The NetBSD Project

CVS log for src/sys/net/npf/npf_handler.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / net / npf

Request diff between arbitrary revisions


Keyword substitution: kv
Default branch: MAIN


Revision 1.50: download - view: text, markup, annotated - select for diffs
Fri Jul 5 04:34:35 2024 UTC (7 months, 2 weeks ago) by rin
Branches: MAIN
CVS tags: HEAD
Diff to: previous 1.49: preferred, colored
Changes since revision 1.49: +4 -6 lines
npf: Drop redundant NULL check before m_freem(9)

XXX
Their standalone version of m_freem() does not work for NULL input.
I will send pullreq to upstream soon.

Revision 1.46.2.3: download - view: text, markup, annotated - select for diffs
Sat Jun 20 15:46:48 2020 UTC (4 years, 7 months ago) by martin
Branches: netbsd-9
CVS tags: netbsd-9-4-RELEASE, netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Diff to: previous 1.46.2.2: preferred, colored; branchpoint 1.46: preferred, colored; next MAIN 1.47: preferred, colored
Changes since revision 1.46.2.2: +35 -12 lines
Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@.

Use more markup.

Revision 1.49: download - view: text, markup, annotated - select for diffs
Sat May 30 14:16:56 2020 UTC (4 years, 8 months ago) by rmind
Branches: MAIN
CVS tags: thorpej-ifq-base, thorpej-ifq, thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, thorpej-altq-separation-base, thorpej-altq-separation, perseant-exfatfs-base-20240630, perseant-exfatfs-base, perseant-exfatfs, netbsd-10-base, netbsd-10-1-RELEASE, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-sunxi-drm-base, bouyer-sunxi-drm
Diff to: previous 1.48: preferred, colored
Changes since revision 1.48: +35 -12 lines
Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.

Revision 1.39.2.2: download - view: text, markup, annotated - select for diffs
Mon Apr 13 08:05:15 2020 UTC (4 years, 10 months ago) by martin
Branches: phil-wifi
Diff to: previous 1.39.2.1: preferred, colored; branchpoint 1.39: preferred, colored; next MAIN 1.40: preferred, colored
Changes since revision 1.39.2.1: +8 -9 lines
Mostly merge changes from HEAD upto 20200411

Revision 1.46.2.2: download - view: text, markup, annotated - select for diffs
Sun Sep 1 13:21:39 2019 UTC (5 years, 5 months ago) by martin
Branches: netbsd-9
CVS tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Diff to: previous 1.46.2.1: preferred, colored; branchpoint 1.46: preferred, colored
Changes since revision 1.46.2.1: +5 -4 lines
Pull up following revision(s) (requested by rmind in ticket #141):

	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.15
	sys/net/npf/npf_alg.c: revision 1.21
	sys/net/npf/npf.h: revision 1.62
	sys/net/npf/npf_ctl.c: revision 1.57
	sys/net/npf/npf_ctl.c: revision 1.58
	sys/net/npf/npf_os.c: revision 1.16
	sys/net/npf/npf_os.c: revision 1.17
	sys/net/npf/npf_conf.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.78
	sys/sys/mbuf.h: revision 1.220
	sys/net/npf/npf_impl.h: revision 1.79
	sys/net/npf/npf.c: revision 1.41
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.19
	sys/net/npf/npf_nat.c: revision 1.48
	sys/net/npf/npf_handler.c: revision 1.48
	sys/net/npf/npf_ifaddr.c: revision 1.6

- npfctl_load_nvlist: simplify the config loading logic.
- Fix a small race condition in npf_nat_getaddr().
- Rework pserialize/EBR wrappers, make it easier to maintain.
Move PACKET_TAG_NPF where it belongs to.
Make npfctl_switch() and pfil private to OS-specific module.

Revision 1.48: download - view: text, markup, annotated - select for diffs
Sun Aug 25 13:21:03 2019 UTC (5 years, 5 months ago) by rmind
Branches: MAIN
CVS tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Diff to: previous 1.47: preferred, colored
Changes since revision 1.47: +5 -4 lines
- npfctl_load_nvlist: simplify the config loading logic.
- Fix a small race condition in npf_nat_getaddr().
- Rework pserialize/EBR wrappers, make it easier to maintain.

Revision 1.46.2.1: download - view: text, markup, annotated - select for diffs
Tue Aug 13 14:35:55 2019 UTC (5 years, 6 months ago) by martin
Branches: netbsd-9
Diff to: previous 1.46: preferred, colored
Changes since revision 1.46: +3 -3 lines
Pull up following revision(s) (requested by rmind in ticket #49):

	usr.sbin/npf/npf.7: revision 1.7
	sys/net/npf/npfkern.h: revision 1.4
	sys/net/npf/npf_conn.h: revision 1.18
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.55
	sys/net/npf/npf_os.c: revision 1.14
	sys/net/npf/npf_conf.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/npf_perf_test.c: revision 1.9
	sys/net/npf/npf_impl.h: revision 1.76
	sys/net/npf/npf_portmap.c: revision 1.4
	sys/net/npf/npf_params.c: revision 1.2
	sys/net/npf/npf.c: revision 1.40
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.18
	sys/net/npf/npf_nat.c: revision 1.47
	sys/net/npf/npf_handler.c: revision 1.47
	sys/net/npf/npf_inet.c: revision 1.55
	sys/net/npf/npf_if.c: revision 1.10
	sys/net/npf/npf_worker.c: revision 1.7
	usr.sbin/npf/npf-params.7: revision 1.3

npf-params(7): add more bpf.jit details.
From David H. Gutteridge.

Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

npf.7: add xref to npf-params.7
(Adding directly here since this particular file isn't included in
rmind@'s upstream GitHub repo at present.)

Revision 1.47: download - view: text, markup, annotated - select for diffs
Sun Aug 11 20:26:33 2019 UTC (5 years, 6 months ago) by rmind
Branches: MAIN
Diff to: previous 1.46: preferred, colored
Changes since revision 1.46: +3 -3 lines
Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

Revision 1.46: download - view: text, markup, annotated - select for diffs
Tue Jul 23 00:52:01 2019 UTC (5 years, 6 months ago) by rmind
Branches: MAIN
CVS tags: netbsd-9-base
Branch point for: netbsd-9
Diff to: previous 1.45: preferred, colored
Changes since revision 1.45: +2 -4 lines
NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Revision 1.39.2.1: download - view: text, markup, annotated - select for diffs
Mon Jun 10 22:09:46 2019 UTC (5 years, 8 months ago) by christos
Branches: phil-wifi
Diff to: previous 1.39: preferred, colored
Changes since revision 1.39: +27 -31 lines
Sync with HEAD

Revision 1.37.12.3: download - view: text, markup, annotated - select for diffs
Sun Sep 30 01:45:56 2018 UTC (6 years, 4 months ago) by pgoyette
Branches: pgoyette-compat
CVS tags: pgoyette-compat-merge-20190127
Diff to: previous 1.37.12.2: preferred, colored; branchpoint 1.37: preferred, colored; next MAIN 1.38: preferred, colored
Changes since revision 1.37.12.2: +1 -3 lines
Ssync with HEAD

Revision 1.45: download - view: text, markup, annotated - select for diffs
Sat Sep 29 14:41:36 2018 UTC (6 years, 4 months ago) by rmind
Branches: MAIN
CVS tags: phil-wifi-20190609, pgoyette-compat-20190127, pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930, isaki-audio2-base, isaki-audio2
Diff to: previous 1.44: preferred, colored
Changes since revision 1.44: +1 -3 lines
NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
  a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
  previous versions.  Also, different serialisation format means NPF
  connection/config saving and loading is not compatible with the
  previous versions either.

Thanks to christos@ for extra testing.

