The NetBSD Project

CVS log for src/sys/net/npf/npf.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / net / npf

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.44 / (download) - annotate - [select for diffs], Thu Aug 27 18:50:25 2020 UTC (3 years, 7 months ago) by riastradh
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, thorpej-altq-separation-base, thorpej-altq-separation, netbsd-10-base, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-sunxi-drm-base, bouyer-sunxi-drm, HEAD
Changes since 1.43: +5 -1 lines
Diff to previous 1.43 (colored)

npf: Make sure to initialize portmap_lock only once.

PR kern/55586

Revision 1.38.2.4 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Changes since 1.38.2.3: +29 -5 lines
Diff to previous 1.38.2.3 (colored) to branchpoint 1.38 (colored) next main 1.39 (colored)

Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@.

Use more markup.

Revision 1.43 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.42: +29 -5 lines
Diff to previous 1.42 (colored)

Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.

Revision 1.34.10.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:15 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.34.10.1: +47 -17 lines
Diff to previous 1.34.10.1 (colored) to branchpoint 1.34 (colored) next main 1.35 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.41.2.1 / (download) - annotate - [select for diffs], Sat Feb 29 20:21:06 2020 UTC (4 years, 1 month ago) by ad
Branch: ad-namecache
Changes since 1.41: +6 -3 lines
Diff to previous 1.41 (colored) next main 1.42 (colored)

Sync with head.

Revision 1.42 / (download) - annotate - [select for diffs], Fri Feb 7 12:35:33 2020 UTC (4 years, 2 months ago) by thorpej
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, is-mlppp-base, is-mlppp, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3
Changes since 1.41: +6 -3 lines
Diff to previous 1.41 (colored)

Use percpu_foreach_xcall() to gather volatile per-cpu counters.  These
must be serialized against the interrupts / soft-interrupts in which
they're manipulated, as well as protected from non-atomic 64-bit memory
loads on 32-bit platforms.

Revision 1.38.2.3 / (download) - annotate - [select for diffs], Sun Sep 1 13:21:39 2019 UTC (4 years, 7 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Changes since 1.38.2.2: +6 -6 lines
Diff to previous 1.38.2.2 (colored) to branchpoint 1.38 (colored)

Pull up following revision(s) (requested by rmind in ticket #141):

	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.15
	sys/net/npf/npf_alg.c: revision 1.21
	sys/net/npf/npf.h: revision 1.62
	sys/net/npf/npf_ctl.c: revision 1.57
	sys/net/npf/npf_ctl.c: revision 1.58
	sys/net/npf/npf_os.c: revision 1.16
	sys/net/npf/npf_os.c: revision 1.17
	sys/net/npf/npf_conf.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.78
	sys/sys/mbuf.h: revision 1.220
	sys/net/npf/npf_impl.h: revision 1.79
	sys/net/npf/npf.c: revision 1.41
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.19
	sys/net/npf/npf_nat.c: revision 1.48
	sys/net/npf/npf_handler.c: revision 1.48
	sys/net/npf/npf_ifaddr.c: revision 1.6

- npfctl_load_nvlist: simplify the config loading logic.
- Fix a small race condition in npf_nat_getaddr().
- Rework pserialize/EBR wrappers, make it easier to maintain.
Move PACKET_TAG_NPF where it belongs to.
Make npfctl_switch() and pfil private to OS-specific module.

Revision 1.41 / (download) - annotate - [select for diffs], Sun Aug 25 13:21:03 2019 UTC (4 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20191119, ad-namecache-base2, ad-namecache-base1, ad-namecache-base
Branch point for: ad-namecache
Changes since 1.40: +6 -6 lines
Diff to previous 1.40 (colored)

- npfctl_load_nvlist: simplify the config loading logic.
- Fix a small race condition in npf_nat_getaddr().
- Rework pserialize/EBR wrappers, make it easier to maintain.

Revision 1.38.2.2 / (download) - annotate - [select for diffs], Tue Aug 13 14:35:55 2019 UTC (4 years, 8 months ago) by martin
Branch: netbsd-9
Changes since 1.38.2.1: +11 -11 lines
Diff to previous 1.38.2.1 (colored) to branchpoint 1.38 (colored)

Pull up following revision(s) (requested by rmind in ticket #49):

	usr.sbin/npf/npf.7: revision 1.7
	sys/net/npf/npfkern.h: revision 1.4
	sys/net/npf/npf_conn.h: revision 1.18
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.55
	sys/net/npf/npf_os.c: revision 1.14
	sys/net/npf/npf_conf.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/npf_perf_test.c: revision 1.9
	sys/net/npf/npf_impl.h: revision 1.76
	sys/net/npf/npf_portmap.c: revision 1.4
	sys/net/npf/npf_params.c: revision 1.2
	sys/net/npf/npf.c: revision 1.40
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.18
	sys/net/npf/npf_nat.c: revision 1.47
	sys/net/npf/npf_handler.c: revision 1.47
	sys/net/npf/npf_inet.c: revision 1.55
	sys/net/npf/npf_if.c: revision 1.10
	sys/net/npf/npf_worker.c: revision 1.7
	usr.sbin/npf/npf-params.7: revision 1.3

npf-params(7): add more bpf.jit details.
From David H. Gutteridge.

Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

npf.7: add xref to npf-params.7
(Adding directly here since this particular file isn't included in
rmind@'s upstream GitHub repo at present.)

Revision 1.40 / (download) - annotate - [select for diffs], Sun Aug 11 20:26:33 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.39: +11 -11 lines
Diff to previous 1.39 (colored)

Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

Revision 1.38.2.1 / (download) - annotate - [select for diffs], Wed Aug 7 08:28:37 2019 UTC (4 years, 8 months ago) by martin
Branch: netbsd-9
Changes since 1.38: +6 -2 lines
Diff to previous 1.38 (colored)

Pull up following revision(s) (requested by rmind in ticket #25):

	sys/net/npf/npf_conn.h: revision 1.17
	sys/net/npf/npf.c: revision 1.39
	sys/net/npf/npf_conn.c: revision 1.28
	sys/net/npf/npf_conn.c: revision 1.29

Introduce an npf_conn_destroy_idx() that can handle partially constructed
conn structures.

- npf_conn_init(): fix a race when initialising the G/C thread.
- Fix a bug when partially initialised connection is destroyed on error.
(from rmind@)

Revision 1.39 / (download) - annotate - [select for diffs], Tue Aug 6 11:40:15 2019 UTC (4 years, 8 months ago) by christos
Branch: MAIN
Changes since 1.38: +6 -2 lines
Diff to previous 1.38 (colored)

- npf_conn_init(): fix a race when initialising the G/C thread.
- Fix a bug when partially initialised connection is destroyed on error.
(from rmind@)

Revision 1.38 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:01 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.37: +24 -1 lines
Diff to previous 1.37 (colored)

NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Revision 1.34.10.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:09:46 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.34: +11 -6 lines
Diff to previous 1.34 (colored)

Sync with HEAD

Revision 1.34.8.2 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:37 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.34.8.1: +1 -3 lines
Diff to previous 1.34.8.1 (colored) to branchpoint 1.34 (colored) next main 1.35 (colored)

Sync with HEAD

Revision 1.37 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:31 2019 UTC (5 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20190609, pgoyette-compat-20190127, isaki-audio2-base, isaki-audio2
Changes since 1.36: +1 -3 lines
Diff to previous 1.36 (colored)

Major NPF improvements:
- Convert NPF connection table to thmap.  State lookup is now lock-free.
- Improve connection state G/C: it is now incremental and tunable.
- Add support for dynamic NAT address.  Translation addresses can now be
  selected from a pool of addresses.  There are two selection algorithms,
  "ip-hash" and "round-robin" (see the man page).
- Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf
  to dynamically choose an IP from the interface address(es).
- Add support for the NETMAP algorithm with static NAT for net-to-net
  translation (it is equivalent to iptables NETMAP logic).
- Convert 'ipset' tables to use thmap; the table lookup is now lock-free.
- Misc improvements, bug fixes and more unit tests.
- Bump NPF_VERSION (will also bump libnpf).

Revision 1.34.8.1 / (download) - annotate - [select for diffs], Sun Sep 30 01:45:56 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.34: +13 -6 lines
Diff to previous 1.34 (colored)

Ssync with HEAD

Revision 1.36 / (download) - annotate - [select for diffs], Sat Sep 29 14:41:36 2018 UTC (5 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930
Changes since 1.35: +10 -5 lines
Diff to previous 1.35 (colored)

NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
  a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
  previous versions.  Also, different serialisation format means NPF
  connection/config saving and loading is not compatible with the
  previous versions either.

Thanks to christos@ for extra testing.

Revision 1.35 / (download) - annotate - [select for diffs], Wed Sep 12 21:58:38 2018 UTC (5 years, 7 months ago) by christos
Branch: MAIN
Changes since 1.34: +4 -2 lines
Diff to previous 1.34 (colored)

Fix lockdebug diagnostic error of trying to acquire an rw_lock from a
pserialized active context. From riastradh@

Revision 1.12.2.5 / (download) - annotate - [select for diffs], Sun Dec 3 11:39:03 2017 UTC (6 years, 4 months ago) by jdolecek
Branch: tls-maxphys
Changes since 1.12.2.4: +70 -200 lines
Diff to previous 1.12.2.4 (colored) next main 1.13 (colored)

update from HEAD

Revision 1.22.4.4 / (download) - annotate - [select for diffs], Mon Aug 28 17:53:11 2017 UTC (6 years, 7 months ago) by skrll
Branch: nick-nhusb
Changes since 1.22.4.3: +2 -6 lines
Diff to previous 1.22.4.3 (colored) to branchpoint 1.22 (colored) next main 1.23 (colored)

