Page MenuHomeFreeBSD
Differential D42331

pf: update pf(4) man page to list DIOCGETSTATESV2
ClosedPublic
Actions

Authored by kp on Oct 23 2023, 3:14 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Mar 26, 2:01 AM
Unknown Object (File)
Tue, Mar 11, 6:19 AM
Unknown Object (File)
Feb 26 2025, 11:54 AM
Unknown Object (File)
Jan 27 2025, 1:18 PM
Unknown Object (File)
Jan 26 2025, 7:32 PM
Unknown Object (File)
Jan 10 2025, 3:23 PM
Unknown Object (File)
Dec 13 2024, 2:52 PM
Unknown Object (File)
Nov 30 2024, 11:45 PM
View All 35 Files
Subscribers
imp

Details

Reviewers
grembo
Group Reviewers
network
pfsense
Commits
rG931c22cb9825: pf: update pf(4) man page to list DIOCGETSTATESV2
rG14cd670053ec: pf: update pf(4) man page to list DIOCGETSTATESV2
rG6869f90bf5bb: pf: update pf(4) man page to list DIOCGETSTATESV2
Summary

The nvlist based state retrieval ioctl has been replaced by an old-style
ioctl for performance reasons. Document that one.

Reported by: Michael Gmelin <grembo@freebsd.org>
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 54132
Build 51022: arc lint + arc unit

Revision Contents
Changeset List

PathSize
share/
man/
man4/
103 lines

Diff 129249

View Options

share/man/man4/pf.4

Show All 20 Lines
.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE. .\" SUCH DAMAGE.
.\" .\"
.Dd September 22, 2023 .Dd October 20, 2023
.Dt PF 4 .Dt PF 4
.Os .Os
.Sh NAME .Sh NAME
.Nm pf .Nm pf
.Nd packet filter .Nd packet filter
.Sh SYNOPSIS .Sh SYNOPSIS
.Cd "device pf" .Cd "device pf"
.Cd "options PF_DEFAULT_TO_DROP" .Cd "options PF_DEFAULT_TO_DROP"
▲ Show 20 Lines • Show All 385 Lines • ▼ Show 20 Lines
}; };
.Ed .Ed
.It Dv DIOCSETDEBUG Fa "u_int32_t *level" .It Dv DIOCSETDEBUG Fa "u_int32_t *level"
Set the debug level. Set the debug level.
.Bd -literal .Bd -literal
enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, enum { PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC,
PF_DEBUG_NOISY }; PF_DEBUG_NOISY };
.Ed .Ed
.It Dv DIOCGETSTATESNV Fa "struct pfioc_nv *nv" .It Dv DIOCGETSTATESV2 Fa "struct pfioc_states_v2 *ps"
Get state table entries. Get state table entries.
.Bd -literal .Bd -literal
nvlist pf_state_key { struct pfioc_states_v2 {
nvlist pf_addr addr[2]; int ps_len;
number port[2]; uint64_t ps_req_version;
number af; union {
number proto; void *ps_buf;
struct pf_state_export *ps_states;
}; };
nvlist pf_state_scrub {
bool timestamp;
number ttl;
number ts_mod;
}; };
nvlist pf_state_peer { struct pf_state_export {
nvlist pf_state_scrub scrub; uint64_t version;
number seqlo; uint64_t id;
number seqhi; char ifname[IFNAMSIZ];
number seqdiff; char orig_ifname[IFNAMSIZ];
number max_win; struct pf_state_key_export key[2];
number mss; struct pf_state_peer_export src;
number state; struct pf_state_peer_export dst;
number wscale; struct pf_addr rt_addr;
uint32_t rule;
uint32_t anchor;
uint32_t nat_rule;
uint32_t creation;
uint32_t expire;
uint32_t spare0;
uint64_t packets[2];
uint64_t bytes[2];
uint32_t creatorid;
uint32_t spare1;
sa_family_t af;
uint8_t proto;
uint8_t direction;
uint8_t log;
uint8_t state_flags_compat;
uint8_t timeout;
uint8_t sync_flags;
uint8_t updates;
uint16_t state_flags;
uint16_t qid;
uint16_t pqid;
uint16_t dnpipe;
uint16_t dnrpipe;
int32_t rtableid;
uint8_t min_ttl;
uint8_t set_tos;
uint16_t max_mss;
uint8_t set_prio[2];
uint8_t rt;
char rt_ifname[IFNAMSIZ];
uint8_t spare[72];
}; };
nvlist pf_state {
number id;
string ifname;
nvlist pf_state_key stack_key;
nvlist pf_state_key wire_key;
nvlist pf_state_peer src;
nvlist pf_state_peer dst;
nvlist pf_addr rt_addr;
number rule;
number anchor;
number nat_rule;
number expire;
number packets[2];
number bytes[2];
number creatorid;
number direction;
number log;
number state_flags;
number timeout;
number sync_flags;
};
nvlist pf_states {
number count;
nvlist pf_state states[];
};
.Ed .Ed
.Pp
If
.Va pfioc_nv.size
is insufficiently large, as many states as possible that can fit into this
size will be copied into the supplied buffer.
.It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr" .It Dv DIOCCHANGERULE Fa "struct pfioc_rule *pcr"
Add or remove the Add or remove the
.Va rule .Va rule
in the ruleset specified by in the ruleset specified by
.Va rule.action . .Va rule.action .
.Pp .Pp
The type of operation to be performed is indicated by The type of operation to be performed is indicated by
.Va action , .Va action ,
▲ Show 20 Lines • Show All 739 Lines • Show Last 20 Lines