1.\" $OpenBSD: pf.4,v 1.62 2008/09/10 14:57:37 jmc Exp $ 2.\" 3.\" Copyright (C) 2001, Kjell Wooding. All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 1. Redistributions of source code must retain the above copyright 9.\" notice, this list of conditions and the following disclaimer. 10.\" 2. Redistributions in binary form must reproduce the above copyright 11.\" notice, this list of conditions and the following disclaimer in the 12.\" documentation and/or other materials provided with the distribution. 13.\" 3. Neither the name of the project nor the names of its contributors 14.\" may be used to endorse or promote products derived from this software 15.\" without specific prior written permission. 16.\" 17.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 18.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20.\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 21.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27.\" SUCH DAMAGE. 28.\" 29.\" $FreeBSD$ 30.\" 31.Dd June 29 2012 32.Dt PF 4 33.Os 34.Sh NAME 35.Nm pf 36.Nd packet filter 37.Sh SYNOPSIS 38.Cd "device pf" 39.Sh DESCRIPTION 40Packet filtering takes place in the kernel. 41A pseudo-device, 42.Pa /dev/pf , 43allows userland processes to control the 44behavior of the packet filter through an 45.Xr ioctl 2 46interface. 47There are commands to enable and disable the filter, load rulesets, 48add and remove individual rules or state table entries, 49and retrieve statistics. 50The most commonly used functions are covered by 51.Xr pfctl 8 . 52.Pp 53Manipulations like loading a ruleset that involve more than a single 54.Xr ioctl 2 55call require a so-called 56.Em ticket , 57which prevents the occurrence of 58multiple concurrent manipulations. 59.Pp 60Fields of 61.Xr ioctl 2 62parameter structures that refer to packet data (like 63addresses and ports) are generally expected in network byte-order. 64.Pp 65Rules and address tables are contained in so-called 66.Em anchors . 67When servicing an 68.Xr ioctl 2 69request, if the anchor field of the argument structure is empty, 70the kernel will use the default anchor (i.e., the main ruleset) 71in operations. 72Anchors are specified by name and may be nested, with components 73separated by 74.Sq / 75characters, similar to how file system hierarchies are laid out. 76The final component of the anchor path is the anchor under which 77operations will be performed. 78.Sh SYSCTL VARIABLES AND LOADER TUNABLES 79The following 80.Xr loader 8 81tunables are available. 82.Bl -tag -width indent 83.It Va net.pf.states_hashsize 84Size of hash tables that store states. 85Should be power of 2. 86Default value is 32768. 87.It Va net.pf.source_nodes_hashsize 88Size of hash table that store source nodes. 89Should be power of 2. 90Default value is 8192. 91.El 92.Pp 93Read only 94.Xr sysctl 8 95variables with matching names are provided to obtain current values 96at runtime. 97.Sh IOCTL INTERFACE 98.Nm 99supports the following 100.Xr ioctl 2 101commands, available through 102.Aq Pa net/pfvar.h : 103.Bl -tag -width xxxxxx 104.It Dv DIOCSTART 105Start the packet filter. 106.It Dv DIOCSTOP 107Stop the packet filter. 108.It Dv DIOCSTARTALTQ 109Start the ALTQ bandwidth control system (see 110.Xr altq 9 ) . 111.It Dv DIOCSTOPALTQ 112Stop the ALTQ bandwidth control system. 113.It Dv DIOCBEGINADDRS Fa "struct pfioc_pooladdr *pp" 114.Bd -literal 115struct pfioc_pooladdr { 116 u_int32_t action; 117 u_int32_t ticket; 118 u_int32_t nr; 119 u_int32_t r_num; 120 u_int8_t r_action; 121 u_int8_t r_last; 122 u_int8_t af; 123 char anchor[MAXPATHLEN]; 124 struct pf_pooladdr addr; 125}; 126.Ed 127.Pp 128Clear the buffer address pool and get a 129.Va ticket 130for subsequent 131.Dv DIOCADDADDR , 132.Dv DIOCADDRULE , 133and 134.Dv DIOCCHANGERULE 135calls. 136.It Dv DIOCADDADDR Fa "struct pfioc_pooladdr *pp" 137.Pp 138Add the pool address 139.Va addr 140to the buffer address pool to be used in the following 141.Dv DIOCADDRULE 142or 143.Dv DIOCCHANGERULE 144call. 145All other members of the structure are ignored. 