.\" $OpenBSD: pf.4,v 1.18 2002/10/25 09:27:54 mpech Exp $ .\" .\" Copyright (C) 2001, Kjell Wooding. All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: .\" 1. Redistributions of source code must retain the above copyright .\" notice, this list of conditions and the following disclaimer. .\" 2. Redistributions in binary form must reproduce the above copyright .\" notice, this list of conditions and the following disclaimer in the .\" documentation and/or other materials provided with the distribution. .\" 3. Neither the name of the project nor the names of its contributors .\" may be used to endorse or promote products derived from this software .\" without specific prior written permission. .\" .\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE .\" ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" .Dd June 24, 2001 .Dt PF 4 .Os .Sh NAME .Nm pf .Nd packet filter .Sh SYNOPSIS .Cd "pseudo-device pf 1" .Sh DESCRIPTION Packet filtering takes place in the kernel. A pseudo-device, /dev/pf, allows userland processes to control the behavior of the packet filter through an .Xr ioctl 2 interface. There are commands to enable and disable the filter, load rule sets, add and remove individual rules or retrieve state table entries and statistics. The most commonly used functions are covered by .Xr pfctl 8 . .Pp Manipulations like loading a rule set that involve more than a single ioctl call require a so-called ticket, which prevents the occurance of multiple concurrent manipulations. .Pp Fields of ioctl parameter structures that refer to packet data (like addresses and ports) are generally expected in network byte-order. .Sh FILES .Bl -tag -width /dev/pf -compact .It Pa /dev/pf packet filtering device. .El .Sh IOCTL INTERFACE pf supports the following .Xr ioctl 2 commands: .Bl -tag -width xxxxxx .It Dv DIOCSTART Starts the packet filter. .It Dv DIOCSTOP Stops the packet filter. .It Dv DIOCBEGINRULES Fa "u_int32_t" Clears the inactive filter rule set, returns ticket for subsequent DIOCADDRULE and DIOCCOMMITRULES calls. .It Dv DIOCADDRULE Fa "struct pfioc_rule" .Bd -literal struct pfioc_rule { u_int32_t ticket; u_int32_t nr; struct pf_rule rule; }; .Ed .Pp Adds filter .Va rule at the end of the inactive filter rule set. Requires .Va ticket obtained through preceding DIOCBEGINRULES call. .Va nr is ignored. .It Dv DIOCCOMMITRULES Fa "u_int32_t" Switch inactive to active filter rule set. Requires .Va ticket . .It Dv DIOCGETRULES Fa "struct pfioc_rule" Returns .Va ticket for subsequent DIOCGETRULE calls and .Va nr of rules in the active filter rule set. .It Dv DIOCGETRULE Fa "struct pfioc_rule" Returns filter .Va rule number .Va nr using .Va ticket obtained through a preceding DIOCGETRULES call. .It Dv DIOCBEGINNATS Fa "u_int32_t" .It Dv DIOCADDNAT Fa "struct pfioc_nat" .Bd -literal struct pfioc_nat { u_int32_t ticket; u_int32_t nr; struct pf_nat nat; }; .Ed .It Dv DIOCCOMMITNATS Fa "u_int32_t" .It Dv DIOCGETNATS Fa "struct pfioc_nat" .It Dv DIOCGETNAT Fa "struct pfioc_nat" .It Dv DIOCBEGINBINATS Fa "u_int32_t" .It Dv DIOCADDBINAT Fa "struct pfioc_binat" .Bd -literal struct pfioc_binat { u_int32_t ticket; u_int32_t nr; struct pf_binat binat; }; .Ed .It Dv DIOCCOMMITBINATS Fa "u_int32_t" .It Dv DIOCGETBINATS Fa "struct pfioc_binat" .It Dv DIOCGETBINAT Fa "struct pfioc_binat" .It Dv DIOCBEGINRDRS Fa "u_int32_t" .It Dv DIOCADDRDR Fa "struct pfioc_rdr" .Bd -literal struct pfioc_rdr { u_int32_t ticket; u_int32_t nr; struct pf_rdr rdr; }; .Ed .It Dv DIOCCOMMITRDRS Fa "u_int32_t" .It Dv DIOCGETRDRS Fa "struct pfioc_rdr" .It Dv DIOCGETRDR Fa "struct pfioc_rdr" .It Dv DIOCCLRSTATES Clears the state table. .It Dv DIOCADDSTATE Fa "struct pfioc_state" Adds a state entry. .It Dv DIOCGETSTATE Fa "struct pfioc_state" .Bd -literal struct pfioc_state { u_int32_t nr; struct pf_state state; }; .Ed .Pp Extracts the entry with the specified number from the state table. .It Dv DIOCKILLSTATES Fa "struct pfioc_state_kill" Removes matching entries from the state table. Returns the number of killed states in psk_af. .Bd -literal struct