![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / sys / net / npf
Request diff between arbitrary revisions
Keyword substitution: kv
Default branch: MAIN
Pull up following revision(s) (requested by riastradh in ticket #1718): sys/net/npf/npf_tableset.c: revision 1.41 npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181
Pull up following revision(s) (requested by riastradh in ticket #332): sys/net/npf/npf_tableset.c: revision 1.41 npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181
npf: Eliminate __HAVE_ATOMIC_AS_MEMBAR conditionals. Discussed on tech-kern: https://mail-index.netbsd.org/tech-kern/2023/02/23/msg028729.html Requested by rmind@: https://github.com/rmind/npf/pull/127#issuecomment-1399573125
npf(9): Drop table lock around copyout. It is forbidden to hold a spin lock around copyout, and t_lock is a spin lock. We need t_lock in order to iterate over the list of entries. However, during copyout itself, we only need to ensure that the object we're copying out isn't freed by npf_table_remove or npf_table_gc. Fortunately, the only caller of npf_table_list, npf_table_remove, and npf_table_gc is npfctl_table, and it serializes all of them by the npf config lock. So we can safely drop t_lock across copyout. PR kern/57136 PR kern/57181
npf(9): Another comment tweak to match upstream. No functional change.
npf(9): Use __HAVE_ATOMIC_AS_MEMBAR around refcnt consistently.
sys: Use membar_release/acquire around reference drop. This just goes through my recent reference count membar audit and changes membar_exit to membar_release and membar_enter to membar_acquire -- this should make everything cheaper on most CPUs without hurting correctness, because membar_acquire is generally cheaper than membar_enter.
sys: Membar audit around reference count releases. If two threads are using an object that is freed when the reference count goes to zero, we need to ensure that all memory operations related to the object happen before freeing the object. Using an atomic_dec_uint_nv(&refcnt) == 0 ensures that only one thread takes responsibility for freeing, but it's not enough to ensure that the other thread's memory operations happen before the freeing. Consider: Thread A Thread B obj->foo = 42; obj->baz = 73; mumble(&obj->bar); grumble(&obj->quux); /* membar_exit(); */ /* membar_exit(); */ atomic_dec -- not last atomic_dec -- last /* membar_enter(); */ KASSERT(invariant(obj->foo, obj->bar)); free_stuff(obj); The memory barriers ensure that obj->foo = 42; mumble(&obj->bar); in thread A happens before KASSERT(invariant(obj->foo, obj->bar)); free_stuff(obj); in thread B. Without them, this ordering is not guaranteed. So in general it is necessary to do membar_exit(); if (atomic_dec_uint_nv(&obj->refcnt) != 0) return; membar_enter(); to release a reference, for the `last one out hit the lights' style of reference counting. (This is in contrast to the style where one thread blocks new references and then waits under a lock for existing ones to drain with a condvar -- no membar needed thanks to mutex(9).) I searched for atomic_dec to find all these. Obviously we ought to have a better abstraction for this because there's so much copypasta. This is a stop-gap measure to fix actual bugs until we have that. It would be nice if an abstraction could gracefully handle the different styles of reference counting in use -- some years ago I drafted an API for this, but making it cover everything got a little out of hand (particularly with struct vnode::v_usecount) and I ended up setting it aside to work on psref/localcount instead for better scalability. I got bored of adding #ifdef __HAVE_ATOMIC_AS_MEMBAR everywhere, so I only put it on things that look performance-critical on 5sec review. We should really adopt membar_enter_preatomic/membar_exit_postatomic or something (except they are applicable only to atomic r/m/w, not to atomic_load/store_*, making the naming annoying) and get rid of all the ifdefs.
Sync with HEAD.
