Long overdue documentation update for IPFilter. These

are taken directly from the ipf distribution, and are
not mandoc'ed. ipf(8), ipfstat(8), and ipnat(8) are yet
to go and must be done manually. (sigh)

1 files changed, 76 insertions, 77 deletions

diff --git a/share/man/man4/ipl.4 b/share/man/man4/ipl.4
index f988e52b896..f897e591288 100644
--- a/share/man/man4/ipl.4
+++ b/share/man/man4/ipl.4
@@ -1,82 +1,81 @@
-.Dd June 13, 1999
-.Dt IPL 4
-.Os
-.Sh NAME
-.Nm ipl
-.Nd IP packet log device
-.Sh DESCRIPTION
-The
-.Nm
-pseudo device's purpose is to provide an easy way to gather
-packet headers of packets you wish to log. If a packet header is to be
-logged, either the entire header (including any
-.Tn IP
-options \(en
-.Tn TCP/UDP
-options are not included when it calculates header size) is logged or nothing.
-Up to 128 bytes of the packet content are logged after the header.
-.Pp
-Prepending every packet header logged are two structures containing information
-relevant to the packet following and why it was logged. The first structure
-is
-.Fa iplog
-and the second is
-.Fa ipflog .
-Both are declared in
-.Aq Pa netinet/ip_fil.h .
-and their formats are as follows:
-.Bd -literal -offset indent
-struct	iplog	{
-	u_long	ipl_magic;	/* IPL_MAGIC 0x49504c4d 'IPLM' */
-	u_long	ipl_sec;
-	u_long	ipl_usec;
-	u_int	ipl_len;
-	u_int	ipl_count;
-	size_t	ipl_dsize;
-	struct	iplog	*ipl_next;
-}
+.\"	$OpenBSD: ipl.4,v 1.9 2000/04/13 19:59:40 kjell Exp $
+.\"
+.TH IPL 4
+.SH NAME
+ipl \- IP packet log device
+.SH DESCRIPTION
+The \fBipl\fP pseudo device's purpose is to provide an easy way to gather
+packet headers of packets you wish to log.  If a packet header is to be
+logged, the entire header is logged (including any IP options \- TCP/UDP
+options are not included when it calculates header size) or not at all.
+The packet contents are also logged after the header.  If the log reader
+is busy or otherwise unable to read log records, upto IPLLOGSIZE (8192 is the
+default) bytes of data are stored.
+.PP
+Prepending every packet header logged is a structure containing information
+relevant to the packet following and why it was logged.  The structure's
+format is as follows:
+.LP
+.nf
+/*
+ * Log structure.  Each packet header logged is prepended by one of these.
+ * Following this in the log records read from the device will be an ipflog
+ * structure which is then followed by any packet data.
+ */
+typedef struct iplog    {
+        u_long  ipl_sec;
+        u_long  ipl_usec;
+        u_int   ipl_len;
+        u_int   ipl_count;
+        size_t  ipl_dsize;
+        struct  iplog   *ipl_next;
+} iplog_t;
 
-struct	ipflog	{
-	u_char	fl_ifname[IFNAMSIZ];
-	u_char	fl_plen;	/* extra data after hlen       */
-	u_char	fl_hlen;	/* length of IP headers saved  */
-	u_short	fl_rule;	/* assume < 64k rules, total   */
-	u_short	fl_group;
-	u_32_t	fl_flags;
-}
-.Ed
-.Pp
-In the case of the header causing the buffer to finish on a non-32-bit
-boundary, padding will be appended to ensure that the next log entry
-is aligned to a 32-bit boundary.
-.Pp
-If the packet content is more than 128 bytes, only
-the first 128 bytes of the
-packet content are logged. Should the packet content finish on a non-32-bit
-boundary, then the last few bytes are not logged to ensure the log entry
-is aligned to a 32-bit boundary.
-.Pp
-.Nm
-is a read-only (sequential) character pseudo-device.
-.Pp
-The ioctls which are loaded with this device can be found under
-.Xr ipf 4 .
-The only ioctl which is used for logging and doesn't affect the filter is:
-.Pp
-.Dl Fn ioctl fd SIOCIPFFB "int *"
-.Pp
-This ioctl flushes the log buffer and returns the number of bytes flushed.
-.Pp
+
+typedef struct  ipflog  {
+#if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199603))
+        u_char  fl_ifname[IFNAMSIZ];
+#else
+        u_int   fl_unit;
+        u_char  fl_ifname[4];
+#endif
+        u_char  fl_plen;        /* extra data after hlen */
+        u_char  fl_hlen;        /* length of IP headers saved */
+        u_short fl_rule;        /* assume never more than 64k rules, total */
+        u_32_t  fl_flags;
+} ipflog_t;
+
+.fi
+.PP
+When reading from the \fBipl\fP device, it is necessary to call read(2) with
+a buffer big enough to hold at least 1 complete log record - reading of partial
+log records is not supported.
+.PP
+If the packet contents is more then 128 bytes when \fBlog body\fP is used,
+then only 128 bytes of the packet contents is logged.
+.PP
+Although it is only possible to read from the \fBipl\fP device, opening it
+for writing is required when using an ioctl which changes any kernel data.
+.PP
+The ioctls which are loaded with this device can be found under \fBipf(4)\fP.
+The ioctls which are for use with logging and don't affect the filter are:
+.LP
+.nf
+        ioctl(fd, SIOCIPFFB, int *)
+        ioctl(fd, FIONREAD, int *)
+.fi
+.PP
+The SIOCIPFFB ioctl flushes the log buffer and returns the number of bytes
+flushed.  FIONREAD returns the number of bytes currently used for storing
+log data.  If IPFILTER_LOG is not defined when compiling, SIOCIPFFB is not
+available and FIONREAD will return but not do anything.
+.PP
 There is currently no support for non-blocking IO with this device, meaning
 all read operations should be considered blocking in nature (if there is no
 data to read, it will sleep until some is made available).
-.Sh FILES
-.Bl -tag -width /dev/ipl -compact
-.It Pa /dev/ipl
-IP packet logging pseudo-device
-.El
-.Sh SEE ALSO
-.Xr ipf 4 ,
-.Xr ipmon 8
-.Sh BUGS
+.SH SEE ALSO
+ipf(4)
+.SH BUGS
 Packet headers are dropped when the internal buffer (static size) fills.
+.SH FILES
+/dev/ipl