Sync with HEAD

Revision 1.34 / (download) - annotate - [select for diffs], Thu Jun 1 02:45:14 2017 UTC (6 years, 10 months ago) by chs
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202, phil-wifi-base, pgoyette-compat-base, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315, perseant-stdc-iso10646-base, perseant-stdc-iso10646, nick-nhusb-base-20170825, netbsd-8-base, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, netbsd-8, matt-nb8-mediatek-base, matt-nb8-mediatek
Branch point for: phil-wifi, pgoyette-compat
Changes since 1.33: +2 -6 lines
Diff to previous 1.33 (colored)

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Revision 1.33.6.2 / (download) - annotate - [select for diffs], Sat Apr 29 11:12:15 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.33.6.1: +2 -3 lines
Diff to previous 1.33.6.1 (colored) to branchpoint 1.33 (colored) next main 1.34 (colored)

Remove more unnecessary #include for sys/localcount.h

Revision 1.33.6.1 / (download) - annotate - [select for diffs], Thu Apr 27 05:36:38 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.33: +3 -2 lines
Diff to previous 1.33 (colored)

Restore all work from the former pgoyette-localcount branch (which is
now abandoned doe to cvs merge botch).

The branch now builds, and installs via anita.  There are still some
problems (cgd is non-functional and all atf tests time-out) but they
will get resolved soon.

Revision 1.22.4.3 / (download) - annotate - [select for diffs], Sun Feb 5 13:40:58 2017 UTC (7 years, 2 months ago) by skrll
Branch: nick-nhusb
Changes since 1.22.4.2: +76 -216 lines
Diff to previous 1.22.4.2 (colored) to branchpoint 1.22 (colored)

Sync with HEAD

Revision 1.31.2.4 / (download) - annotate - [select for diffs], Sat Jan 7 08:56:50 2017 UTC (7 years, 3 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.31.2.3: +76 -217 lines
Diff to previous 1.31.2.3 (colored) to branchpoint 1.31 (colored) next main 1.32 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.33 / (download) - annotate - [select for diffs], Mon Dec 26 23:05:06 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-localcount-20170107, nick-nhusb-base-20170204, jdolecek-ncq-base, jdolecek-ncq, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan
Branch point for: prg-localcount2
Changes since 1.32: +76 -219 lines
Diff to previous 1.32 (colored)

Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)

Revision 1.32 / (download) - annotate - [select for diffs], Sat Dec 10 05:41:10 2016 UTC (7 years, 4 months ago) by christos
Branch: MAIN
Changes since 1.31: +5 -2 lines
Diff to previous 1.31 (colored)

add functionality to lookup a nat entry from the connection list.

Revision 1.31.2.3 / (download) - annotate - [select for diffs], Tue Jul 26 05:54:40 2016 UTC (7 years, 8 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.31.2.2: +3 -3 lines
Diff to previous 1.31.2.2 (colored) to branchpoint 1.31 (colored)

Rename LOCALCOUNT_INITIALIZER to DEVSW_MODULE_INIT.  This better describes
what we're doing, and why.

Revision 1.31.2.2 / (download) - annotate - [select for diffs], Tue Jul 19 06:27:00 2016 UTC (7 years, 8 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.31.2.1: +3 -9 lines
Diff to previous 1.31.2.1 (colored) to branchpoint 1.31 (colored)

Instead of repeatedly typing the conditional initialization of the
.d_localcount members in the various {b,c}devsw, define an initializer
macro and use it.  This also removes the need for defining new symbols
for each 'struct localcount'.

As suggested by riastradh@

Revision 1.31.2.1 / (download) - annotate - [select for diffs], Mon Jul 18 03:50:00 2016 UTC (7 years, 8 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.31: +10 -2 lines
Diff to previous 1.31 (colored)

Rump drivers are always installed via devsw_attach() so we need to
always allocate a 'struct localcount' for these drivers whenever they
are built as modules.

Revision 1.22.4.2 / (download) - annotate - [select for diffs], Sun Dec 27 12:10:07 2015 UTC (8 years, 3 months ago) by skrll
Branch: nick-nhusb
Changes since 1.22.4.1: +24 -10 lines
Diff to previous 1.22.4.1 (colored) to branchpoint 1.22 (colored)

Sync with HEAD (as of 26th Dec)

Revision 1.31 / (download) - annotate - [select for diffs], Thu Oct 29 15:19:43 2015 UTC (8 years, 5 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.30: +5 -17 lines
Diff to previous 1.30 (colored)

Simplify even further and fix non-modular kernels:
We cannot use the init at attach() trick, because other npf ext modules
will load before the attach function is called on non modular kernels.

Revision 1.30 / (download) - annotate - [select for diffs], Tue Oct 27 19:58:09 2015 UTC (8 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.29: +3 -3 lines
Diff to previous 1.29 (colored)

modules don't define MODULAR.

Revision 1.29 / (download) - annotate - [select for diffs], Tue Oct 27 19:31:55 2015 UTC (8 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.28: +4 -8 lines
Diff to previous 1.28 (colored)

simplify (and fix) logic.

Revision 1.28 / (download) - annotate - [select for diffs], Mon Oct 19 09:28:24 2015 UTC (8 years, 5 months ago) by martin
Branch: MAIN
Changes since 1.27: +4 -2 lines
Diff to previous 1.27 (colored)

Ifdef npf_init() the same way as all it's callers are protected.

