xref: /freebsd/share/man/man4/pf.4 (revision 3b3a8eb937bf8045231e8364bfd1b94cd4a95979)
1.\"	$OpenBSD: pf.4,v 1.62 2008/09/10 14:57:37 jmc Exp $
2.\"
3.\" Copyright (C) 2001, Kjell Wooding.  All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\" 1. Redistributions of source code must retain the above copyright
9.\"    notice, this list of conditions and the following disclaimer.
10.\" 2. Redistributions in binary form must reproduce the above copyright
11.\"    notice, this list of conditions and the following disclaimer in the
12.\"    documentation and/or other materials provided with the distribution.
13.\" 3. Neither the name of the project nor the names of its contributors
14.\"    may be used to endorse or promote products derived from this software
15.\"    without specific prior written permission.
16.\"
17.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27.\" SUCH DAMAGE.
28.\"
29.\" $FreeBSD$
30.\"
31.Dd June 29 2012
32.Dt PF 4
33.Os
34.Sh NAME
35.Nm pf
36.Nd packet filter
37.Sh SYNOPSIS
38.Cd "device pf"
39.Sh DESCRIPTION
40Packet filtering takes place in the kernel.
41A pseudo-device,
42.Pa /dev/pf ,
43allows userland processes to control the
44behavior of the packet filter through an
45.Xr ioctl 2
46interface.
47There are commands to enable and disable the filter, load rulesets,
48add and remove individual rules or state table entries,
49and retrieve statistics.
50The most commonly used functions are covered by
51.Xr pfctl 8 .
52.Pp
53Manipulations like loading a ruleset that involve more than a single
54.Xr ioctl 2
55call require a so-called
56.Em ticket ,
57which prevents the occurrence of
58multiple concurrent manipulations.
59.Pp
60Fields of
61.Xr ioctl 2
62parameter structures that refer to packet data (like
63addresses and ports) are generally expected in network byte-order.
64.Pp
65Rules and address tables are contained in so-called
66.Em anchors .
67When servicing an
68.Xr ioctl 2
69request, if the anchor field of the argument structure is empty,
70the kernel will use the default anchor (i.e., the main ruleset)
71in operations.
72Anchors are specified by name and may be nested, with components
73separated by
74.Sq /
75characters, similar to how file system hierarchies are laid out.
76The final component of the anchor path is the anchor under which
77operations will be performed.
78.Sh SYSCTL VARIABLES AND LOADER TUNABLES
79The following
80.Xr loader 8
81tunables are available.
82.Bl -tag -width indent
83.It Va net.pf.states_hashsize
84Size of hash tables that store states.
85Should be power of 2.
86Default value is 32768.
87.It Va net.pf.source_nodes_hashsize
88Size of hash table that store source nodes.
89Should be power of 2.
90Default value is 8192.
91.El
92.Pp
93Read only
94.Xr sysctl 8
95variables with matching names are provided to obtain current values
96at runtime.
97.Sh IOCTL INTERFACE
98.Nm
99supports the following
100.Xr ioctl 2
101commands, available through
102.Aq Pa net/pfvar.h :
103.Bl -tag -width xxxxxx
104.It Dv DIOCSTART
105Start the packet filter.
106.It Dv DIOCSTOP
107Stop the packet filter.
108.It Dv DIOCSTARTALTQ
109Start the ALTQ bandwidth control system (see
110.Xr altq 9 ) .
111.It Dv DIOCSTOPALTQ
112Stop the ALTQ bandwidth control system.
113.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp"
114.Bd -literal
115struct pfioc_pooladdr {
116	u_int32_t		action;
117	u_int32_t		ticket;
118	u_int32_t		nr;
119	u_int32_t		r_num;
120	u_int8_t		r_action;
121	u_int8_t		r_last;
122	u_int8_t		af;
123	char			anchor[MAXPATHLEN];
124	struct pf_pooladdr	addr;
125};
126.Ed
127.Pp
128Clear the buffer address pool and get a
129.Va ticket
130for subsequent
131.Dv DIOCADDADDR ,
132.Dv DIOCADDRULE ,
133and
134.Dv DIOCCHANGERULE
135calls.
136.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp"
137.Pp
138Add the pool address
139.Va addr
140to the buffer address pool to be used in the following
141.Dv DIOCADDRULE
142or
143.Dv DIOCCHANGERULE
144call.
145All other members of the structure are ignored.
