![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / sys / net / npf
Request diff between arbitrary revisions
Keyword substitution: kv
Default branch: MAIN
npf: Make sure to initialize portmap_lock only once. PR kern/55586
Pull up following revision(s) (requested by rmind in ticket #956):
usr.sbin/npf/npf-params.7: revision 1.4
sys/net/npf/npf_worker.c: revision 1.9
usr.sbin/npf/npftest/npftest.h: revision 1.17
usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
usr.sbin/npf/npf-params.7: revision 1.5
sys/net/npf/npf_state_tcp.c: revision 1.21
usr.sbin/npf/npfctl/npf_build.c: revision 1.55
usr.sbin/npf/npf-params.7: revision 1.6
sys/net/npf/npfkern.h: revision 1.5
lib/libnpf/npf.c: revision 1.49
usr.sbin/npf/npf-params.7: revision 1.7
sys/net/npf/npf_impl.h: revision 1.81
sys/net/npf/npf_ext_log.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.h: revision 1.53
usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.50
sys/net/npf/npf_mbuf.c: revision 1.24
sys/net/npf/npf_alg.c: revision 1.22
usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
sys/net/npf/npf.h: revision 1.63
usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
usr.sbin/npf/npfctl/npf_var.c: revision 1.13
sys/net/npf/files.npf: revision 1.23
usr.sbin/npf/npfctl/npf_show.c: revision 1.32
usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
sys/net/npf/npf_os.c: revision 1.18
sys/net/npf/npf_connkey.c: revision 1.2
sys/net/npf/npf_conf.c: revision 1.17
lib/libnpf/libnpf.3: revision 1.12
usr.sbin/npf/npftest/npftest.c: revision 1.25
usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
sys/net/npf/npf_tableset.c: revision 1.35
usr.sbin/npf/npftest/npftest.conf: revision 1.9
sys/net/npf/npf_sendpkt.c: revision 1.22
usr.sbin/npf/npfctl/npf_var.h: revision 1.10
sys/net/npf/npf_state.c: revision 1.23
sys/net/npf/npf_conn.h: revision 1.20
usr.sbin/npf/npfctl/npfctl.c: revision 1.64
usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
sys/net/npf/npf_portmap.c: revision 1.5
sys/net/npf/npf_params.c: revision 1.3
usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
tests/net/npf/t_npf.sh: revision 1.4
sys/net/npf/npf_ext_rndblock.c: revision 1.9
lib/libnpf/npf.h: revision 1.39
sys/net/npf/npf_ruleset.c: revision 1.51
sys/net/npf/npf_alg_icmp.c: revision 1.33
sys/net/npf/npf.c: revision 1.43
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.8: revision 1.25
sys/net/npf/npf_ctl.c: revision 1.60
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
sys/net/npf/npf_handler.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.57
sys/net/npf/npf_ifaddr.c: revision 1.7
sys/net/npf/npf_conndb.c: revision 1.9
sys/net/npf/npf_if.c: revision 1.13
usr.sbin/npf/npfctl/Makefile: revision 1.15
sys/net/npf/npf_conn.c: revision 1.32
sys/net/npf/npf_ext_normalize.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.20
sys/net/npf/npf_worker.c: revision 1.8
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.
npftest -- npf_test_init(): add a workaround for NetBSD.
npf-params(7): fix the state.key defaults.
npf-params.7: s/filer/filter/
Adjust to "npfctl debug" command line changes, from rmind@.
Use more markup.
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
Mostly merge changes from HEAD upto 20200411
Sync with head.
Use percpu_foreach_xcall() to gather volatile per-cpu counters. These must be serialized against the interrupts / soft-interrupts in which they're manipulated, as well as protected from non-atomic 64-bit memory loads on 32-bit platforms.
Pull up following revision(s) (requested by rmind in ticket #141): usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.15 sys/net/npf/npf_alg.c: revision 1.21 sys/net/npf/npf.h: revision 1.62 sys/net/npf/npf_ctl.c: revision 1.57 sys/net/npf/npf_ctl.c: revision 1.58 sys/net/npf/npf_os.c: revision 1.16 sys/net/npf/npf_os.c: revision 1.17 sys/net/npf/npf_conf.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.78 sys/sys/mbuf.h: revision 1.220 sys/net/npf/npf_impl.h: revision 1.79 sys/net/npf/npf.c: revision 1.41 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.19 sys/net/npf/npf_nat.c: revision 1.48 sys/net/npf/npf_handler.c: revision 1.48 sys/net/npf/npf_ifaddr.c: revision 1.6 - npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain. Move PACKET_TAG_NPF where it belongs to. Make npfctl_switch() and pfil private to OS-specific module.
- npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
Pull up following revision(s) (requested by rmind in ticket #49): usr.sbin/npf/npf.7: revision 1.7 sys/net/npf/npfkern.h: revision 1.4 sys/net/npf/npf_conn.h: revision 1.18 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.13 sys/net/npf/npf_ctl.c: revision 1.55 sys/net/npf/npf_os.c: revision 1.14 sys/net/npf/npf_conf.c: revision 1.14 usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_perf_test.c: revision 1.9 sys/net/npf/npf_impl.h: revision 1.76 sys/net/npf/npf_portmap.c: revision 1.4 sys/net/npf/npf_params.c: revision 1.2 sys/net/npf/npf.c: revision 1.40 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.18 sys/net/npf/npf_nat.c: revision 1.47 sys/net/npf/npf_handler.c: revision 1.47 sys/net/npf/npf_inet.c: revision 1.55 sys/net/npf/npf_if.c: revision 1.10 sys/net/npf/npf_worker.c: revision 1.7 usr.sbin/npf/npf-params.7: revision 1.3 npf-params(7): add more bpf.jit details. From David H. Gutteridge. Adjust some internal NPF APIs: * npfkern: use the npfk_ prefix. * NPF portmap: amend the API so it could be used elsewhere. * Make npf_connkey_t public. npf.7: add xref to npf-params.7 (Adding directly here since this particular file isn't included in rmind@'s upstream GitHub repo at present.)
Adjust some internal NPF APIs: * npfkern: use the npfk_ prefix. * NPF portmap: amend the API so it could be used elsewhere. * Make npf_connkey_t public.
Pull up following revision(s) (requested by rmind in ticket #25): sys/net/npf/npf_conn.h: revision 1.17 sys/net/npf/npf.c: revision 1.39 sys/net/npf/npf_conn.c: revision 1.28 sys/net/npf/npf_conn.c: revision 1.29 Introduce an npf_conn_destroy_idx() that can handle partially constructed conn structures. - npf_conn_init(): fix a race when initialising the G/C thread. - Fix a bug when partially initialised connection is destroyed on error. (from rmind@)
- npf_conn_init(): fix a race when initialising the G/C thread. - Fix a bug when partially initialised connection is destroyed on error. (from rmind@)
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Sync with HEAD
Sync with HEAD
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Ssync with HEAD
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
Fix lockdebug diagnostic error of trying to acquire an rw_lock from a pserialized active context. From riastradh@
update from HEAD
Sync with HEAD
remove checks for failure after memory allocation calls that cannot fail: kmem_alloc() with KM_SLEEP kmem_zalloc() with KM_SLEEP percpu_alloc() pserialize_create() psref_class_create() all of these paths include an assertion that the allocation has not failed, so callers should not assert that again.
Remove more unnecessary #include for sys/localcount.h
Restore all work from the former pgoyette-localcount branch (which is now abandoned doe to cvs merge botch). The branch now builds, and installs via anita. There are still some problems (cgd is non-functional and all atf tests time-out) but they will get resolved soon.
Sync with HEAD
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
add functionality to lookup a nat entry from the connection list.
Rename LOCALCOUNT_INITIALIZER to DEVSW_MODULE_INIT. This better describes what we're doing, and why.
Instead of repeatedly typing the conditional initialization of the
.d_localcount members in the various {b,c}devsw, define an initializer
macro and use it. This also removes the need for defining new symbols
for each 'struct localcount'.
As suggested by riastradh@
Rump drivers are always installed via devsw_attach() so we need to always allocate a 'struct localcount' for these drivers whenever they are built as modules.
Sync with HEAD (as of 26th Dec)
Simplify even further and fix non-modular kernels: We cannot use the init at attach() trick, because other npf ext modules will load before the attach function is called on non modular kernels.
modules don't define MODULAR.
simplify (and fix) logic.
Ifdef npf_init() the same way as all it's callers are protected.
Fix the code so that it works in all 3 cases: non-modular, modular/builtin, modular/filesystem. In the non-modular case we initialize through attach. In the modular/builtin case we define the module to be class misc so it attaches late (after percpu is initialized) since driver modules attach too early. In the modular/filesystem case we define it to be a driver module since we autoload it via /dev/npf open.
