xref: /freebsd/share/man/man4/pf.4 (revision 2da0fcde21e0b90384f61fd50b87ea7dbd820233)
1.\"	$OpenBSD: pf.4,v 1.62 2008/09/10 14:57:37 jmc Exp $
2.\"
3.\" Copyright (C) 2001, Kjell Wooding.  All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\"    notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\"    notice, this list of conditions and the following disclaimer in the
12.\"    documentation and/or other materials provided with the distribution.
13.\" 3. Neither the name of the project nor the names of its contributors
14.\"    may be used to endorse or promote products derived from this software
15.\"    without specific prior written permission.
16.\"
17.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27.\" SUCH DAMAGE.
28.\"
29.\" $FreeBSD$
30.\"
31.Dd November 14, 2013
32.Dt PF 4
33.Os
34.Sh NAME
35.Nm pf
36.Nd packet filter
37.Sh SYNOPSIS
38.Cd "device pf"
39.Cd "options PF_DEFAULT_TO_DROP"
40.Sh DESCRIPTION
41Packet filtering takes place in the kernel.
42A pseudo-device,
43.Pa /dev/pf ,
44allows userland processes to control the
45behavior of the packet filter through an
46.Xr ioctl 2
47interface.
48There are commands to enable and disable the filter, load rulesets,
49add and remove individual rules or state table entries,
50and retrieve statistics.
51The most commonly used functions are covered by
52.Xr pfctl 8 .
53.Pp
54Manipulations like loading a ruleset that involve more than a single
55.Xr ioctl 2
56call require a so-called
57.Em ticket ,
58which prevents the occurrence of
59multiple concurrent manipulations.
60.Pp
61Fields of
62.Xr ioctl 2
63parameter structures that refer to packet data (like
64addresses and ports) are generally expected in network byte-order.
65.Pp
66Rules and address tables are contained in so-called
67.Em anchors .
68When servicing an
69.Xr ioctl 2
70request, if the anchor field of the argument structure is empty,
71the kernel will use the default anchor (i.e., the main ruleset)
72in operations.
73Anchors are specified by name and may be nested, with components
74separated by
75.Sq /
76characters, similar to how file system hierarchies are laid out.
77The final component of the anchor path is the anchor under which
78operations will be performed.
79.Sh SYSCTL VARIABLES AND LOADER TUNABLES
80The following
81.Xr loader 8
82tunables are available.
83.Bl -tag -width indent
84.It Va net.pf.states_hashsize
85Size of hash tables that store states.
86Should be power of 2.
87Default value is 32768.
88.It Va net.pf.source_nodes_hashsize
89Size of hash table that store source nodes.
90Should be power of 2.
91Default value is 8192.
92.El
93.Pp
94Read only
95.Xr sysctl 8
96variables with matching names are provided to obtain current values
97at runtime.
98.Sh KERNEL OPTIONS
99The following options in the kernel configuration file are related to
100.Nm
101operation:
102.Pp
103.Bl -tag -width ".Dv PF_DEFAULT_TO_DROP" -compact
104.It Dv PF_DEFAULT_TO_DROP
105Change default policy to drop by default
106.El
107.Sh IOCTL INTERFACE
108.Nm
109supports the following
110.Xr ioctl 2
111commands, available through
112.Aq Pa net/pfvar.h :
113.Bl -tag -width xxxxxx
114.It Dv DIOCSTART
115Start the packet filter.
116.It Dv DIOCSTOP
117Stop the packet filter.
118.It Dv DIOCSTARTALTQ
119Start the ALTQ bandwidth control system (see
120.Xr altq 9 ) .
121.It Dv DIOCSTOPALTQ
122Stop the ALTQ bandwidth control system.
123.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp"
124.Bd -literal
125struct pfioc_pooladdr {
126	u_int32_t		action;
127	u_int32_t		ticket;
128	u_int32_t		nr;
129	u_int32_t		r_num;
130	u_int8_t		r_action;
131	u_int8_t		r_last;
132	u_int8_t		af;
133	char			anchor[MAXPATHLEN];
134	struct pf_pooladdr	addr;
135};
136.Ed
137.Pp
138Clear the buffer address pool and get a
139.Va ticket
140for subsequent
141.Dv DIOCADDADDR ,
142and
143.Dv DIOCADDRULE
144calls.
145.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp"
146.Pp
147Add the pool address
148.Va addr
149to the buffer address pool to be used in the following
150.Dv DIOCADDRULE
151call.