146.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr"
147.Bd -literal
148struct pfioc_rule {
149	u_int32_t	action;
150	u_int32_t	ticket;
151	u_int32_t	pool_ticket;
152	u_int32_t	nr;
153	char		anchor[MAXPATHLEN];
154	char		anchor_call[MAXPATHLEN];
155	struct pf_rule	rule;
156};
157.Ed
158.Pp
159Add
160.Va rule
161at the end of the inactive ruleset.
162This call requires a
163.Va ticket
164obtained through a preceding
165.Dv DIOCXBEGIN
166call and a
167.Va pool_ticket
168obtained through a
169.Dv DIOCBEGINADDRS
170call.
171.Dv DIOCADDADDR
172must also be called if any pool addresses are required.
173The optional
174.Va anchor
175name indicates the anchor in which to append the rule.
176.Va nr
177and
178.Va action
179are ignored.
180.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa"
181Add an ALTQ discipline or queue.
182.Bd -literal
183struct pfioc_altq {
184	u_int32_t	action;
185	u_int32_t	ticket;
186	u_int32_t	nr;
187	struct pf_altq  altq;
188};
189.Ed
190.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr"
191Get a
192.Va ticket
193for subsequent
194.Dv DIOCGETRULE
195calls and the number
196.Va nr
197of rules in the active ruleset.
198.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr"
199Get a
200.Va rule
201by its number
202.Va nr
203using the
204.Va ticket
205obtained through a preceding
206.Dv DIOCGETRULES
207call.
208If
209.Va action
210is set to
211.Dv PF_GET_CLR_CNTR ,
212the per-rule statistics on the requested rule are cleared.
213.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp"
214Get a
215.Va ticket
216for subsequent
217.Dv DIOCGETADDR
218calls and the number
219.Va nr
220of pool addresses in the rule specified with
221.Va r_action ,
222.Va r_num ,
223and
224.Va anchor .
225.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp"
226Get the pool address
227.Va addr
228by its number
229.Va nr
230from the rule specified with
231.Va r_action ,
232.Va r_num ,
233and
234.Va anchor
235using the
236.Va ticket
237obtained through a preceding
238.Dv DIOCGETADDRS
239call.
240.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa"
241Get a
242.Va ticket
243for subsequent
244.Dv DIOCGETALTQ
245calls and the number
246.Va nr
247of queues in the active list.
248.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa"
249Get the queueing discipline
250.Va altq
251by its number
252.Va nr
253using the
254.Va ticket
255obtained through a preceding
256.Dv DIOCGETALTQS
257call.
258.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq"
259Get the statistics on a queue.
260.Bd -literal
261struct pfioc_qstats {
262	u_int32_t	 ticket;
263	u_int32_t	 nr;
264	void		*buf;
265	int		 nbytes;
266	u_int8_t	 scheduler;
267};
268.Ed
269.Pp
270This call fills in a pointer to the buffer of statistics
271.Va buf ,
272of length
273.Va nbytes ,
274for the queue specified by
275.Va nr .
276.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr"
277.Bd -literal
278struct pfioc_ruleset {
279	u_int32_t	 nr;
280	char		 path[MAXPATHLEN];
281	char		 name[PF_ANCHOR_NAME_SIZE];
282};
283.Ed
284.Pp
285Get the number
286.Va nr
287of rulesets (i.e., anchors) directly attached to the anchor named by
288.Va path
289for use in subsequent
290.Dv DIOCGETRULESET
291calls.
292Nested anchors, since they are not directly attached to the given
293anchor, will not be included.
294This ioctl returns
295.Er EINVAL
296if the given anchor does not exist.
297.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr"
298Get a ruleset (i.e., an anchor)
299.Va name
300by its number
301.Va nr
302from the given anchor
303.Va path ,
304the maximum number of which can be obtained from a preceding
305.Dv DIOCGETRULESETS
306call.
307This ioctl returns
308.Er EINVAL
309if the given anchor does not exist or
310.Er EBUSY
311if another process is concurrently updating a ruleset.
312.It Dv DIOCADDSTATE Fa "struct pfioc_state *ps"
313Add a state entry.
314.Bd -literal
315struct pfioc_state {
316	struct pfsync_state	state;
317};
318.Ed
319.It Dv DIOCGETSTATE Fa "struct pfioc_state *ps"
320Extract the entry identified by the
321.Va id
322and
323.Va creatorid
324fields of the
325.Va state
326structure from the state table.
327.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk"
328Remove matching entries from the state table.
329This ioctl returns the number of killed states in
330.Va psk_killed .