s/npf_config_lock/npf->config_lock/ in the comments
Pull up following revision(s) (requested by rmind in ticket #956):
usr.sbin/npf/npf-params.7: revision 1.4
sys/net/npf/npf_worker.c: revision 1.9
usr.sbin/npf/npftest/npftest.h: revision 1.17
usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
usr.sbin/npf/npf-params.7: revision 1.5
sys/net/npf/npf_state_tcp.c: revision 1.21
usr.sbin/npf/npfctl/npf_build.c: revision 1.55
usr.sbin/npf/npf-params.7: revision 1.6
sys/net/npf/npfkern.h: revision 1.5
lib/libnpf/npf.c: revision 1.49
usr.sbin/npf/npf-params.7: revision 1.7
sys/net/npf/npf_impl.h: revision 1.81
sys/net/npf/npf_ext_log.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.h: revision 1.53
usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.50
sys/net/npf/npf_mbuf.c: revision 1.24
sys/net/npf/npf_alg.c: revision 1.22
usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
sys/net/npf/npf.h: revision 1.63
usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
usr.sbin/npf/npfctl/npf_var.c: revision 1.13
sys/net/npf/files.npf: revision 1.23
usr.sbin/npf/npfctl/npf_show.c: revision 1.32
usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
sys/net/npf/npf_os.c: revision 1.18
sys/net/npf/npf_connkey.c: revision 1.2
sys/net/npf/npf_conf.c: revision 1.17
lib/libnpf/libnpf.3: revision 1.12
usr.sbin/npf/npftest/npftest.c: revision 1.25
usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
sys/net/npf/npf_tableset.c: revision 1.35
usr.sbin/npf/npftest/npftest.conf: revision 1.9
sys/net/npf/npf_sendpkt.c: revision 1.22
usr.sbin/npf/npfctl/npf_var.h: revision 1.10
sys/net/npf/npf_state.c: revision 1.23
sys/net/npf/npf_conn.h: revision 1.20
usr.sbin/npf/npfctl/npfctl.c: revision 1.64
usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
sys/net/npf/npf_portmap.c: revision 1.5
sys/net/npf/npf_params.c: revision 1.3
usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
tests/net/npf/t_npf.sh: revision 1.4
sys/net/npf/npf_ext_rndblock.c: revision 1.9
lib/libnpf/npf.h: revision 1.39
sys/net/npf/npf_ruleset.c: revision 1.51
sys/net/npf/npf_alg_icmp.c: revision 1.33
sys/net/npf/npf.c: revision 1.43
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.8: revision 1.25
sys/net/npf/npf_ctl.c: revision 1.60
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
sys/net/npf/npf_handler.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.57
sys/net/npf/npf_ifaddr.c: revision 1.7
sys/net/npf/npf_conndb.c: revision 1.9
sys/net/npf/npf_if.c: revision 1.13
usr.sbin/npf/npfctl/Makefile: revision 1.15
sys/net/npf/npf_conn.c: revision 1.32
sys/net/npf/npf_ext_normalize.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.20
sys/net/npf/npf_worker.c: revision 1.8
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.
npftest -- npf_test_init(): add a workaround for NetBSD.
npf-params(7): fix the state.key defaults.
npf-params.7: s/filer/filter/
Adjust to "npfctl debug" command line changes, from rmind@.
Use more markup.
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
Mostly merge changes from HEAD upto 20200411
Pull up following revision(s) (requested by rmind in ticket #139): lib/libnpf/npf.c: revision 1.47 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.10 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.10 sys/net/npf/npf.h: revision 1.61 sys/net/npf/npf_ctl.c: revision 1.56 sys/net/npf/npf_os.c: revision 1.15 lib/libnpf/libnpf.3: revision 1.10 sys/net/npf/npf_tableset.c: revision 1.34 usr.sbin/npf/npfctl/npfctl.c: revision 1.61 sys/net/npf/npf_impl.h: revision 1.77 lib/libnpf/npf.h: revision 1.37 - npftest: fix a memleak in a unit test (standalone path only). - Minor style fixes. No functional change. npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Add error checking for previous memory allocation failure.
PR/54314: Frank Kardel: LOCKDEBUG: Mutex error: assert_sleepable,70: spin lock held when loading NPF
Avoid LOCKDEBUG pserialize panic by implementing suggestion #1 from
http://mail-index.netbsd.org/current-users/2019/02/24/msg035220.html:
Convert the mutex to spin-lock at IPL_NET (but it is excessive) and
convert the memory allocations in that code path to KM_NOSLEEP.
Sync with HEAD
Sync with HEAD
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Ssync with HEAD
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
update from HEAD
Sync with HEAD
Sync with HEAD
Sync with HEAD
fix MIN/MAX confusion.
Sync with HEAD
Sync with netbsd-5
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
NPF: implement dynamic handling of interface addresses (the kernel part).
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
Pull up following revision(s) (requested by rmind in ticket #1319): sys/modules/npf/Makefile: revision 1.19 sys/net/npf/files.npf: revision 1.18 sys/net/npf/lpm.c: revision 1.1 sys/net/npf/lpm.h: revision 1.1 sys/net/npf/npf_impl.h: revision 1.62 sys/net/npf/npf_tableset.c: revision 1.24 sys/net/npf/npf_tableset_ptree.c: file removal sys/rump/net/lib/libnpf/Makefile: revision 1.18 This patches ditches the ptree(3) library, because it is broken (you can get missing entries!). Instead, as a temporary solution, we switch to a simple linear scan of the hash tables for the longest-prefix-match (lpm.c lpm.h) algorithm. In fact, with few unique prefixes in the set, on modern hardware this simple algorithm is pretty fast anyway! -- ditch ptree and use lpm -- remove ptree add lpm
This patches ditches the ptree(3) library, because it is broken (you can get missing entries!). Instead, as a temporary solution, we switch to a simple linear scan of the hash tables for the longest-prefix-match (lpm.c lpm.h) algorithm. In fact, with few unique prefixes in the set, on modern hardware this simple algorithm is pretty fast anyway!