146.It Dv DIOCADDRULE Fa "struct pfioc_rule *pr" 147.Bd -literal 148struct pfioc_rule { 149 u_int32_t action; 150 u_int32_t ticket; 151 u_int32_t pool_ticket; 152 u_int32_t nr; 153 char anchor[MAXPATHLEN]; 154 char anchor_call[MAXPATHLEN]; 155 struct pf_rule rule; 156}; 157.Ed 158.Pp 159Add 160.Va rule 161at the end of the inactive ruleset. 162This call requires a 163.Va ticket 164obtained through a preceding 165.Dv DIOCXBEGIN 166call and a 167.Va pool_ticket 168obtained through a 169.Dv DIOCBEGINADDRS 170call. 171.Dv DIOCADDADDR 172must also be called if any pool addresses are required. 173The optional 174.Va anchor 175name indicates the anchor in which to append the rule. 176.Va nr 177and 178.Va action 179are ignored. 180.It Dv DIOCADDALTQ Fa "struct pfioc_altq *pa" 181Add an ALTQ discipline or queue. 182.Bd -literal 183struct pfioc_altq { 184 u_int32_t action; 185 u_int32_t ticket; 186 u_int32_t nr; 187 struct pf_altq altq; 188}; 189.Ed 190.It Dv DIOCGETRULES Fa "struct pfioc_rule *pr" 191Get a 192.Va ticket 193for subsequent 194.Dv DIOCGETRULE 195calls and the number 196.Va nr 197of rules in the active ruleset. 198.It Dv DIOCGETRULE Fa "struct pfioc_rule *pr" 199Get a 200.Va rule 201by its number 202.Va nr 203using the 204.Va ticket 205obtained through a preceding 206.Dv DIOCGETRULES 207call. 208If 209.Va action 210is set to 211.Dv PF_GET_CLR_CNTR , 212the per-rule statistics on the requested rule are cleared. 213.It Dv DIOCGETADDRS Fa "struct pfioc_pooladdr *pp" 214Get a 215.Va ticket 216for subsequent 217.Dv DIOCGETADDR 218calls and the number 219.Va nr 220of pool addresses in the rule specified with 221.Va r_action , 222.Va r_num , 223and 224.Va anchor . 225.It Dv DIOCGETADDR Fa "struct pfioc_pooladdr *pp" 226Get the pool address 227.Va addr 228by its number 229.Va nr 230from the rule specified with 231.Va r_action , 232.Va r_num , 233and 234.Va anchor 235using the 236.Va ticket 237obtained through a preceding 238.Dv DIOCGETADDRS 239call. 240.It Dv DIOCGETALTQS Fa "struct pfioc_altq *pa" 241Get a 242.Va ticket 243for subsequent 244.Dv DIOCGETALTQ 245calls and the number 246.Va nr 247of queues in the active list. 248.It Dv DIOCGETALTQ Fa "struct pfioc_altq *pa" 249Get the queueing discipline 250.Va altq 251by its number 252.Va nr 253using the 254.Va ticket 255obtained through a preceding 256.Dv DIOCGETALTQS 257call. 258.It Dv DIOCGETQSTATS Fa "struct pfioc_qstats *pq" 259Get the statistics on a queue. 260.Bd -literal 261struct pfioc_qstats { 262 u_int32_t ticket; 263 u_int32_t nr; 264 void *buf; 265 int nbytes; 266 u_int8_t scheduler; 267}; 268.Ed 269.Pp 270This call fills in a pointer to the buffer of statistics 271.Va buf , 272of length 273.Va nbytes , 274for the queue specified by 275.Va nr . 276.It Dv DIOCGETRULESETS Fa "struct pfioc_ruleset *pr" 277.Bd -literal 278struct pfioc_ruleset { 279 u_int32_t nr; 280 char path[MAXPATHLEN]; 281 char name[PF_ANCHOR_NAME_SIZE]; 282}; 283.Ed 284.Pp 285Get the number 286.Va nr 287of rulesets (i.e., anchors) directly attached to the anchor named by 288.Va path 289for use in subsequent 290.Dv DIOCGETRULESET 291calls. 292Nested anchors, since they are not directly attached to the given 293anchor, will not be included. 294This ioctl returns 295.Er EINVAL 296if the given anchor does not exist. 297.It Dv DIOCGETRULESET Fa "struct pfioc_ruleset *pr" 298Get a ruleset (i.e., an anchor) 299.Va name 300by its number 301.Va nr 302from the given anchor 303.Va path , 304the maximum number of which can be obtained from a preceding 305.Dv DIOCGETRULESETS 306call. 307This ioctl returns 308.Er EINVAL 309if the given anchor does not exist or 310.Er EBUSY 311if another process is concurrently updating a ruleset. 312.It Dv DIOCADDSTATE Fa "struct pfioc_state *ps" 313Add a state entry. 