152All other members of the structure are ignored.
153.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr"
154.Bd -literal
155struct pfioc_rule {
156	u_int32_t	action;
157	u_int32_t	ticket;
158	u_int32_t	pool_ticket;
159	u_int32_t	nr;
160	char		anchor[MAXPATHLEN];
161	char		anchor_call[MAXPATHLEN];
162	struct pf_rule	rule;
163};
164.Ed
165.Pp
166Add
167.Va rule
168at the end of the inactive ruleset.
169This call requires a
170.Va ticket
171obtained through a preceding
172.Dv DIOCXBEGIN
173call and a
174.Va pool_ticket
175obtained through a
176.Dv DIOCBEGINADDRS
177call.
178.Dv DIOCADDADDR
179must also be called if any pool addresses are required.
180The optional
181.Va anchor
182name indicates the anchor in which to append the rule.
183.Va nr
184and
185.Va action
186are ignored.
187.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa"
188Add an ALTQ discipline or queue.
189.Bd -literal
190struct pfioc_altq {
191	u_int32_t	action;
192	u_int32_t	ticket;
193	u_int32_t	nr;
194	struct pf_altq  altq;
195};
196.Ed
197.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr"
198Get a
199.Va ticket
200for subsequent
201.Dv DIOCGETRULE
202calls and the number
203.Va nr
204of rules in the active ruleset.
205.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr"
206Get a
207.Va rule
208by its number
209.Va nr
210using the
211.Va ticket
212obtained through a preceding
213.Dv DIOCGETRULES
214call.
215If
216.Va action
217is set to
218.Dv PF_GET_CLR_CNTR ,
219the per-rule statistics on the requested rule are cleared.
220.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp"
221Get a
222.Va ticket
223for subsequent
224.Dv DIOCGETADDR
225calls and the number
226.Va nr
227of pool addresses in the rule specified with
228.Va r_action ,
229.Va r_num ,
230and
231.Va anchor .
232.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp"
233Get the pool address
234.Va addr
235by its number
236.Va nr
237from the rule specified with
238.Va r_action ,
239.Va r_num ,
240and
241.Va anchor
242using the
243.Va ticket
244obtained through a preceding
245.Dv DIOCGETADDRS
246call.
247.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa"
248Get a
249.Va ticket
250for subsequent
251.Dv DIOCGETALTQ
252calls and the number
253.Va nr
254of queues in the active list.
255.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa"
256Get the queueing discipline
257.Va altq
258by its number
259.Va nr
260using the
261.Va ticket
262obtained through a preceding
263.Dv DIOCGETALTQS
264call.
265.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq"
266Get the statistics on a queue.
267.Bd -literal
268struct pfioc_qstats {
269	u_int32_t	 ticket;
270	u_int32_t	 nr;
271	void		*buf;
272	int		 nbytes;
273	u_int8_t	 scheduler;
274};
275.Ed
276.Pp
277This call fills in a pointer to the buffer of statistics
278.Va buf ,
279of length
280.Va nbytes ,
281for the queue specified by
282.Va nr .
283.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr"
284.Bd -literal
285struct pfioc_ruleset {
286	u_int32_t	 nr;
287	char		 path[MAXPATHLEN];
288	char		 name[PF_ANCHOR_NAME_SIZE];
289};
290.Ed
291.Pp
292Get the number
293.Va nr
294of rulesets (i.e., anchors) directly attached to the anchor named by
295.Va path
296for use in subsequent
297.Dv DIOCGETRULESET
298calls.
299Nested anchors, since they are not directly attached to the given
300anchor, will not be included.
301This ioctl returns
302.Er EINVAL
303if the given anchor does not exist.
304.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr"
305Get a ruleset (i.e., an anchor)
306.Va name
307by its number
308.Va nr
309from the given anchor
310.Va path ,
311the maximum number of which can be obtained from a preceding
312.Dv DIOCGETRULESETS
313call.
314This ioctl returns
315.Er EINVAL
316if the given anchor does not exist or
317.Er EBUSY
318if another process is concurrently updating a ruleset.
319.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk"
320Remove matching entries from the state table.
321This ioctl returns the number of killed states in
322.Va psk_killed .