Revision 1.37.12.2: download - view: text, markup, annotated - select for diffs
Sat Jul 28 04:38:10 2018 UTC (6 years, 6 months ago) by pgoyette
Branches: pgoyette-compat
Diff to: previous 1.37.12.1: preferred, colored; branchpoint 1.37: preferred, colored
Changes since revision 1.37.12.1: +28 -30 lines
Sync with HEAD

Revision 1.44: download - view: text, markup, annotated - select for diffs
Tue Jul 10 16:49:09 2018 UTC (6 years, 7 months ago) by maxv
Branches: MAIN
CVS tags: pgoyette-compat-0906, pgoyette-compat-0728
Diff to: previous 1.43: preferred, colored
Changes since revision 1.43: +6 -9 lines
Modify the logic in npf_reassembly. Don't call nbuf_reset, we don't need
it since we don't read the IPv4 header anymore.

If ip{6}_reass_packet fails, always free 'm', and always clear the nbuf.

We want to avoid the case where

	'm' was reallocated
	the nbuf pointer was not updated accordingly
	the caller tried to use the nbuf pointer

This case doesn't happen right now, but the code is fragile, so strengthen
it.

Revision 1.43: download - view: text, markup, annotated - select for diffs
Tue Jul 10 15:46:58 2018 UTC (6 years, 7 months ago) by maxv
Branches: MAIN
Diff to: previous 1.42: preferred, colored
Changes since revision 1.42: +3 -4 lines
Remove the second argument from ip_reass_packet(). We want the IP header
on the mbuf, not elsewhere. Simplifies the NPF reassembly code a little.
No real functional change.

Revision 1.42: download - view: text, markup, annotated - select for diffs
Tue Jul 10 15:25:01 2018 UTC (6 years, 7 months ago) by maxv
Branches: MAIN
Diff to: previous 1.41: preferred, colored
Changes since revision 1.41: +26 -24 lines
Simplify the pointer handling. Set *mp = NULL at the beginning of the
function. In npf_reassembly, pass a simple boolean instead of a ** mbuf
pointer. Add a KASSERT for IPv4, we don't want (error && !m). Remove
the 'fastout' label, use 'out'.

Revision 1.37.6.2: download - view: text, markup, annotated - select for diffs
Tue Jul 10 14:44:05 2018 UTC (6 years, 7 months ago) by martin
Branches: netbsd-8
CVS tags: netbsd-8-3-RELEASE, netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE
Diff to: previous 1.37.6.1: preferred, colored; branchpoint 1.37: preferred, colored; next MAIN 1.38: preferred, colored
Changes since revision 1.37.6.1: +3 -2 lines
Pull up following revision(s) (requested by maxv in ticket #919):

	sys/net/npf/npf_handler.c: revision 1.41

Update the pointer when fast-kicking, because it may have been freed.

Before my changes the nonsensical pointer ininitialization held, but
when I started introducing sanity checks the whole thing collapsed.

Need pullup-8.

Revision 1.41: download - view: text, markup, annotated - select for diffs
Tue Jul 10 14:04:07 2018 UTC (6 years, 7 months ago) by maxv
Branches: MAIN
Diff to: previous 1.40: preferred, colored
Changes since revision 1.40: +3 -2 lines
Update the pointer when fast-kicking, because it may have been freed.
Before my changes the nonsensical pointer ininitialization held, but
when I started introducing sanity checks the whole thing collapsed.

Need pullup-8.

Revision 1.40: download - view: text, markup, annotated - select for diffs
Tue Jul 10 12:31:46 2018 UTC (6 years, 7 months ago) by maxv
Branches: MAIN
Diff to: previous 1.39: preferred, colored
Changes since revision 1.39: +3 -4 lines
Set con = NULL just once, instead of doing it in each branch.

Revision 1.37.6.1: download - view: text, markup, annotated - select for diffs
Wed May 9 15:35:37 2018 UTC (6 years, 9 months ago) by martin
Branches: netbsd-8
CVS tags: netbsd-8-0-RC2
Diff to: previous 1.37: preferred, colored
Changes since revision 1.37: +14 -12 lines
Pull up following revision(s) (requested by maxv in ticket #817):

	sys/net/npf/npf_inet.c: revision 1.38-1.44
	sys/net/npf/npf_handler.c: revision 1.38-1.39
	sys/net/npf/npf_alg_icmp.c: revision 1.26
	sys/net/npf/npf.h: revision 1.56
	sys/net/npf/npf_sendpkt.c: revision 1.17-1.18

Declare NPC_FMTERR, and use it to kick malformed packets. Several sanity
checks are added in IPv6; after we see the first IPPROTO_FRAGMENT header,
we are allowed to fail to advance, otherwise we kick the packet.
Sent on tech-net@ a few days ago, no response, but I'm committing it now
anyway.

Switch nptr to uint8_t, and use nbuf_ensure_contig. Makes us use fewer
magic values.

Remove dead branches, 'npc' can't be NULL (and it is dereferenced
earlier).

Fix two consecutive mistakes.

The first mistake was npf_inet.c rev1.37:
        "Don't reassemble ipv6 fragments, instead treat the first fragment
        as a regular packet (subject to filtering rules), and pass
        subsequent fragments in the same group unconditionally."

Doing this was entirely wrong, because then a packet just had to push
the L4 payload in a secondary fragment, and NPF wouldn't apply rules on
it - meaning any IPv6 packet could bypass >=L4 filtering. This mistake
was supposed to be a fix for the second mistake.

The second mistake was that ip6_reass_packet (in npf_reassembly) was
getting called with npc->npc_hlen. But npc_hlen pointed to the last
encountered header in the IPv6 chain, which was not necessarily the
fragment header. So ip6_reass_packet was given garbage, and would fail,
resulting in the packet getting kicked. So basically IPv6 was broken by
NPF.

The first mistake is reverted, and the second one is fixed by doing:
-                       hlen = sizeof(struct ip6_frag);
+                       hlen = 0;

Now the iteration stops on the fragment header, and the call to
ip6_reass_packet is valid.

My npf_inet.c rev1.38 is partially reverted: we don't need to worry
about failing properly to advance; once the packet is reassembled
npf_cache_ip gets called again, and this time the whole chain should be
there.

Tested with a simple UDPv6 server - send a 3000-byte-sized buffer, the
packet gets correctly reassembled by NPF now.

Mmh, put back the RFC6946 check (about dummy fragments), otherwise NPF
is not happy in npf_reassembly, because NPC_IPFRAG is again returned after
the packet was reassembled.

I'm wondering whether it would not be better to just remove the fragment
header in frag6_input directly.

Fix the "return-rst" rule on IPv6 packets.
The scopes needed to be set on the addresses before invoking ip6_output,
because ip6_output needs them. The reason they are not here already is
because pfil_run_hooks (in ip6_input) is called _before_ the kernel
initializes the scopes.

Until now ip6_output was always failing, and the IPv6-TCP-RST packet was
never actually sent.

Perhaps it would be better to have the kernel initialize the scopes
before invoking pfil_run_hooks, but several things will need to be fixed
in several places.

Tested with a simple TCPv6 server. Until now the client would block
waiting for an answer that never came; now it receives an RST right away
and closes the connection, as expected.
I believe that the same problem exists in the "return-icmp" rules, but I
can't investigate this right now (some problems with wireshark).

Fix the IPv6 payload computation in npf_tcpsaw. It was incorrect, and this
caused the "return-rst" rules to send back an RST with the wrong ACK when
the received SYN had an IPv6 option.

Set the scopes before calling icmp6_error(). This fixes a bug similar to
the one I fixed in rev1.17: since the scopes were not set the packet was
never actually sent.

Tested with wireshark, now the ICMPv6 reply is correctly sent, as
expected.

Don't read the L4 payload after IPPROTO_AH when handling IPv6 packets.
AH must be considered as the payload, otherwise a

        block all
        pass in proto ah from any
        pass out proto ah from any

configuration will actually block everything, because NPF checks the
protocol against the one found after AH, and not AH itself.