314.Bd -literal 315struct pfioc_state { 316 struct pfsync_state state; 317}; 318.Ed 319.It Dv DIOCGETSTATE Fa "struct pfioc_state *ps" 320Extract the entry identified by the 321.Va id 322and 323.Va creatorid 324fields of the 325.Va state 326structure from the state table. 327.It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill *psk" 328Remove matching entries from the state table. 329This ioctl returns the number of killed states in 330.Va psk_killed . 331.Bd -literal 332struct pfioc_state_kill { 333 struct pf_state_cmp psk_pfcmp; 334 sa_family_t psk_af; 335 int psk_proto; 336 struct pf_rule_addr psk_src; 337 struct pf_rule_addr psk_dst; 338 char psk_ifname[IFNAMSIZ]; 339 char psk_label[PF_RULE_LABEL_SIZE]; 340 u_int psk_killed; 341}; 342.Ed 343.It Dv DIOCCLRSTATES Fa "struct pfioc_state_kill *psk" 344Clear all states. 345It works like 346.Dv DIOCKILLSTATES , 347but ignores the 348.Va psk_af , 349.Va psk_proto , 350.Va psk_src , 351and 352.Va psk_dst 353fields of the 354.Vt pfioc_state_kill 355structure. 356.It Dv DIOCSETSTATUSIF Fa "struct pfioc_if *pi" 357Specify the interface for which statistics are accumulated. 358.Bd -literal 359struct pfioc_if { 360 char ifname[IFNAMSIZ]; 361}; 362.Ed 363.It Dv DIOCGETSTATUS Fa "struct pf_status *s" 364Get the internal packet filter statistics. 365.Bd -literal 366struct pf_status { 367 u_int64_t counters[PFRES_MAX]; 368 u_int64_t lcounters[LCNT_MAX]; 369 u_int64_t fcounters[FCNT_MAX]; 370 u_int64_t scounters[SCNT_MAX]; 371 u_int64_t pcounters[2][2][3]; 372 u_int64_t bcounters[2][2]; 373 u_int32_t running; 374 u_int32_t states; 375 u_int32_t src_nodes; 376 u_int32_t since; 377 u_int32_t debug; 378 u_int32_t hostid; 379 char ifname[IFNAMSIZ]; 380 u_int8_t pf_chksum[MD5_DIGEST_LENGTH]; 381}; 382.Ed 383.It Dv DIOCCLRSTATUS 384Clear the internal packet filter statistics. 385.It Dv DIOCNATLOOK Fa "struct pfioc_natlook *pnl" 386Look up a state table entry by source and destination addresses and ports. 387.Bd -literal 388struct pfioc_natlook { 389 struct pf_addr saddr; 390 struct pf_addr daddr; 391 struct pf_addr rsaddr; 392 struct pf_addr rdaddr; 393 u_int16_t sport; 394 u_int16_t dport; 395 u_int16_t rsport; 396 u_int16_t rdport; 397 sa_family_t af; 398 u_int8_t proto; 399 u_int8_t direction; 400}; 401.Ed 402.It Dv DIOCSETDEBUG Fa "u_int32_t *level" 403Set the debug level. 404.Bd -literal 405enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, 406 PF_DEBUG_NOISY }; 407.Ed 408.It Dv DIOCGETSTATES Fa "struct pfioc_states *ps" 409Get state table entries. 410.Bd -literal 411struct pfioc_states { 412 int ps_len; 413 union { 414 caddr_t psu_buf; 415 struct pf_state *psu_states; 416 } ps_u; 417#define ps_buf ps_u.psu_buf 418#define ps_states ps_u.psu_states 419}; 420.Ed 421.Pp 422If 423.Va ps_len 424is non-zero on entry, as many states as possible that can fit into this 425size will be copied into the supplied buffer 426.Va ps_states . 427On exit, 428.Va ps_len 429is always set to the total size required to hold all state table entries 430(i.e., it is set to 431.Li sizeof(struct pf_state) * nr ) . 432.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr" 433Add or remove the 434.Va rule 435in the ruleset specified by 436.Va rule.action . 437.Pp 438The type of operation to be performed is indicated by 439.Va action , 440which can be any of the following: 441.Bd -literal 442enum { PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL, 443 PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER, 444 PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET }; 445.Ed 446.Pp 447.Va ticket 448must be set to the value obtained with 449.Dv PF_CHANGE_GET_TICKET 450for all actions except 451.Dv PF_CHANGE_GET_TICKET . 452.Va pool_ticket 453must be set to the value obtained with the 454.Dv DIOCBEGINADDRS 455call for all actions except 456.Dv PF_CHANGE_REMOVE 457and 458.Dv PF_CHANGE_GET_TICKET . 459.Va anchor 460indicates to which anchor the operation applies. 