331.Bd -literal
332struct pfioc_state_kill {
333	struct pf_state_cmp	psk_pfcmp;
334	sa_family_t		psk_af;
335	int			psk_proto;
336	struct pf_rule_addr	psk_src;
337	struct pf_rule_addr	psk_dst;
338	char			psk_ifname[IFNAMSIZ];
339	char			psk_label[PF_RULE_LABEL_SIZE];
340	u_int			psk_killed;
341};
342.Ed
343.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk"
344Clear all states.
345It works like
346.Dv DIOCKILLSTATES ,
347but ignores the
348.Va psk_af ,
349.Va psk_proto ,
350.Va psk_src ,
351and
352.Va psk_dst
353fields of the
354.Vt pfioc_state_kill
355structure.
356.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi"
357Specify the interface for which statistics are accumulated.
358.Bd -literal
359struct pfioc_if {
360	char		 ifname[IFNAMSIZ];
361};
362.Ed
363.It Dv DIOCGETSTATUS Fa "struct pf_status *s"
364Get the internal packet filter statistics.
365.Bd -literal
366struct pf_status {
367	u_int64_t	counters[PFRES_MAX];
368	u_int64_t	lcounters[LCNT_MAX];
369	u_int64_t	fcounters[FCNT_MAX];
370	u_int64_t	scounters[SCNT_MAX];
371	u_int64_t	pcounters[2][2][3];
372	u_int64_t	bcounters[2][2];
373	u_int32_t	running;
374	u_int32_t	states;
375	u_int32_t	src_nodes;
376	u_int32_t	since;
377	u_int32_t	debug;
378	u_int32_t	hostid;
379	char		ifname[IFNAMSIZ];
380	u_int8_t	pf_chksum[MD5_DIGEST_LENGTH];
381};
382.Ed
383.It Dv DIOCCLRSTATUS
384Clear the internal packet filter statistics.
385.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl"
386Look up a state table entry by source and destination addresses and ports.
387.Bd -literal
388struct pfioc_natlook {
389	struct pf_addr	 saddr;
390	struct pf_addr	 daddr;
391	struct pf_addr	 rsaddr;
392	struct pf_addr	 rdaddr;
393	u_int16_t	 sport;
394	u_int16_t	 dport;
395	u_int16_t	 rsport;
396	u_int16_t	 rdport;
397	sa_family_t	 af;
398	u_int8_t	 proto;
399	u_int8_t	 direction;
400};
401.Ed
402.It Dv DIOCSETDEBUG Fa "u_int32_t *level"
403Set the debug level.
404.Bd -literal
405enum	{ PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC,
406	  PF_DEBUG_NOISY };
407.Ed
408.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps"
409Get state table entries.
410.Bd -literal
411struct pfioc_states {
412	int	ps_len;
413	union {
414		caddr_t		 psu_buf;
415		struct pf_state *psu_states;
416	} ps_u;
417#define ps_buf		ps_u.psu_buf
418#define ps_states	ps_u.psu_states
419};
420.Ed
421.Pp
422If
423.Va ps_len
424is non-zero on entry, as many states as possible that can fit into this
425size will be copied into the supplied buffer
426.Va ps_states .
427On exit,
428.Va ps_len
429is always set to the total size required to hold all state table entries
430(i.e., it is set to
431.Li sizeof(struct pf_state) * nr ) .
432.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr"
433Add or remove the
434.Va rule
435in the ruleset specified by
436.Va rule.action .
437.Pp
438The type of operation to be performed is indicated by
439.Va action ,
440which can be any of the following:
441.Bd -literal
442enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
443	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
444	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
445.Ed
446.Pp
447.Va ticket
448must be set to the value obtained with
449.Dv PF_CHANGE_GET_TICKET
450for all actions except
451.Dv PF_CHANGE_GET_TICKET .
452.Va pool_ticket
453must be set to the value obtained with the
454.Dv DIOCBEGINADDRS
455call for all actions except
456.Dv PF_CHANGE_REMOVE
457and
458.Dv PF_CHANGE_GET_TICKET .
459.Va anchor
460indicates to which anchor the operation applies.
461.Va nr
462indicates the rule number against which
463.Dv PF_CHANGE_ADD_BEFORE ,
464.Dv PF_CHANGE_ADD_AFTER ,
465or
466.Dv PF_CHANGE_REMOVE
467actions are applied.
468.\" It Dv DIOCCHANGEALTQ Fa "struct pfioc_altq *pcr"
469.It Dv DIOCCHANGEADDR Fa "struct pfioc_pooladdr *pca"
470Add or remove the pool address
471.Va addr
472from the rule specified by
473.Va r_action ,
474.Va r_num ,
475and
476.Va anchor .