323.Bd -literal
324struct pfioc_state_kill {
325	struct pf_state_cmp	psk_pfcmp;
326	sa_family_t		psk_af;
327	int			psk_proto;
328	struct pf_rule_addr	psk_src;
329	struct pf_rule_addr	psk_dst;
330	char			psk_ifname[IFNAMSIZ];
331	char			psk_label[PF_RULE_LABEL_SIZE];
332	u_int			psk_killed;
333};
334.Ed
335.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk"
336Clear all states.
337It works like
338.Dv DIOCKILLSTATES ,
339but ignores the
340.Va psk_af ,
341.Va psk_proto ,
342.Va psk_src ,
343and
344.Va psk_dst
345fields of the
346.Vt pfioc_state_kill
347structure.
348.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi"
349Specify the interface for which statistics are accumulated.
350.Bd -literal
351struct pfioc_if {
352	char		 ifname[IFNAMSIZ];
353};
354.Ed
355.It Dv DIOCGETSTATUS Fa "struct pf_status *s"
356Get the internal packet filter statistics.
357.Bd -literal
358struct pf_status {
359	u_int64_t	counters[PFRES_MAX];
360	u_int64_t	lcounters[LCNT_MAX];
361	u_int64_t	fcounters[FCNT_MAX];
362	u_int64_t	scounters[SCNT_MAX];
363	u_int64_t	pcounters[2][2][3];
364	u_int64_t	bcounters[2][2];
365	u_int32_t	running;
366	u_int32_t	states;
367	u_int32_t	src_nodes;
368	u_int32_t	since;
369	u_int32_t	debug;
370	u_int32_t	hostid;
371	char		ifname[IFNAMSIZ];
372	u_int8_t	pf_chksum[MD5_DIGEST_LENGTH];
373};
374.Ed
375.It Dv DIOCCLRSTATUS
376Clear the internal packet filter statistics.
377.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl"
378Look up a state table entry by source and destination addresses and ports.
379.Bd -literal
380struct pfioc_natlook {
381	struct pf_addr	 saddr;
382	struct pf_addr	 daddr;
383	struct pf_addr	 rsaddr;
384	struct pf_addr	 rdaddr;
385	u_int16_t	 sport;
386	u_int16_t	 dport;
387	u_int16_t	 rsport;
388	u_int16_t	 rdport;
389	sa_family_t	 af;
390	u_int8_t	 proto;
391	u_int8_t	 direction;
392};
393.Ed
394.It Dv DIOCSETDEBUG Fa "u_int32_t *level"
395Set the debug level.
396.Bd -literal
397enum	{ PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC,
398	  PF_DEBUG_NOISY };
399.Ed
400.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps"
401Get state table entries.
402.Bd -literal
403struct pfioc_states {
404	int	ps_len;
405	union {
406		caddr_t		 psu_buf;
407		struct pf_state *psu_states;
408	} ps_u;
409#define ps_buf		ps_u.psu_buf
410#define ps_states	ps_u.psu_states
411};
412.Ed
413.Pp
414If
415.Va ps_len
416is non-zero on entry, as many states as possible that can fit into this
417size will be copied into the supplied buffer
418.Va ps_states .
419On exit,
420.Va ps_len
421is always set to the total size required to hold all state table entries
422(i.e., it is set to
423.Li sizeof(struct pf_state) * nr ) .
424.Pp
425The type of operation to be performed is indicated by
426.Va action ,
427which can be any of the following:
428.Bd -literal
429enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
430	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
431	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
432.Ed
433.Pp
434.Va ticket
435must be set to the value obtained with
436.Dv PF_CHANGE_GET_TICKET
437for all actions except
438.Dv PF_CHANGE_GET_TICKET .
439.Va pool_ticket
440must be set to the value obtained with the
441.Dv DIOCBEGINADDRS
442call for all actions except
443.Dv PF_CHANGE_REMOVE
444and
445.Dv PF_CHANGE_GET_TICKET .
446.Va anchor
447indicates to which anchor the operation applies.
448.Va nr
449indicates the rule number against which
450.Dv PF_CHANGE_ADD_BEFORE ,
451.Dv PF_CHANGE_ADD_AFTER ,
452or
453.Dv PF_CHANGE_REMOVE
454actions are applied.
455.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt"
456.Bd -literal
457struct pfioc_tm {
458	int		 timeout;
459	int		 seconds;
460};
461.Ed
462.Pp
463Set the state timeout of
464.Va timeout
465to
466.Va seconds .
467The old value will be placed into
468.Va seconds .