461.Va nr 462indicates the rule number against which 463.Dv PF_CHANGE_ADD_BEFORE , 464.Dv PF_CHANGE_ADD_AFTER , 465or 466.Dv PF_CHANGE_REMOVE 467actions are applied. 468.\" It Dv DIOCCHANGEALTQ Fa "struct pfioc_altq *pcr" 469.It Dv DIOCCHANGEADDR Fa "struct pfioc_pooladdr *pca" 470Add or remove the pool address 471.Va addr 472from the rule specified by 473.Va r_action , 474.Va r_num , 475and 476.Va anchor . 477.It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm *pt" 478.Bd -literal 479struct pfioc_tm { 480 int timeout; 481 int seconds; 482}; 483.Ed 484.Pp 485Set the state timeout of 486.Va timeout 487to 488.Va seconds . 489The old value will be placed into 490.Va seconds . 491For possible values of 492.Va timeout , 493consult the 494.Dv PFTM_* 495values in 496.Aq Pa net/pfvar.h . 497.It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm *pt" 498Get the state timeout of 499.Va timeout . 500The value will be placed into the 501.Va seconds 502field. 503.It Dv DIOCCLRRULECTRS 504Clear per-rule statistics. 505.It Dv DIOCSETLIMIT Fa "struct pfioc_limit *pl" 506Set the hard limits on the memory pools used by the packet filter. 507.Bd -literal 508struct pfioc_limit { 509 int index; 510 unsigned limit; 511}; 512 513enum { PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS, 514 PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX }; 515.Ed 516.It Dv DIOCGETLIMIT Fa "struct pfioc_limit *pl" 517Get the hard 518.Va limit 519for the memory pool indicated by 520.Va index . 521.It Dv DIOCRCLRTABLES Fa "struct pfioc_table *io" 522Clear all tables. 523All the ioctls that manipulate radix tables 524use the same structure described below. 525For 526.Dv DIOCRCLRTABLES , 527.Va pfrio_ndel 528contains on exit the number of tables deleted. 529.Bd -literal 530struct pfioc_table { 531 struct pfr_table pfrio_table; 532 void *pfrio_buffer; 533 int pfrio_esize; 534 int pfrio_size; 535 int pfrio_size2; 536 int pfrio_nadd; 537 int pfrio_ndel; 538 int pfrio_nchange; 539 int pfrio_flags; 540 u_int32_t pfrio_ticket; 541}; 542#define pfrio_exists pfrio_nadd 543#define pfrio_nzero pfrio_nadd 544#define pfrio_nmatch pfrio_nadd 545#define pfrio_naddr pfrio_size2 546#define pfrio_setflag pfrio_size2 547#define pfrio_clrflag pfrio_nadd 548.Ed 549.It Dv DIOCRADDTABLES Fa "struct pfioc_table *io" 550Create one or more tables. 551On entry, 552.Va pfrio_buffer 553must point to an array of 554.Vt struct pfr_table 555containing at least 556.Vt pfrio_size 557elements. 558.Vt pfrio_esize 559must be the size of 560.Vt struct pfr_table . 561On exit, 562.Va pfrio_nadd 563contains the number of tables effectively created. 564.Bd -literal 565struct pfr_table { 566 char pfrt_anchor[MAXPATHLEN]; 567 char pfrt_name[PF_TABLE_NAME_SIZE]; 568 u_int32_t pfrt_flags; 569 u_int8_t pfrt_fback; 570}; 571.Ed 572.It Dv DIOCRDELTABLES Fa "struct pfioc_table *io" 573Delete one or more tables. 574On entry, 575.Va pfrio_buffer 576must point to an array of 577.Vt struct pfr_table 578containing at least 579.Vt pfrio_size 580elements. 581.Vt pfrio_esize 582must be the size of 583.Vt struct pfr_table . 584On exit, 585.Va pfrio_ndel 586contains the number of tables effectively deleted. 587.It Dv DIOCRGETTABLES Fa "struct pfioc_table *io" 588Get the list of all tables. 589On entry, 590.Va pfrio_buffer[pfrio_size] 591contains a valid writeable buffer for 592.Vt pfr_table 593structures. 594On exit, 595.Va pfrio_size 596contains the number of tables written into the buffer. 597If the buffer is too small, the kernel does not store anything but just 598returns the required buffer size, without error. 599.It Dv DIOCRGETTSTATS Fa "struct pfioc_table *io" 600This call is like 601.Dv DIOCRGETTABLES 602but is used to get an array of 603.Vt pfr_tstats 604structures. 