1.\" $OpenBSD: pf.4,v 1.54 2004/12/22 17:17:55 dhartmei Exp $
| 1.\" $OpenBSD: pf.4,v 1.58 2007/02/09 11:39:06 henning Exp $
|
2.\" 3.\" Copyright (C) 2001, Kjell Wooding. All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. Neither the name of the project nor the names of its contributors 14.\" may be used to endorse or promote products derived from this software 15.\" without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\"
| 2.\" 3.\" Copyright (C) 2001, Kjell Wooding. All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. Neither the name of the project nor the names of its contributors 14.\" may be used to endorse or promote products derived from this software 15.\" without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\"
|
29.\" $FreeBSD: head/contrib/pf/man/pf.4 150673 2005-09-28 08:11:15Z mlaier $
| 29.\" $FreeBSD: head/contrib/pf/man/pf.4 171172 2007-07-03 12:30:03Z mlaier $
|
30.\" 31.Dd February 7, 2005 32.Dt PF 4 33.Os 34.Sh NAME 35.Nm pf 36.Nd packet filter 37.Sh SYNOPSIS 38.Cd "device pf" 39.Sh DESCRIPTION 40Packet filtering takes place in the kernel. 41A pseudo-device, 42.Pa /dev/pf , 43allows userland processes to control the 44behavior of the packet filter through an 45.Xr ioctl 2 46interface. 47There are commands to enable and disable the filter, load rulesets, 48add and remove individual rules or state table entries, 49and retrieve statistics. 50The most commonly used functions are covered by 51.Xr pfctl 8 . 52.Pp 53Manipulations like loading a ruleset that involve more than a single 54.Xr ioctl 2 55call require a so-called 56.Em ticket , 57which prevents the occurrence of 58multiple concurrent manipulations. 59.Pp 60Fields of 61.Xr ioctl 2 62parameter structures that refer to packet data (like 63addresses and ports) are generally expected in network byte-order. 64.Pp 65Rules and address tables are contained in so-called 66.Em anchors . 67When servicing an 68.Xr ioctl 2 69request, if the anchor field of the argument structure is empty, 70the kernel will use the default anchor (i.e., the main ruleset) 71in operations. 72Anchors are specified by name and may be nested, with components 73separated by 74.Sq / 75characters, similar to how file system hierarchies are laid out. 76The final component of the anchor path is the anchor under which 77operations will be performed. 78.Sh IOCTL INTERFACE 79.Nm 80supports the following 81.Xr ioctl 2 82commands, available through 83.Aq Pa net/pfvar.h : 84.Bl -tag -width xxxxxx 85.It Dv DIOCSTART 86Start the packet filter. 87.It Dv DIOCSTOP 88Stop the packet filter. 89.It Dv DIOCSTARTALTQ 90Start the ALTQ bandwidth control system (see 91.Xr altq 9 ) . 92.It Dv DIOCSTOPALTQ 93Stop the ALTQ bandwidth control system. 94.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp" 95.Bd -literal 96struct pfioc_pooladdr { 97 u_int32_t action; 98 u_int32_t ticket; 99 u_int32_t nr; 100 u_int32_t r_num; 101 u_int8_t r_action; 102 u_int8_t r_last; 103 u_int8_t af; 104 char anchor[MAXPATHLEN]; 105 struct pf_pooladdr addr; 106}; 107.Ed 108.Pp 109Clear the buffer address pool and get a 110.Va ticket 111for subsequent 112.Dv DIOCADDADDR , 113.Dv DIOCADDRULE , 114and 115.Dv DIOCCHANGERULE 116calls. 117.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp" 118.Pp 119Add the pool address 120.Va addr 121to the buffer address pool to be used in the following 122.Dv DIOCADDRULE 123or 124.Dv DIOCCHANGERULE 125call. 126All other members of the structure are ignored. 127.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr" 128.Bd -literal 129struct pfioc_rule { 130 u_int32_t action; 131 u_int32_t ticket; 132 u_int32_t pool_ticket; 133 u_int32_t nr; 134 char anchor[MAXPATHLEN]; 135 char anchor_call[MAXPATHLEN]; 136 struct pf_rule rule; 137}; 138.Ed 139.Pp 140Add 141.Va rule 142at the end of the inactive ruleset. 143This call requires a 144.Va ticket 145obtained through a preceding 146.Dv DIOCXBEGIN 147call and a 148.Va pool_ticket 149obtained through a 150.Dv DIOCBEGINADDRS 151call. 152.Dv DIOCADDADDR 153must also be called if any pool addresses are required. 154The optional 155.Va anchor 156name indicates the anchor in which to append the rule. 157.Va nr 158and 159.Va action 160are ignored. 161.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa" 162Add an ALTQ discipline or queue. 163.Bd -literal 164struct pfioc_altq { 165 u_int32_t action; 166 u_int32_t ticket; 167 u_int32_t nr; 168 struct pf_altq altq; 169}; 170.Ed 171.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr" 172Get a 173.Va ticket 174for subsequent 175.Dv DIOCGETRULE 176calls and the number 177.Va nr 178of rules in the active ruleset. 179.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr" 180Get a 181.Va rule 182by its number 183.Va nr 184using the 185.Va ticket 186obtained through a preceding 187.Dv DIOCGETRULES 188call.
| 30.\" 31.Dd February 7, 2005 32.Dt PF 4 33.Os 34.Sh NAME 35.Nm pf 36.Nd packet filter 37.Sh SYNOPSIS 38.Cd "device pf" 39.Sh DESCRIPTION 40Packet filtering takes place in the kernel. 41A pseudo-device, 42.Pa /dev/pf , 43allows userland processes to control the 44behavior of the packet filter through an 45.Xr ioctl 2 46interface. 47There are commands to enable and disable the filter, load rulesets, 48add and remove individual rules or state table entries, 49and retrieve statistics. 50The most commonly used functions are covered by 51.Xr pfctl 8 . 52.Pp 53Manipulations like loading a ruleset that involve more than a single 54.Xr ioctl 2 55call require a so-called 56.Em ticket , 57which prevents the occurrence of 58multiple concurrent manipulations. 59.Pp 60Fields of 61.Xr ioctl 2 62parameter structures that refer to packet data (like 63addresses and ports) are generally expected in network byte-order. 64.Pp 65Rules and address tables are contained in so-called 66.Em anchors . 67When servicing an 68.Xr ioctl 2 69request, if the anchor field of the argument structure is empty, 70the kernel will use the default anchor (i.e., the main ruleset) 71in operations. 72Anchors are specified by name and may be nested, with components 73separated by 74.Sq / 75characters, similar to how file system hierarchies are laid out. 76The final component of the anchor path is the anchor under which 77operations will be performed. 78.Sh IOCTL INTERFACE 79.Nm 80supports the following 81.Xr ioctl 2 82commands, available through 83.Aq Pa net/pfvar.h : 84.Bl -tag -width xxxxxx 85.It Dv DIOCSTART 86Start the packet filter. 87.It Dv DIOCSTOP 88Stop the packet filter. 89.It Dv DIOCSTARTALTQ 90Start the ALTQ bandwidth control system (see 91.Xr altq 9 ) . 92.It Dv DIOCSTOPALTQ 93Stop the ALTQ bandwidth control system. 94.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp" 95.Bd -literal 96struct pfioc_pooladdr { 97 u_int32_t action; 98 u_int32_t ticket; 99 u_int32_t nr; 100 u_int32_t r_num; 101 u_int8_t r_action; 102 u_int8_t r_last; 103 u_int8_t af; 104 char anchor[MAXPATHLEN]; 105 struct pf_pooladdr addr; 106}; 107.Ed 108.Pp 109Clear the buffer address pool and get a 110.Va ticket 111for subsequent 112.Dv DIOCADDADDR , 113.Dv DIOCADDRULE , 114and 115.Dv DIOCCHANGERULE 116calls. 117.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp" 118.Pp 119Add the pool address 120.Va addr 121to the buffer address pool to be used in the following 122.Dv DIOCADDRULE 123or 124.Dv DIOCCHANGERULE 125call. 126All other members of the structure are ignored. 127.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr" 128.Bd -literal 129struct pfioc_rule { 130 u_int32_t action; 131 u_int32_t ticket; 132 u_int32_t pool_ticket; 133 u_int32_t nr; 134 char anchor[MAXPATHLEN]; 135 char anchor_call[MAXPATHLEN]; 136 struct pf_rule rule; 137}; 138.Ed 139.Pp 140Add 141.Va rule 142at the end of the inactive ruleset. 143This call requires a 144.Va ticket 145obtained through a preceding 146.Dv DIOCXBEGIN 147call and a 148.Va pool_ticket 149obtained through a 150.Dv DIOCBEGINADDRS 151call. 152.Dv DIOCADDADDR 153must also be called if any pool addresses are required. 154The optional 155.Va anchor 156name indicates the anchor in which to append the rule. 157.Va nr 158and 159.Va action 160are ignored. 161.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa" 162Add an ALTQ discipline or queue. 163.Bd -literal 164struct pfioc_altq { 165 u_int32_t action; 166 u_int32_t ticket; 167 u_int32_t nr; 168 struct pf_altq altq; 169}; 170.Ed 171.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr" 172Get a 173.Va ticket 174for subsequent 175.Dv DIOCGETRULE 176calls and the number 177.Va nr 178of rules in the active ruleset. 179.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr" 180Get a 181.Va rule 182by its number 183.Va nr 184using the 185.Va ticket 186obtained through a preceding 187.Dv DIOCGETRULES 188call.