477.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt"
478.Bd -literal
479struct pfioc_tm {
480	int		 timeout;
481	int		 seconds;
482};
483.Ed
484.Pp
485Set the state timeout of
486.Va timeout
487to
488.Va seconds .
489The old value will be placed into
490.Va seconds .
491For possible values of
492.Va timeout ,
493consult the
494.Dv PFTM_*
495values in
496.Aq Pa net/pfvar.h .
497.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt"
498Get the state timeout of
499.Va timeout .
500The value will be placed into the
501.Va seconds
502field.
503.It Dv DIOCCLRRULECTRS
504Clear per-rule statistics.
505.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl"
506Set the hard limits on the memory pools used by the packet filter.
507.Bd -literal
508struct pfioc_limit {
509	int		index;
510	unsigned	limit;
511};
512
513enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
514	  PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
515.Ed
516.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl"
517Get the hard
518.Va limit
519for the memory pool indicated by
520.Va index .
521.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io"
522Clear all tables.
523All the ioctls that manipulate radix tables
524use the same structure described below.
525For
526.Dv DIOCRCLRTABLES ,
527.Va pfrio_ndel
528contains on exit the number of tables deleted.
529.Bd -literal
530struct pfioc_table {
531	struct pfr_table	 pfrio_table;
532	void			*pfrio_buffer;
533	int			 pfrio_esize;
534	int			 pfrio_size;
535	int			 pfrio_size2;
536	int			 pfrio_nadd;
537	int			 pfrio_ndel;
538	int			 pfrio_nchange;
539	int			 pfrio_flags;
540	u_int32_t		 pfrio_ticket;
541};
542#define pfrio_exists    pfrio_nadd
543#define pfrio_nzero     pfrio_nadd
544#define pfrio_nmatch    pfrio_nadd
545#define pfrio_naddr     pfrio_size2
546#define pfrio_setflag   pfrio_size2
547#define pfrio_clrflag   pfrio_nadd
548.Ed
549.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io"
550Create one or more tables.
551On entry,
552.Va pfrio_buffer
553must point to an array of
554.Vt struct pfr_table
555containing at least
556.Vt pfrio_size
557elements.
558.Vt pfrio_esize
559must be the size of
560.Vt struct pfr_table .
561On exit,
562.Va pfrio_nadd
563contains the number of tables effectively created.
564.Bd -literal
565struct pfr_table {
566	char		pfrt_anchor[MAXPATHLEN];
567	char		pfrt_name[PF_TABLE_NAME_SIZE];
568	u_int32_t	pfrt_flags;
569	u_int8_t	pfrt_fback;
570};
571.Ed
572.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io"
573Delete one or more tables.
574On entry,
575.Va pfrio_buffer
576must point to an array of
577.Vt struct pfr_table
578containing at least
579.Vt pfrio_size
580elements.
581.Vt pfrio_esize
582must be the size of
583.Vt struct pfr_table .
584On exit,
585.Va pfrio_ndel
586contains the number of tables effectively deleted.
587.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io"
588Get the list of all tables.
589On entry,
590.Va pfrio_buffer[pfrio_size]
591contains a valid writeable buffer for
592.Vt pfr_table
593structures.
594On exit,
595.Va pfrio_size
596contains the number of tables written into the buffer.
597If the buffer is too small, the kernel does not store anything but just
598returns the required buffer size, without error.
599.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io"
600This call is like
601.Dv DIOCRGETTABLES
602but is used to get an array of
603.Vt pfr_tstats
604structures.
605.Bd -literal
606struct pfr_tstats {
607	struct pfr_table pfrts_t;
608	u_int64_t	 pfrts_packets
609			     [PFR_DIR_MAX][PFR_OP_TABLE_MAX];
610	u_int64_t	 pfrts_bytes
611			     [PFR_DIR_MAX][PFR_OP_TABLE_MAX];
612	u_int64_t	 pfrts_match;
613	u_int64_t	 pfrts_nomatch;
614	long		 pfrts_tzero;
615	int		 pfrts_cnt;
616	int		 pfrts_refcnt[PFR_REFCNT_MAX];
617};
618#define pfrts_name	 pfrts_t.pfrt_name
619#define pfrts_flags	 pfrts_t.pfrt_flags
620.Ed
621.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io"
622Clear the statistics of one or more tables.