469For possible values of
470.Va timeout ,
471consult the
472.Dv PFTM_*
473values in
474.Aq Pa net/pfvar.h .
475.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt"
476Get the state timeout of
477.Va timeout .
478The value will be placed into the
479.Va seconds
480field.
481.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl"
482Set the hard limits on the memory pools used by the packet filter.
483.Bd -literal
484struct pfioc_limit {
485	int		index;
486	unsigned	limit;
487};
488
489enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
490	  PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
491.Ed
492.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl"
493Get the hard
494.Va limit
495for the memory pool indicated by
496.Va index .
497.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io"
498Clear all tables.
499All the ioctls that manipulate radix tables
500use the same structure described below.
501For
502.Dv DIOCRCLRTABLES ,
503.Va pfrio_ndel
504contains on exit the number of tables deleted.
505.Bd -literal
506struct pfioc_table {
507	struct pfr_table	 pfrio_table;
508	void			*pfrio_buffer;
509	int			 pfrio_esize;
510	int			 pfrio_size;
511	int			 pfrio_size2;
512	int			 pfrio_nadd;
513	int			 pfrio_ndel;
514	int			 pfrio_nchange;
515	int			 pfrio_flags;
516	u_int32_t		 pfrio_ticket;
517};
518#define pfrio_exists    pfrio_nadd
519#define pfrio_nzero     pfrio_nadd
520#define pfrio_nmatch    pfrio_nadd
521#define pfrio_naddr     pfrio_size2
522#define pfrio_setflag   pfrio_size2
523#define pfrio_clrflag   pfrio_nadd
524.Ed
525.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io"
526Create one or more tables.
527On entry,
528.Va pfrio_buffer
529must point to an array of
530.Vt struct pfr_table
531containing at least
532.Vt pfrio_size
533elements.
534.Vt pfrio_esize
535must be the size of
536.Vt struct pfr_table .
537On exit,
538.Va pfrio_nadd
539contains the number of tables effectively created.
540.Bd -literal
541struct pfr_table {
542	char		pfrt_anchor[MAXPATHLEN];
543	char		pfrt_name[PF_TABLE_NAME_SIZE];
544	u_int32_t	pfrt_flags;
545	u_int8_t	pfrt_fback;
546};
547.Ed
548.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io"
549Delete one or more tables.
550On entry,
551.Va pfrio_buffer
552must point to an array of
553.Vt struct pfr_table
554containing at least
555.Vt pfrio_size
556elements.
557.Vt pfrio_esize
558must be the size of
559.Vt struct pfr_table .
560On exit,
561.Va pfrio_ndel
562contains the number of tables effectively deleted.
563.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io"
564Get the list of all tables.
565On entry,
566.Va pfrio_buffer[pfrio_size]
567contains a valid writeable buffer for
568.Vt pfr_table
569structures.
570On exit,
571.Va pfrio_size
572contains the number of tables written into the buffer.
573If the buffer is too small, the kernel does not store anything but just
574returns the required buffer size, without error.
575.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io"
576This call is like
577.Dv DIOCRGETTABLES
578but is used to get an array of
579.Vt pfr_tstats
580structures.
581.Bd -literal
582struct pfr_tstats {
583	struct pfr_table pfrts_t;
584	u_int64_t	 pfrts_packets
585			     [PFR_DIR_MAX][PFR_OP_TABLE_MAX];
586	u_int64_t	 pfrts_bytes
587			     [PFR_DIR_MAX][PFR_OP_TABLE_MAX];
588	u_int64_t	 pfrts_match;
589	u_int64_t	 pfrts_nomatch;
590	long		 pfrts_tzero;
591	int		 pfrts_cnt;
592	int		 pfrts_refcnt[PFR_REFCNT_MAX];
593};
594#define pfrts_name	 pfrts_t.pfrt_name
595#define pfrts_flags	 pfrts_t.pfrt_flags
596.Ed
597.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io"
598Clear the statistics of one or more tables.
599On entry,
600.Va pfrio_buffer
601must point to an array of
602.Vt struct pfr_table
603containing at least
604.Vt pfrio_size
605elements.
606.Vt pfrio_esize
607must be the size of
608.Vt struct pfr_table .
609On exit,
610.Va pfrio_nzero
611contains the number of tables effectively cleared.
612.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io"
613Clear all addresses in a table.
614On entry,
615.Va pfrio_table
616contains the table to clear.
617On exit,
618.Va pfrio_ndel
619contains the number of addresses removed.