|
| 189If 190.Va action 191is set to 192.Dv PF_GET_CLR_CNTR , 193the per-rule statistics on the requested rule are cleared.
|
189.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp" 190Get a 191.Va ticket 192for subsequent 193.Dv DIOCGETADDR 194calls and the number 195.Va nr 196of pool addresses in the rule specified with 197.Va r_action , 198.Va r_num , 199and 200.Va anchor . 201.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp" 202Get the pool address 203.Va addr 204by its number 205.Va nr 206from the rule specified with 207.Va r_action , 208.Va r_num , 209and 210.Va anchor 211using the 212.Va ticket 213obtained through a preceding 214.Dv DIOCGETADDRS 215call. 216.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa" 217Get a 218.Va ticket 219for subsequent 220.Dv DIOCGETALTQ 221calls and the number 222.Va nr 223of queues in the active list. 224.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa" 225Get the queueing discipline 226.Va altq 227by its number 228.Va nr 229using the 230.Va ticket 231obtained through a preceding 232.Dv DIOCGETALTQS 233call. 234.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq" 235Get the statistics on a queue. 236.Bd -literal 237struct pfioc_qstats { 238 u_int32_t ticket; 239 u_int32_t nr; 240 void *buf; 241 int nbytes; 242 u_int8_t scheduler; 243}; 244.Ed 245.Pp 246This call fills in a pointer to the buffer of statistics 247.Va buf , 248of length 249.Va nbytes , 250for the queue specified by 251.Va nr . 252.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr" 253.Bd -literal 254struct pfioc_ruleset { 255 u_int32_t nr; 256 char path[MAXPATHLEN]; 257 char name[PF_ANCHOR_NAME_SIZE]; 258}; 259.Ed 260.Pp 261Get the number 262.Va nr 263of rulesets (i.e., anchors) directly attached to the anchor named by 264.Va path 265for use in subsequent 266.Dv DIOCGETRULESET 267calls. 268Nested anchors, since they are not directly attached to the given 269anchor, will not be included. 270This ioctl returns 271.Er EINVAL 272if the given anchor does not exist. 273.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr" 274Get a ruleset (i.e., an anchor) 275.Va name 276by its number 277.Va nr 278from the given anchor 279.Va path , 280the maximum number of which can be obtained from a preceding 281.Dv DIOCGETRULESETS 282call. 283This ioctl returns 284.Er EINVAL 285if the given anchor does not exist or 286.Er EBUSY 287if another process is concurrently updating a ruleset. 288.It Dv DIOCADDSTATE Fa "struct pfioc_state *ps" 289Add a state entry. 290.Bd -literal 291struct pfioc_state { 292 u_int32_t nr; 293 struct pf_state state; 294}; 295.Ed 296.It Dv DIOCGETSTATE Fa "struct pfioc_state *ps" 297Extract the entry with the specified number 298.Va nr 299from the state table. 300.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk" 301Remove matching entries from the state table. 302This ioctl returns the number of killed states in 303.Va psk_af . 304.Bd -literal 305struct pfioc_state_kill { 306 sa_family_t psk_af; 307 int psk_proto; 308 struct pf_rule_addr psk_src; 309 struct pf_rule_addr psk_dst; 310 char psk_ifname[IFNAMSIZ]; 311}; 312.Ed 313.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk" 314Clear all states. 315It works like 316.Dv DIOCKILLSTATES , 317but ignores the 318.Va psk_af , 319.Va psk_proto , 320.Va psk_src , 321and 322.Va psk_dst 323fields of the 324.Vt pfioc_state_kill 325structure. 326.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi" 327Specify the interface for which statistics are accumulated. 328.Bd -literal 329struct pfioc_if { 330 char ifname[IFNAMSIZ]; 331}; 332.Ed 333.It Dv DIOCGETSTATUS Fa "struct pf_status *s" 334Get the internal packet filter statistics. 335.Bd -literal 336struct pf_status { 337 u_int64_t counters[PFRES_MAX]; 338 u_int64_t lcounters[LCNT_MAX]; 339 u_int64_t fcounters[FCNT_MAX]; 340 u_int64_t scounters[SCNT_MAX]; 341 u_int64_t pcounters[2][2][3]; 342 u_int64_t bcounters[2][2]; 343 u_int64_t stateid; 344 u_int32_t running; 345 u_int32_t states; 346 u_int32_t src_nodes; 347 u_int32_t since; 348 u_int32_t debug; 349 u_int32_t hostid; 350 char ifname[IFNAMSIZ];
| 194.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp" 195Get a 196.Va ticket 197for subsequent 198.Dv DIOCGETADDR 199calls and the number 200.Va nr 201of pool addresses in the rule specified with 202.Va r_action , 203.Va r_num , 204and 205.Va anchor . 206.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp" 207Get the pool address 208.Va addr 209by its number 210.Va nr 211from the rule specified with 212.Va r_action , 213.Va r_num , 214and 215.Va anchor 216using the 217.Va ticket 218obtained through a preceding 219.Dv DIOCGETADDRS 220call. 221.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa" 222Get a 223.Va ticket 224for subsequent 225.Dv DIOCGETALTQ 226calls and the number 227.Va nr 228of queues in the active list. 229.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa" 230Get the queueing discipline 231.Va altq 232by its number 233.Va nr 234using the 235.Va ticket 236obtained through a preceding 237.Dv DIOCGETALTQS 238call. 239.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq" 240Get the statistics on a queue. 241.Bd -literal 242struct pfioc_qstats { 243 u_int32_t ticket; 244 u_int32_t nr; 245 void *buf; 246 int nbytes; 247 u_int8_t scheduler; 248}; 249.Ed 250.Pp 251This call fills in a pointer to the buffer of statistics 252.Va buf , 253of length 254.Va nbytes , 255for the queue specified by 256.Va nr . 257.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr" 258.Bd -literal 259struct pfioc_ruleset { 260 u_int32_t nr; 261 char path[MAXPATHLEN]; 262 char name[PF_ANCHOR_NAME_SIZE]; 263}; 264.Ed 265.Pp 266Get the number 267.Va nr 268of rulesets (i.e., anchors) directly attached to the anchor named by 269.Va path 270for use in subsequent 271.Dv DIOCGETRULESET 272calls. 273Nested anchors, since they are not directly attached to the given 274anchor, will not be included. 275This ioctl returns 276.Er EINVAL 277if the given anchor does not exist. 278.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr" 279Get a ruleset (i.e., an anchor) 280.Va name 281by its number 282.Va nr 283from the given anchor 284.Va path , 285the maximum number of which can be obtained from a preceding 286.Dv DIOCGETRULESETS 287call. 288This ioctl returns 289.Er EINVAL 290if the given anchor does not exist or 291.Er EBUSY 292if another process is concurrently updating a ruleset. 293.It Dv DIOCADDSTATE Fa "struct pfioc_state *ps" 294Add a state entry. 295.Bd -literal 296struct pfioc_state { 297 u_int32_t nr; 298 struct pf_state state; 299}; 300.Ed 301.It Dv DIOCGETSTATE Fa "struct pfioc_state *ps" 302Extract the entry with the specified number 303.Va nr 304from the state table. 305.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk" 306Remove matching entries from the state table. 307This ioctl returns the number of killed states in 308.Va psk_af . 309.Bd -literal 310struct pfioc_state_kill { 311 sa_family_t psk_af; 312 int psk_proto; 313 struct pf_rule_addr psk_src; 314 struct pf_rule_addr psk_dst; 315 char psk_ifname[IFNAMSIZ]; 316}; 317.Ed 318.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk" 319Clear all states. 320It works like 321.Dv DIOCKILLSTATES , 322but ignores the 323.Va psk_af , 324.Va psk_proto , 325.Va psk_src , 326and 327.Va psk_dst 328fields of the 329.Vt pfioc_state_kill 330structure. 331.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi" 332Specify the interface for which statistics are accumulated. 333.Bd -literal 334struct pfioc_if { 335 char ifname[IFNAMSIZ]; 336}; 337.Ed 338.It Dv DIOCGETSTATUS Fa "struct pf_status *s" 339Get the internal packet filter statistics. 340.Bd -literal 341struct pf_status { 342 u_int64_t counters[PFRES_MAX]; 343 u_int64_t lcounters[LCNT_MAX]; 344 u_int64_t fcounters[FCNT_MAX]; 345 u_int64_t scounters[SCNT_MAX]; 346 u_int64_t pcounters[2][2][3]; 347 u_int64_t bcounters[2][2]; 348 u_int64_t stateid; 349 u_int32_t running; 350 u_int32_t states; 351 u_int32_t src_nodes; 352 u_int32_t since; 353 u_int32_t debug; 354 u_int32_t hostid; 355 char ifname[IFNAMSIZ];