605.Bd -literal 606struct pfr_tstats { 607 struct pfr_table pfrts_t; 608 u_int64_t pfrts_packets 609 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 610 u_int64_t pfrts_bytes 611 [PFR_DIR_MAX][PFR_OP_TABLE_MAX]; 612 u_int64_t pfrts_match; 613 u_int64_t pfrts_nomatch; 614 long pfrts_tzero; 615 int pfrts_cnt; 616 int pfrts_refcnt[PFR_REFCNT_MAX]; 617}; 618#define pfrts_name pfrts_t.pfrt_name 619#define pfrts_flags pfrts_t.pfrt_flags 620.Ed 621.It Dv DIOCRCLRTSTATS Fa "struct pfioc_table *io" 622Clear the statistics of one or more tables. 623On entry, 624.Va pfrio_buffer 625must point to an array of 626.Vt struct pfr_table 627containing at least 628.Vt pfrio_size 629elements. 630.Vt pfrio_esize 631must be the size of 632.Vt struct pfr_table . 633On exit, 634.Va pfrio_nzero 635contains the number of tables effectively cleared. 636.It Dv DIOCRCLRADDRS Fa "struct pfioc_table *io" 637Clear all addresses in a table. 638On entry, 639.Va pfrio_table 640contains the table to clear. 641On exit, 642.Va pfrio_ndel 643contains the number of addresses removed. 644.It Dv DIOCRADDADDRS Fa "struct pfioc_table *io" 645Add one or more addresses to a table. 646On entry, 647.Va pfrio_table 648contains the table ID and 649.Va pfrio_buffer 650must point to an array of 651.Vt struct pfr_addr 652containing at least 653.Vt pfrio_size 654elements to add to the table. 655.Vt pfrio_esize 656must be the size of 657.Vt struct pfr_addr . 658On exit, 659.Va pfrio_nadd 660contains the number of addresses effectively added. 661.Bd -literal 662struct pfr_addr { 663 union { 664 struct in_addr _pfra_ip4addr; 665 struct in6_addr _pfra_ip6addr; 666 } pfra_u; 667 u_int8_t pfra_af; 668 u_int8_t pfra_net; 669 u_int8_t pfra_not; 670 u_int8_t pfra_fback; 671}; 672#define pfra_ip4addr pfra_u._pfra_ip4addr 673#define pfra_ip6addr pfra_u._pfra_ip6addr 674.Ed 675.It Dv DIOCRDELADDRS Fa "struct pfioc_table *io" 676Delete one or more addresses from a table. 677On entry, 678.Va pfrio_table 679contains the table ID and 680.Va pfrio_buffer 681must point to an array of 682.Vt struct pfr_addr 683containing at least 684.Vt pfrio_size 685elements to delete from the table. 686.Vt pfrio_esize 687must be the size of 688.Vt struct pfr_addr . 689On exit, 690.Va pfrio_ndel 691contains the number of addresses effectively deleted. 692.It Dv DIOCRSETADDRS Fa "struct pfioc_table *io" 693Replace the content of a table by a new address list. 694This is the most complicated command, which uses all the structure members. 695.Pp 696On entry, 697.Va pfrio_table 698contains the table ID and 699.Va pfrio_buffer 700must point to an array of 701.Vt struct pfr_addr 702containing at least 703.Vt pfrio_size 704elements which become the new contents of the table. 705.Vt pfrio_esize 706must be the size of 707.Vt struct pfr_addr . 708Additionally, if 709.Va pfrio_size2 710is non-zero, 711.Va pfrio_buffer[pfrio_size..pfrio_size2] 712must be a writeable buffer, into which the kernel can copy the 713addresses that have been deleted during the replace operation. 714On exit, 715.Va pfrio_ndel , 716.Va pfrio_nadd , 717and 718.Va pfrio_nchange 719contain the number of addresses deleted, added, and changed by the 720kernel. 721If 722.Va pfrio_size2 723was set on entry, 724.Va pfrio_size2 725will point to the size of the buffer used, exactly like 726.Dv DIOCRGETADDRS . 727.It Dv DIOCRGETADDRS Fa "struct pfioc_table *io" 728Get all the addresses of a table. 729On entry, 730.Va pfrio_table 731contains the table ID and 732.Va pfrio_buffer[pfrio_size] 733contains a valid writeable buffer for 734.Vt pfr_addr 735structures. 736On exit, 737.Va pfrio_size 738contains the number of addresses written into the buffer. 739If the buffer was too small, the kernel does not store anything but just 740returns the required buffer size, without returning an error. 741.It Dv DIOCRGETASTATS Fa "struct pfioc_table *io" 742This call is like 743.Dv DIOCRGETADDRS 744but is used to get an array of 745.Vt pfr_astats 746structures. 