620.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io"
621Add one or more addresses to a table.
622On entry,
623.Va pfrio_table
624contains the table ID and
625.Va pfrio_buffer
626must point to an array of
627.Vt struct pfr_addr
628containing at least
629.Vt pfrio_size
630elements to add to the table.
631.Vt pfrio_esize
632must be the size of
633.Vt struct pfr_addr .
634On exit,
635.Va pfrio_nadd
636contains the number of addresses effectively added.
637.Bd -literal
638struct pfr_addr {
639	union {
640		struct in_addr	 _pfra_ip4addr;
641		struct in6_addr	 _pfra_ip6addr;
642	}		 pfra_u;
643	u_int8_t	 pfra_af;
644	u_int8_t	 pfra_net;
645	u_int8_t	 pfra_not;
646	u_int8_t	 pfra_fback;
647};
648#define pfra_ip4addr    pfra_u._pfra_ip4addr
649#define pfra_ip6addr    pfra_u._pfra_ip6addr
650.Ed
651.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io"
652Delete one or more addresses from a table.
653On entry,
654.Va pfrio_table
655contains the table ID and
656.Va pfrio_buffer
657must point to an array of
658.Vt struct pfr_addr
659containing at least
660.Vt pfrio_size
661elements to delete from the table.
662.Vt pfrio_esize
663must be the size of
664.Vt struct pfr_addr .
665On exit,
666.Va pfrio_ndel
667contains the number of addresses effectively deleted.
668.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io"
669Replace the content of a table by a new address list.
670This is the most complicated command, which uses all the structure members.
671.Pp
672On entry,
673.Va pfrio_table
674contains the table ID and
675.Va pfrio_buffer
676must point to an array of
677.Vt struct pfr_addr
678containing at least
679.Vt pfrio_size
680elements which become the new contents of the table.
681.Vt pfrio_esize
682must be the size of
683.Vt struct pfr_addr .
684Additionally, if
685.Va pfrio_size2
686is non-zero,
687.Va pfrio_buffer[pfrio_size..pfrio_size2]
688must be a writeable buffer, into which the kernel can copy the
689addresses that have been deleted during the replace operation.
690On exit,
691.Va pfrio_ndel ,
692.Va pfrio_nadd ,
693and
694.Va pfrio_nchange
695contain the number of addresses deleted, added, and changed by the
696kernel.
697If
698.Va pfrio_size2
699was set on entry,
700.Va pfrio_size2
701will point to the size of the buffer used, exactly like
702.Dv DIOCRGETADDRS .
703.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io"
704Get all the addresses of a table.
705On entry,
706.Va pfrio_table
707contains the table ID and
708.Va pfrio_buffer[pfrio_size]
709contains a valid writeable buffer for
710.Vt pfr_addr
711structures.
712On exit,
713.Va pfrio_size
714contains the number of addresses written into the buffer.
715If the buffer was too small, the kernel does not store anything but just
716returns the required buffer size, without returning an error.
717.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io"
718This call is like
719.Dv DIOCRGETADDRS
720but is used to get an array of
721.Vt pfr_astats
722structures.
723.Bd -literal
724struct pfr_astats {
725	struct pfr_addr	 pfras_a;
726	u_int64_t	 pfras_packets
727			     [PFR_DIR_MAX][PFR_OP_ADDR_MAX];
728	u_int64_t	 pfras_bytes
729			     [PFR_DIR_MAX][PFR_OP_ADDR_MAX];
730	long		 pfras_tzero;
731};
732.Ed
733.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io"
734Clear the statistics of one or more addresses.
735On entry,
736.Va pfrio_table
737contains the table ID and
738.Va pfrio_buffer
739must point to an array of
740.Vt struct pfr_addr
741containing at least
742.Vt pfrio_size
743elements to be cleared from the table.
744.Vt pfrio_esize
745must be the size of
746.Vt struct pfr_addr .
747On exit,
748.Va pfrio_nzero
749contains the number of addresses effectively cleared.
750.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io"
751Test if the given addresses match a table.
752On entry,
753.Va pfrio_table
754contains the table ID and
755.Va pfrio_buffer
756must point to an array of
757.Vt struct pfr_addr
758containing at least
759.Vt pfrio_size
760elements, each of which will be tested for a match in the table.
761.Vt pfrio_esize
762must be the size of
763.Vt struct pfr_addr .