In addition it may have been a problem for stateful connections; an AH
packet sent by an attacker with an incorrect authentication and a correct
TCP/UDP/whatever payload from an active connection could manage to change
NPF's FSM state, which would perhaps have altered the legitimate
connection with the authenticated remote IPsec host.

Note that IPv4 already doesn't go beyond AH, which is the correct
behavior.

Add XXX (we don't handle IPv6 Jumbograms), and whitespace.

Revision 1.37.12.1: download - view: text, markup, annotated - select for diffs
Thu Mar 15 09:12:06 2018 UTC (6 years, 11 months ago) by pgoyette
Branches: pgoyette-compat
Diff to: previous 1.37: preferred, colored
Changes since revision 1.37: +14 -12 lines
Synch with HEAD

Revision 1.39: download - view: text, markup, annotated - select for diffs
Tue Mar 13 09:04:02 2018 UTC (6 years, 11 months ago) by maxv
Branches: MAIN
CVS tags: phil-wifi-base, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: phil-wifi
Diff to: previous 1.38: preferred, colored
Changes since revision 1.38: +3 -10 lines
Fix two consecutive mistakes.

The first mistake was npf_inet.c rev1.37:

	"Don't reassemble ipv6 fragments, instead treat the first fragment
	as a regular packet (subject to filtering rules), and pass
	subsequent fragments in the same group unconditionally."

Doing this was entirely wrong, because then a packet just had to push
the L4 payload in a secondary fragment, and NPF wouldn't apply rules on
it - meaning any IPv6 packet could bypass >=L4 filtering. This mistake
was supposed to be a fix for the second mistake.

The second mistake was that ip6_reass_packet (in npf_reassembly) was
getting called with npc->npc_hlen. But npc_hlen pointed to the last
encountered header in the IPv6 chain, which was not necessarily the
fragment header. So ip6_reass_packet was given garbage, and would fail,
resulting in the packet getting kicked. So basically IPv6 was broken by
NPF.

The first mistake is reverted, and the second one is fixed by doing:

-			hlen = sizeof(struct ip6_frag);
+			hlen = 0;

Now the iteration stops on the fragment header, and the call to
ip6_reass_packet is valid.

My npf_inet.c rev1.38 is partially reverted: we don't need to worry
about failing properly to advance; once the packet is reassembled
npf_cache_ip gets called again, and this time the whole chain should be
there.

Tested with a simple UDPv6 server - send a 3000-byte-sized buffer, the
packet gets correctly reassembled by NPF now.

Revision 1.38: download - view: text, markup, annotated - select for diffs
Thu Mar 8 07:06:13 2018 UTC (6 years, 11 months ago) by maxv
Branches: MAIN
Diff to: previous 1.37: preferred, colored
Changes since revision 1.37: +13 -4 lines
Declare NPC_FMTERR, and use it to kick malformed packets. Several sanity
checks are added in IPv6; after we see the first IPPROTO_FRAGMENT header,
we are allowed to fail to advance, otherwise we kick the packet.

Sent on tech-net@ a few days ago, no response, but I'm committing it now
anyway.

Revision 1.21.2.4: download - view: text, markup, annotated - select for diffs
Sun Dec 3 11:39:03 2017 UTC (7 years, 2 months ago) by jdolecek
Branches: tls-maxphys
Diff to: previous 1.21.2.3: preferred, colored; next MAIN 1.22: preferred, colored
Changes since revision 1.21.2.3: +61 -147 lines
update from HEAD

Revision 1.33.4.2: download - view: text, markup, annotated - select for diffs
Mon Aug 28 17:53:11 2017 UTC (7 years, 5 months ago) by skrll
Branches: nick-nhusb
Diff to: previous 1.33.4.1: preferred, colored; branchpoint 1.33: preferred, colored; next MAIN 1.34: preferred, colored
Changes since revision 1.33.4.1: +13 -5 lines
Sync with HEAD

Revision 1.35.2.1: download - view: text, markup, annotated - select for diffs
Fri Apr 21 16:54:05 2017 UTC (7 years, 9 months ago) by bouyer
Branches: bouyer-socketcan
Diff to: previous 1.35: preferred, colored; next MAIN 1.36: preferred, colored
Changes since revision 1.35: +25 -14 lines
Sync with HEAD

Revision 1.33.8.2: download - view: text, markup, annotated - select for diffs
Mon Mar 20 06:57:50 2017 UTC (7 years, 11 months ago) by pgoyette
Branches: pgoyette-localcount
Diff to: previous 1.33.8.1: preferred, colored; branchpoint 1.33: preferred, colored; next MAIN 1.34: preferred, colored
Changes since revision 1.33.8.1: +25 -14 lines
Sync with HEAD

Revision 1.37: download - view: text, markup, annotated - select for diffs
Sun Feb 19 20:27:22 2017 UTC (8 years ago) by christos
Branches: MAIN
CVS tags: tls-maxphys-base-20171202, prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-compat-base, perseant-stdc-iso10646-base, perseant-stdc-iso10646, nick-nhusb-base-20170825, netbsd-8-base, netbsd-8-0-RC1, matt-nb8-mediatek-base, matt-nb8-mediatek, jdolecek-ncq-base, jdolecek-ncq, bouyer-socketcan-base1
Branch point for: pgoyette-compat, netbsd-8
Diff to: previous 1.36: preferred, colored
Changes since revision 1.36: +13 -5 lines
Don't reassemble ipv6 fragments, instead treat the first fragment as a regular
packet (subject to filtering rules), and pass subsequent fragments in the
same group unconditionally.

Revision 1.33.4.1: download - view: text, markup, annotated - select for diffs
Sun Feb 5 13:40:58 2017 UTC (8 years ago) by skrll
Branches: nick-nhusb
Diff to: previous 1.33: preferred, colored
Changes since revision 1.33: +53 -147 lines
Sync with HEAD

Revision 1.36: download - view: text, markup, annotated - select for diffs
Sun Jan 29 00:15:54 2017 UTC (8 years ago) by christos
Branches: MAIN
CVS tags: nick-nhusb-base-20170204
Diff to: previous 1.35: preferred, colored
Changes since revision 1.35: +15 -12 lines
- Increase copyin buffer size to 4M
- Change log output format to be like the OpenBSD's pf including in
  the header the matching rule etc, and fill in the matching info.

Revision 1.33.8.1: download - view: text, markup, annotated - select for diffs
Sat Jan 7 08:56:50 2017 UTC (8 years, 1 month ago) by pgoyette
Branches: pgoyette-localcount
Diff to: previous 1.33: preferred, colored
Changes since revision 1.33: +40 -137 lines
Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.35: download - view: text, markup, annotated - select for diffs
Mon Dec 26 23:05:06 2016 UTC (8 years, 1 month ago) by christos
Branches: MAIN
CVS tags: pgoyette-localcount-20170107, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Diff to: previous 1.34: preferred, colored
Changes since revision 1.34: +31 -135 lines
Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)

Revision 1.34: download - view: text, markup, annotated - select for diffs
Thu Dec 8 23:07:11 2016 UTC (8 years, 2 months ago) by rmind
Branches: MAIN
Diff to: previous 1.33: preferred, colored
Changes since revision 1.33: +9 -2 lines
NPF: adjust the 'stateful-ends' mechanism to tag the packets and thus
pass-through them on other interfaces.  Per discussion with christos@.

Revision 1.21.2.3: download - view: text, markup, annotated - select for diffs
Wed Aug 20 00:04:35 2014 UTC (10 years, 6 months ago) by tls
Branches: tls-maxphys
Diff to: previous 1.21.2.2: preferred, colored
Changes since revision 1.21.2.2: +93 -66 lines
Rebase to HEAD as of a few days ago.

Revision 1.29.2.1: download - view: text, markup, annotated - select for diffs
Sun Aug 10 06:56:16 2014 UTC (10 years, 6 months ago) by tls
Branches: tls-earlyentropy
Diff to: previous 1.29: preferred, colored; next MAIN 1.30: preferred, colored
Changes since revision 1.29: +42 -33 lines
Rebase.