747.Bd -literal 748struct pfr_astats { 749 struct pfr_addr pfras_a; 750 u_int64_t pfras_packets 751 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 752 u_int64_t pfras_bytes 753 [PFR_DIR_MAX][PFR_OP_ADDR_MAX]; 754 long pfras_tzero; 755}; 756.Ed 757.It Dv DIOCRCLRASTATS Fa "struct pfioc_table *io" 758Clear the statistics of one or more addresses. 759On entry, 760.Va pfrio_table 761contains the table ID and 762.Va pfrio_buffer 763must point to an array of 764.Vt struct pfr_addr 765containing at least 766.Vt pfrio_size 767elements to be cleared from the table. 768.Vt pfrio_esize 769must be the size of 770.Vt struct pfr_addr . 771On exit, 772.Va pfrio_nzero 773contains the number of addresses effectively cleared. 774.It Dv DIOCRTSTADDRS Fa "struct pfioc_table *io" 775Test if the given addresses match a table. 776On entry, 777.Va pfrio_table 778contains the table ID and 779.Va pfrio_buffer 780must point to an array of 781.Vt struct pfr_addr 782containing at least 783.Vt pfrio_size 784elements, each of which will be tested for a match in the table. 785.Vt pfrio_esize 786must be the size of 787.Vt struct pfr_addr . 788On exit, the kernel updates the 789.Vt pfr_addr 790array by setting the 791.Va pfra_fback 792member appropriately. 793.It Dv DIOCRSETTFLAGS Fa "struct pfioc_table *io" 794Change the 795.Dv PFR_TFLAG_CONST 796or 797.Dv PFR_TFLAG_PERSIST 798flags of a table. 799On entry, 800.Va pfrio_buffer 801must point to an array of 802.Vt struct pfr_table 803containing at least 804.Vt pfrio_size 805elements. 806.Va pfrio_esize 807must be the size of 808.Vt struct pfr_table . 809.Va pfrio_setflag 810must contain the flags to add, while 811.Va pfrio_clrflag 812must contain the flags to remove. 813On exit, 814.Va pfrio_nchange 815and 816.Va pfrio_ndel 817contain the number of tables altered or deleted by the kernel. 818Yes, tables can be deleted if one removes the 819.Dv PFR_TFLAG_PERSIST 820flag of an unreferenced table. 821.It Dv DIOCRINADEFINE Fa "struct pfioc_table *io" 822Defines a table in the inactive set. 823On entry, 824.Va pfrio_table 825contains the table ID and 826.Va pfrio_buffer[pfrio_size] 827contains an array of 828.Vt pfr_addr 829structures to put in the table. 830A valid ticket must also be supplied to 831.Va pfrio_ticket . 832On exit, 833.Va pfrio_nadd 834contains 0 if the table was already defined in the inactive list 835or 1 if a new table has been created. 836.Va pfrio_naddr 837contains the number of addresses effectively put in the table. 838.It Dv DIOCXBEGIN Fa "struct pfioc_trans *io" 839.Bd -literal 840struct pfioc_trans { 841 int size; /* number of elements */ 842 int esize; /* size of each element in bytes */ 843 struct pfioc_trans_e { 844 int rs_num; 845 char anchor[MAXPATHLEN]; 846 u_int32_t ticket; 847 } *array; 848}; 849.Ed 850.Pp 851Clear all the inactive rulesets specified in the 852.Vt pfioc_trans_e 853array. 854For each ruleset, a ticket is returned for subsequent "add rule" ioctls, 855as well as for the 856.Dv DIOCXCOMMIT 857and 858.Dv DIOCXROLLBACK 859calls. 860.Pp 861Ruleset types, identified by 862.Va rs_num , 863include the following: 864.Pp 865.Bl -tag -width PF_RULESET_FILTER -offset ind -compact 866.It Dv PF_RULESET_SCRUB 867Scrub (packet normalization) rules. 868.It Dv PF_RULESET_FILTER 869Filter rules. 870.It Dv PF_RULESET_NAT 871NAT (Network Address Translation) rules. 872.It Dv PF_RULESET_BINAT 873Bidirectional NAT rules. 874.It Dv PF_RULESET_RDR 875Redirect rules. 876.It Dv PF_RULESET_ALTQ 877ALTQ disciplines. 878.It Dv PF_RULESET_TABLE 879Address tables. 880.El 881.It Dv DIOCXCOMMIT Fa "struct pfioc_trans *io" 882Atomically switch a vector of inactive rulesets to the active rulesets. 883This call is implemented as a standard two-phase commit, which will either 884fail for all rulesets or completely succeed. 885All tickets need to be valid. 886This ioctl returns 887.Er EBUSY 888if another process is concurrently updating some of the same rulesets. 