|
| 356 u_int8_t pf_chksum[MD5_DIGEST_LENGTH];
|
351}; 352.Ed 353.It Dv DIOCCLRSTATUS 354Clear the internal packet filter statistics. 355.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl" 356Look up a state table entry by source and destination addresses and ports. 357.Bd -literal 358struct pfioc_natlook { 359 struct pf_addr saddr; 360 struct pf_addr daddr; 361 struct pf_addr rsaddr; 362 struct pf_addr rdaddr; 363 u_int16_t sport; 364 u_int16_t dport; 365 u_int16_t rsport; 366 u_int16_t rdport; 367 sa_family_t af; 368 u_int8_t proto; 369 u_int8_t direction; 370}; 371.Ed 372.It Dv DIOCSETDEBUG Fa "u_int32_t *level" 373Set the debug level. 374.Bd -literal 375enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, 376 PF_DEBUG_NOISY }; 377.Ed 378.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps" 379Get state table entries. 380.Bd -literal 381struct pfioc_states { 382 int ps_len; 383 union { 384 caddr_t psu_buf; 385 struct pf_state *psu_states; 386 } ps_u; 387#define ps_buf ps_u.psu_buf 388#define ps_states ps_u.psu_states 389}; 390.Ed 391.Pp 392If 393.Va ps_len
| 357}; 358.Ed 359.It Dv DIOCCLRSTATUS 360Clear the internal packet filter statistics. 361.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl" 362Look up a state table entry by source and destination addresses and ports. 363.Bd -literal 364struct pfioc_natlook { 365 struct pf_addr saddr; 366 struct pf_addr daddr; 367 struct pf_addr rsaddr; 368 struct pf_addr rdaddr; 369 u_int16_t sport; 370 u_int16_t dport; 371 u_int16_t rsport; 372 u_int16_t rdport; 373 sa_family_t af; 374 u_int8_t proto; 375 u_int8_t direction; 376}; 377.Ed 378.It Dv DIOCSETDEBUG Fa "u_int32_t *level" 379Set the debug level. 380.Bd -literal 381enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, 382 PF_DEBUG_NOISY }; 383.Ed 384.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps" 385Get state table entries. 386.Bd -literal 387struct pfioc_states { 388 int ps_len; 389 union { 390 caddr_t psu_buf; 391 struct pf_state *psu_states; 392 } ps_u; 393#define ps_buf ps_u.psu_buf 394#define ps_states ps_u.psu_states 395}; 396.Ed 397.Pp 398If 399.Va ps_len
|
394is zero, all states will be gathered into 395.Va pf_states 396and
| 400is non-zero on entry, as many states as possible that can fit into this 401size will be copied into the supplied buffer 402.Va ps_states . 403On exit,
|
397.Va ps_len
| 404.Va ps_len
|
398will be set to the size they take in memory (i.e.,
| 405is always set to the total size required to hold all state table entries 406(i.e., it is set to
|
399.Li sizeof(struct pf_state) * nr ) .
| 407.Li sizeof(struct pf_state) * nr ) .
|
400If 401.Va ps_len 402is non-zero, as many states that can fit into 403.Va ps_len 404as possible will be gathered, and 405.Va ps_len 406will be updated to the size those rules take in memory.
| |
407.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr" 408Add or remove the 409.Va rule 410in the ruleset specified by 411.Va rule.action . 412.Pp 413The type of operation to be performed is indicated by 414.Va action , 415which can be any of the following: 416.Bd -literal 417enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 418 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 419 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 420.Ed 421.Pp 422.Va ticket 423must be set to the value obtained with 424.Dv PF_CHANGE_GET_TICKET 425for all actions except 426.Dv PF_CHANGE_GET_TICKET . 427.Va pool_ticket 428must be set to the value obtained with the 429.Dv DIOCBEGINADDRS 430call for all actions except 431.Dv PF_CHANGE_REMOVE 432and 433.Dv PF_CHANGE_GET_TICKET . 434.Va anchor 435indicates to which anchor the operation applies. 436.Va nr 437indicates the rule number against which 438.Dv PF_CHANGE_ADD_BEFORE , 439.Dv PF_CHANGE_ADD_AFTER , 440or 441.Dv PF_CHANGE_REMOVE 442actions are applied. 443.\" It Dv DIOCCHANGEALTQ Fa "struct pfioc_altq *pcr" 444.It Dv DIOCCHANGEADDR Fa "struct pfioc_pooladdr *pca" 445Add or remove the pool address 446.Va addr 447from the rule specified by 448.Va r_action , 449.Va r_num , 450and 451.Va anchor . 452.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt" 453.Bd -literal 454struct pfioc_tm { 455 int timeout; 456 int seconds; 457}; 458.Ed 459.Pp 460Set the state timeout of 461.Va timeout 462to 463.Va seconds . 464The old value will be placed into 465.Va seconds . 466For possible values of 467.Va timeout , 468consult the 469.Dv PFTM_* 470values in 471.Aq Pa net/pfvar.h . 472.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt" 473Get the state timeout of 474.Va timeout . 475The value will be placed into the 476.Va seconds 477field. 478.It Dv DIOCCLRRULECTRS 479Clear per-rule statistics. 480.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl" 481Set the hard limits on the memory pools used by the packet filter. 482.Bd -literal 483struct pfioc_limit { 484 int index; 485 unsigned limit; 486}; 487
| 408.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr" 409Add or remove the 410.Va rule 411in the ruleset specified by 412.Va rule.action . 413.Pp 414The type of operation to be performed is indicated by 415.Va action , 416which can be any of the following: 417.Bd -literal 418enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 419 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 420 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 421.Ed 422.Pp 423.Va ticket 424must be set to the value obtained with 425.Dv PF_CHANGE_GET_TICKET 426for all actions except 427.Dv PF_CHANGE_GET_TICKET . 428.Va pool_ticket 429must be set to the value obtained with the 430.Dv DIOCBEGINADDRS 431call for all actions except 432.Dv PF_CHANGE_REMOVE 433and 434.Dv PF_CHANGE_GET_TICKET . 435.Va anchor 436indicates to which anchor the operation applies. 437.Va nr 438indicates the rule number against which 439.Dv PF_CHANGE_ADD_BEFORE , 440.Dv PF_CHANGE_ADD_AFTER , 441or 442.Dv PF_CHANGE_REMOVE 443actions are applied. 444.\" It Dv DIOCCHANGEALTQ Fa "struct pfioc_altq *pcr" 445.It Dv DIOCCHANGEADDR Fa "struct pfioc_pooladdr *pca" 446Add or remove the pool address 447.Va addr 448from the rule specified by 449.Va r_action , 450.Va r_num , 451and 452.Va anchor . 453.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt" 454.Bd -literal 455struct pfioc_tm { 456 int timeout; 457 int seconds; 458}; 459.Ed 460.Pp 461Set the state timeout of 462.Va timeout 463to 464.Va seconds . 465The old value will be placed into 466.Va seconds . 467For possible values of 468.Va timeout , 469consult the 470.Dv PFTM_* 471values in 472.Aq Pa net/pfvar.h . 473.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt" 474Get the state timeout of 475.Va timeout . 476The value will be placed into the 477.Va seconds 478field. 479.It Dv DIOCCLRRULECTRS 480Clear per-rule statistics. 481.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl" 482Set the hard limits on the memory pools used by the packet filter. 483.Bd -literal 484struct pfioc_limit { 485 int index; 486 unsigned limit; 487}; 488
