1 files changed, 56 insertions, 7 deletions
diff --git a/contrib/blocklist/bin/blacklistctl.8 b/contrib/blocklist/bin/blacklistctl.8
index 7c6521117745..08f1d1b9e5af 100644
--- a/contrib/blocklist/bin/blacklistctl.8
+++ b/contrib/blocklist/bin/blacklistctl.8
@@ -1,4 +1,4 @@
-.\" $NetBSD: blacklistctl.8,v 1.9 2016/06/08 12:48:37 wiz Exp $
+.\" $NetBSD: blocklistctl.8,v 1.4 2025/02/07 01:35:38 kre Exp $
 .\"
 .\" Copyright (c) 2015 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,27 +27,42 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd June 7, 2016
+.Dd January 27, 2025
 .Dt BLACKLISTCTL 8
 .Os
 .Sh NAME
 .Nm blacklistctl
-.Nd display and change the state of blacklistd
+.Nd display and change the state of the blacklistd database
 .Sh SYNOPSIS
 .Nm
 .Cm dump
 .Op Fl abdnrw
+.Op Fl D Ar dbname
 .Sh DESCRIPTION
 .Nm
-is a program used to display the state of
+is a program used to display and change the state of the
 .Xr blacklistd 8
-.Pp
-The following options are available:
+database.
+The following sub-commands are supported:
+.Ss dump
+The following options are available for the
+.Cm dump
+sub-command:
 .Bl -tag -width indent
 .It Fl a
-Show all database entries, by default it shows only the embryonic ones.
+Show all database entries, by default it shows only the active ones.
+Inactive entries will be shown with a last-access (or, with
+.Fl r ,
+the remaining) time of
+.Ql never .
 .It Fl b
 Show only the blocked entries.
+.It Fl D Ar dbname
+Specify the location of the
+.Ic blacklistd
+database file to use.
+The default is
+.Pa /var/db/blocklistd.db .
 .It Fl d
 Increase debugging level.
 .It Fl n
@@ -59,9 +74,43 @@ Normally the width of addresses is good for IPv4, the
 .Fl w
 flag, makes the display wide enough for IPv6 addresses.
 .El
+.Pp
+The output of the
+.Cm dump
+sub-command consists of a header (unless
+.Fl n
+was given) and one line for each record in the database, where each line
+has the following columns:
+.Bl -tag -width indent
+.It Ql address/ma:port
+The remote address, mask, and local port number of the client connection
+associated with the database entry.
+.It Ql id
+column will show the identifier for the packet filter rule associated
+with the database entry, though this may only be the word
+.Ql OK
+for packet filters which do not create a unique identifier for each rule.
+.It Ql nfail
+The number of
+.Em failures
+reported for the client on the noted port, as well as the number of
+failures allowed before blocking (or, with
+.Fl a ,
+an asterisk
+.Aq * )
+.It So last access Sc | So remaining time Sc
+The last time a the client was reported as attempting access, or, with
+.Fl r ,
+the time remaining before the rule blocking the client will be removed.
+.El
 .Sh SEE ALSO
 .Xr blacklistd 8
 .Sh NOTES
+The
+.Nm
+program has been renamed to
+.Xr blocklistctl 8 .
+.Pp
 Sometimes the reported number of failed attempts can exceed the number
 of attempts that
 .Xr blacklistd 8