889.It Dv DIOCXROLLBACK Fa "struct pfioc_trans *io" 890Clean up the kernel by undoing all changes that have taken place on the 891inactive rulesets since the last 892.Dv DIOCXBEGIN . 893.Dv DIOCXROLLBACK 894will silently ignore rulesets for which the ticket is invalid. 895.It Dv DIOCSETHOSTID Fa "u_int32_t *hostid" 896Set the host ID, which is used by 897.Xr pfsync 4 898to identify which host created state table entries. 899.It Dv DIOCOSFPFLUSH 900Flush the passive OS fingerprint table. 901.It Dv DIOCOSFPADD Fa "struct pf_osfp_ioctl *io" 902.Bd -literal 903struct pf_osfp_ioctl { 904 struct pf_osfp_entry { 905 SLIST_ENTRY(pf_osfp_entry) fp_entry; 906 pf_osfp_t fp_os; 907 char fp_class_nm[PF_OSFP_LEN]; 908 char fp_version_nm[PF_OSFP_LEN]; 909 char fp_subtype_nm[PF_OSFP_LEN]; 910 } fp_os; 911 pf_tcpopts_t fp_tcpopts; 912 u_int16_t fp_wsize; 913 u_int16_t fp_psize; 914 u_int16_t fp_mss; 915 u_int16_t fp_flags; 916 u_int8_t fp_optcnt; 917 u_int8_t fp_wscale; 918 u_int8_t fp_ttl; 919 int fp_getnum; 920}; 921.Ed 922.Pp 923Add a passive OS fingerprint to the table. 924Set 925.Va fp_os.fp_os 926to the packed fingerprint, 927.Va fp_os.fp_class_nm 928to the name of the class (Linux, Windows, etc), 929.Va fp_os.fp_version_nm 930to the name of the version (NT, 95, 98), and 931.Va fp_os.fp_subtype_nm 932to the name of the subtype or patchlevel. 933The members 934.Va fp_mss , 935.Va fp_wsize , 936.Va fp_psize , 937.Va fp_ttl , 938.Va fp_optcnt , 939and 940.Va fp_wscale 941are set to the TCP MSS, the TCP window size, the IP length, the IP TTL, 942the number of TCP options, and the TCP window scaling constant of the 943TCP SYN packet, respectively. 944.Pp 945The 946.Va fp_flags 947member is filled according to the 948.Aq Pa net/pfvar.h 949include file 950.Dv PF_OSFP_* 951defines. 952The 953.Va fp_tcpopts 954member contains packed TCP options. 955Each option uses 956.Dv PF_OSFP_TCPOPT_BITS 957bits in the packed value. 958Options include any of 959.Dv PF_OSFP_TCPOPT_NOP , 960.Dv PF_OSFP_TCPOPT_SACK , 961.Dv PF_OSFP_TCPOPT_WSCALE , 962.Dv PF_OSFP_TCPOPT_MSS , 963or 964.Dv PF_OSFP_TCPOPT_TS . 965.Pp 966The 967.Va fp_getnum 968member is not used with this ioctl. 969.Pp 970The structure's slack space must be zeroed for correct operation; 971.Xr memset 3 972the whole structure to zero before filling and sending to the kernel. 973.It Dv DIOCOSFPGET Fa "struct pf_osfp_ioctl *io" 974Get the passive OS fingerprint number 975.Va fp_getnum 976from the kernel's fingerprint list. 977The rest of the structure members will come back filled. 978Get the whole list by repeatedly incrementing the 979.Va fp_getnum 980number until the ioctl returns 981.Er EBUSY . 982.It Dv DIOCGETSRCNODES Fa "struct pfioc_src_nodes *psn" 983.Bd -literal 984struct pfioc_src_nodes { 985 int psn_len; 986 union { 987 caddr_t psu_buf; 988 struct pf_src_node *psu_src_nodes; 989 } psn_u; 990#define psn_buf psn_u.psu_buf 991#define psn_src_nodes psn_u.psu_src_nodes 992}; 993.Ed 994.Pp 995Get the list of source nodes kept by sticky addresses and source 996tracking. 997The ioctl must be called once with 998.Va psn_len 999set to 0. 1000If the ioctl returns without error, 1001.Va psn_len 1002will be set to the size of the buffer required to hold all the 1003.Va pf_src_node 1004structures held in the table. 1005A buffer of this size should then be allocated, and a pointer to this buffer 1006placed in 1007.Va psn_buf . 1008The ioctl must then be called again to fill this buffer with the actual 1009source node data. 1010After that call, 1011.Va psn_len 1012will be set to the length of the buffer actually used. 1013.It Dv DIOCCLRSRCNODES 1014Clear the tree of source tracking nodes. 1015.It Dv DIOCIGETIFACES Fa "struct pfioc_iface *io" 1016Get the list of interfaces and interface drivers known to 1017.Nm . 