|
488enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS };
| 489enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, 490 PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
|
489.Ed 490.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl" 491Get the hard 492.Va limit 493for the memory pool indicated by 494.Va index . 495.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io" 496Clear all tables. 497All the ioctls that manipulate radix tables 498use the same structure described below. 499For 500.Dv DIOCRCLRTABLES , 501.Va pfrio_ndel 502contains on exit the number of tables deleted. 503.Bd -literal 504struct pfioc_table { 505 struct pfr_table pfrio_table; 506 void *pfrio_buffer; 507 int pfrio_esize; 508 int pfrio_size; 509 int pfrio_size2; 510 int pfrio_nadd; 511 int pfrio_ndel; 512 int pfrio_nchange; 513 int pfrio_flags; 514 u_int32_t pfrio_ticket; 515}; 516#define pfrio_exists pfrio_nadd 517#define pfrio_nzero pfrio_nadd 518#define pfrio_nmatch pfrio_nadd 519#define pfrio_naddr pfrio_size2 520#define pfrio_setflag pfrio_size2 521#define pfrio_clrflag pfrio_nadd 522.Ed 523.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io" 524Create one or more tables. 525On entry,
| 491.Ed 492.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl" 493Get the hard 494.Va limit 495for the memory pool indicated by 496.Va index . 497.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io" 498Clear all tables. 499All the ioctls that manipulate radix tables 500use the same structure described below. 501For 502.Dv DIOCRCLRTABLES , 503.Va pfrio_ndel 504contains on exit the number of tables deleted. 505.Bd -literal 506struct pfioc_table { 507 struct pfr_table pfrio_table; 508 void *pfrio_buffer; 509 int pfrio_esize; 510 int pfrio_size; 511 int pfrio_size2; 512 int pfrio_nadd; 513 int pfrio_ndel; 514 int pfrio_nchange; 515 int pfrio_flags; 516 u_int32_t pfrio_ticket; 517}; 518#define pfrio_exists pfrio_nadd 519#define pfrio_nzero pfrio_nadd 520#define pfrio_nmatch pfrio_nadd 521#define pfrio_naddr pfrio_size2 522#define pfrio_setflag pfrio_size2 523#define pfrio_clrflag pfrio_nadd 524.Ed 525.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io" 526Create one or more tables. 527On entry,
|
526.Va pfrio_buffer[pfrio_size] 527contains a table of 528.Vt pfr_table 529structures.
| 528.Va pfrio_buffer 529must point to an array of 530.Vt struct pfr_table 531containing at least 532.Vt pfrio_size 533elements. 534.Vt pfrio_esize 535must be the size of 536.Vt struct pfr_table .
|
530On exit, 531.Va pfrio_nadd 532contains the number of tables effectively created. 533.Bd -literal 534struct pfr_table { 535 char pfrt_anchor[MAXPATHLEN]; 536 char pfrt_name[PF_TABLE_NAME_SIZE]; 537 u_int32_t pfrt_flags; 538 u_int8_t pfrt_fback; 539}; 540.Ed 541.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io" 542Delete one or more tables. 543On entry,
| 537On exit, 538.Va pfrio_nadd 539contains the number of tables effectively created. 540.Bd -literal 541struct pfr_table { 542 char pfrt_anchor[MAXPATHLEN]; 543 char pfrt_name[PF_TABLE_NAME_SIZE]; 544 u_int32_t pfrt_flags; 545 u_int8_t pfrt_fback; 546}; 547.Ed 548.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io" 549Delete one or more tables. 550On entry,
|
544.Va pfrio_buffer[pfrio_size] 545contains a table of 546.Vt pfr_table 547structures.
| 551.Va pfrio_buffer 552must point to an array of 553.Vt struct pfr_table 554containing at least 555.Vt pfrio_size 556elements. 557.Vt pfrio_esize 558must be the size of 559.Vt struct pfr_table .
|
548On exit,
| 560On exit,
|
549.Va pfrio_nadd
| 561.Va pfrio_ndel
|
550contains the number of tables effectively deleted. 551.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io" 552Get the list of all tables. 553On entry, 554.Va pfrio_buffer[pfrio_size] 555contains a valid writeable buffer for 556.Vt pfr_table 557structures. 558On exit, 559.Va pfrio_size 560contains the number of tables written into the buffer. 561If the buffer is too small, the kernel does not store anything but just 562returns the required buffer size, without error. 563.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io" 564This call is like 565.Dv DIOCRGETTABLES 566but is used to get an array of 567.Vt pfr_tstats 568structures. 569.Bd -literal 570struct pfr_tstats { 571 struct pfr_table pfrts_t; 572 u_int64_t pfrts_packets 573 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 574 u_int64_t pfrts_bytes 575 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 576 u_int64_t pfrts_match; 577 u_int64_t pfrts_nomatch; 578 long pfrts_tzero; 579 int pfrts_cnt; 580 int pfrts_refcnt[PFR_REFCNT_MAX]; 581}; 582#define pfrts_name pfrts_t.pfrt_name 583#define pfrts_flags pfrts_t.pfrt_flags 584.Ed 585.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io" 586Clear the statistics of one or more tables. 587On entry,
| 562contains the number of tables effectively deleted. 563.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io" 564Get the list of all tables. 565On entry, 566.Va pfrio_buffer[pfrio_size] 567contains a valid writeable buffer for 568.Vt pfr_table 569structures. 570On exit, 571.Va pfrio_size 572contains the number of tables written into the buffer. 573If the buffer is too small, the kernel does not store anything but just 574returns the required buffer size, without error. 575.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io" 576This call is like 577.Dv DIOCRGETTABLES 578but is used to get an array of 579.Vt pfr_tstats 580structures. 581.Bd -literal 582struct pfr_tstats { 583 struct pfr_table pfrts_t; 584 u_int64_t pfrts_packets 585 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 586 u_int64_t pfrts_bytes 587 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 588 u_int64_t pfrts_match; 589 u_int64_t pfrts_nomatch; 590 long pfrts_tzero; 591 int pfrts_cnt; 592 int pfrts_refcnt[PFR_REFCNT_MAX]; 593}; 594#define pfrts_name pfrts_t.pfrt_name 595#define pfrts_flags pfrts_t.pfrt_flags 596.Ed 597.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io" 598Clear the statistics of one or more tables. 599On entry,
|
588.Va pfrio_buffer[pfrio_size] 589contains a table of 590.Vt pfr_table 591structures.
| 600.Va pfrio_buffer 601must point to an array of 602.Vt struct pfr_table 603containing at least 604.Vt pfrio_size 605elements. 606.Vt pfrio_esize 607must be the size of 608.Vt struct pfr_table .
|
592On exit, 593.Va pfrio_nzero 594contains the number of tables effectively cleared. 595.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io" 596Clear all addresses in a table. 597On entry, 598.Va pfrio_table 599contains the table to clear. 600On exit, 601.Va pfrio_ndel 602contains the number of addresses removed. 603.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io" 604Add one or more addresses to a table. 605On entry, 606.Va pfrio_table 607contains the table ID and
| 609On exit, 610.Va pfrio_nzero 611contains the number of tables effectively cleared. 612.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io" 613Clear all addresses in a table. 614On entry, 615.Va pfrio_table 616contains the table to clear. 617On exit, 618.Va pfrio_ndel 619contains the number of addresses removed. 620.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io" 621Add one or more addresses to a table. 622On entry, 623.Va pfrio_table 624contains the table ID and
|
608.Va pfrio_buffer[pfrio_size] 609contains the list of 610.Vt pfr_addr 611structures to add.