Defer initialization of built-in npf module until other pseudo-devices are initialized. MODULE_CLASS_DRIVER modules are now initialized before autoconfiguration starts, but npf_init has a dependency on percpu(9) which doesn't work until CPUs have attached (at least on ARM).
needs to be driver, otherwise it will not load!
mark this MODULE_CLASS_MISC as npf_init cannot run when builtin driver modules are initialized
Sync with HEAD
include "ioconf.h" to get the 'void <driver>attach(int count);' prototype.
Rebase to HEAD as of a few days ago.
Rebase.
Add d_discard to all struct cdevsw instances I could find. All have been set to "nodiscard"; some should get a real implementation.
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
sync with head
Change (mostly mechanically) every cdevsw/bdevsw I can find to use designated initializers. I have not built every extant kernel so I have probably broken at least one build; however I've also found and fixed some wrong cdevsw/bdevsw entries so even if so I think we come out ahead.
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
resync from head
- NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
resync with head
Pull up following revision(s) (requested by rmind in ticket #817): usr.sbin/npf/npfctl/npfctl.8: revision 1.12 usr.sbin/npf/npfctl/npf.conf.5: revision 1.27 usr.sbin/npf/npfctl/npf_parse.y: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.20 usr.sbin/npf/npfctl/npfctl.c: revision 1.28 lib/libnpf/npf.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.c: revision 1.29 lib/libnpf/npf.c: revision 1.17 sys/modules/npf/Makefile: revision 1.12 sys/net/npf/npf_rproc.c: revision 1.6 usr.sbin/npf/npftest/README: revision 1.4 sys/net/npf/npf_tableset.c: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.21 sys/net/npf/npf_ctl.c: revision 1.22 usr.sbin/npf/npfctl/npfctl.h: revision 1.25 lib/libnpf/npf.h: revision 1.13 usr.sbin/npf/npftest/npftest.conf: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.26 sys/net/npf/npf_ruleset.c: revision 1.17 lib/libnpf/npf.h: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.18 sys/net/npf/npf_conf.c: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.10 sys/net/npf/npf_conf.c: revision 1.2 sys/net/npf/npf_instr.c: revision 1.16 sys/net/npf/npf_handler.c: revision 1.26 sys/net/npf/npf_impl.h: revision 1.26 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14 sys/net/npf/npf_processor.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.27 sys/net/npf/npf_alg_icmp.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16 sys/net/npf/npf_ncode.h: revision 1.11 sys/net/npf/files.npf: revision 1.10 usr.sbin/npf/npftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.c: revision 1.30 lib/libnpf/npf.3: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4 sys/net/npf/npf_session.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5 usr.sbin/npf/npfctl/npf_build.c: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.19 sys/net/npf/npf_alg.c: revision 1.7 usr.sbin/npf/npfctl/Makefile: revision 1.10 sys/net/npf/npf_inet.c: revision 1.21 sys/net/npf/npf.h: revision 1.26 sys/net/npf/npf.h: revision 1.27 usr.sbin/pf/ftp-proxy/Makefile: revision 1.8 sys/net/npf/npf_nat.c: revision 1.19 sys/net/npf/npf.c: revision 1.15 sys/net/npf/npf_state.c: revision 1.14 sys/net/npf/npf_sendpkt.c: revision 1.14 sys/rump/net/lib/libnpf/Makefile: revision 1.4 IPv6 linklocal address printing cosmetics NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version. Disable -DWITH_NPF for now; will be converted to BPF mechanism. - Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset. Allow filtering on IP addresses even if the L4 protocol is unknown. Patch from spz@. npftest: adjust for recent change.
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
Pull up following revision(s) (requested by rmind in ticket #702): sys/net/npf/npf_tableset.c: revision 1.15 usr.sbin/npf/npfctl/npfctl.h: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.6 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.10 sys/net/npf/npf_state_tcp.c: revision 1.11 sys/net/npf/npf_impl.h: revision 1.24 sys/net/npf/npf.h: revision 1.22 sys/net/npf/npf_ctl.c: revision 1.19 sys/net/npf/npf.c: revision 1.14 usr.sbin/npf/npfctl/npfctl.8: revision 1.10 usr.sbin/npf/npfctl/npfctl.c: revision 1.21 npf_tcp_inwindow: inspect the sequence numbers even if the packet contains no data, fixing up only the RST to the initial SYN. This makes off-path attacks more difficult. For the reference, see "Reflection Scan: an Off-Path Attack on TCP" by Jan Wrobel. Implement NPF table listing and preservation of entries on reload. Bump the version. npfctl(8): mention table listing.