Revision 1.27 / (download) - annotate - [select for diffs], Mon Oct 19 00:29:57 2015 UTC (8 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.26: +33 -9 lines
Diff to previous 1.26 (colored)

Fix the code so that it works in all 3 cases: non-modular, modular/builtin,
modular/filesystem. In the non-modular case we initialize through attach.
In the modular/builtin case we define the module to be class misc so it
attaches late (after percpu is initialized) since driver modules attach
too early.  In the modular/filesystem case we define it to be a driver
module since we autoload it via /dev/npf open.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Oct 18 20:39:53 2015 UTC (8 years, 5 months ago) by jmcneill
Branch: MAIN
Changes since 1.25: +8 -4 lines
Diff to previous 1.25 (colored)

Defer initialization of built-in npf module until other pseudo-devices
are initialized. MODULE_CLASS_DRIVER modules are now initialized before
autoconfiguration starts, but npf_init has a dependency on percpu(9) which
doesn't work until CPUs have attached (at least on ARM).

Revision 1.25 / (download) - annotate - [select for diffs], Sun Oct 18 18:48:01 2015 UTC (8 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.24: +3 -3 lines
Diff to previous 1.24 (colored)

needs to be driver, otherwise it will not load!

Revision 1.24 / (download) - annotate - [select for diffs], Sat Oct 17 13:53:40 2015 UTC (8 years, 5 months ago) by jmcneill
Branch: MAIN
Changes since 1.23: +3 -3 lines
Diff to previous 1.23 (colored)

mark this MODULE_CLASS_MISC as npf_init cannot run when builtin driver modules are initialized

Revision 1.22.4.1 / (download) - annotate - [select for diffs], Tue Sep 22 12:06:11 2015 UTC (8 years, 6 months ago) by skrll
Branch: nick-nhusb
Changes since 1.22: +4 -4 lines
Diff to previous 1.22 (colored)

Sync with HEAD

Revision 1.23 / (download) - annotate - [select for diffs], Thu Aug 20 14:40:19 2015 UTC (8 years, 7 months ago) by christos
Branch: MAIN
CVS Tags: nick-nhusb-base-20150921
Changes since 1.22: +4 -4 lines
Diff to previous 1.22 (colored)

include "ioconf.h" to get the 'void <driver>attach(int count);' prototype.

Revision 1.12.2.4 / (download) - annotate - [select for diffs], Wed Aug 20 00:04:35 2014 UTC (9 years, 7 months ago) by tls
Branch: tls-maxphys
Changes since 1.12.2.3: +23 -19 lines
Diff to previous 1.12.2.3 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.19.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 06:56:16 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.19: +10 -17 lines
Diff to previous 1.19 (colored) next main 1.20 (colored)

Rebase.

Revision 1.22 / (download) - annotate - [select for diffs], Fri Jul 25 08:10:40 2014 UTC (9 years, 8 months ago) by dholland
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7
Branch point for: nick-nhusb
Changes since 1.21: +3 -2 lines
Diff to previous 1.21 (colored)

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

Revision 1.21 / (download) - annotate - [select for diffs], Wed Jul 23 01:25:34 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.20: +6 -15 lines
Diff to previous 1.20 (colored)

NPF: rework of the connection saving and restoring:
- Add support for saving a snapshot of the current connections together
  with a full configuration.  Support a reverse load operation.  Eliminate
  the old 'sess-save' and 'sess-load' in favour of the new mechanism.
- Share code between load and reload operations: the latter performs
  load from npf.conf without affecting the connections.
- Simplify and fix races with connection loading.
- Bump NPF_VERSION.

Revision 1.20 / (download) - annotate - [select for diffs], Sat Jul 19 18:24:16 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.19: +9 -8 lines
Diff to previous 1.19 (colored)

NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
  and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.

Revision 1.5.4.4 / (download) - annotate - [select for diffs], Thu May 22 11:41:09 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5.4.3: +37 -147 lines
Diff to previous 1.5.4.3 (colored) to branchpoint 1.5 (colored) next main 1.6 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.16.2.1 / (download) - annotate - [select for diffs], Sun May 18 17:46:13 2014 UTC (9 years, 10 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.16: +17 -6 lines
Diff to previous 1.16 (colored) next main 1.17 (colored)

sync with head

Revision 1.19 / (download) - annotate - [select for diffs], Sun Mar 16 05:20:30 2014 UTC (10 years, 1 month ago) by dholland
Branch: MAIN
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.18: +13 -4 lines
Diff to previous 1.18 (colored)

Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

Revision 1.18 / (download) - annotate - [select for diffs], Fri Nov 8 00:38:26 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.17: +4 -3 lines
Diff to previous 1.17 (colored)

NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections).  Once the interface is reattached they will
become active.

Bump NPF_VERSION.