1018All the ioctls that manipulate interfaces 1019use the same structure described below: 1020.Bd -literal 1021struct pfioc_iface { 1022 char pfiio_name[IFNAMSIZ]; 1023 void *pfiio_buffer; 1024 int pfiio_esize; 1025 int pfiio_size; 1026 int pfiio_nzero; 1027 int pfiio_flags; 1028}; 1029.Ed 1030.Pp 1031If not empty, 1032.Va pfiio_name 1033can be used to restrict the search to a specific interface or driver. 1034.Va pfiio_buffer[pfiio_size] 1035is the user-supplied buffer for returning the data. 1036On entry, 1037.Va pfiio_size 1038contains the number of 1039.Vt pfi_kif 1040entries that can fit into the buffer. 1041The kernel will replace this value by the real number of entries it wants 1042to return. 1043.Va pfiio_esize 1044should be set to 1045.Li sizeof(struct pfi_kif) . 1046.Pp 1047The data is returned in the 1048.Vt pfi_kif 1049structure described below: 1050.Bd -literal 1051struct pfi_kif { 1052 RB_ENTRY(pfi_kif) pfik_tree; 1053 char pfik_name[IFNAMSIZ]; 1054 u_int64_t pfik_packets[2][2][2]; 1055 u_int64_t pfik_bytes[2][2][2]; 1056 u_int32_t pfik_tzero; 1057 int pfik_flags; 1058 struct pf_state_tree_lan_ext pfik_lan_ext; 1059 struct pf_state_tree_ext_gwy pfik_ext_gwy; 1060 TAILQ_ENTRY(pfi_kif) pfik_w_states; 1061 void *pfik_ah_cookie; 1062 struct ifnet *pfik_ifp; 1063 struct ifg_group *pfik_group; 1064 int pfik_states; 1065 int pfik_rules; 1066 TAILQ_HEAD(, pfi_dynaddr) pfik_dynaddrs; 1067}; 1068.Ed 1069.It Dv DIOCSETIFFLAG Fa "struct pfioc_iface *io" 1070Set the user setable flags (described above) of the 1071.Nm 1072internal interface description. 1073The filtering process is the same as for 1074.Dv DIOCIGETIFACES . 1075.Bd -literal 1076#define PFI_IFLAG_SKIP 0x0100 /* skip filtering on interface */ 1077.Ed 1078.It Dv DIOCCLRIFFLAG Fa "struct pfioc_iface *io" 1079Works as 1080.Dv DIOCSETIFFLAG 1081above but clears the flags. 1082.It Dv DIOCKILLSRCNODES Fa "struct pfioc_iface *io" 1083Explicitly remove source tracking nodes. 1084.El 1085.Sh FILES 1086.Bl -tag -width /dev/pf -compact 1087.It Pa /dev/pf 1088packet filtering device. 1089.El 1090.Sh EXAMPLES 1091The following example demonstrates how to use the 1092.Dv DIOCNATLOOK 1093command to find the internal host/port of a NATed connection: 1094.Bd -literal 1095#include <sys/types.h> 1096#include <sys/socket.h> 1097#include <sys/ioctl.h> 1098#include <sys/fcntl.h> 1099#include <net/if.h> 1100#include <netinet/in.h> 1101#include <net/pfvar.h> 1102#include <err.h> 1103#include <stdio.h> 1104#include <stdlib.h> 1105 1106u_int32_t 1107read_address(const char *s) 1108{ 1109 int a, b, c, d; 1110 1111 sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d); 1112 return htonl(a << 24 | b << 16 | c << 8 | d); 1113} 1114 1115void 1116print_address(u_int32_t a) 1117{ 1118 a = ntohl(a); 1119 printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255, 1120 a >> 8 & 255, a & 255); 1121} 1122 1123int 1124main(int argc, char *argv[]) 1125{ 1126 struct pfioc_natlook nl; 1127 int dev; 1128 1129 if (argc != 5) { 1130 printf("%s <gwy addr> <gwy port> <ext addr> <ext port>\\n", 1131 argv[0]); 1132 return 1; 1133 } 1134 1135 dev = open("/dev/pf", O_RDWR); 1136 if (dev == -1) 1137 err(1, "open(\\"/dev/pf\\") failed"); 1138 1139 memset(&nl, 0, sizeof(struct pfioc_natlook)); 1140 nl.saddr.v4.s_addr = read_address(argv[1]); 1141 nl.sport = htons(atoi(argv[2])); 1142 nl.daddr.v4.s_addr = read_address(argv[3]); 1143 nl.dport = htons(atoi(argv[4])); 1144 nl.af = AF_INET; 1145 nl.proto = IPPROTO_TCP; 1146 nl.direction = PF_IN; 1147 1148 if (ioctl(dev, DIOCNATLOOK, &nl)) 1149 err(1, "DIOCNATLOOK"); 1150 1151 printf("internal host "); 1152 print_address(nl.rsaddr.v4.s_addr); 1153 printf(":%u\\n", ntohs(nl.rsport)); 1154 return 0; 1155} 1156.Ed 1157.Sh SEE ALSO 1158.Xr ioctl 2 , 1159.Xr altq 4 , 1160.Xr if_bridge 4 , 1161.Xr pflog 4 , 1162.Xr pflow 4 , 1163.Xr pfsync 4 , 1164.Xr pfctl 8 , 1165.Xr altq 9 1166.Sh HISTORY 1167The 1168.Nm 1169packet filtering mechanism first appeared in 1170.Ox 3.0 1171and then 1172.Fx 5.2 . 1173.Pp 1174This implementation matches 1175.Ox 4.5 . 1176