Revision 1.33: download - view: text, markup, annotated - select for diffs
Wed Jul 23 01:25:34 2014 UTC (10 years, 6 months ago) by rmind
Branches: MAIN
CVS tags: tls-maxphys-base, tls-earlyentropy-base, pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20161204, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, nick-nhusb-base-20151226, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0, netbsd-7, localcount-20160914
Branch point for: pgoyette-localcount, nick-nhusb
Diff to: previous 1.32: preferred, colored
Changes since revision 1.32: +3 -3 lines
NPF: rework of the connection saving and restoring:
- Add support for saving a snapshot of the current connections together
  with a full configuration.  Support a reverse load operation.  Eliminate
  the old 'sess-save' and 'sess-load' in favour of the new mechanism.
- Share code between load and reload operations: the latter performs
  load from npf.conf without affecting the connections.
- Simplify and fix races with connection loading.
- Bump NPF_VERSION.

Revision 1.32: download - view: text, markup, annotated - select for diffs
Sun Jul 20 00:37:41 2014 UTC (10 years, 7 months ago) by rmind
Branches: MAIN
Diff to: previous 1.31: preferred, colored
Changes since revision 1.31: +17 -14 lines
NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.

Revision 1.31: download - view: text, markup, annotated - select for diffs
Sat Jul 19 18:24:16 2014 UTC (10 years, 7 months ago) by rmind
Branches: MAIN
Diff to: previous 1.30: preferred, colored
Changes since revision 1.30: +25 -24 lines
NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
  and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.

Revision 1.7.6.6: download - view: text, markup, annotated - select for diffs
Thu May 22 11:41:09 2014 UTC (10 years, 9 months ago) by yamt
Branches: yamt-pagecache
Diff to: previous 1.7.6.5: preferred, colored; branchpoint 1.7: preferred, colored; next MAIN 1.8: preferred, colored
Changes since revision 1.7.6.5: +78 -55 lines
sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.30: download - view: text, markup, annotated - select for diffs
Mon May 19 18:45:51 2014 UTC (10 years, 9 months ago) by jakllsch
Branches: MAIN
Diff to: previous 1.29: preferred, colored
Changes since revision 1.29: +9 -4 lines
Add ability to have mbufs disappear (to another interface) during
npf_rproc_run().  For upcoming npf_ext_route extension.

Guidance and ok by rmind@.

Revision 1.26.2.2: download - view: text, markup, annotated - select for diffs
Sun May 18 17:46:13 2014 UTC (10 years, 9 months ago) by rmind
Branches: rmind-smpnet
Diff to: previous 1.26.2.1: preferred, colored; branchpoint 1.26: preferred, colored; next MAIN 1.27: preferred, colored
Changes since revision 1.26.2.1: +47 -29 lines
sync with head

Revision 1.29: download - view: text, markup, annotated - select for diffs
Fri Mar 14 11:29:44 2014 UTC (10 years, 11 months ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Diff to: previous 1.28: preferred, colored
Changes since revision 1.28: +4 -3 lines
NPF: add support for "stateful-ends".

Revision 1.28: download - view: text, markup, annotated - select for diffs
Fri Nov 8 00:38:26 2013 UTC (11 years, 3 months ago) by rmind
Branches: MAIN
Diff to: previous 1.27: preferred, colored
Changes since revision 1.27: +45 -28 lines
NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections).  Once the interface is reattached they will
become active.

Bump NPF_VERSION.

Revision 1.26.2.1: download - view: text, markup, annotated - select for diffs
Wed Aug 28 23:59:36 2013 UTC (11 years, 5 months ago) by rmind
Branches: rmind-smpnet
Diff to: previous 1.26: preferred, colored
Changes since revision 1.26: +10 -10 lines
sync with head

Revision 1.27: download - view: text, markup, annotated - select for diffs
Sat Jun 29 21:06:58 2013 UTC (11 years, 7 months ago) by rmind
Branches: MAIN
CVS tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Diff to: previous 1.26: preferred, colored
Changes since revision 1.26: +10 -10 lines
- Rewrite parts of pfil(9): use array to store hooks and thus be more cache
  friendly (there are only few hooks in the system).  Make the structures
  opaque and the interface more strict.
- Remove PFIL_HOOKS option by making pfil(9) mandatory.

Revision 1.21.2.2: download - view: text, markup, annotated - select for diffs
Mon Feb 25 00:30:03 2013 UTC (11 years, 11 months ago) by tls
Branches: tls-maxphys
Diff to: previous 1.21.2.1: preferred, colored
Changes since revision 1.21.2.1: +91 -57 lines
resync with head

Revision 1.13.2.9: download - view: text, markup, annotated - select for diffs
Mon Feb 11 21:49:48 2013 UTC (12 years ago) by riz
Branches: netbsd-6
CVS tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1
Diff to: previous 1.13.2.8: preferred, colored; branchpoint 1.13: preferred, colored; next MAIN 1.14: preferred, colored
Changes since revision 1.13.2.8: +26 -21 lines
Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.

Revision 1.26: download - view: text, markup, annotated - select for diffs
Sat Feb 9 03:35:31 2013 UTC (12 years ago) by rmind
Branches: MAIN
CVS tags: khorben-n900, agc-symver-base, agc-symver
Branch point for: rmind-smpnet
Diff to: previous 1.25: preferred, colored
Changes since revision 1.25: +26 -21 lines
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

Revision 1.13.2.8: download - view: text, markup, annotated - select for diffs
Fri Feb 8 19:18:10 2013 UTC (12 years ago) by riz
Branches: netbsd-6
Diff to: previous 1.13.2.7: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.7: +72 -43 lines
Pull up following revision(s) (requested by rmind in ticket #777):
	usr.sbin/npf/npfctl/npfctl.c: revision 1.27
	sys/net/npf/npf_session.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.4
	sys/net/npf/npf_rproc.c: revision 1.5
	usr.sbin/npf/npftest/README: revision 1.3
	sys/sys/mbuf.h: revision 1.151
	sys/net/npf/npf_ruleset.c: revision 1.15
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.3
	sys/net/npf/npf_ruleset.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.4
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.19
	sys/net/npf/npf_instr.c: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.24
	sys/net/npf/npf_handler.c: revision 1.25
	sys/net/npf/npf_state_tcp.c: revision 1.12
	sys/net/npf/npf_processor.c: revision 1.13
	sys/net/npf/npf_impl.h: revision 1.25
	sys/net/npf/npf_processor.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.10
	sys/net/npf/npf_alg_icmp.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.3
	sys/net/npf/npf_session.c: revision 1.20
	sys/net/npf/npf_alg.c: revision 1.6
	sys/kern/uipc_mbuf.c: revision 1.148
	sys/net/npf/npf_inet.c: revision 1.20
	sys/net/npf/npf.h: revision 1.25
	sys/net/npf/npf_nat.c: revision 1.18
	sys/net/npf/npf_state.c: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.13
	sys/net/npf/npf_ext_log.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.4
	sys/net/npf/npf_ext_normalise.c: revision 1.2
- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.
Silence gcc in npf_recache().
Add m_ensure_contig() routine, which is equivalent to m_pullup, but does not
destroy the mbuf chain on failure (it is kept valid).
- nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free
  the mbuf chain on failure.  Fixes some corner cases.  Improve regression
  test and sprinkle some asserts.
- npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix).
  The problem was found and fix provided by Anthony Mallet.