| 625.Va pfrio_buffer 626must point to an array of 627.Vt struct pfr_addr 628containing at least 629.Vt pfrio_size 630elements to add to the table. 631.Vt pfrio_esize 632must be the size of 633.Vt struct pfr_addr .
|
612On exit, 613.Va pfrio_nadd 614contains the number of addresses effectively added. 615.Bd -literal 616struct pfr_addr { 617 union { 618 struct in_addr _pfra_ip4addr; 619 struct in6_addr _pfra_ip6addr; 620 } pfra_u; 621 u_int8_t pfra_af; 622 u_int8_t pfra_net; 623 u_int8_t pfra_not; 624 u_int8_t pfra_fback; 625}; 626#define pfra_ip4addr pfra_u._pfra_ip4addr 627#define pfra_ip6addr pfra_u._pfra_ip6addr 628.Ed 629.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io" 630Delete one or more addresses from a table. 631On entry, 632.Va pfrio_table 633contains the table ID and
| 634On exit, 635.Va pfrio_nadd 636contains the number of addresses effectively added. 637.Bd -literal 638struct pfr_addr { 639 union { 640 struct in_addr _pfra_ip4addr; 641 struct in6_addr _pfra_ip6addr; 642 } pfra_u; 643 u_int8_t pfra_af; 644 u_int8_t pfra_net; 645 u_int8_t pfra_not; 646 u_int8_t pfra_fback; 647}; 648#define pfra_ip4addr pfra_u._pfra_ip4addr 649#define pfra_ip6addr pfra_u._pfra_ip6addr 650.Ed 651.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io" 652Delete one or more addresses from a table. 653On entry, 654.Va pfrio_table 655contains the table ID and
|
634.Va pfrio_buffer[pfrio_size] 635contains the list of 636.Vt pfr_addr 637structures to delete.
| 656.Va pfrio_buffer 657must point to an array of 658.Vt struct pfr_addr 659containing at least 660.Vt pfrio_size 661elements to delete from the table. 662.Vt pfrio_esize 663must be the size of 664.Vt struct pfr_addr .
|
638On exit, 639.Va pfrio_ndel 640contains the number of addresses effectively deleted. 641.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io" 642Replace the content of a table by a new address list. 643This is the most complicated command, which uses all the structure members. 644.Pp 645On entry, 646.Va pfrio_table 647contains the table ID and
| 665On exit, 666.Va pfrio_ndel 667contains the number of addresses effectively deleted. 668.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io" 669Replace the content of a table by a new address list. 670This is the most complicated command, which uses all the structure members. 671.Pp 672On entry, 673.Va pfrio_table 674contains the table ID and
|
648.Va pfrio_buffer[pfrio_size] 649contains the new list of 650.Vt pfr_addr 651structures.
| 675.Va pfrio_buffer 676must point to an array of 677.Vt struct pfr_addr 678containing at least 679.Vt pfrio_size 680elements which become the new contents of the table. 681.Vt pfrio_esize 682must be the size of 683.Vt struct pfr_addr .
|
652Additionally, if 653.Va pfrio_size2 654is non-zero, 655.Va pfrio_buffer[pfrio_size..pfrio_size2] 656must be a writeable buffer, into which the kernel can copy the 657addresses that have been deleted during the replace operation. 658On exit, 659.Va pfrio_ndel , 660.Va pfrio_nadd , 661and 662.Va pfrio_nchange 663contain the number of addresses deleted, added, and changed by the 664kernel. 665If 666.Va pfrio_size2 667was set on entry, 668.Va pfrio_size2 669will point to the size of the buffer used, exactly like 670.Dv DIOCRGETADDRS . 671.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io" 672Get all the addresses of a table. 673On entry, 674.Va pfrio_table 675contains the table ID and 676.Va pfrio_buffer[pfrio_size] 677contains a valid writeable buffer for 678.Vt pfr_addr 679structures. 680On exit, 681.Va pfrio_size 682contains the number of addresses written into the buffer. 683If the buffer was too small, the kernel does not store anything but just 684returns the required buffer size, without returning an error. 685.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io" 686This call is like 687.Dv DIOCRGETADDRS 688but is used to get an array of 689.Vt pfr_astats 690structures. 691.Bd -literal 692struct pfr_astats { 693 struct pfr_addr pfras_a; 694 u_int64_t pfras_packets 695 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 696 u_int64_t pfras_bytes 697 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 698 long pfras_tzero; 699}; 700.Ed 701.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io" 702Clear the statistics of one or more addresses. 703On entry, 704.Va pfrio_table 705contains the table ID and
| 684Additionally, if 685.Va pfrio_size2 686is non-zero, 687.Va pfrio_buffer[pfrio_size..pfrio_size2] 688must be a writeable buffer, into which the kernel can copy the 689addresses that have been deleted during the replace operation. 690On exit, 691.Va pfrio_ndel , 692.Va pfrio_nadd , 693and 694.Va pfrio_nchange 695contain the number of addresses deleted, added, and changed by the 696kernel. 697If 698.Va pfrio_size2 699was set on entry, 700.Va pfrio_size2 701will point to the size of the buffer used, exactly like 702.Dv DIOCRGETADDRS . 703.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io" 704Get all the addresses of a table. 705On entry, 706.Va pfrio_table 707contains the table ID and 708.Va pfrio_buffer[pfrio_size] 709contains a valid writeable buffer for 710.Vt pfr_addr 711structures. 712On exit, 713.Va pfrio_size 714contains the number of addresses written into the buffer. 715If the buffer was too small, the kernel does not store anything but just 716returns the required buffer size, without returning an error. 717.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io" 718This call is like 719.Dv DIOCRGETADDRS 720but is used to get an array of 721.Vt pfr_astats 722structures. 723.Bd -literal 724struct pfr_astats { 725 struct pfr_addr pfras_a; 726 u_int64_t pfras_packets 727 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 728 u_int64_t pfras_bytes 729 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 730 long pfras_tzero; 731}; 732.Ed 733.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io" 734Clear the statistics of one or more addresses. 735On entry, 736.Va pfrio_table 737contains the table ID and
|
706.Va pfrio_buffer[pfrio_size] 707contains a table of 708.Vt pfr_addr 709structures to clear.
| 738.Va pfrio_buffer 739must point to an array of 740.Vt struct pfr_addr 741containing at least 742.Vt pfrio_size 743elements to be cleared from the table. 744.Vt pfrio_esize 745must be the size of 746.Vt struct pfr_addr .
|
710On exit, 711.Va pfrio_nzero 712contains the number of addresses effectively cleared. 713.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io" 714Test if the given addresses match a table. 715On entry, 716.Va pfrio_table 717contains the table ID and
| 747On exit, 748.Va pfrio_nzero 749contains the number of addresses effectively cleared. 750.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io" 751Test if the given addresses match a table. 752On entry, 753.Va pfrio_table 754contains the table ID and
|
718.Va pfrio_buffer[pfrio_size] 719contains a table of 720.Vt pfr_addr 721structures to test.
| 755.Va pfrio_buffer 756must point to an array of 757.Vt struct pfr_addr 758containing at least 759.Vt pfrio_size 760elements, each of which will be tested for a match in the table. 761.Vt pfrio_esize 762must be the size of 763.Vt struct pfr_addr .
|
722On exit, the kernel updates the 723.Vt pfr_addr
| 764On exit, the kernel updates the 765.Vt pfr_addr
|
724table by setting the
| 766array by setting the
|
725.Va pfra_fback 726member appropriately. 727.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io" 728Change the 729.Dv PFR_TFLAG_CONST 730or 731.Dv PFR_TFLAG_PERSIST 732flags of a table. 733On entry,
| 767.Va pfra_fback 768member appropriately. 769.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io" 770Change the 771.Dv PFR_TFLAG_CONST 772or 773.Dv PFR_TFLAG_PERSIST 774flags of a table. 775On entry,
|
734.Va pfrio_buffer[pfrio_size] 735contains a table of 736.Vt pfr_table 737structures, and
| 776.Va pfrio_buffer 777must point to an array of 778.Vt struct pfr_table 779containing at least 780.Vt pfrio_size 781elements. 782.Va pfrio_esize 783must be the size of 784.Vt struct pfr_table .