Revision 1.17 / (download) - annotate - [select for diffs], Thu Sep 19 01:04:46 2013 UTC (10 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.16: +4 -3 lines
Diff to previous 1.16 (colored)

- Convert NPF to use BPF byte-code by default.  Compile BPF byte-code in
  npfctl(8) and generate separate marks to describe the filter criteria.
- Rewrite 'npfctl show' functionality and fix some of the bugs.
- npftest: add a test for BPF COP.
- Bump NPF_VERSION.

Revision 1.12.2.3 / (download) - annotate - [select for diffs], Sun Jun 23 06:20:25 2013 UTC (10 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.12.2.2: +6 -2 lines
Diff to previous 1.12.2.2 (colored)

resync from head

Revision 1.16 / (download) - annotate - [select for diffs], Sun Jun 2 02:20:04 2013 UTC (10 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Branch point for: rmind-smpnet
Changes since 1.15: +6 -2 lines
Diff to previous 1.15 (colored)

- NPF connection tracking: rework synchronisation on tracking disable/enable
  points and document it.  Split the worker thread into a separate module
  with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.

Revision 1.12.2.2 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:02 2013 UTC (11 years, 1 month ago) by tls
Branch: tls-maxphys
Changes since 1.12.2.1: +18 -143 lines
Diff to previous 1.12.2.1 (colored)

resync with head

Revision 1.7.2.7 / (download) - annotate - [select for diffs], Mon Feb 11 21:49:49 2013 UTC (11 years, 2 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1
Changes since 1.7.2.6: +18 -143 lines
Diff to previous 1.7.2.6 (colored) to branchpoint 1.7 (colored) next main 1.8 (colored)

Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.

Revision 1.15 / (download) - annotate - [select for diffs], Sat Feb 9 03:35:31 2013 UTC (11 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: khorben-n900, agc-symver-base, agc-symver
Changes since 1.14: +18 -143 lines
Diff to previous 1.14 (colored)

NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

Revision 1.7.2.6 / (download) - annotate - [select for diffs], Sat Nov 24 04:34:42 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.7.2.5: +5 -3 lines
Diff to previous 1.7.2.5 (colored) to branchpoint 1.7 (colored)

Pull up following revision(s) (requested by rmind in ticket #702):
	sys/net/npf/npf_tableset.c: revision 1.15
	usr.sbin/npf/npfctl/npfctl.h: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.6
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.10
	sys/net/npf/npf_state_tcp.c: revision 1.11
	sys/net/npf/npf_impl.h: revision 1.24
	sys/net/npf/npf.h: revision 1.22
	sys/net/npf/npf_ctl.c: revision 1.19
	sys/net/npf/npf.c: revision 1.14
	usr.sbin/npf/npfctl/npfctl.8: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.21
npf_tcp_inwindow: inspect the sequence numbers even if the packet contains no
data, fixing up only the RST to the initial SYN.  This makes off-path attacks
more difficult.  For the reference, see &quot;Reflection Scan: an Off-Path Attack
on TCP&quot; by Jan Wrobel.
Implement NPF table listing and preservation of entries on reload.
Bump the version.
npfctl(8): mention table listing.

Revision 1.12.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:02:47 2012 UTC (11 years, 4 months ago) by tls
Branch: tls-maxphys
Changes since 1.12: +15 -7 lines
Diff to previous 1.12 (colored)

Resync to 2012-11-19 00:00:00 UTC

Revision 1.7.2.5 / (download) - annotate - [select for diffs], Mon Nov 19 09:44:42 2012 UTC (11 years, 4 months ago) by msaitoh
Branch: netbsd-6
Changes since 1.7.2.4: +4 -4 lines
Diff to previous 1.7.2.4 (colored) to branchpoint 1.7 (colored)

Fix a bug that the patch was incorrectly applied with last commit.

Revision 1.7.2.4 / (download) - annotate - [select for diffs], Sun Nov 18 22:38:26 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.7.2.3: +12 -6 lines
Diff to previous 1.7.2.3 (colored) to branchpoint 1.7 (colored)