Revision 1.7.6.5: download - view: text, markup, annotated - select for diffs
Wed Jan 23 00:06:25 2013 UTC (12 years ago) by yamt
Branches: yamt-pagecache
CVS tags: yamt-pagecache-tag8
Diff to: previous 1.7.6.4: preferred, colored; branchpoint 1.7: preferred, colored
Changes since revision 1.7.6.4: +72 -43 lines
sync with head

Revision 1.25: download - view: text, markup, annotated - select for diffs
Sun Jan 20 18:45:56 2013 UTC (12 years, 1 month ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base8
Diff to: previous 1.24: preferred, colored
Changes since revision 1.24: +6 -3 lines
- nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free
  the mbuf chain on failure.  Fixes some corner cases.  Improve regression
  test and sprinkle some asserts.
- npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix).
  The problem was found and fix provided by Anthony Mallet.

Revision 1.24: download - view: text, markup, annotated - select for diffs
Mon Dec 24 19:05:43 2012 UTC (12 years, 1 month ago) by rmind
Branches: MAIN
Diff to: previous 1.23: preferred, colored
Changes since revision 1.23: +69 -43 lines
- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.

Revision 1.21.2.1: download - view: text, markup, annotated - select for diffs
Tue Nov 20 03:02:47 2012 UTC (12 years, 3 months ago) by tls
Branches: tls-maxphys
Diff to: previous 1.21: preferred, colored
Changes since revision 1.21: +9 -6 lines
Resync to 2012-11-19 00:00:00 UTC

Revision 1.13.2.7: download - view: text, markup, annotated - select for diffs
Sun Nov 18 22:38:25 2012 UTC (12 years, 3 months ago) by riz
Branches: netbsd-6
Diff to: previous 1.13.2.6: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.6: +5 -4 lines
Pull up following revision(s) (requested by rmind in ticket #693):
	lib/npf/ext_normalise/shlib_version: revision 1.1
	lib/libnpf/npf.c: revision 1.13
	distrib/sets/lists/modules/mi: revision 1.48
	sys/net/npf/npf_rproc.c: revision 1.3
	sys/net/npf/npf_rproc.c: revision 1.4
	sys/modules/npf/Makefile: revision 1.11
	usr.sbin/npf/npfctl/npfctl.h: revision 1.20
	lib/npf/ext_log/npfext_log.c: revision 1.1
	lib/libnpf/npf.h: revision 1.11
	sys/net/npf/npf_inet.c: revision 1.17
	sys/net/npf/npf_log.c: file removal
	sys/net/npf/npf_handler.c: revision 1.22
	distrib/sets/lists/base/shl.mi: revision 1.636
	sys/net/npf/npf_impl.h: revision 1.23
	usr.sbin/npf/npfctl/Makefile: revision 1.8
	lib/npf/Makefile: revision 1.1
	lib/npf/ext_log/shlib_version: revision 1.1
	lib/Makefile: revision 1.189
	distrib/sets/lists/comp/shl.mi: revision 1.236
	usr.sbin/npf/npfctl/npf_build.c: revision 1.14
	distrib/sets/lists/base/mi: revision 1.1007
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
	distrib/sets/lists/base/mi: revision 1.1009
	sys/net/npf/npf.h: revision 1.21
	lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.105
	lib/libnpf/Makefile: revision 1.3
	etc/mtree/NetBSD.dist.base: revision 1.106
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
	sys/net/npf/npf_ctl.c: revision 1.18
	lib/npf/ext_log/Makefile: revision 1.1
	distrib/sets/lists/comp/mi: revision 1.1781
	usr.sbin/npf/npfctl/npf_var.h: revision 1.4
	sys/net/npf/npf.c: revision 1.13
	sys/modules/Makefile: revision 1.111
	sys/net/npf/npf_ext_log.c: revision 1.1
	lib/npf/Makefile.inc: revision 1.1
	sys/net/npf/npf_ext_normalise.c: revision 1.1
	sys/net/npf/files.npf: revision 1.8
	sys/rump/net/lib/libnpf/Makefile: revision 1.2
	sys/modules/npf_ext_log/Makefile: revision 1.1
	lib/npf/ext_normalise/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npfctl.c: revision 1.20
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
	sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@

Revision 1.13.2.5.2.1: download - view: text, markup, annotated - select for diffs
Thu Nov 1 16:45:04 2012 UTC (12 years, 3 months ago) by matt
Branches: matt-nb6-plus
Diff to: previous 1.13.2.5: preferred, colored; next MAIN 1.13.2.6: preferred, colored
Changes since revision 1.13.2.5: +6 -4 lines
sync with netbsd-6-0-RELEASE.

Revision 1.7.6.4: download - view: text, markup, annotated - select for diffs
Tue Oct 30 17:22:44 2012 UTC (12 years, 3 months ago) by yamt
Branches: yamt-pagecache
Diff to: previous 1.7.6.3: preferred, colored; branchpoint 1.7: preferred, colored
Changes since revision 1.7.6.3: +26 -23 lines
sync with head

Revision 1.13.2.6: download - view: text, markup, annotated - select for diffs
Tue Oct 9 23:49:03 2012 UTC (12 years, 4 months ago) by riz
Branches: netbsd-6
CVS tags: netbsd-6-0-RELEASE, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, matt-nb6-plus-nbase, matt-nb6-plus-base
Diff to: previous 1.13.2.5: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.5: +6 -4 lines
Pull up following revision(s) (requested by rmind in ticket #594):
	sys/net/npf/npf_handler.c: revision 1.23
npf_packet_handler: drop the packet if IPv6 reassembly did not work.

Revision 1.23: download - view: text, markup, annotated - select for diffs
Sat Oct 6 23:38:20 2012 UTC (12 years, 4 months ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base7, yamt-pagecache-base6
Diff to: previous 1.22: preferred, colored
Changes since revision 1.22: +6 -4 lines
npf_packet_handler: drop the packet if IPv6 reassembly did not work.

Revision 1.22: download - view: text, markup, annotated - select for diffs
Sun Sep 16 13:47:41 2012 UTC (12 years, 5 months ago) by rmind
Branches: MAIN
Diff to: previous 1.21: preferred, colored
Changes since revision 1.21: +5 -4 lines
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.

Revision 1.13.2.5: download - view: text, markup, annotated - select for diffs
Mon Aug 13 17:49:52 2012 UTC (12 years, 6 months ago) by riz
Branches: netbsd-6
CVS tags: netbsd-6-0-RC2, netbsd-6-0-RC1
Branch point for: matt-nb6-plus
Diff to: previous 1.13.2.4: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.4: +4 -4 lines
Pull up following revision(s) (requested by rmind in ticket #485):
	lib/libnpf/npf.c: revision 1.11
	sys/net/npf/npf_session.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.10
	usr.sbin/npf/npftest/npftest.c: revision 1.4
	usr.sbin/npf/npftest/README: revision 1.1
	sys/net/npf/npf_tableset.c: revision 1.14
	usr.sbin/npf/npftest/npftest.h: revision 1.4
	lib/libnpf/npf.h: revision 1.10
	sys/net/npf/npf_ruleset.c: revision 1.14
	usr.sbin/npf/npfctl/npf_data.c: revision 1.18
	usr.sbin/npf/npftest/npftest.conf: revision 1.1
	sys/net/npf/npf_handler.c: revision 1.21
	sys/net/npf/npf_impl.h: revision 1.21
	usr.sbin/npf/npfctl/npfctl.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.13
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1
	usr.sbin/npf/npftest/npfstream.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.19
	sys/net/npf/npf_nat.c: revision 1.16
	sys/net/npf/npf_state.c: revision 1.11
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.12
- Extend npftest: add ruleset inspection testing from the config generated
  by npfctl debug functionality.  Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
  share between the entries and thus fix the handling of them.  Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.

Revision 1.21: download - view: text, markup, annotated - select for diffs
Sun Aug 12 03:35:14 2012 UTC (12 years, 6 months ago) by rmind
Branches: MAIN
Branch point for: tls-maxphys
Diff to: previous 1.20: preferred, colored
Changes since revision 1.20: +4 -4 lines
- Extend npftest: add ruleset inspection testing from the config generated
  by npfctl debug functionality.  Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
  share between the entries and thus fix the handling of them.  Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.