|
738.Va pfrio_setflag
| 785.Va pfrio_setflag
|
739contains the flags to add, while
| 786must contain the flags to add, while
|
740.Va pfrio_clrflag
| 787.Va pfrio_clrflag
|
741contains the flags to remove.
| 788must contain the flags to remove.
|
742On exit, 743.Va pfrio_nchange 744and 745.Va pfrio_ndel 746contain the number of tables altered or deleted by the kernel. 747Yes, tables can be deleted if one removes the 748.Dv PFR_TFLAG_PERSIST 749flag of an unreferenced table. 750.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io" 751Defines a table in the inactive set. 752On entry, 753.Va pfrio_table 754contains the table ID and 755.Va pfrio_buffer[pfrio_size]
| 789On exit, 790.Va pfrio_nchange 791and 792.Va pfrio_ndel 793contain the number of tables altered or deleted by the kernel. 794Yes, tables can be deleted if one removes the 795.Dv PFR_TFLAG_PERSIST 796flag of an unreferenced table. 797.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io" 798Defines a table in the inactive set. 799On entry, 800.Va pfrio_table 801contains the table ID and 802.Va pfrio_buffer[pfrio_size]
|
756contains the list of
| 803contains an array of
|
757.Vt pfr_addr 758structures to put in the table. 759A valid ticket must also be supplied to 760.Va pfrio_ticket . 761On exit, 762.Va pfrio_nadd 763contains 0 if the table was already defined in the inactive list 764or 1 if a new table has been created. 765.Va pfrio_naddr 766contains the number of addresses effectively put in the table. 767.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io" 768.Bd -literal 769struct pfioc_trans { 770 int size; /* number of elements */ 771 int esize; /* size of each element in bytes */ 772 struct pfioc_trans_e { 773 int rs_num; 774 char anchor[MAXPATHLEN]; 775 u_int32_t ticket; 776 } *array; 777}; 778.Ed 779.Pp 780Clear all the inactive rulesets specified in the 781.Vt pfioc_trans_e 782array. 783For each ruleset, a ticket is returned for subsequent "add rule" ioctls, 784as well as for the 785.Dv DIOCXCOMMIT 786and 787.Dv DIOCXROLLBACK 788calls. 789.Pp 790Ruleset types, identified by 791.Va rs_num , 792include the following: 793.Pp 794.Bl -tag -width PF_RULESET_FILTER -offset ind -compact 795.It Dv PF_RULESET_SCRUB 796Scrub (packet normalization) rules. 797.It Dv PF_RULESET_FILTER 798Filter rules. 799.It Dv PF_RULESET_NAT 800NAT (Network Address Translation) rules. 801.It Dv PF_RULESET_BINAT 802Bidirectional NAT rules. 803.It Dv PF_RULESET_RDR 804Redirect rules. 805.It Dv PF_RULESET_ALTQ 806ALTQ disciplines. 807.It Dv PF_RULESET_TABLE 808Address tables. 809.El 810.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io" 811Atomically switch a vector of inactive rulesets to the active rulesets. 812This call is implemented as a standard two-phase commit, which will either 813fail for all rulesets or completely succeed. 814All tickets need to be valid. 815This ioctl returns 816.Er EBUSY 817if another process is concurrently updating some of the same rulesets. 818.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io" 819Clean up the kernel by undoing all changes that have taken place on the 820inactive rulesets since the last 821.Dv DIOCXBEGIN . 822.Dv DIOCXROLLBACK 823will silently ignore rulesets for which the ticket is invalid. 824.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid" 825Set the host ID, which is used by 826.Xr pfsync 4 827to identify which host created state table entries. 828.It Dv DIOCOSFPFLUSH 829Flush the passive OS fingerprint table. 830.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io" 831.Bd -literal 832struct pf_osfp_ioctl { 833 struct pf_osfp_entry { 834 SLIST_ENTRY(pf_osfp_entry) fp_entry; 835 pf_osfp_t fp_os; 836 char fp_class_nm[PF_OSFP_LEN]; 837 char fp_version_nm[PF_OSFP_LEN]; 838 char fp_subtype_nm[PF_OSFP_LEN]; 839 } fp_os; 840 pf_tcpopts_t fp_tcpopts; 841 u_int16_t fp_wsize; 842 u_int16_t fp_psize; 843 u_int16_t fp_mss; 844 u_int16_t fp_flags; 845 u_int8_t fp_optcnt; 846 u_int8_t fp_wscale; 847 u_int8_t fp_ttl; 848 int fp_getnum; 849}; 850.Ed 851.Pp 852Add a passive OS fingerprint to the table. 853Set 854.Va fp_os.fp_os 855to the packed fingerprint, 856.Va fp_os.fp_class_nm 857to the name of the class (Linux, Windows, etc), 858.Va fp_os.fp_version_nm 859to the name of the version (NT, 95, 98), and 860.Va fp_os.fp_subtype_nm 861to the name of the subtype or patchlevel. 862The members 863.Va fp_mss , 864.Va fp_wsize , 865.Va fp_psize , 866.Va fp_ttl , 867.Va fp_optcnt , 868and 869.Va fp_wscale 870are set to the TCP MSS, the TCP window size, the IP length, the IP TTL, 871the number of TCP options, and the TCP window scaling constant of the 872TCP SYN packet, respectively. 873.Pp 874The 875.Va fp_flags 876member is filled according to the 877.Aq Pa net/pfvar.h 878include file 879.Dv PF_OSFP_* 880defines. 881The 882.Va fp_tcpopts 883member contains packed TCP options. 884Each option uses 885.Dv PF_OSFP_TCPOPT_BITS 886bits in the packed value. 887Options include any of 888.Dv PF_OSFP_TCPOPT_NOP , 889.Dv PF_OSFP_TCPOPT_SACK , 890.Dv PF_OSFP_TCPOPT_WSCALE , 891.Dv PF_OSFP_TCPOPT_MSS , 892or 893.Dv PF_OSFP_TCPOPT_TS . 894.Pp 895The 896.Va fp_getnum 897member is not used with this ioctl. 898.Pp 899The structure's slack space must be zeroed for correct operation; 900.Xr memset 3 901the whole structure to zero before filling and sending to the kernel. 902.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io" 903Get the passive OS fingerprint number 904.Va fp_getnum 905from the kernel's fingerprint list. 906The rest of the structure members will come back filled. 907Get the whole list by repeatedly incrementing the 908.Va fp_getnum 909number until the ioctl returns 910.Er EBUSY . 911.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn" 912.Bd -literal 913struct pfioc_src_nodes { 914 int psn_len; 915 union { 916 caddr_t psu_buf; 917 struct pf_src_node *psu_src_nodes; 918 } psn_u; 919#define psn_buf psn_u.psu_buf 920#define psn_src_nodes psn_u.psu_src_nodes 921}; 922.Ed 923.Pp 924Get the list of source nodes kept by sticky addresses and source 925tracking. 926The ioctl must be called once with 927.Va psn_len 928set to 0. 929If the ioctl returns without error, 930.Va psn_len 931will be set to the size of the buffer required to hold all the 932.Va pf_src_node 933structures held in the table. 934A buffer of this size should then be allocated, and a pointer to this buffer 935placed in 936.Va psn_buf . 937The ioctl must then be called again to fill this buffer with the actual 938source node data. 939After that call, 940.Va psn_len 941will be set to the length of the buffer actually used. 942.It Dv DIOCCLRSRCNODES 943Clear the tree of source tracking nodes. 944.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io" 945Get the list of interfaces and interface drivers known to 946.Nm . 947All the ioctls that manipulate interfaces 948use the same structure described below: 949.Bd -literal 950struct pfioc_iface { 951 char pfiio_name[IFNAMSIZ]; 952 void *pfiio_buffer; 953 int pfiio_esize; 954 int pfiio_size; 955 int pfiio_nzero; 956 int pfiio_flags; 957};