623On entry,
624.Va pfrio_buffer
625must point to an array of
626.Vt struct pfr_table
627containing at least
628.Vt pfrio_size
629elements.
630.Vt pfrio_esize
631must be the size of
632.Vt struct pfr_table .
633On exit,
634.Va pfrio_nzero
635contains the number of tables effectively cleared.
636.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io"
637Clear all addresses in a table.
638On entry,
639.Va pfrio_table
640contains the table to clear.
641On exit,
642.Va pfrio_ndel
643contains the number of addresses removed.
644.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io"
645Add one or more addresses to a table.
646On entry,
647.Va pfrio_table
648contains the table ID and
649.Va pfrio_buffer
650must point to an array of
651.Vt struct pfr_addr
652containing at least
653.Vt pfrio_size
654elements to add to the table.
655.Vt pfrio_esize
656must be the size of
657.Vt struct pfr_addr .
658On exit,
659.Va pfrio_nadd
660contains the number of addresses effectively added.
661.Bd -literal
662struct pfr_addr {
663	union {
664		struct in_addr	 _pfra_ip4addr;
665		struct in6_addr	 _pfra_ip6addr;
666	}		 pfra_u;
667	u_int8_t	 pfra_af;
668	u_int8_t	 pfra_net;
669	u_int8_t	 pfra_not;
670	u_int8_t	 pfra_fback;
671};
672#define pfra_ip4addr    pfra_u._pfra_ip4addr
673#define pfra_ip6addr    pfra_u._pfra_ip6addr
674.Ed
675.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io"
676Delete one or more addresses from a table.
677On entry,
678.Va pfrio_table
679contains the table ID and
680.Va pfrio_buffer
681must point to an array of
682.Vt struct pfr_addr
683containing at least
684.Vt pfrio_size
685elements to delete from the table.
686.Vt pfrio_esize
687must be the size of
688.Vt struct pfr_addr .
689On exit,
690.Va pfrio_ndel
691contains the number of addresses effectively deleted.
692.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io"
693Replace the content of a table by a new address list.
694This is the most complicated command, which uses all the structure members.
695.Pp
696On entry,
697.Va pfrio_table
698contains the table ID and
699.Va pfrio_buffer
700must point to an array of
701.Vt struct pfr_addr
702containing at least
703.Vt pfrio_size
704elements which become the new contents of the table.
705.Vt pfrio_esize
706must be the size of
707.Vt struct pfr_addr .
708Additionally, if
709.Va pfrio_size2
710is non-zero,
711.Va pfrio_buffer[pfrio_size..pfrio_size2]
712must be a writeable buffer, into which the kernel can copy the
713addresses that have been deleted during the replace operation.
714On exit,
715.Va pfrio_ndel ,
716.Va pfrio_nadd ,
717and
718.Va pfrio_nchange
719contain the number of addresses deleted, added, and changed by the
720kernel.
721If
722.Va pfrio_size2
723was set on entry,
724.Va pfrio_size2
725will point to the size of the buffer used, exactly like
726.Dv DIOCRGETADDRS .
727.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io"
728Get all the addresses of a table.
729On entry,
730.Va pfrio_table
731contains the table ID and
732.Va pfrio_buffer[pfrio_size]
733contains a valid writeable buffer for
734.Vt pfr_addr
735structures.
736On exit,
737.Va pfrio_size
738contains the number of addresses written into the buffer.
739If the buffer was too small, the kernel does not store anything but just
740returns the required buffer size, without returning an error.
741.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io"
742This call is like
743.Dv DIOCRGETADDRS
744but is used to get an array of
745.Vt pfr_astats
746structures.
747.Bd -literal
748struct pfr_astats {
749	struct pfr_addr	 pfras_a;
750	u_int64_t	 pfras_packets
751			     [PFR_DIR_MAX][PFR_OP_ADDR_MAX];
752	u_int64_t	 pfras_bytes
753			     [PFR_DIR_MAX][PFR_OP_ADDR_MAX];
754	long		 pfras_tzero;
755};
756.Ed
757.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io"
758Clear the statistics of one or more addresses.
759On entry,
760.Va pfrio_table
761contains the table ID and
762.Va pfrio_buffer
763must point to an array of
764.Vt struct pfr_addr
765containing at least
766.Vt pfrio_size
767elements to be cleared from the table.
768.Vt pfrio_esize
769must be the size of
770.Vt struct pfr_addr .
771On exit,
772.Va pfrio_nzero
773contains the number of addresses effectively cleared.
774.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io"
775Test if the given addresses match a table.
