doc: add osf expression to man page

Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt
index 634930496b540e0d337f62d1e55211c144e8eb60..e7a022a5c6bead5cb4fad3a06aaff1d03bb7c165 100644 (file)
--- a/doc/primary-expression.txt
+++ b/doc/primary-expression.txt
@@ -173,6 +173,35 @@ table inet x {
 }
 ----------------------
 
+OSF EXPRESSION
+~~~~~~~~~~~~~~
+[verse]
+osf {name}
+
+The osf expression does passive operating system fingerprinting. This
+expression compares some data (Window Size, MSS, options and their order, DF,
+and others) from packets with the SYN bit set.
+
+.Available osf attributes
+[options="header"]
+|==================
+|Name |Description| Type
+|name|
+Name of the OS signature to match. All signatures can be found at pf.os file.|
+Use "unknown" for OS signatures that the expression could not detect.
+|==================
+
+.Using osf expression
+---------------------
+# Accept packets that match the "Linux" OS signature.
+table inet x {
+    chain y {
+       type filter hook input priority 0; policy accept;
+        osf "Linux"
+    }
+}
+-----------------------
+
 FIB EXPRESSIONS
 ~~~~~~~~~~~~~~~
 [verse]