| 804.Vt pfr_addr 805structures to put in the table. 806A valid ticket must also be supplied to 807.Va pfrio_ticket . 808On exit, 809.Va pfrio_nadd 810contains 0 if the table was already defined in the inactive list 811or 1 if a new table has been created. 812.Va pfrio_naddr 813contains the number of addresses effectively put in the table. 814.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io" 815.Bd -literal 816struct pfioc_trans { 817 int size; /* number of elements */ 818 int esize; /* size of each element in bytes */ 819 struct pfioc_trans_e { 820 int rs_num; 821 char anchor[MAXPATHLEN]; 822 u_int32_t ticket; 823 } *array; 824}; 825.Ed 826.Pp 827Clear all the inactive rulesets specified in the 828.Vt pfioc_trans_e 829array. 830For each ruleset, a ticket is returned for subsequent "add rule" ioctls, 831as well as for the 832.Dv DIOCXCOMMIT 833and 834.Dv DIOCXROLLBACK 835calls. 836.Pp 837Ruleset types, identified by 838.Va rs_num , 839include the following: 840.Pp 841.Bl -tag -width PF_RULESET_FILTER -offset ind -compact 842.It Dv PF_RULESET_SCRUB 843Scrub (packet normalization) rules. 844.It Dv PF_RULESET_FILTER 845Filter rules. 846.It Dv PF_RULESET_NAT 847NAT (Network Address Translation) rules. 848.It Dv PF_RULESET_BINAT 849Bidirectional NAT rules. 850.It Dv PF_RULESET_RDR 851Redirect rules. 852.It Dv PF_RULESET_ALTQ 853ALTQ disciplines. 854.It Dv PF_RULESET_TABLE 855Address tables. 856.El 857.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io" 858Atomically switch a vector of inactive rulesets to the active rulesets. 859This call is implemented as a standard two-phase commit, which will either 860fail for all rulesets or completely succeed. 861All tickets need to be valid. 862This ioctl returns 863.Er EBUSY 864if another process is concurrently updating some of the same rulesets. 865.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io" 866Clean up the kernel by undoing all changes that have taken place on the 867inactive rulesets since the last 868.Dv DIOCXBEGIN . 869.Dv DIOCXROLLBACK 870will silently ignore rulesets for which the ticket is invalid. 871.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid" 872Set the host ID, which is used by 873.Xr pfsync 4 874to identify which host created state table entries. 875.It Dv DIOCOSFPFLUSH 876Flush the passive OS fingerprint table. 877.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io" 878.Bd -literal 879struct pf_osfp_ioctl { 880 struct pf_osfp_entry { 881 SLIST_ENTRY(pf_osfp_entry) fp_entry; 882 pf_osfp_t fp_os; 883 char fp_class_nm[PF_OSFP_LEN]; 884 char fp_version_nm[PF_OSFP_LEN]; 885 char fp_subtype_nm[PF_OSFP_LEN]; 886 } fp_os; 887 pf_tcpopts_t fp_tcpopts; 888 u_int16_t fp_wsize; 889 u_int16_t fp_psize; 890 u_int16_t fp_mss; 891 u_int16_t fp_flags; 892 u_int8_t fp_optcnt; 893 u_int8_t fp_wscale; 894 u_int8_t fp_ttl; 895 int fp_getnum; 896}; 897.Ed 898.Pp 899Add a passive OS fingerprint to the table. 900Set 901.Va fp_os.fp_os 902to the packed fingerprint, 903.Va fp_os.fp_class_nm 904to the name of the class (Linux, Windows, etc), 905.Va fp_os.fp_version_nm 906to the name of the version (NT, 95, 98), and 907.Va fp_os.fp_subtype_nm 908to the name of the subtype or patchlevel. 909The members 910.Va fp_mss , 911.Va fp_wsize , 912.Va fp_psize , 913.Va fp_ttl , 914.Va fp_optcnt , 915and 916.Va fp_wscale 917are set to the TCP MSS, the TCP window size, the IP length, the IP TTL, 918the number of TCP options, and the TCP window scaling constant of the 919TCP SYN packet, respectively. 920.Pp 921The 922.Va fp_flags 923member is filled according to the 924.Aq Pa net/pfvar.h 925include file 926.Dv PF_OSFP_* 927defines. 928The 929.Va fp_tcpopts 930member contains packed TCP options. 931Each option uses 932.Dv PF_OSFP_TCPOPT_BITS 933bits in the packed value. 934Options include any of 935.Dv PF_OSFP_TCPOPT_NOP , 936.Dv PF_OSFP_TCPOPT_SACK , 937.Dv PF_OSFP_TCPOPT_WSCALE , 938.Dv PF_OSFP_TCPOPT_MSS , 939or 940.Dv PF_OSFP_TCPOPT_TS . 941.Pp 942The 943.Va fp_getnum 944member is not used with this ioctl. 945.Pp 946The structure's slack space must be zeroed for correct operation; 947.Xr memset 3 948the whole structure to zero before filling and sending to the kernel. 949.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io" 950Get the passive OS fingerprint number 951.Va fp_getnum 952from the kernel's fingerprint list. 953The rest of the structure members will come back filled. 954Get the whole list by repeatedly incrementing the 955.Va fp_getnum 956number until the ioctl returns 957.Er EBUSY . 958.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn" 959.Bd -literal 960struct pfioc_src_nodes { 961 int psn_len; 962 union { 963 caddr_t psu_buf; 964 struct pf_src_node *psu_src_nodes; 965 } psn_u; 966#define psn_buf psn_u.psu_buf 967#define psn_src_nodes psn_u.psu_src_nodes 968}; 969.Ed 970.Pp 971Get the list of source nodes kept by sticky addresses and source 972tracking. 973The ioctl must be called once with 974.Va psn_len 975set to 0. 976If the ioctl returns without error, 977.Va psn_len 978will be set to the size of the buffer required to hold all the 979.Va pf_src_node 980structures held in the table. 981A buffer of this size should then be allocated, and a pointer to this buffer 982placed in 983.Va psn_buf . 984The ioctl must then be called again to fill this buffer with the actual 985source node data. 986After that call, 987.Va psn_len 988will be set to the length of the buffer actually used. 989.It Dv DIOCCLRSRCNODES 990Clear the tree of source tracking nodes. 991.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io" 992Get the list of interfaces and interface drivers known to 993.Nm . 994All the ioctls that manipulate interfaces 995use the same structure described below: 996.Bd -literal 997struct pfioc_iface { 998 char pfiio_name[IFNAMSIZ]; 999 void *pfiio_buffer; 1000 int pfiio_esize; 1001 int pfiio_size; 1002 int pfiio_nzero; 1003 int pfiio_flags; 1004};
|
958 959#define PFI_FLAG_GROUP 0x0001 /* gets groups of interfaces */ 960#define PFI_FLAG_INSTANCE 0x0002 /* gets single interfaces */ 961#define PFI_FLAG_ALLMASK 0x0003
| |
962.Ed 963.Pp 964If not empty, 965.Va pfiio_name 966can be used to restrict the search to a specific interface or driver. 967.Va pfiio_buffer[pfiio_size] 968is the user-supplied buffer for returning the data. 969On entry, 970.Va pfiio_size
| 1005.Ed 1006.Pp 1007If not empty, 1008.Va pfiio_name 1009can be used to restrict the search to a specific interface or driver. 1010.Va pfiio_buffer[pfiio_size] 1011is the user-supplied buffer for returning the data. 1012On entry, 1013.Va pfiio_size
|
971represents the number of 972.Va pfi_if
| 1014contains the number of 1015.Vt pfi_kif
|
973entries that can fit into the buffer. 974The kernel will replace this value by the real number of entries it wants 975to return. 976.Va pfiio_esize 977should be set to
| 1016entries that can fit into the buffer. 1017The kernel will replace this value by the real number of entries it wants 1018to return. 1019.Va pfiio_esize 1020should be set to
|
978.Li sizeof(struct pfi_if) . 979.Va pfiio_flags 980should be set to 981.Dv PFI_FLAG_GROUP , 982.Dv PFI_FLAG_INSTANCE , 983or both, to tell the kernel to return a group of interfaces 984(drivers, like "fxp"), real interface instances (like "fxp1") or both.