776On entry,
777.Va pfrio_table
778contains the table ID and
779.Va pfrio_buffer
780must point to an array of
781.Vt struct pfr_addr
782containing at least
783.Vt pfrio_size
784elements, each of which will be tested for a match in the table.
785.Vt pfrio_esize
786must be the size of
787.Vt struct pfr_addr .
788On exit, the kernel updates the
789.Vt pfr_addr
790array by setting the
791.Va pfra_fback
792member appropriately.
793.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io"
794Change the
795.Dv PFR_TFLAG_CONST
796or
797.Dv PFR_TFLAG_PERSIST
798flags of a table.
799On entry,
800.Va pfrio_buffer
801must point to an array of
802.Vt struct pfr_table
803containing at least
804.Vt pfrio_size
805elements.
806.Va pfrio_esize
807must be the size of
808.Vt struct pfr_table .
809.Va pfrio_setflag
810must contain the flags to add, while
811.Va pfrio_clrflag
812must contain the flags to remove.
813On exit,
814.Va pfrio_nchange
815and
816.Va pfrio_ndel
817contain the number of tables altered or deleted by the kernel.
818Yes, tables can be deleted if one removes the
819.Dv PFR_TFLAG_PERSIST
820flag of an unreferenced table.
821.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io"
822Defines a table in the inactive set.
823On entry,
824.Va pfrio_table
825contains the table ID and
826.Va pfrio_buffer[pfrio_size]
827contains an array of
828.Vt pfr_addr
829structures to put in the table.
830A valid ticket must also be supplied to
831.Va pfrio_ticket .
832On exit,
833.Va pfrio_nadd
834contains 0 if the table was already defined in the inactive list
835or 1 if a new table has been created.
836.Va pfrio_naddr
837contains the number of addresses effectively put in the table.
838.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io"
839.Bd -literal
840struct pfioc_trans {
841	int		 size;	/* number of elements */
842	int		 esize;	/* size of each element in bytes */
843	struct pfioc_trans_e {
844		int		rs_num;
845		char		anchor[MAXPATHLEN];
846		u_int32_t	ticket;
847	}		*array;
848};
849.Ed
850.Pp
851Clear all the inactive rulesets specified in the
852.Vt pfioc_trans_e
853array.
854For each ruleset, a ticket is returned for subsequent "add rule" ioctls,
855as well as for the
856.Dv DIOCXCOMMIT
857and
858.Dv DIOCXROLLBACK
859calls.
860.Pp
861Ruleset types, identified by
862.Va rs_num ,
863include the following:
864.Pp
865.Bl -tag -width PF_RULESET_FILTER -offset ind -compact
866.It Dv PF_RULESET_SCRUB
867Scrub (packet normalization) rules.
868.It Dv PF_RULESET_FILTER
869Filter rules.
870.It Dv PF_RULESET_NAT
871NAT (Network Address Translation) rules.
872.It Dv PF_RULESET_BINAT
873Bidirectional NAT rules.
874.It Dv PF_RULESET_RDR
875Redirect rules.
876.It Dv PF_RULESET_ALTQ
877ALTQ disciplines.
878.It Dv PF_RULESET_TABLE
879Address tables.
880.El
881.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io"
882Atomically switch a vector of inactive rulesets to the active rulesets.
883This call is implemented as a standard two-phase commit, which will either
884fail for all rulesets or completely succeed.
885All tickets need to be valid.
886This ioctl returns
887.Er EBUSY
888if another process is concurrently updating some of the same rulesets.
889.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io"
890Clean up the kernel by undoing all changes that have taken place on the
891inactive rulesets since the last
892.Dv DIOCXBEGIN .
893.Dv DIOCXROLLBACK
894will silently ignore rulesets for which the ticket is invalid.
895.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid"
896Set the host ID, which is used by
897.Xr pfsync 4
898to identify which host created state table entries.
899.It Dv DIOCOSFPFLUSH
900Flush the passive OS fingerprint table.
901.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io"
902.Bd -literal
903struct pf_osfp_ioctl {
904	struct pf_osfp_entry {
905		SLIST_ENTRY(pf_osfp_entry) fp_entry;
906		pf_osfp_t		fp_os;
907		char			fp_class_nm[PF_OSFP_LEN];
908		char			fp_version_nm[PF_OSFP_LEN];
909		char			fp_subtype_nm[PF_OSFP_LEN];
910	} 			fp_os;
911	pf_tcpopts_t		fp_tcpopts;
912	u_int16_t		fp_wsize;
913	u_int16_t		fp_psize;
914	u_int16_t		fp_mss;
915	u_int16_t		fp_flags;
916	u_int8_t		fp_optcnt;
917	u_int8_t		fp_wscale;
918	u_int8_t		fp_ttl;
919	int			fp_getnum;
920};
921.Ed
922.Pp
923Add a passive OS fingerprint to the table.