Sync with HEAD
/32 and /128 are valid netmasks.
Rebase to HEAD as of a few days ago.
NPF: finish up the rework of npfctl_save() mechanism.
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
sync with head
Add support for CDB based NPF tables.
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128). Few misc fixes. Bump NPF_VERSION.
resync from head
- Add NPF table flushing functionality. - Fix line numbering for npfctl debug command.
resync with head
Pull up following revision(s) (requested by rmind in ticket #817): usr.sbin/npf/npfctl/npfctl.8: revision 1.12 usr.sbin/npf/npfctl/npf.conf.5: revision 1.27 usr.sbin/npf/npfctl/npf_parse.y: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.20 usr.sbin/npf/npfctl/npfctl.c: revision 1.28 lib/libnpf/npf.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.c: revision 1.29 lib/libnpf/npf.c: revision 1.17 sys/modules/npf/Makefile: revision 1.12 sys/net/npf/npf_rproc.c: revision 1.6 usr.sbin/npf/npftest/README: revision 1.4 sys/net/npf/npf_tableset.c: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.21 sys/net/npf/npf_ctl.c: revision 1.22 usr.sbin/npf/npfctl/npfctl.h: revision 1.25 lib/libnpf/npf.h: revision 1.13 usr.sbin/npf/npftest/npftest.conf: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.26 sys/net/npf/npf_ruleset.c: revision 1.17 lib/libnpf/npf.h: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.18 sys/net/npf/npf_conf.c: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.10 sys/net/npf/npf_conf.c: revision 1.2 sys/net/npf/npf_instr.c: revision 1.16 sys/net/npf/npf_handler.c: revision 1.26 sys/net/npf/npf_impl.h: revision 1.26 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14 sys/net/npf/npf_processor.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.27 sys/net/npf/npf_alg_icmp.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16 sys/net/npf/npf_ncode.h: revision 1.11 sys/net/npf/files.npf: revision 1.10 usr.sbin/npf/npftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.c: revision 1.30 lib/libnpf/npf.3: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4 sys/net/npf/npf_session.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5 usr.sbin/npf/npfctl/npf_build.c: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.19 sys/net/npf/npf_alg.c: revision 1.7 usr.sbin/npf/npfctl/Makefile: revision 1.10 sys/net/npf/npf_inet.c: revision 1.21 sys/net/npf/npf.h: revision 1.26 sys/net/npf/npf.h: revision 1.27 usr.sbin/pf/ftp-proxy/Makefile: revision 1.8 sys/net/npf/npf_nat.c: revision 1.19 sys/net/npf/npf.c: revision 1.15 sys/net/npf/npf_state.c: revision 1.14 sys/net/npf/npf_sendpkt.c: revision 1.14 sys/rump/net/lib/libnpf/Makefile: revision 1.4 IPv6 linklocal address printing cosmetics NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version. Disable -DWITH_NPF for now; will be converted to BPF mechanism. - Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset. Allow filtering on IP addresses even if the L4 protocol is unknown. Patch from spz@. npftest: adjust for recent change.
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
sync with (a bit old) head
Pull up following revision(s) (requested by rmind in ticket #736): usr.sbin/npf/npfctl/npf_parse.y: revision 1.17 sys/net/npf/npf_tableset.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.h: revision 1.23 usr.sbin/npf/npfctl/npf_data.c: revision 1.19 usr.sbin/npf/npfctl/npf_build.c: revision 1.15 share/examples/npf/host-npf.conf: revision 1.3 usr.sbin/npf/npfctl/npf_scan.l: revision 1.9 share/examples/npf/soho_gw-npf.conf: revision 1.3 usr.sbin/npf/npfctl/npf_var.h: revision 1.6 usr.sbin/npf/npfctl/npf.conf.5: revision 1.24 npfctl: extend syntax for extracting interface IP address(es) by the family. adjust to current npf.conf syntax npf_table_list: avoid triggering assert on diagnostic.
npf_table_list: avoid triggering assert on diagnostic.