Revision 1.13.2.4: download - view: text, markup, annotated - select for diffs
Mon Jul 16 22:13:26 2012 UTC (12 years, 7 months ago) by riz
Branches: netbsd-6
Diff to: previous 1.13.2.3: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.3: +6 -5 lines
Pull up following revision(s) (requested by rmind in ticket #421):
	lib/libnpf/npf.c: revision 1.10
	sys/net/npf/npf_session.c: revision 1.15
	sys/net/npf/npf_tableset.c: revision 1.13
	sys/net/npf/npf_state_tcp.c: revision 1.9
	usr.sbin/npf/npfctl/npf_data.c: revision 1.15
	sys/net/npf/npf_inet.c: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.13
	sys/net/npf/npf.h: revision 1.19
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12
	sys/net/npf/npf_instr.c: revision 1.13
	sys/net/npf/npf_handler.c: revision 1.20
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4
	sys/net/npf/npf_alg_icmp.c: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.11
	lib/libnpf/npf.h: revision 1.9
	sys/net/npf/npf_alg.c: revision 1.5
	sys/rump/dev/lib/libnpf/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.15
	sys/net/npf/npf_tableset_ptree.c: revision 1.1
	sys/net/npf/npf.c: revision 1.12
	sys/net/npf/npf_sendpkt.c: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.18
	sys/net/npf/files.npf: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.10
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.20: download - view: text, markup, annotated - select for diffs
Sun Jul 15 00:23:00 2012 UTC (12 years, 7 months ago) by rmind
Branches: MAIN
Diff to: previous 1.19: preferred, colored
Changes since revision 1.19: +6 -5 lines
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.13.2.3: download - view: text, markup, annotated - select for diffs
Thu Jul 5 17:48:42 2012 UTC (12 years, 7 months ago) by riz
Branches: netbsd-6
Diff to: previous 1.13.2.2: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.2: +14 -13 lines
Pull up following revision(s) (requested by rmind in ticket #399):
	sys/net/npf/npf_session.c: revision 1.14
	sys/net/npf/npf_tableset.c: revision 1.12
	sys/net/npf/npf_state_tcp.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.14
	sys/net/npf/npf_inet.c: revision 1.13
	sys/net/npf/npf_ruleset.c: revision 1.12
	sys/net/npf/npf.h: revision 1.18
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.8: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2
	usr.sbin/npf/npfctl/npfctl.8: revision 1.8
	sys/net/npf/npf_instr.c: revision 1.12
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.13
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.14
	sys/net/npf/npf_state.c: revision 1.9
	sys/net/npf/npf_processor.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.13
	usr.sbin/npf/npfctl/npfctl.c: revision 1.14
	usr.sbin/npf/npfctl/npf_build.c: revision 1.10
	lib/libnpf/npf.3: revision 1.5
	lib/libnpf/npf.h: revision 1.8
	share/man/man9/npf_ncode.9: revision 1.9
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.4
	lib/libnpf/npf.c: revision 1.9
	usr.sbin/npf/npfctl/npfctl.h: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6
	sys/net/npf/npf_impl.h: revision 1.17
	sys/net/npf/npf_handler.c: revision 1.18
	sys/net/npf/npf_handler.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4
	sys/net/npf/npf_ncode.h: revision 1.9
Fix and update npf.conf(5), npfctl(8) and its usage message.
npf_state_tcp: fix for FIN retransmission and out-of-order ACK case.
NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.
npf_packet_handler: fix gcc unused warning.

Revision 1.19: download - view: text, markup, annotated - select for diffs
Mon Jul 2 06:55:58 2012 UTC (12 years, 7 months ago) by rmind
Branches: MAIN
Diff to: previous 1.18: preferred, colored
Changes since revision 1.18: +3 -3 lines
npf_packet_handler: fix gcc unused warning.

Revision 1.18: download - view: text, markup, annotated - select for diffs
Sun Jul 1 23:21:06 2012 UTC (12 years, 7 months ago) by rmind
Branches: MAIN
Diff to: previous 1.17: preferred, colored
Changes since revision 1.17: +14 -13 lines
NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.

Revision 1.13.2.2: download - view: text, markup, annotated - select for diffs
Tue Jun 26 00:07:16 2012 UTC (12 years, 7 months ago) by riz
Branches: netbsd-6
Diff to: previous 1.13.2.1: preferred, colored; branchpoint 1.13: preferred, colored
Changes since revision 1.13.2.1: +30 -22 lines
Pull up following revision(s) (requested by rmind in ticket #354):
	sys/net/npf/npf_state_tcp.c: revision 1.4
	sys/net/npf/npf_state_tcp.c: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.6
	usr.sbin/npf/npftest/npftest.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.1
	usr.sbin/npf/npftest/npftest.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.2
	usr.sbin/npf/npfctl/npf_data.c: revision 1.11
	usr.sbin/npf/npftest/npftest.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.12
	usr.sbin/npf/npftest/npftest.h: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.5
	usr.sbin/npf/npfctl/npf_data.c: revision 1.13
	sys/net/npf/npf.h: revision 1.16
	usr.sbin/npf/npftest/npftest.h: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.6
	usr.sbin/npf/npftest/npftest.h: revision 1.3
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.7
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.10
	usr.sbin/npf/npfctl/npf_build.c: revision 1.6
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.8
	usr.sbin/npf/npfctl/npf_build.c: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.9
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.10
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.11
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.12
	sys/net/npf/npf_state.c: revision 1.7
	usr.sbin/npf/npfctl/npfctl.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.12
	usr.sbin/npf/npfctl/Makefile: revision 1.7
	sys/rump/net/lib/libnet/Makefile: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.7
	usr.sbin/npf/npftest/Makefile: revision 1.1
	usr.sbin/npf/npftest/Makefile: revision 1.2
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.2
	usr.sbin/npf/npftest/npfstream.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.3
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.12
	sys/rump/dev/lib/libnpf/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.14
	sys/rump/dev/lib/libnpf/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.15
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.9
	sys/net/npf/npf_ctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_var.c: revision 1.4
	usr.sbin/npf/npfctl/npf_var.h: revision 1.2
	usr.sbin/npf/npfctl/npf_var.c: revision 1.5
	sys/net/npf/npf_impl.h: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.10
	sys/net/npf/npf_impl.h: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.4
	sys/net/npf/npf_impl.h: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.5
	sys/net/npf/npf_handler.c: revision 1.17
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.2
	sys/net/npf/npf_ncode.h: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.3
	sys/net/npf/npf_ncode.h: revision 1.8
npf_tcp_inwindow: in a case of negative skew, bump the maximum seen value of
SEQ+LEN in the receiver's side correctly (using ACK from the sender's side).
PR/46265 from Changli Gao.
rumpnet_net: add pfil.c
Update rumpdev_npf; use WARNS=4.
Add initial NPF regression tests integrated with RUMP framework (running the
kernel part of NPF in userland).  Other tests will be added once converted to
RUMP framework.  All tests are in the public domain.
Some Makefile fixes from christos@.
- Fix double-free case on ICMP return case.
- npf_pfil_register: handle kernels without INET6 option correctly.
- Reduce some #ifdefs.
npfctl(8): add show-config command.  Also, update syntax.
npftest: add a stream processor, which prints out the TCP state information.
A tool for debugging connection tracking from tcpdump -w captured data.
npftest: add a module for TCP state tracking and add few test cases.
npf_state_tcp: add an assert; fix some comments while here.
- Rework NPF NAT syntax to be more structured and support future additions
  of different types and configurations of NAT.
- npfctl: improve disassemble and show-config command functionality.
- Fix custom ICMP code and type filtering.
make this compile again.
remove error(1) output
Remove superfluous Pp
- make each element of a variable hold a type
- change get_type to take an index, so we can get the individual types of
  each element (since primitive elements can be in lists)
- make port_range primitive
- add a routine to convert a variable of primitives to a variable containing
- only port ranges.
remove extra rule that got merged...