Pull up following revision(s) (requested by rmind in ticket #693):
	lib/npf/ext_normalise/shlib_version: revision 1.1
	lib/libnpf/npf.c: revision 1.13
	distrib/sets/lists/modules/mi: revision 1.48
	sys/net/npf/npf_rproc.c: revision 1.3
	sys/net/npf/npf_rproc.c: revision 1.4
	sys/modules/npf/Makefile: revision 1.11
	usr.sbin/npf/npfctl/npfctl.h: revision 1.20
	lib/npf/ext_log/npfext_log.c: revision 1.1
	lib/libnpf/npf.h: revision 1.11
	sys/net/npf/npf_inet.c: revision 1.17
	sys/net/npf/npf_log.c: file removal
	sys/net/npf/npf_handler.c: revision 1.22
	distrib/sets/lists/base/shl.mi: revision 1.636
	sys/net/npf/npf_impl.h: revision 1.23
	usr.sbin/npf/npfctl/Makefile: revision 1.8
	lib/npf/Makefile: revision 1.1
	lib/npf/ext_log/shlib_version: revision 1.1
	lib/Makefile: revision 1.189
	distrib/sets/lists/comp/shl.mi: revision 1.236
	usr.sbin/npf/npfctl/npf_build.c: revision 1.14
	distrib/sets/lists/base/mi: revision 1.1007
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
	distrib/sets/lists/base/mi: revision 1.1009
	sys/net/npf/npf.h: revision 1.21
	lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.105
	lib/libnpf/Makefile: revision 1.3
	etc/mtree/NetBSD.dist.base: revision 1.106
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
	sys/net/npf/npf_ctl.c: revision 1.18
	lib/npf/ext_log/Makefile: revision 1.1
	distrib/sets/lists/comp/mi: revision 1.1781
	usr.sbin/npf/npfctl/npf_var.h: revision 1.4
	sys/net/npf/npf.c: revision 1.13
	sys/modules/Makefile: revision 1.111
	sys/net/npf/npf_ext_log.c: revision 1.1
	lib/npf/Makefile.inc: revision 1.1
	sys/net/npf/npf_ext_normalise.c: revision 1.1
	sys/net/npf/files.npf: revision 1.8
	sys/rump/net/lib/libnpf/Makefile: revision 1.2
	sys/modules/npf_ext_log/Makefile: revision 1.1
	lib/npf/ext_normalise/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npfctl.c: revision 1.20
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
	sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@

Revision 1.5.4.3 / (download) - annotate - [select for diffs], Tue Oct 30 17:22:44 2012 UTC (11 years, 5 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.5.4.2: +27 -6 lines
Diff to previous 1.5.4.2 (colored) to branchpoint 1.5 (colored)

sync with head

Revision 1.14 / (download) - annotate - [select for diffs], Mon Oct 29 02:27:11 2012 UTC (11 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base8, yamt-pagecache-base7, yamt-pagecache-base6
Changes since 1.13: +5 -3 lines
Diff to previous 1.13 (colored)

Implement NPF table listing and preservation of entries on reload.
Bump the version.

Revision 1.13 / (download) - annotate - [select for diffs], Sun Sep 16 13:47:41 2012 UTC (11 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.12: +12 -6 lines
Diff to previous 1.12 (colored)

Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.

Revision 1.7.2.3 / (download) - annotate - [select for diffs], Mon Jul 16 22:13:27 2012 UTC (11 years, 8 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus
Changes since 1.7.2.2: +7 -2 lines
Diff to previous 1.7.2.2 (colored) to branchpoint 1.7 (colored)

Pull up following revision(s) (requested by rmind in ticket #421):
	lib/libnpf/npf.c: revision 1.10
	sys/net/npf/npf_session.c: revision 1.15
	sys/net/npf/npf_tableset.c: revision 1.13
	sys/net/npf/npf_state_tcp.c: revision 1.9
	usr.sbin/npf/npfctl/npf_data.c: revision 1.15
	sys/net/npf/npf_inet.c: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.13
	sys/net/npf/npf.h: revision 1.19
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12
	sys/net/npf/npf_instr.c: revision 1.13
	sys/net/npf/npf_handler.c: revision 1.20
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4
	sys/net/npf/npf_alg_icmp.c: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.11
	lib/libnpf/npf.h: revision 1.9
	sys/net/npf/npf_alg.c: revision 1.5
	sys/rump/dev/lib/libnpf/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.15
	sys/net/npf/npf_tableset_ptree.c: revision 1.1
	sys/net/npf/npf.c: revision 1.12
	sys/net/npf/npf_sendpkt.c: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.18
	sys/net/npf/files.npf: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.10
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.12 / (download) - annotate - [select for diffs], Sun Jul 15 00:23:00 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.11: +7 -2 lines
Diff to previous 1.11 (colored)

- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.7.2.2 / (download) - annotate - [select for diffs], Tue Jun 26 14:49:10 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.7.2.1: +10 -2 lines
Diff to previous 1.7.2.1 (colored) to branchpoint 1.7 (colored)

Pull up following revision(s) (requested by rmind in ticket #365):
	sys/rump/librump/rumpkern/rumpcpu_generic.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.13
	sys/net/npf/npf_tableset.c: revision 1.11
	sys/net/npf/npf_state_tcp.c: revision 1.7
	sys/net/npf/npf_inet.c: revision 1.12
	sys/net/npf/npf.h: revision 1.17
	sys/net/npf/npf_instr.c: revision 1.11
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.2
	sys/net/npf/npf_state.c: revision 1.8
	sys/net/npf/npf_log.c: revision 1.4
	sys/net/npf/npf_alg.c: revision 1.4
	sys/rump/librump/rumpkern/Makefile.rumpkern: revision 1.118
	sys/net/npf/npf_nat.c: revision 1.13
	sys/net/npf/npf.c: revision 1.11
	sys/net/npf/npf_sendpkt.c: revision 1.11
	sys/net/npf/npf_impl.h: revision 1.16
	sys/rump/librump/rumpkern/scheduler.c: revision 1.28
rumpkern:
- Add subr_kcpuset.c and subr_pserialize.c modules.
- Add kcpuset_{running,attached} for RUMP env.
NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.