764On exit, the kernel updates the
765.Vt pfr_addr
766array by setting the
767.Va pfra_fback
768member appropriately.
769.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io"
770Change the
771.Dv PFR_TFLAG_CONST
772or
773.Dv PFR_TFLAG_PERSIST
774flags of a table.
775On entry,
776.Va pfrio_buffer
777must point to an array of
778.Vt struct pfr_table
779containing at least
780.Vt pfrio_size
781elements.
782.Va pfrio_esize
783must be the size of
784.Vt struct pfr_table .
785.Va pfrio_setflag
786must contain the flags to add, while
787.Va pfrio_clrflag
788must contain the flags to remove.
789On exit,
790.Va pfrio_nchange
791and
792.Va pfrio_ndel
793contain the number of tables altered or deleted by the kernel.
794Yes, tables can be deleted if one removes the
795.Dv PFR_TFLAG_PERSIST
796flag of an unreferenced table.
797.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io"
798Defines a table in the inactive set.
799On entry,
800.Va pfrio_table
801contains the table ID and
802.Va pfrio_buffer[pfrio_size]
803contains an array of
804.Vt pfr_addr
805structures to put in the table.
806A valid ticket must also be supplied to
807.Va pfrio_ticket .
808On exit,
809.Va pfrio_nadd
810contains 0 if the table was already defined in the inactive list
811or 1 if a new table has been created.
812.Va pfrio_naddr
813contains the number of addresses effectively put in the table.
814.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io"
815.Bd -literal
816struct pfioc_trans {
817	int		 size;	/* number of elements */
818	int		 esize;	/* size of each element in bytes */
819	struct pfioc_trans_e {
820		int		rs_num;
821		char		anchor[MAXPATHLEN];
822		u_int32_t	ticket;
823	}		*array;
824};
825.Ed
826.Pp
827Clear all the inactive rulesets specified in the
828.Vt pfioc_trans_e
829array.
830For each ruleset, a ticket is returned for subsequent "add rule" ioctls,
831as well as for the
832.Dv DIOCXCOMMIT
833and
834.Dv DIOCXROLLBACK
835calls.
836.Pp
837Ruleset types, identified by
838.Va rs_num ,
839include the following:
840.Pp
841.Bl -tag -width PF_RULESET_FILTER -offset ind -compact
842.It Dv PF_RULESET_SCRUB
843Scrub (packet normalization) rules.
844.It Dv PF_RULESET_FILTER
845Filter rules.
846.It Dv PF_RULESET_NAT
847NAT (Network Address Translation) rules.
848.It Dv PF_RULESET_BINAT
849Bidirectional NAT rules.
850.It Dv PF_RULESET_RDR
851Redirect rules.
852.It Dv PF_RULESET_ALTQ
853ALTQ disciplines.
854.It Dv PF_RULESET_TABLE
855Address tables.
856.El
857.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io"
858Atomically switch a vector of inactive rulesets to the active rulesets.
859This call is implemented as a standard two-phase commit, which will either
860fail for all rulesets or completely succeed.
861All tickets need to be valid.
862This ioctl returns
863.Er EBUSY
864if another process is concurrently updating some of the same rulesets.
865.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io"
866Clean up the kernel by undoing all changes that have taken place on the
867inactive rulesets since the last
868.Dv DIOCXBEGIN .
869.Dv DIOCXROLLBACK
870will silently ignore rulesets for which the ticket is invalid.
871.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid"
872Set the host ID, which is used by
873.Xr pfsync 4
874to identify which host created state table entries.
875.It Dv DIOCOSFPFLUSH
876Flush the passive OS fingerprint table.
877.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io"
878.Bd -literal
879struct pf_osfp_ioctl {
880	struct pf_osfp_entry {
881		SLIST_ENTRY(pf_osfp_entry) fp_entry;
882		pf_osfp_t		fp_os;
883		char			fp_class_nm[PF_OSFP_LEN];
884		char			fp_version_nm[PF_OSFP_LEN];
885		char			fp_subtype_nm[PF_OSFP_LEN];
886	} 			fp_os;
887	pf_tcpopts_t		fp_tcpopts;
888	u_int16_t		fp_wsize;
889	u_int16_t		fp_psize;
890	u_int16_t		fp_mss;
891	u_int16_t		fp_flags;
892	u_int8_t		fp_optcnt;
893	u_int8_t		fp_wscale;
894	u_int8_t		fp_ttl;
895	int			fp_getnum;
896};
897.Ed
898.Pp
899Add a passive OS fingerprint to the table.