924Set
925.Va fp_os.fp_os
926to the packed fingerprint,
927.Va fp_os.fp_class_nm
928to the name of the class (Linux, Windows, etc),
929.Va fp_os.fp_version_nm
930to the name of the version (NT, 95, 98), and
931.Va fp_os.fp_subtype_nm
932to the name of the subtype or patchlevel.
933The members
934.Va fp_mss ,
935.Va fp_wsize ,
936.Va fp_psize ,
937.Va fp_ttl ,
938.Va fp_optcnt ,
939and
940.Va fp_wscale
941are set to the TCP MSS, the TCP window size, the IP length, the IP TTL,
942the number of TCP options, and the TCP window scaling constant of the
943TCP SYN packet, respectively.
944.Pp
945The
946.Va fp_flags
947member is filled according to the
948.Aq Pa net/pfvar.h
949include file
950.Dv PF_OSFP_*
951defines.
952The
953.Va fp_tcpopts
954member contains packed TCP options.
955Each option uses
956.Dv PF_OSFP_TCPOPT_BITS
957bits in the packed value.
958Options include any of
959.Dv PF_OSFP_TCPOPT_NOP ,
960.Dv PF_OSFP_TCPOPT_SACK ,
961.Dv PF_OSFP_TCPOPT_WSCALE ,
962.Dv PF_OSFP_TCPOPT_MSS ,
963or
964.Dv PF_OSFP_TCPOPT_TS .
965.Pp
966The
967.Va fp_getnum
968member is not used with this ioctl.
969.Pp
970The structure's slack space must be zeroed for correct operation;
971.Xr memset 3
972the whole structure to zero before filling and sending to the kernel.
973.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io"
974Get the passive OS fingerprint number
975.Va fp_getnum
976from the kernel's fingerprint list.
977The rest of the structure members will come back filled.
978Get the whole list by repeatedly incrementing the
979.Va fp_getnum
980number until the ioctl returns
981.Er EBUSY .
982.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn"
983.Bd -literal
984struct pfioc_src_nodes {
985	int	psn_len;
986	union {
987		caddr_t		psu_buf;
988		struct pf_src_node	*psu_src_nodes;
989	} psn_u;
990#define psn_buf		psn_u.psu_buf
991#define psn_src_nodes	psn_u.psu_src_nodes
992};
993.Ed
994.Pp
995Get the list of source nodes kept by sticky addresses and source
996tracking.
997The ioctl must be called once with
998.Va psn_len
999set to 0.
1000If the ioctl returns without error,
1001.Va psn_len
1002will be set to the size of the buffer required to hold all the
1003.Va pf_src_node
1004structures held in the table.
1005A buffer of this size should then be allocated, and a pointer to this buffer
1006placed in
1007.Va psn_buf .
1008The ioctl must then be called again to fill this buffer with the actual
1009source node data.
1010After that call,
1011.Va psn_len
1012will be set to the length of the buffer actually used.
1013.It Dv DIOCCLRSRCNODES
1014Clear the tree of source tracking nodes.
1015.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io"
1016Get the list of interfaces and interface drivers known to
1017.Nm .
1018All the ioctls that manipulate interfaces
1019use the same structure described below:
1020.Bd -literal
1021struct pfioc_iface {
1022	char			 pfiio_name[IFNAMSIZ];
1023	void			*pfiio_buffer;
1024	int			 pfiio_esize;
1025	int			 pfiio_size;
1026	int			 pfiio_nzero;
1027	int			 pfiio_flags;
1028};
1029.Ed
1030.Pp
1031If not empty,
1032.Va pfiio_name
1033can be used to restrict the search to a specific interface or driver.
1034.Va pfiio_buffer[pfiio_size]
1035is the user-supplied buffer for returning the data.
1036On entry,
1037.Va pfiio_size
1038contains the number of
1039.Vt pfi_kif
1040entries that can fit into the buffer.
1041The kernel will replace this value by the real number of entries it wants
1042to return.
1043.Va pfiio_esize
1044should be set to
1045.Li sizeof(struct pfi_kif) .