Revision 1.11 / (download) - annotate - [select for diffs], Fri Jun 22 13:43:17 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.10: +10 -2 lines
Diff to previous 1.10 (colored)

NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.

Revision 1.5.4.2 / (download) - annotate - [select for diffs], Tue Apr 17 00:08:38 2012 UTC (11 years, 11 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5.4.1: +42 -18 lines
Diff to previous 1.5.4.1 (colored) to branchpoint 1.5 (colored)

sync with head

Revision 1.6.4.3 / (download) - annotate - [select for diffs], Thu Apr 5 21:33:43 2012 UTC (12 years ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.6.4.2: +31 -14 lines
Diff to previous 1.6.4.2 (colored) to branchpoint 1.6 (colored) next main 1.7 (colored)

sync to latest -current.

Revision 1.7.2.1 / (download) - annotate - [select for diffs], Tue Apr 3 17:22:53 2012 UTC (12 years ago) by riz
Branch: netbsd-6
Changes since 1.7: +38 -13 lines
Diff to previous 1.7 (colored)

Pull up following revision(s) (requested by rmind in ticket #158):
	sys/net/npf/npf_session.c: revision 1.12
	sys/net/npf/npf_tableset.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.11
	sys/net/npf/npf.h: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.5
	sys/net/npf/npf_ruleset.c: revision 1.11
	sys/net/npf/npf_instr.c: revision 1.10
	usr.sbin/npf/npfctl/Makefile: revision 1.6
	sys/net/npf/npf_processor.c: revision 1.10
	sys/net/npf/npf_log.c: revision 1.3
	lib/libnpf/npf.h: revision 1.7
	sys/net/npf/npf_alg.c: revision 1.3
	sys/net/npf/npf_sendpkt.c: revision 1.9
	lib/libnpf/npf.c: revision 1.8
	usr.sbin/npf/npfctl/npfctl.h: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.13
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
	sys/net/npf/npf_ctl.c: revision 1.14
	sys/net/npf/npf_nat.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.12
	sys/net/npf/npf_impl.h: revision 1.11
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
	sys/net/npf/npf_impl.h: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
	sys/net/npf/npf_handler.c: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
	sys/net/npf/npf_handler.c: revision 1.15
	sys/net/npf/npf_ncode.h: revision 1.6
	sys/net/npf/npf.c: revision 1.8
	sys/net/npf/npf.c: revision 1.9
	sys/net/npf/npf_alg_icmp.c: revision 1.9
	sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes.  Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.

Revision 1.10 / (download) - annotate - [select for diffs], Tue Mar 13 18:40:59 2012 UTC (12 years, 1 month ago) by elad
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base10
Changes since 1.9: +6 -4 lines
Diff to previous 1.9 (colored)

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

    http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
    http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
    http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

Revision 1.9 / (download) - annotate - [select for diffs], Sun Mar 11 18:27:59 2012 UTC (12 years, 1 month ago) by rmind
Branch: MAIN
Changes since 1.8: +29 -14 lines
Diff to previous 1.8 (colored)

- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes.  Improve some comments.

Revision 1.6.4.2 / (download) - annotate - [select for diffs], Fri Feb 24 09:11:49 2012 UTC (12 years, 1 month ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.6.4.1: +15 -5 lines
Diff to previous 1.6.4.1 (colored) to branchpoint 1.6 (colored)

sync to -current.

Revision 1.8 / (download) - annotate - [select for diffs], Mon Feb 20 00:18:19 2012 UTC (12 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3
Changes since 1.7: +15 -5 lines
Diff to previous 1.7 (colored)

- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.

Revision 1.6.4.1 / (download) - annotate - [select for diffs], Sat Feb 18 07:35:38 2012 UTC (12 years, 1 month ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.6: +2 -5 lines
Diff to previous 1.6 (colored)

merge to -current.

Revision 1.7 / (download) - annotate - [select for diffs], Sun Jan 15 00:49:48 2012 UTC (12 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-6-base, jmcneill-usbmp-base2
Branch point for: netbsd-6
Changes since 1.6: +2 -5 lines
Diff to previous 1.6 (colored)

- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.

Revision 1.5.4.1 / (download) - annotate - [select for diffs], Thu Nov 10 14:31:50 2011 UTC (12 years, 5 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)

sync with head

Revision 1.6 / (download) - annotate - [select for diffs], Sun Nov 6 13:08:04 2011 UTC (12 years, 5 months ago) by tron
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base, jmcneill-audiomp3-base, jmcneill-audiomp3
Branch point for: jmcneill-usbmp
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)

Change module class to driver as npf(4) is a pseudo device.

Revision 1.2.2.1 / (download) - annotate - [select for diffs], Mon Jun 6 09:09:53 2011 UTC (12 years, 10 months ago) by jruoho
Branch: jruoho-x86intr
Changes since 1.2: +7 -3 lines
Diff to previous 1.2 (colored) next main 1.3 (colored)

Sync with HEAD.