Revision 1.11.2.4: download - view: text, markup, annotated - select for diffs
Sat Jun 2 11:09:38 2012 UTC (12 years, 8 months ago) by mrg
Branches: jmcneill-usbmp
Diff to: previous 1.11.2.3: preferred, colored; branchpoint 1.11: preferred, colored; next MAIN 1.12: preferred, colored
Changes since revision 1.11.2.3: +28 -20 lines
sync to latest -current.

Revision 1.17: download - view: text, markup, annotated - select for diffs
Wed May 30 21:38:03 2012 UTC (12 years, 8 months ago) by rmind
Branches: MAIN
CVS tags: jmcneill-usbmp-base10
Diff to: previous 1.16: preferred, colored
Changes since revision 1.16: +2 -4 lines
npftest: add a stream processor, which prints out the TCP state information.
A tool for debugging connection tracking from tcpdump -w captured data.

Revision 1.7.6.3: download - view: text, markup, annotated - select for diffs
Wed May 23 10:08:15 2012 UTC (12 years, 8 months ago) by yamt
Branches: yamt-pagecache
Diff to: previous 1.7.6.2: preferred, colored; branchpoint 1.7: preferred, colored
Changes since revision 1.7.6.2: +30 -20 lines
sync with head.

Revision 1.16: download - view: text, markup, annotated - select for diffs
Sun May 6 02:45:25 2012 UTC (12 years, 9 months ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base5
Diff to: previous 1.15: preferred, colored
Changes since revision 1.15: +30 -20 lines
- Fix double-free case on ICMP return case.
- npf_pfil_register: handle kernels without INET6 option correctly.
- Reduce some #ifdefs.

Revision 1.7.6.2: download - view: text, markup, annotated - select for diffs
Tue Apr 17 00:08:39 2012 UTC (12 years, 10 months ago) by yamt
Branches: yamt-pagecache
Diff to: previous 1.7.6.1: preferred, colored; branchpoint 1.7: preferred, colored
Changes since revision 1.7.6.1: +75 -54 lines
sync with head

Revision 1.11.2.3: download - view: text, markup, annotated - select for diffs
Thu Apr 5 21:33:43 2012 UTC (12 years, 10 months ago) by mrg
Branches: jmcneill-usbmp
Diff to: previous 1.11.2.2: preferred, colored; branchpoint 1.11: preferred, colored
Changes since revision 1.11.2.2: +10 -4 lines
sync to latest -current.

Revision 1.13.2.1: download - view: text, markup, annotated - select for diffs
Tue Apr 3 17:22:53 2012 UTC (12 years, 10 months ago) by riz
Branches: netbsd-6
Diff to: previous 1.13: preferred, colored
Changes since revision 1.13: +44 -34 lines
Pull up following revision(s) (requested by rmind in ticket #158):
	sys/net/npf/npf_session.c: revision 1.12
	sys/net/npf/npf_tableset.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.11
	sys/net/npf/npf.h: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.5
	sys/net/npf/npf_ruleset.c: revision 1.11
	sys/net/npf/npf_instr.c: revision 1.10
	usr.sbin/npf/npfctl/Makefile: revision 1.6
	sys/net/npf/npf_processor.c: revision 1.10
	sys/net/npf/npf_log.c: revision 1.3
	lib/libnpf/npf.h: revision 1.7
	sys/net/npf/npf_alg.c: revision 1.3
	sys/net/npf/npf_sendpkt.c: revision 1.9
	lib/libnpf/npf.c: revision 1.8
	usr.sbin/npf/npfctl/npfctl.h: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.13
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
	sys/net/npf/npf_ctl.c: revision 1.14
	sys/net/npf/npf_nat.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.12
	sys/net/npf/npf_impl.h: revision 1.11
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
	sys/net/npf/npf_impl.h: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
	sys/net/npf/npf_handler.c: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
	sys/net/npf/npf_handler.c: revision 1.15
	sys/net/npf/npf_ncode.h: revision 1.6
	sys/net/npf/npf.c: revision 1.8
	sys/net/npf/npf.c: revision 1.9
	sys/net/npf/npf_alg_icmp.c: revision 1.9
	sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes.  Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.

Revision 1.15: download - view: text, markup, annotated - select for diffs
Sun Mar 11 18:27:59 2012 UTC (12 years, 11 months ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base4, jmcneill-usbmp-base9, jmcneill-usbmp-base8
Diff to: previous 1.14: preferred, colored
Changes since revision 1.14: +12 -6 lines
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes.  Improve some comments.

Revision 1.11.2.2: download - view: text, markup, annotated - select for diffs
Fri Feb 24 09:11:49 2012 UTC (12 years, 11 months ago) by mrg
Branches: jmcneill-usbmp
Diff to: previous 1.11.2.1: preferred, colored; branchpoint 1.11: preferred, colored
Changes since revision 1.11.2.1: +34 -30 lines
sync to -current.

Revision 1.14: download - view: text, markup, annotated - select for diffs
Mon Feb 20 00:18:19 2012 UTC (13 years ago) by rmind
Branches: MAIN
CVS tags: jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3
Diff to: previous 1.13: preferred, colored
Changes since revision 1.13: +34 -30 lines
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.

Revision 1.11.2.1: download - view: text, markup, annotated - select for diffs
Sat Feb 18 07:35:38 2012 UTC (13 years ago) by mrg
Branches: jmcneill-usbmp
Diff to: previous 1.11: preferred, colored
Changes since revision 1.11: +37 -26 lines
merge to -current.

Revision 1.13: download - view: text, markup, annotated - select for diffs
Mon Feb 6 23:30:14 2012 UTC (13 years ago) by rmind
Branches: MAIN
CVS tags: netbsd-6-base, jmcneill-usbmp-base2
Branch point for: netbsd-6
Diff to: previous 1.12: preferred, colored
Changes since revision 1.12: +36 -26 lines
- Split NPF rule procedure code into a separate module (no functional changes).
- Simplify some code, add more comments, some asserts.
- G/C unused rule hook code.

Revision 1.12: download - view: text, markup, annotated - select for diffs
Sun Jan 15 00:49:48 2012 UTC (13 years, 1 month ago) by rmind
Branches: MAIN
Diff to: previous 1.11: preferred, colored
Changes since revision 1.11: +3 -2 lines
- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.

Revision 1.11: download - view: text, markup, annotated - select for diffs
Tue Nov 29 20:05:30 2011 UTC (13 years, 2 months ago) by rmind
Branches: MAIN
CVS tags: jmcneill-usbmp-pre-base2, jmcneill-usbmp-base
Branch point for: jmcneill-usbmp
Diff to: previous 1.10: preferred, colored
Changes since revision 1.10: +9 -9 lines
- Rework and improve TCP state tracking.
- Fix regressions after IPv6 patch merge.

Note: npfctl(8) rework will come soon.

Revision 1.7.6.1: download - view: text, markup, annotated - select for diffs
Thu Nov 10 14:31:50 2011 UTC (13 years, 3 months ago) by yamt
Branches: yamt-pagecache
Diff to: previous 1.7: preferred, colored
Changes since revision 1.7: +43 -12 lines
sync with head

Revision 1.10: download - view: text, markup, annotated - select for diffs
Sun Nov 6 02:49:03 2011 UTC (13 years, 3 months ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base3, yamt-pagecache-base2, jmcneill-audiomp3-base, jmcneill-audiomp3
Diff to: previous 1.9: preferred, colored
Changes since revision 1.9: +13 -14 lines
Few fixes, KNF/style, bump the NPF version.

Revision 1.9: download - view: text, markup, annotated - select for diffs
Sat Nov 5 10:23:26 2011 UTC (13 years, 3 months ago) by zoltan
Branches: MAIN
Diff to: previous 1.8: preferred, colored
Changes since revision 1.8: +7 -4 lines
When building the kernel without IPv6 support, compilation failed.
Fix that.