pfioc_state_kill { int psk_af; int psk_proto; struct pf_rule_addr psk_src; struct pf_rule_addr psk_dst; }; .Ed .It Dv DIOCSETSTATUSIF Fa "struct pfioc_if" .Bd -literal struct pfioc_if { char ifname[IFNAMSIZ]; }; .Ed .Pp Specifies the interface for which statistics are accumulated. .It Dv DIOCGETSTATUS Fa "struct pf_status" .Bd -literal struct pf_status { u_int64_t counters[PFRES_MAX]; u_int64_t fcounters[FCNT_MAX]; u_int64_t pcounters[2][2][3]; u_int64_t bcounters[2][2]; u_int32_t running; u_int32_t states; u_int32_t since; u_int32_t debug; }; .Ed .Pp Gets the internal packet filter statistics. .It Dv DIOCCLRSTATUS Clears the internal packet filter statistics. .It Dv DIOCNATLOOK Fa "struct pfioc_natlook" Looks up a state table entry by source and destination addresses and ports. .Bd -literal struct pfioc_natlook { struct pf_addr saddr; struct pf_addr daddr; struct pf_addr rsaddr; struct pf_addr rdaddr; u_int16_t sport; u_int16_t dport; u_int16_t rsport; u_int16_t rdport; u_int8_t af; u_int8_t proto; u_int8_t direction; }; .Ed .It Dv DIOCSETDEBUG Fa "u_int32_t" Sets the debug level. .Bd -literal enum { PF_DEBUG_NONE=0, PF_DEBUG_URGENT=1, PF_DEBUG_MISC=2 }; .Ed .It Dv DIOCGETSTATES Fa "struct pfioc_states" .Bd -literal struct pfioc_states { int ps_len; union { caddr_t psu_buf; struct pf_state *psu_states; } ps_u; #define ps_buf ps_u.psu_buf #define ps_states ps_u.psu_states }; .Ed .It Dv DIOCCHANGERULE Fa "struct pfioc_changerule" Adds or removes a filter rule in the active filter rule set. .Bd -literal struct pfioc_changerule { u_int32_t action; struct pf_rule oldrule; struct pf_rule newrule; }; enum { PF_CHANGE_ADD_HEAD=1, PF_CHANGE_ADD_TAIL=2, PF_CHANGE_ADD_BEFORE=3, PF_CHANGE_ADD_AFTER=4, PF_CHANGE_REMOVE=5 }; .Ed .It Dv DIOCCHANGENAT Fa "struct pfioc_changenat" Adds or removes a nat rule in the active nat rule set. .Bd -literal struct pfioc_changenat { u_int32_t action; struct pf_nat oldnat; struct pf_nat newnat; }; .Ed .It Dv DIOCCHANGEBINAT Fa "struct pfioc_changebinat" Adds or removes a binat rule in the active binat rule set. .Bd -literal struct pfioc_changebinat { u_int32_t action; struct pf_binat oldbinat; struct pf_binat newbinat; }; .Ed .It Dv DIOCCHANGERDR Fa "struct pfioc_changerdr" Adds or removes a rdr rule in the active rdr rule set. .Bd -literal struct pfioc_changerdr { u_int32_t action; struct pf_rdr oldrdr; struct pf_rdr newrdr; }; .Ed .It Dv DIOCSETTIMEOUT Fa "struct pfioc_tm" .Bd -literal struct pfioc_tm { int timeout; int seconds; }; .Ed .It Dv DIOCGETTIMEOUT Fa "struct pfioc_tm" .It Dv DIOCCLRRULECTRS Clear per-rule statistics. .It Dv DIOCSETLIMIT Fa "struct pfioc_limit" Sets hard limits on the memory pools used by the packet filter. .Bd -literal struct pfioc_limit { int index; unsigned limit; }; .Ed .It Dv DIOCGETLIMIT Fa "struct pfioc_limit" .El .Sh EXAMPLES The following example demonstrates how to use the DIOCNATLOOK command to find the internal host/port of a NATed connection. .Bd -literal #include #include #include #include #include #include #include #include u_int32_t read_address(const char *s) { int a, b, c, d; sscanf(s, "%i.%i.%i.%i", &a, &b, &c, &d); return htonl(a << 24 | b << 16 | c << 8 | d); } void print_address(u_int32_t a) { a = ntohl(a); printf("%d.%d.%d.%d", a >> 24 & 255, a >> 16 & 255, a >> 8 & 255, a & 255); } int main(int argc, char *argv[]) { struct pfioc_natlook nl; int dev; if (argc != 5) { printf("%s \\n", argv[0]); return 1; } dev = open("/dev/pf", O_RDWR); if (dev == -1) err(1, "open(\\"/dev/pf\\") failed"); memset(&nl, 0, sizeof(struct pfioc_natlook)); nl.saddr.v4.s_addr = read_address(argv[1]); nl.sport = htons(atoi(argv[2])); nl.daddr.v4.s_addr = read_address(argv[3]); nl.dport = htons(atoi(argv[4])); nl.af = AF_INET; nl.proto = IPPROTO_TCP; nl.direction = PF_IN; if (ioctl(dev, DIOCNATLOOK, &nl)) err(1, "DIOCNATLOOK"); printf("internal host "); print_address(nl.rsaddr.v4.s_addr); printf(":%u\\n", ntohs(nl.rsport)); return 0; } .Ed .Sh SEE ALSO .Xr bridge 4 , .Xr pflog 4 , .Xr pfctl 8 .Sh HISTORY The .Nm packet filtering mechanism first appeared in .Ox 3.0 .