Resync to 2012-11-19 00:00:00 UTC
Fix a bug that the patch was incorrectly applied with last commit.
Pull up following revision(s) (requested by rmind in ticket #693): lib/npf/ext_normalise/shlib_version: revision 1.1 lib/libnpf/npf.c: revision 1.13 distrib/sets/lists/modules/mi: revision 1.48 sys/net/npf/npf_rproc.c: revision 1.3 sys/net/npf/npf_rproc.c: revision 1.4 sys/modules/npf/Makefile: revision 1.11 usr.sbin/npf/npfctl/npfctl.h: revision 1.20 lib/npf/ext_log/npfext_log.c: revision 1.1 lib/libnpf/npf.h: revision 1.11 sys/net/npf/npf_inet.c: revision 1.17 sys/net/npf/npf_log.c: file removal sys/net/npf/npf_handler.c: revision 1.22 distrib/sets/lists/base/shl.mi: revision 1.636 sys/net/npf/npf_impl.h: revision 1.23 usr.sbin/npf/npfctl/Makefile: revision 1.8 lib/npf/Makefile: revision 1.1 lib/npf/ext_log/shlib_version: revision 1.1 lib/Makefile: revision 1.189 distrib/sets/lists/comp/shl.mi: revision 1.236 usr.sbin/npf/npfctl/npf_build.c: revision 1.14 distrib/sets/lists/base/mi: revision 1.1007 usr.sbin/npf/npfctl/npf_scan.l: revision 1.6 distrib/sets/lists/base/mi: revision 1.1009 sys/net/npf/npf.h: revision 1.21 lib/npf/ext_normalise/npfext_normalise.c: revision 1.1 etc/mtree/NetBSD.dist.base: revision 1.105 lib/libnpf/Makefile: revision 1.3 etc/mtree/NetBSD.dist.base: revision 1.106 usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1 sys/net/npf/npf_ctl.c: revision 1.18 lib/npf/ext_log/Makefile: revision 1.1 distrib/sets/lists/comp/mi: revision 1.1781 usr.sbin/npf/npfctl/npf_var.h: revision 1.4 sys/net/npf/npf.c: revision 1.13 sys/modules/Makefile: revision 1.111 sys/net/npf/npf_ext_log.c: revision 1.1 lib/npf/Makefile.inc: revision 1.1 sys/net/npf/npf_ext_normalise.c: revision 1.1 sys/net/npf/files.npf: revision 1.8 sys/rump/net/lib/libnpf/Makefile: revision 1.2 sys/modules/npf_ext_log/Makefile: revision 1.1 lib/npf/ext_normalise/Makefile: revision 1.1 usr.sbin/npf/npfctl/npfctl.c: revision 1.20 usr.sbin/npf/npfctl/npf_parse.y: revision 1.13 sys/modules/npf_ext_normalise/Makefile: revision 1.1 Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come. Add /usr/lib/npf. Add ./usr/libdata/debug/usr/lib/npf for rmind Fix MKDEBUG set lists ext_ops does not change during the life cycle and can be fetched without the mutex held. This avoids confusion in the compiler about an uninitialized variable ext_ops. ok rmind@
sync with head
Implement NPF table listing and preservation of entries on reload. Bump the version.