| 1021.Li sizeof(struct pfi_kif) . 1022.Pp
|
985The data is returned in the
| 1023The data is returned in the
|
986.Vt pfi_if
| 1024.Vt pfi_kif
|
987structure described below: 988.Bd -literal
| 1025structure described below: 1026.Bd -literal
|
989struct pfi_if { 990 char pfif_name[IFNAMSIZ]; 991 u_int64_t pfif_packets[2][2][2]; 992 u_int64_t pfif_bytes[2][2][2]; 993 u_int64_t pfif_addcnt; 994 u_int64_t pfif_delcnt; 995 long pfif_tzero; 996 int pfif_states; 997 int pfif_rules; 998 int pfif_flags;
| 1027struct pfi_kif { 1028 RB_ENTRY(pfi_kif) pfik_tree; 1029 char pfik_name[IFNAMSIZ]; 1030 u_int64_t pfik_packets[2][2][2]; 1031 u_int64_t pfik_bytes[2][2][2]; 1032 u_int32_t pfik_tzero; 1033 int pfik_flags; 1034 struct pf_state_tree_lan_ext pfik_lan_ext; 1035 struct pf_state_tree_ext_gwy pfik_ext_gwy; 1036 TAILQ_ENTRY(pfi_kif) pfik_w_states; 1037 void *pfik_ah_cookie; 1038 struct ifnet *pfik_ifp; 1039 struct ifg_group *pfik_group; 1040 int pfik_states; 1041 int pfik_rules; 1042 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs;
|
999};
| 1043};
|
1000 1001#define PFI_IFLAG_GROUP 0x0001 /* group of interfaces */ 1002#define PFI_IFLAG_INSTANCE 0x0002 /* single instance */ 1003#define PFI_IFLAG_CLONABLE 0x0010 /* clonable group */ 1004#define PFI_IFLAG_DYNAMIC 0x0020 /* dynamic group */ 1005#define PFI_IFLAG_ATTACHED 0x0040 /* interface attached */
| |
1006.Ed
| 1044.Ed
|
1007.It Dv DIOCICLRISTATS Fa "struct pfioc_iface *io" 1008Clear the statistics counters of one or more interfaces. 1009.Va pfiio_name 1010and 1011.Va pfiio_flags 1012can be used to select which interfaces need to be cleared. 1013The filtering process is the same as for 1014.Dv DIOCIGETIFACES . 1015.Va pfiio_nzero 1016will be set by the kernel to the number of interfaces and drivers 1017that have been cleared.
| |
1018.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io"
| 1045.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io"
|
1019Set the user setable flags (described below) of the pf internal interface 1020description.
| 1046Set the user setable flags (described above) of the 1047.Nm 1048internal interface description.
|
1021The filtering process is the same as for 1022.Dv DIOCIGETIFACES . 1023.Bd -literal
| 1049The filtering process is the same as for 1050.Dv DIOCIGETIFACES . 1051.Bd -literal
|
1024#define PFI_IFLAG_SKIP 0x0100 /* skip interface */ 1025#define PFI_IFLAG_SETABLE_MASK 0x0100 /* mask */
| 1052#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */
|
1026.Ed 1027.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io" 1028Works as 1029.Dv DIOCSETIFFLAG 1030above but clears the flags. 1031.El 1032.Sh FILES 1033.Bl -tag -width /dev/pf -compact 1034.It Pa /dev/pf 1035packet filtering device. 1036.El 1037.Sh EXAMPLES 1038The following example demonstrates how to use the 1039.Dv DIOCNATLOOK 1040command to find the internal host/port of a NATed connection: 1041.Bd -literal 1042#include <sys/types.h> 1043#include <sys/socket.h> 1044#include <sys/ioctl.h> 1045#include <sys/fcntl.h> 1046#include <net/if.h> 1047#include <netinet/in.h> 1048#include <net/pfvar.h> 1049#include <err.h> 1050#include <stdio.h> 1051#include <stdlib.h> 1052 1053u_int32_t 1054read_address(const char *s) 1055{ 1056 int a, b, c, d; 1057 1058 sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d); 1059 return htonl(a << 24 | b << 16 | c << 8 | d); 1060} 1061 1062void 1063print_address(u_int32_t a) 1064{ 1065 a = ntohl(a); 1066 printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255, 1067 a >> 8 & 255, a & 255); 1068} 1069 1070int 1071main(int argc, char *argv[]) 1072{ 1073 struct pfioc_natlook nl; 1074 int dev; 1075 1076 if (argc != 5) { 1077 printf("%s <gwy addr> <gwy port> <ext addr> <ext port>\\n", 1078 argv[0]); 1079 return 1; 1080 } 1081 1082 dev = open("/dev/pf", O_RDWR); 1083 if (dev == -1) 1084 err(1, "open(\\"/dev/pf\\") failed"); 1085 1086 memset(&nl, 0, sizeof(struct pfioc_natlook)); 1087 nl.saddr.v4.s_addr = read_address(argv[1]); 1088 nl.sport = htons(atoi(argv[2])); 1089 nl.daddr.v4.s_addr = read_address(argv[3]); 1090 nl.dport = htons(atoi(argv[4])); 1091 nl.af = AF_INET; 1092 nl.proto = IPPROTO_TCP; 1093 nl.direction = PF_IN; 1094 1095 if (ioctl(dev, DIOCNATLOOK, &nl)) 1096 err(1, "DIOCNATLOOK"); 1097 1098 printf("internal host "); 1099 print_address(nl.rsaddr.v4.s_addr); 1100 printf(":%u\\n", ntohs(nl.rsport)); 1101 return 0; 1102} 1103.Ed 1104.Sh SEE ALSO 1105.Xr ioctl 2 , 1106.Xr altq 4 , 1107.Xr if_bridge 4 , 1108.Xr pflog 4 , 1109.Xr pfsync 4 , 1110.Xr pfctl 8 , 1111.Xr altq 9 1112.Sh HISTORY 1113The 1114.Nm 1115packet filtering mechanism first appeared in 1116.Ox 3.0 .
| 1053.Ed 1054.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io" 1055Works as 1056.Dv DIOCSETIFFLAG 1057above but clears the flags. 1058.El 1059.Sh FILES 1060.Bl -tag -width /dev/pf -compact 1061.It Pa /dev/pf 1062packet filtering device. 1063.El 1064.Sh EXAMPLES 1065The following example demonstrates how to use the 1066.Dv DIOCNATLOOK 1067command to find the internal host/port of a NATed connection: 1068.Bd -literal 1069#include <sys/types.h> 1070#include <sys/socket.h> 1071#include <sys/ioctl.h> 1072#include <sys/fcntl.h> 1073#include <net/if.h> 1074#include <netinet/in.h> 1075#include <net/pfvar.h> 1076#include <err.h> 1077#include <stdio.h> 1078#include <stdlib.h> 1079 1080u_int32_t 1081read_address(const char *s) 1082{ 1083 int a, b, c, d; 1084 1085 sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d); 1086 return htonl(a << 24 | b << 16 | c << 8 | d); 1087} 1088 1089void 1090print_address(u_int32_t a) 1091{ 1092 a = ntohl(a); 1093 printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255, 1094 a >> 8 & 255, a & 255); 1095} 1096 1097int 1098main(int argc, char *argv[]) 1099{ 1100 struct pfioc_natlook nl; 1101 int dev; 1102 1103 if (argc != 5) { 1104 printf("%s <gwy addr> <gwy port> <ext addr> <ext port>\\n", 1105 argv[0]); 1106 return 1; 1107 } 1108 1109 dev = open("/dev/pf", O_RDWR); 1110 if (dev == -1) 1111 err(1, "open(\\"/dev/pf\\") failed"); 1112 1113 memset(&nl, 0, sizeof(struct pfioc_natlook)); 1114 nl.saddr.v4.s_addr = read_address(argv[1]); 1115 nl.sport = htons(atoi(argv[2])); 1116 nl.daddr.v4.s_addr = read_address(argv[3]); 1117 nl.dport = htons(atoi(argv[4])); 1118 nl.af = AF_INET; 1119 nl.proto = IPPROTO_TCP; 1120 nl.direction = PF_IN; 1121 1122 if (ioctl(dev, DIOCNATLOOK, &nl)) 1123 err(1, "DIOCNATLOOK"); 1124 1125 printf("internal host "); 1126 print_address(nl.rsaddr.v4.s_addr); 1127 printf(":%u\\n", ntohs(nl.rsport)); 1128 return 0; 1129} 1130.Ed 1131.Sh SEE ALSO 1132.Xr ioctl 2 , 1133.Xr altq 4 , 1134.Xr if_bridge 4 , 1135.Xr pflog 4 , 1136.Xr pfsync 4 , 1137.Xr pfctl 8 , 1138.Xr altq 9 1139.Sh HISTORY 1140The 1141.Nm 1142packet filtering mechanism first appeared in 1143.Ox 3.0 .
|