1046.Pp
1047The data is returned in the
1048.Vt pfi_kif
1049structure described below:
1050.Bd -literal
1051struct pfi_kif {
1052	RB_ENTRY(pfi_kif)		 pfik_tree;
1053	char				 pfik_name[IFNAMSIZ];
1054	u_int64_t			 pfik_packets[2][2][2];
1055	u_int64_t			 pfik_bytes[2][2][2];
1056	u_int32_t			 pfik_tzero;
1057	int				 pfik_flags;
1058	struct pf_state_tree_lan_ext	 pfik_lan_ext;
1059	struct pf_state_tree_ext_gwy	 pfik_ext_gwy;
1060	TAILQ_ENTRY(pfi_kif)		 pfik_w_states;
1061	void				*pfik_ah_cookie;
1062	struct ifnet			*pfik_ifp;
1063	struct ifg_group		*pfik_group;
1064	int				 pfik_states;
1065	int				 pfik_rules;
1066	TAILQ_HEAD(, pfi_dynaddr)	 pfik_dynaddrs;
1067};
1068.Ed
1069.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io"
1070Set the user setable flags (described above) of the
1071.Nm
1072internal interface description.
1073The filtering process is the same as for
1074.Dv DIOCIGETIFACES .
1075.Bd -literal
1076#define PFI_IFLAG_SKIP	0x0100	/* skip filtering on interface */
1077.Ed
1078.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io"
1079Works as
1080.Dv DIOCSETIFFLAG
1081above but clears the flags.
1082.It Dv DIOCKILLSRCNODES Fa "struct pfioc_iface *io"
1083Explicitly remove source tracking nodes.
1084.El
1085.Sh FILES
1086.Bl -tag -width /dev/pf -compact
1087.It Pa /dev/pf
1088packet filtering device.
1089.El
1090.Sh EXAMPLES
1091The following example demonstrates how to use the
1092.Dv DIOCNATLOOK
1093command to find the internal host/port of a NATed connection:
1094.Bd -literal
1095#include <sys/types.h>
1096#include <sys/socket.h>
1097#include <sys/ioctl.h>
1098#include <sys/fcntl.h>
1099#include <net/if.h>
1100#include <netinet/in.h>
1101#include <net/pfvar.h>
1102#include <err.h>
1103#include <stdio.h>
1104#include <stdlib.h>
1105
1106u_int32_t
1107read_address(const char *s)
1108{
1109	int a, b, c, d;
1110
1111	sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d);
1112	return htonl(a << 24 | b << 16 | c << 8 | d);
1113}
1114
1115void
1116print_address(u_int32_t a)
1117{
1118	a = ntohl(a);
1119	printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255,
1120	    a >> 8 & 255, a & 255);
1121}
1122
1123int
1124main(int argc, char *argv[])
1125{
1126	struct pfioc_natlook nl;
1127	int dev;
1128
1129	if (argc != 5) {
1130		printf("%s <gwy addr> <gwy port> <ext addr> <ext port>\\n",
1131		    argv[0]);
1132		return 1;
1133	}
1134
1135	dev = open("/dev/pf", O_RDWR);
1136	if (dev == -1)
1137		err(1, "open(\\"/dev/pf\\") failed");
1138
1139	memset(&nl, 0, sizeof(struct pfioc_natlook));
1140	nl.saddr.v4.s_addr	= read_address(argv[1]);
1141	nl.sport		= htons(atoi(argv[2]));
1142	nl.daddr.v4.s_addr	= read_address(argv[3]);
1143	nl.dport		= htons(atoi(argv[4]));
1144	nl.af			= AF_INET;
1145	nl.proto		= IPPROTO_TCP;
1146	nl.direction		= PF_IN;
1147
1148	if (ioctl(dev, DIOCNATLOOK, &nl))
1149		err(1, "DIOCNATLOOK");
1150
1151	printf("internal host ");
1152	print_address(nl.rsaddr.v4.s_addr);
1153	printf(":%u\\n", ntohs(nl.rsport));
1154	return 0;
1155}
1156.Ed
1157.Sh SEE ALSO
1158.Xr ioctl 2 ,
1159.Xr altq 4 ,
1160.Xr if_bridge 4 ,
1161.Xr pflog 4 ,
1162.Xr pflow 4 ,
1163.Xr pfsync 4 ,
1164.Xr pfctl 8 ,
1165.Xr altq 9
1166.Sh HISTORY
1167The
1168.Nm
1169packet filtering mechanism first appeared in
1170.Ox 3.0
1171and then
1172.Fx 5.2 .
1173.Pp
1174This implementation matches
1175.Ox 4.5 .
1176