li timeout.closed 116Timeout for closed state. 117Default: 0. 118.El 119.\" --- 120.It Li state.tcp 121State tracking parameters for TCP connections. 122All timeout values are in seconds. 123.Bl -tag -width "123456" 124.It Li max_ack_win 125Maximum allowed ACK window. 126Default: 66000. 127.It Li strict_order_rst 128Enforce strict order RST. 129Default: 1. 130.\" - 131.It Li timeout.new 132Timeout for a new connection in "unsynchronized" state. 133Default: 30. 134.It Li timeout.established 135Timeout for an established connection ("synchronized" state). 136Default: 86400. 137.It Li timeout.half_close 138Timeout for the half-close TCP states. 139Default: 3600. 140.It Li timeout.close 141Timeout for the full close TCP states. 142Default: 10. 143.It Li timeout.time_wait 144Timeout for the TCP time-wait state. 145Default: 240. 146.El 147.\" --- 148.It Li portmap.min_port 149Lower bound of the port range used when selecting the port 150for dynamic NAT with port translation enabled. 151Default: 1024 (inclusive; also the lowest allowed value). 152.It Li portmap.max_port 153Upper bound of the port range as described above. 154Default: 49151 (inclusive; 65535 is the highest allowed value). 155.\" --- 156.El 157.\" ----- 158.Sh EXAMPLES 159An example line in the 160.Xr npf.conf 5 161configuration file: 162.Bd -literal -offset indent 163set state.tcp.strict_order_rst on # "on" can be used instead of 1 164set state.tcp.timeout.time_wait 0 # destroy the state immediately 165.Ed 166.\" ----- 167.Sh SEE ALSO 168.Xr libnpf 3 , 169.Xr npfkern 3 , 170.Xr bpfjit 4 , 171.Xr npf.conf 5 , 172.Xr pcap-filter 7 , 173.Xr npfctl 8 174.\" ----- 175.Sh AUTHORS 176NPF 177was designed and implemented by 178.An Mindaugas Rasiukevicius . 179