summaryrefslogtreecommitdiff
path: root/share
diff options
context:
space:
mode:
authorgutteridge <gutteridge@NetBSD.org>2023-06-29 23:20:02 +0000
committergutteridge <gutteridge@NetBSD.org>2023-06-29 23:20:02 +0000
commitcc427db147b7ca9e23e933e5f43569b6fe3bf783 (patch)
tree843984ee046e304f0326281968f1042670a9dd47 /share
parent63bc8721af8f9ff9f368c8d2fae67bbce86a5bb9 (diff)
npflog.4: add and adjust some details
Add details about the header structure (though the if_npflog.h file is not presently installed and has a _KERNEL guard). Also adjust some sentences (requested by riastradh@), and include the original OpenBSD RCS ID, since much of this content shares that origin.
Diffstat (limited to 'share')
-rw-r--r--share/man/man4/npflog.431
1 files changed, 25 insertions, 6 deletions
diff --git a/share/man/man4/npflog.4 b/share/man/man4/npflog.4
index 25b7b1f3492..0947bb8ee7a 100644
--- a/share/man/man4/npflog.4
+++ b/share/man/man4/npflog.4
@@ -1,4 +1,5 @@
-.\" $NetBSD: npflog.4,v 1.1 2023/06/20 01:02:46 gutteridge Exp $
+.\" $NetBSD: npflog.4,v 1.2 2023/06/29 23:20:02 gutteridge Exp $
+.\" $OpenBSD: pflog.4,v 1.10 2007/05/31 19:19:51 jmc Exp $
.\"
.\" Copyright (c) 2001 Tobias Weingartner
.\" All rights reserved.
@@ -29,7 +30,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd June 19, 2023
+.Dd June 29, 2023
.Dt NPFLOG 4
.Os
.Sh NAME
@@ -44,8 +45,7 @@ interface is a pseudo-device which makes visible all packets logged by
the
.Xr npf 7
packet filter.
-Logged packets can easily be monitored in real
-time by invoking
+Logged packets can be monitored in real time by invoking
.Xr tcpdump 8
on the
.Nm
@@ -61,8 +61,27 @@ further instances can be created using
Each packet retrieved on this interface has a header associated
that presently matches the format used by
.Xr pf 4 .
-However, this is intentionally not exposed to userland, and is also
-possibly subject to change in future.
+This header documents the address family, interface name, rule
+number, reason, action, and direction of the packet that was logged.
+This structure looks like:
+.Bd -literal -offset indent
+struct npfloghdr {
+ uint8_t length;
+ sa_family_t af;
+ uint8_t action;
+ uint8_t reason;
+ char ifname[IFNAMSIZ];
+ char ruleset[NPFLOG_RULESET_NAME_SIZE];
+ uint32_t rulenr;
+ uint32_t subrulenr;
+ uint32_t uid;
+ uint32_t pid;
+ uint32_t rule_uid;
+ uint32_t rule_pid;
+ uint8_t dir;
+ uint8_t pad[3];
+};
+.Ed
.Sh EXAMPLES
Monitor all packets logged on the default interface:
.Bd -literal -offset indent