Revision 1.4.2.3 / (download) - annotate - [select for diffs], Tue May 31 03:05:07 2011 UTC (12 years, 10 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.4.2.2: +1 -0 lines
Diff to previous 1.4.2.2 (colored) to branchpoint 1.4 (colored) next main 1.5 (colored)

sync with head

Revision 1.5 / (download) - annotate - [select for diffs], Mon Apr 25 22:16:21 2011 UTC (12 years, 11 months ago) by yamt
Branch: MAIN
CVS Tags: yamt-pagecache-base, rmind-uvmplock-nbase, rmind-uvmplock-base, cherry-xenmp-base, cherry-xenmp
Branch point for: yamt-pagecache
Changes since 1.4: +3 -2 lines
Diff to previous 1.4 (colored)

fix module build

Revision 1.4.2.2 / (download) - annotate - [select for diffs], Sat Mar 5 20:55:54 2011 UTC (13 years, 1 month ago) by rmind
Branch: rmind-uvmplock
Changes since 1.4.2.1: +380 -0 lines
Diff to previous 1.4.2.1 (colored) to branchpoint 1.4 (colored)

sync with head

Revision 1.3.2.1 / (download) - annotate - [select for diffs], Tue Feb 8 16:20:01 2011 UTC (13 years, 2 months ago) by bouyer
Branch: bouyer-quota2
Changes since 1.3: +5 -2 lines
Diff to previous 1.3 (colored) next main 1.4 (colored)

Sync with HEAD

Revision 1.4.2.1, Wed Feb 2 02:20:25 2011 UTC (13 years, 2 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.4: +0 -380 lines
FILE REMOVED

file npf.c was added on branch rmind-uvmplock on 2011-03-05 20:55:54 +0000

Revision 1.4 / (download) - annotate - [select for diffs], Wed Feb 2 02:20:25 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: bouyer-quota2-nbase, bouyer-quota2-base
Branch point for: rmind-uvmplock
Changes since 1.3: +5 -2 lines
Diff to previous 1.3 (colored)

NPF checkpoint:
- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc).
- Add NPF support for ftp-proxy(8).
- Add rc.d script for NPF.
- Convert npfctl(8) to use libnpf(3) and thus make it less depressive.
  Note: next clean-up step should be a parser, once dholland@ will finish it.
- Add more documentation.
- Various fixes.

Revision 1.3 / (download) - annotate - [select for diffs], Tue Jan 18 20:33:45 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
Branch point for: bouyer-quota2
Changes since 1.2: +3 -3 lines
Diff to previous 1.2 (colored)

NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
  potentially other functions from the rule structure.  Rule procedure can be
  shared amongst the rules.  Separation is both at kernel level (npf_rproc_t)
  and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic.  Use TCP FSM definitions.
- Add if_byindex(), OK by matt@.  Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.

Revision 1.2 / (download) - annotate - [select for diffs], Sat Dec 18 01:07:25 2010 UTC (13 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: matt-mips64-premerge-20101231, jruoho-x86intr-base
Branch point for: jruoho-x86intr
Changes since 1.1: +191 -30 lines
Diff to previous 1.1 (colored)

NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.

Revision 1.1.4.2 / (download) - annotate - [select for diffs], Fri Oct 22 09:23:14 2010 UTC (13 years, 5 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.1.4.1: +216 -0 lines
Diff to previous 1.1.4.1 (colored) to branchpoint 1.1 (colored) next main 1.2 (colored)

Sync with HEAD (-D20101022).

Revision 1.1.2.2 / (download) - annotate - [select for diffs], Sat Oct 9 03:32:37 2010 UTC (13 years, 6 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.1.2.1: +216 -0 lines
Diff to previous 1.1.2.1 (colored) to branchpoint 1.1 (colored) next main 1.2 (colored)

sync with head

Revision 1.1.4.1, Sun Aug 22 18:56:22 2010 UTC (13 years, 7 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.1: +0 -216 lines
FILE REMOVED

file npf.c was added on branch uebayasi-xip on 2010-10-22 09:23:14 +0000

Revision 1.1.2.1, Sun Aug 22 18:56:22 2010 UTC (13 years, 7 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.1: +0 -216 lines
FILE REMOVED

file npf.c was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000

Revision 1.1 / (download) - annotate - [select for diffs], Sun Aug 22 18:56:22 2010 UTC (13 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, uebayasi-xip-base4, uebayasi-xip-base3
Branch point for: yamt-nfs-mp, uebayasi-xip

Import NPF - a packet filter.  Some features:

- Designed to be fully MP-safe and highly efficient.

- Tables/IP sets (hash or red-black tree) for high performance lookups.

- Stateful filtering and Network Address Port Translation (NAPT).
  Framework for application level gateways (ALGs).

- Packet inspection engine called n-code processor - inspired by BPF -
  supporting generic RISC-like and specific CISC-like instructions for
  common patterns (e.g. IPv4 address matching).  See npf_ncode(9) manual.

- Convenient userland utility npfctl(8) with npf.conf(8).

NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.

Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>