900Set
901.Va fp_os.fp_os
902to the packed fingerprint,
903.Va fp_os.fp_class_nm
904to the name of the class (Linux, Windows, etc),
905.Va fp_os.fp_version_nm
906to the name of the version (NT, 95, 98), and
907.Va fp_os.fp_subtype_nm
908to the name of the subtype or patchlevel.
909The members
910.Va fp_mss ,
911.Va fp_wsize ,
912.Va fp_psize ,
913.Va fp_ttl ,
914.Va fp_optcnt ,
915and
916.Va fp_wscale
917are set to the TCP MSS, the TCP window size, the IP length, the IP TTL,
918the number of TCP options, and the TCP window scaling constant of the
919TCP SYN packet, respectively.
920.Pp
921The
922.Va fp_flags
923member is filled according to the
924.Aq Pa net/pfvar.h
925include file
926.Dv PF_OSFP_*
927defines.
928The
929.Va fp_tcpopts
930member contains packed TCP options.
931Each option uses
932.Dv PF_OSFP_TCPOPT_BITS
933bits in the packed value.
934Options include any of
935.Dv PF_OSFP_TCPOPT_NOP ,
936.Dv PF_OSFP_TCPOPT_SACK ,
937.Dv PF_OSFP_TCPOPT_WSCALE ,
938.Dv PF_OSFP_TCPOPT_MSS ,
939or
940.Dv PF_OSFP_TCPOPT_TS .
941.Pp
942The
943.Va fp_getnum
944member is not used with this ioctl.
945.Pp
946The structure's slack space must be zeroed for correct operation;
947.Xr memset 3
948the whole structure to zero before filling and sending to the kernel.
949.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io"
950Get the passive OS fingerprint number
951.Va fp_getnum
952from the kernel's fingerprint list.
953The rest of the structure members will come back filled.
954Get the whole list by repeatedly incrementing the
955.Va fp_getnum
956number until the ioctl returns
957.Er EBUSY .
958.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn"
959.Bd -literal
960struct pfioc_src_nodes {
961	int	psn_len;
962	union {
963		caddr_t		psu_buf;
964		struct pf_src_node	*psu_src_nodes;
965	} psn_u;
966#define psn_buf		psn_u.psu_buf
967#define psn_src_nodes	psn_u.psu_src_nodes
968};
969.Ed
970.Pp
971Get the list of source nodes kept by sticky addresses and source
972tracking.
973The ioctl must be called once with
974.Va psn_len
975set to 0.
976If the ioctl returns without error,
977.Va psn_len
978will be set to the size of the buffer required to hold all the
979.Va pf_src_node
980structures held in the table.
981A buffer of this size should then be allocated, and a pointer to this buffer
982placed in
983.Va psn_buf .
984The ioctl must then be called again to fill this buffer with the actual
985source node data.
986After that call,
987.Va psn_len
988will be set to the length of the buffer actually used.
989.It Dv DIOCCLRSRCNODES
990Clear the tree of source tracking nodes.
991.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io"
992Get the list of interfaces and interface drivers known to
993.Nm .
994All the ioctls that manipulate interfaces
995use the same structure described below:
996.Bd -literal
997struct pfioc_iface {
998	char			 pfiio_name[IFNAMSIZ];
999	void			*pfiio_buffer;
1000	int			 pfiio_esize;
1001	int			 pfiio_size;
1002	int			 pfiio_nzero;
1003	int			 pfiio_flags;
1004};
1005.Ed
1006.Pp
1007If not empty,
1008.Va pfiio_name
1009can be used to restrict the search to a specific interface or driver.
1010.Va pfiio_buffer[pfiio_size]
1011is the user-supplied buffer for returning the data.
1012On entry,
1013.Va pfiio_size
1014contains the number of
1015.Vt pfi_kif
1016entries that can fit into the buffer.
1017The kernel will replace this value by the real number of entries it wants
1018to return.
1019.Va pfiio_esize
1020should be set to
1021.Li sizeof(struct pfi_kif) .