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
Pull up following revision(s) (requested by rmind in ticket #421): lib/libnpf/npf.c: revision 1.10 sys/net/npf/npf_session.c: revision 1.15 sys/net/npf/npf_tableset.c: revision 1.13 sys/net/npf/npf_state_tcp.c: revision 1.9 usr.sbin/npf/npfctl/npf_data.c: revision 1.15 sys/net/npf/npf_inet.c: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.13 sys/net/npf/npf.h: revision 1.19 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12 sys/net/npf/npf_instr.c: revision 1.13 sys/net/npf/npf_handler.c: revision 1.20 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4 sys/net/npf/npf_alg_icmp.c: revision 1.10 usr.sbin/npf/npfctl/npfctl.c: revision 1.15 usr.sbin/npf/npfctl/npf_build.c: revision 1.11 lib/libnpf/npf.h: revision 1.9 sys/net/npf/npf_alg.c: revision 1.5 sys/rump/dev/lib/libnpf/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.16 sys/net/npf/npf_nat.c: revision 1.15 sys/net/npf/npf_tableset_ptree.c: revision 1.1 sys/net/npf/npf.c: revision 1.12 sys/net/npf/npf_sendpkt.c: revision 1.12 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7 sys/net/npf/npf_impl.h: revision 1.18 sys/net/npf/files.npf: revision 1.7 usr.sbin/npf/npfctl/npf_parse.y: revision 1.10 - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
Pull up following revision(s) (requested by rmind in ticket #365):
sys/rump/librump/rumpkern/rumpcpu_generic.c: revision 1.4
sys/net/npf/npf_session.c: revision 1.13
sys/net/npf/npf_tableset.c: revision 1.11
sys/net/npf/npf_state_tcp.c: revision 1.7
sys/net/npf/npf_inet.c: revision 1.12
sys/net/npf/npf.h: revision 1.17
sys/net/npf/npf_instr.c: revision 1.11
usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.2
sys/net/npf/npf_state.c: revision 1.8
sys/net/npf/npf_log.c: revision 1.4
sys/net/npf/npf_alg.c: revision 1.4
sys/rump/librump/rumpkern/Makefile.rumpkern: revision 1.118
sys/net/npf/npf_nat.c: revision 1.13
sys/net/npf/npf.c: revision 1.11
sys/net/npf/npf_sendpkt.c: revision 1.11
sys/net/npf/npf_impl.h: revision 1.16
sys/rump/librump/rumpkern/scheduler.c: revision 1.28
rumpkern:
- Add subr_kcpuset.c and subr_pserialize.c modules.
- Add kcpuset_{running,attached} for RUMP env.
NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
sync with head
sync to latest -current.
Pull up following revision(s) (requested by rmind in ticket #158):
sys/net/npf/npf_session.c: revision 1.12
sys/net/npf/npf_tableset.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.2
usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
sys/net/npf/npf_inet.c: revision 1.11
sys/net/npf/npf.h: revision 1.15
usr.sbin/npf/npfctl/npf_build.c: revision 1.5
sys/net/npf/npf_ruleset.c: revision 1.11
sys/net/npf/npf_instr.c: revision 1.10
usr.sbin/npf/npfctl/Makefile: revision 1.6
sys/net/npf/npf_processor.c: revision 1.10
sys/net/npf/npf_log.c: revision 1.3
lib/libnpf/npf.h: revision 1.7
sys/net/npf/npf_alg.c: revision 1.3
sys/net/npf/npf_sendpkt.c: revision 1.9
lib/libnpf/npf.c: revision 1.8
usr.sbin/npf/npfctl/npfctl.h: revision 1.13
sys/net/npf/npf_ctl.c: revision 1.13
usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
sys/net/npf/npf_ctl.c: revision 1.14
sys/net/npf/npf_nat.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.12
sys/net/npf/npf_impl.h: revision 1.11
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
sys/net/npf/npf_impl.h: revision 1.12
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
sys/net/npf/npf_handler.c: revision 1.14
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
sys/net/npf/npf_handler.c: revision 1.15
sys/net/npf/npf_ncode.h: revision 1.6
sys/net/npf/npf.c: revision 1.8
sys/net/npf/npf.c: revision 1.9
sys/net/npf/npf_alg_icmp.c: revision 1.9
sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes. Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.
Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.
Most of these changes were brought up in the following messages:
http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html
Thanks to christos, manu, njoly, and jmmv for input.
Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve. - Few fixes. Improve some comments.
sync to -current.
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
merge to -current.
- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
sync with head
Change module class to driver as npf(4) is a pseudo device.
Sync with HEAD.
sync with head
fix module build
sync with head
Sync with HEAD
file npf.c was added on branch rmind-uvmplock on 2011-03-05 20:55:54 +0000
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
potentially other functions from the rule structure. Rule procedure can be
shared amongst the rules. Separation is both at kernel level (npf_rproc_t)
and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic. Use TCP FSM definitions.
- Add if_byindex(), OK by matt@. Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.
NPF checkpoint: - Add support for session saving/restoring. - Add packet logging support (can tcpdump a pseudo-interface). - Support reload without flushing of sessions; rework some locking. - Revisit session mangement, replace linking with npf_sentry_t entries. - Add some counters for statistics, using percpu(9). - Add IP_DF flag cleansing. - Fix various bugs; misc clean-up.
Sync with HEAD (-D20101022).
sync with head
file npf.c was added on branch uebayasi-xip on 2010-10-22 09:23:14 +0000
file npf.c was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000
Import NPF - a packet filter. Some features: - Designed to be fully MP-safe and highly efficient. - Tables/IP sets (hash or red-black tree) for high performance lookups. - Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs). - Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual. - Convenient userland utility npfctl(8) with npf.conf(8). NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress. Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@