;
    struct pf_rdr    oldrdr;
    struct pf_rdr    newrdr;
};

Adds or removes a redirect rule in the active redirect rule set.

DIOCSETTIMEOUT struct pfioc_tm

struct pfioc_tm {
    int              timeout;
    int              seconds;
};

Sets the state timeout of timeout to seconds. The old value is placed into seconds. For the possible values of timeout, see the PFTM_* values in <netinet/pfvar.h>.

DIOCGETTIMEOUT struct pfioc_tm

Gets the state timeout of timeout to seconds.

DIOCSETLIMIT struct pfioc_limit

struct pfioc_limit {
    int             index;
    unsigned        limit;
};

Sets hard limits on the memory pools used by the packet filter. For the possible values of index, see the PF_LIMIT_* values in <netinet/pfvar.h>.

DIOCGETLIMIT struct pfioc_limit

Gets hard limits on the memory pools used by the packet filter.

Compiler options

To manage RAM and ROM sizes used by pf, it has several compiler options in the file <tcpdconfig.h> from tcp-server directory. These defines can disable and enable some functionality and change pf takes memory.

PACKET_FILTER

Enable/disable whole pf functionality.

PF_MODIFY_ENTRY

Modify pf entry support (get and change).
Dependent ioctl() commands:
–  DIOCGETRULES,   DIOCGETRULE,   DIOCCHANGERULE
–  DIOCGETNATS,   DIOCGETNAT,   DIOCCHANGENAT
–  DIOCGETBINATS,   DIOCGETBINAT,   DIOCCHANGEBINAT
–  DIOCGETRDRS,   DIOCGETRDR,   DIOCCHANGERDR

PF_STATE_CTRL

Additional commands for state control (ADD and GET).
Dependent ioctl() commands:
–  DIOCCLRSTATES
–  DIOCKILLSTATES
–  DIOCADDSTATE
–  DIOCGETSTATE
–  DIOCGETSTATES

PF_TIME_MEMORY_CTRL

Extended control for timeouts and memory limits.
Dependent ioctl() commands:
–  DIOCSETTIMEOUT
–  DIOCGETTIMEOUT
–  DIOCGETLIMIT
–  DIOCSETLIMIT

PF_STATISTICS

Calculate statistics.
Dependent ioctl() commands:
–  DIOCSETSTATUSIF
–  DIOCCLRSTATUS

PF_NAT_SUPPORT

Support NAT capabilities (NAT, BINAT and RDR).
Dependent ioctl() commands:
–  DIOCBEGINNATS,   DIOCADDNAT,   DIOCCOMMITNATS
–  DIOCGETNATS,   DIOCGETNAT,   DIOCCHANGENAT
–  DIOCBEGINBINATS,   DIOCADDBINAT,   DIOCCOMMITBINATS
–  DIOCGETBINATS,   DIOCGETBINAT,   DIOCCHANGEBINAT
–  DIOCBEGINRDRS,   DIOCADDRDR,   DIOCCOMMITRDRS
–  DIOCGETRDRS,   DIOCGETRDR,   DIOCCHANGERDR
–  DIOCNATLOOK

PF_NATLOOKUP

Looks up a NAT entry.
Dependent ioctl() commands:
–  DIOCNATLOOK

Note that some ioctl() commands can dependent on several compiler options!

EXAMPLE

The following example demonstrates how to use the DIOCNATLOOK command to find the external host/port of a NATed connection.

void nat_lookup(void)
{
	struct pfioc_natlook nl;
	int s;


	/*
	 * open control socket
	 */
	s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
	if (s < 0)
	{
		printf("pf sock open error %d\n", errno);
		return;
	}
	else
		printf("pf sock %d\n", s);


	memset(&nl, 0, sizeof(struct pfioc_natlook));
	nl.saddr.v4.s_addr      = inet_addr("192.168.20.227");
	nl.sport                = htons(2000);
	nl.daddr.v4.s_addr      = inet_addr("192.168.17.2");
	nl.dport                = htons(2000);
	nl.af                   = AF_INET;
	nl.proto                = IPPROTO_TCP;
	nl.direction            = PF_OUT;

	if (ioctl(s, DIOCNATLOOK, &nl))
	{
		printf("DIOCNATLOOK err\n");
		close(s);
		return;
	}

	printf("external host %s:%d\n", inet_ntoa(nl.rdaddr.v4), ntohs(nl.rdport));
	close(s);
	return;
}

NOTES

There is a demo available for the Unison and DSPnano pf which is found in installdir/demos.

SEE ALSO

tcpd_dual, pfctl, ioctl()