Revision 1.8: download - view: text, markup, annotated - select for diffs
Fri Nov 4 01:00:27 2011 UTC (13 years, 3 months ago) by zoltan
Branches: MAIN
Diff to: previous 1.7: preferred, colored
Changes since revision 1.7: +39 -10 lines
Add IPv6 support for NPF.

Revision 1.5.2.1: download - view: text, markup, annotated - select for diffs
Mon Jun 6 09:09:53 2011 UTC (13 years, 8 months ago) by jruoho
Branches: jruoho-x86intr
Diff to: previous 1.5: preferred, colored; next MAIN 1.6: preferred, colored
Changes since revision 1.5: +32 -23 lines
Sync with HEAD.

Revision 1.7.2.2: download - view: text, markup, annotated - select for diffs
Sat Mar 5 20:55:55 2011 UTC (13 years, 11 months ago) by rmind
Branches: rmind-uvmplock
Diff to: previous 1.7.2.1: preferred, colored; branchpoint 1.7: preferred, colored; next MAIN 1.8: preferred, colored
Changes since revision 1.7.2.1: +277 -0 lines
sync with head

Revision 1.6.2.1: download - view: text, markup, annotated - select for diffs
Tue Feb 8 16:20:01 2011 UTC (14 years ago) by bouyer
Branches: bouyer-quota2
Diff to: previous 1.6: preferred, colored; next MAIN 1.7: preferred, colored
Changes since revision 1.6: +8 -5 lines
Sync with HEAD

Revision 1.7.2.1
Wed Feb 2 02:20:25 2011 UTC (14 years ago) by rmind
Branches: rmind-uvmplock
FILE REMOVED
Changes since revision 1.7: +0 -277 lines
file npf_handler.c was added on branch rmind-uvmplock on 2011-03-05 20:55:55 +0000

Revision 1.7: download - view: text, markup, annotated - select for diffs
Wed Feb 2 02:20:25 2011 UTC (14 years ago) by rmind
Branches: MAIN
CVS tags: yamt-pagecache-base, rmind-uvmplock-nbase, rmind-uvmplock-base, cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base
Branch point for: yamt-pagecache, rmind-uvmplock
Diff to: previous 1.6: preferred, colored
Changes since revision 1.6: +8 -5 lines
NPF checkpoint:
- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc).
- Add NPF support for ftp-proxy(8).
- Add rc.d script for NPF.
- Convert npfctl(8) to use libnpf(3) and thus make it less depressive.
  Note: next clean-up step should be a parser, once dholland@ will finish it.
- Add more documentation.
- Various fixes.

Revision 1.6: download - view: text, markup, annotated - select for diffs
Tue Jan 18 20:33:45 2011 UTC (14 years, 1 month ago) by rmind
Branches: MAIN
Branch point for: bouyer-quota2
Diff to: previous 1.5: preferred, colored
Changes since revision 1.5: +27 -21 lines
NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
  potentially other functions from the rule structure.  Rule procedure can be
  shared amongst the rules.  Separation is both at kernel level (npf_rproc_t)
  and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic.  Use TCP FSM definitions.
- Add if_byindex(), OK by matt@.  Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.

Revision 1.5: download - view: text, markup, annotated - select for diffs
Sat Dec 18 01:07:25 2010 UTC (14 years, 2 months ago) by rmind
Branches: MAIN
CVS tags: matt-mips64-premerge-20101231, jruoho-x86intr-base
Branch point for: jruoho-x86intr
Diff to: previous 1.4: preferred, colored
Changes since revision 1.4: +25 -8 lines
NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.

Revision 1.4: download - view: text, markup, annotated - select for diffs
Thu Nov 11 06:30:39 2010 UTC (14 years, 3 months ago) by rmind
Branches: MAIN
Diff to: previous 1.3: preferred, colored
Changes since revision 1.3: +29 -5 lines
NPF checkpoint:
- Add proper TCP state tracking as described in Guido van Rooij paper,
  plus handle TCP Window Scaling option.
- Completely rework npf_cache_t, reduce granularity, simplify code.
- Add npf_addr_t as an abstraction, amend session handling code, as well
  as NAT code et al, to use it.  Now design is prepared for IPv6 support.
- Handle IPv4 fragments i.e. perform packet reassembly.
- Add support for IPv4 ID randomization and minimum TTL enforcement.
- Add support for TCP MSS "clamping".
- Random bits for IPv6.  Various fixes and clean-up.

Revision 1.3.2.2: download - view: text, markup, annotated - select for diffs
Fri Oct 22 09:23:14 2010 UTC (14 years, 4 months ago) by uebayasi
Branches: uebayasi-xip
Diff to: previous 1.3.2.1: preferred, colored; branchpoint 1.3: preferred, colored; next MAIN 1.4: preferred, colored
Changes since revision 1.3.2.1: +227 -0 lines
Sync with HEAD (-D20101022).

Revision 1.3.2.1
Sun Oct 10 15:29:01 2010 UTC (14 years, 4 months ago) by uebayasi
Branches: uebayasi-xip
FILE REMOVED
Changes since revision 1.3: +0 -227 lines
file npf_handler.c was added on branch uebayasi-xip on 2010-10-22 09:23:14 +0000

Revision 1.3: download - view: text, markup, annotated - select for diffs
Sun Oct 10 15:29:01 2010 UTC (14 years, 4 months ago) by rmind
Branches: MAIN
CVS tags: uebayasi-xip-base4, uebayasi-xip-base3
Branch point for: uebayasi-xip
Diff to: previous 1.2: preferred, colored
Changes since revision 1.2: +8 -4 lines
npf_packet_handler: clear M_CANFASTFWD flag, so inspection would work when
fast forwarding is enabled (e.g. with GATEWAY kernel option).  Thanks matt@
for the tip.

Revision 1.2.2.2: download - view: text, markup, annotated - select for diffs
Sat Oct 9 03:32:37 2010 UTC (14 years, 4 months ago) by yamt
Branches: yamt-nfs-mp
Diff to: previous 1.2.2.1: preferred, colored; branchpoint 1.2: preferred, colored; next MAIN 1.3: preferred, colored
Changes since revision 1.2.2.1: +223 -0 lines
sync with head

Revision 1.2.2.1
Thu Sep 16 04:53:27 2010 UTC (14 years, 5 months ago) by yamt
Branches: yamt-nfs-mp
FILE REMOVED
Changes since revision 1.2: +0 -223 lines
file npf_handler.c was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000

Revision 1.2: download - view: text, markup, annotated - select for diffs
Thu Sep 16 04:53:27 2010 UTC (14 years, 5 months ago) by rmind
Branches: MAIN
CVS tags: yamt-nfs-mp-base11
Branch point for: yamt-nfs-mp
Diff to: previous 1.1: preferred, colored
Changes since revision 1.1: +50 -33 lines
NPF checkpoint:
- Add support for bi-directional NAT and redirection / port forwarding.
- Finish filtering on ICMP type/code and add filtering on TCP flags.
- Add support for TCP reset (RST) or ICMP destination unreachable on block.
- Fix a bunch of bugs; misc cleanup.

Revision 1.1: download - view: text, markup, annotated - select for diffs
Sun Aug 22 18:56:22 2010 UTC (14 years, 6 months ago) by rmind
Branches: MAIN
Import NPF - a packet filter.  Some features:

- Designed to be fully MP-safe and highly efficient.

- Tables/IP sets (hash or red-black tree) for high performance lookups.

- Stateful filtering and Network Address Port Translation (NAPT).
  Framework for application level gateways (ALGs).

- Packet inspection engine called n-code processor - inspired by BPF -
  supporting generic RISC-like and specific CISC-like instructions for
  common patterns (e.g. IPv4 address matching).  See npf_ncode(9) manual.

- Convenient userland utility npfctl(8) with npf.conf(8).

NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.

Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@

Diff request

This form allows you to request diffs between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.

Log view options

CVSweb <webmaster@jp.NetBSD.org>