1022.Pp
1023The data is returned in the
1024.Vt pfi_kif
1025structure described below:
1026.Bd -literal
1027struct pfi_kif {
1028	RB_ENTRY(pfi_kif)		 pfik_tree;
1029	char				 pfik_name[IFNAMSIZ];
1030	u_int64_t			 pfik_packets[2][2][2];
1031	u_int64_t			 pfik_bytes[2][2][2];
1032	u_int32_t			 pfik_tzero;
1033	int				 pfik_flags;
1034	struct pf_state_tree_lan_ext	 pfik_lan_ext;
1035	struct pf_state_tree_ext_gwy	 pfik_ext_gwy;
1036	TAILQ_ENTRY(pfi_kif)		 pfik_w_states;
1037	void				*pfik_ah_cookie;
1038	struct ifnet			*pfik_ifp;
1039	struct ifg_group		*pfik_group;
1040	int				 pfik_states;
1041	int				 pfik_rules;
1042	TAILQ_HEAD(, pfi_dynaddr)	 pfik_dynaddrs;
1043};
1044.Ed
1045.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io"
1046Set the user settable flags (described above) of the
1047.Nm
1048internal interface description.
1049The filtering process is the same as for
1050.Dv DIOCIGETIFACES .
1051.Bd -literal
1052#define PFI_IFLAG_SKIP	0x0100	/* skip filtering on interface */
1053.Ed
1054.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io"
1055Works as
1056.Dv DIOCSETIFFLAG
1057above but clears the flags.
1058.It Dv DIOCKILLSRCNODES Fa "struct pfioc_iface *io"
1059Explicitly remove source tracking nodes.
1060.El
1061.Sh FILES
1062.Bl -tag -width /dev/pf -compact
1063.It Pa /dev/pf
1064packet filtering device.
1065.El
1066.Sh EXAMPLES
1067The following example demonstrates how to use the
1068.Dv DIOCNATLOOK
1069command to find the internal host/port of a NATed connection:
1070.Bd -literal
1071#include <sys/types.h>
1072#include <sys/socket.h>
1073#include <sys/ioctl.h>
1074#include <sys/fcntl.h>
1075#include <net/if.h>
1076#include <netinet/in.h>
1077#include <net/pfvar.h>
1078#include <err.h>
1079#include <stdio.h>
1080#include <stdlib.h>
1081
1082u_int32_t
1083read_address(const char *s)
1084{
1085	int a, b, c, d;
1086
1087	sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d);
1088	return htonl(a << 24 | b << 16 | c << 8 | d);
1089}
1090
1091void
1092print_address(u_int32_t a)
1093{
1094	a = ntohl(a);
1095	printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255,
1096	    a >> 8 & 255, a & 255);
1097}
1098
1099int
1100main(int argc, char *argv[])
1101{
1102	struct pfioc_natlook nl;
1103	int dev;
1104
1105	if (argc != 5) {
1106		printf("%s <gwy addr> <gwy port> <ext addr> <ext port>\\n",
1107		    argv[0]);
1108		return 1;
1109	}
1110
1111	dev = open("/dev/pf", O_RDWR);
1112	if (dev == -1)
1113		err(1, "open(\\"/dev/pf\\") failed");
1114
1115	memset(&nl, 0, sizeof(struct pfioc_natlook));
1116	nl.saddr.v4.s_addr	= read_address(argv[1]);
1117	nl.sport		= htons(atoi(argv[2]));
1118	nl.daddr.v4.s_addr	= read_address(argv[3]);
1119	nl.dport		= htons(atoi(argv[4]));
1120	nl.af			= AF_INET;
1121	nl.proto		= IPPROTO_TCP;
1122	nl.direction		= PF_IN;
1123
1124	if (ioctl(dev, DIOCNATLOOK, &nl))
1125		err(1, "DIOCNATLOOK");
1126
1127	printf("internal host ");
1128	print_address(nl.rsaddr.v4.s_addr);
1129	printf(":%u\\n", ntohs(nl.rsport));
1130	return 0;
1131}
1132.Ed
1133.Sh SEE ALSO
1134.Xr ioctl 2 ,
1135.Xr altq 4 ,
1136.Xr if_bridge 4 ,
1137.Xr pflog 4 ,
1138.Xr pfsync 4 ,
1139.Xr pfctl 8 ,
1140.Xr altq 9
1141.Sh HISTORY
1142The
1143.Nm
1144packet filtering mechanism first appeared in
1145.Ox 3.0
1146and then
1147.Fx 5.2 .
1148.Pp
1149This implementation is derived from
1150.Ox 4.5 .
1151It has been heavily modified to be capable of running in multithreaded
1152.Fx
1153kernel and scale its performance on multiple CPUs.
1154