Pull up following revision(s) (requested by rmind in ticket #702): sys/net/npf/npf_tableset.c: revision 1.15 usr.sbin/npf/npfctl/npfctl.h: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.6 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.10 sys/net/npf/npf_state_tcp.c: revision 1.11 sys/net/npf/npf_impl.h: revision 1.24 sys/net/npf/npf.h: revision 1.22 sys/net/npf/npf_ctl.c: revision 1.19 sys/net/npf/npf.c: revision 1.14 usr.sbin/npf/npfctl/npfctl.8: revision 1.10 usr.sbin/npf/npfctl/npfctl.c: revision 1.21 npf_tcp_inwindow: inspect the sequence numbers even if the packet contains no data, fixing up only the RST to the initial SYN. This makes off-path attacks more difficult. For the reference, see "Reflection Scan: an Off-Path Attack on TCP" by Jan Wrobel. Implement NPF table listing and preservation of entries on reload. Bump the version. npfctl(8): mention table listing.
Resync to 2012-11-19 00:00:00 UTC
sync with head
Implement NPF table listing and preservation of entries on reload. Bump the version.
Pull up following revision(s) (requested by rmind in ticket #485): lib/libnpf/npf.c: revision 1.11 sys/net/npf/npf_session.c: revision 1.17 sys/modules/npf/Makefile: revision 1.10 usr.sbin/npf/npftest/npftest.c: revision 1.4 usr.sbin/npf/npftest/README: revision 1.1 sys/net/npf/npf_tableset.c: revision 1.14 usr.sbin/npf/npftest/npftest.h: revision 1.4 lib/libnpf/npf.h: revision 1.10 sys/net/npf/npf_ruleset.c: revision 1.14 usr.sbin/npf/npfctl/npf_data.c: revision 1.18 usr.sbin/npf/npftest/npftest.conf: revision 1.1 sys/net/npf/npf_handler.c: revision 1.21 sys/net/npf/npf_impl.h: revision 1.21 usr.sbin/npf/npfctl/npfctl.c: revision 1.18 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.13 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1 usr.sbin/npf/npftest/npfstream.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.19 sys/net/npf/npf_nat.c: revision 1.16 sys/net/npf/npf_state.c: revision 1.11 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5 usr.sbin/npf/npfctl/npf_parse.y: revision 1.12 - Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
Pull up following revision(s) (requested by rmind in ticket #421): lib/libnpf/npf.c: revision 1.10 sys/net/npf/npf_session.c: revision 1.15 sys/net/npf/npf_tableset.c: revision 1.13 sys/net/npf/npf_state_tcp.c: revision 1.9 usr.sbin/npf/npfctl/npf_data.c: revision 1.15 sys/net/npf/npf_inet.c: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.13 sys/net/npf/npf.h: revision 1.19 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12 sys/net/npf/npf_instr.c: revision 1.13 sys/net/npf/npf_handler.c: revision 1.20 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4 sys/net/npf/npf_alg_icmp.c: revision 1.10 usr.sbin/npf/npfctl/npfctl.c: revision 1.15 usr.sbin/npf/npfctl/npf_build.c: revision 1.11 lib/libnpf/npf.h: revision 1.9 sys/net/npf/npf_alg.c: revision 1.5 sys/rump/dev/lib/libnpf/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.16 sys/net/npf/npf_nat.c: revision 1.15 sys/net/npf/npf_tableset_ptree.c: revision 1.1 sys/net/npf/npf.c: revision 1.12 sys/net/npf/npf_sendpkt.c: revision 1.12 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7 sys/net/npf/npf_impl.h: revision 1.18 sys/net/npf/files.npf: revision 1.7 usr.sbin/npf/npfctl/npf_parse.y: revision 1.10 - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
Pull up following revision(s) (requested by rmind in ticket #399): sys/net/npf/npf_session.c: revision 1.14 sys/net/npf/npf_tableset.c: revision 1.12 sys/net/npf/npf_state_tcp.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3 usr.sbin/npf/npfctl/npf_data.c: revision 1.14 sys/net/npf/npf_inet.c: revision 1.13 sys/net/npf/npf_ruleset.c: revision 1.12 sys/net/npf/npf.h: revision 1.18 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.8: revision 1.7 usr.sbin/npf/npfctl/npf_parse.y: revision 1.9 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2 usr.sbin/npf/npfctl/npfctl.8: revision 1.8 sys/net/npf/npf_instr.c: revision 1.12 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3 usr.sbin/npf/npfctl/npf.conf.5: revision 1.13 usr.sbin/npf/npfctl/npf.conf.5: revision 1.14 sys/net/npf/npf_state.c: revision 1.9 sys/net/npf/npf_processor.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.c: revision 1.13 usr.sbin/npf/npfctl/npfctl.c: revision 1.14 usr.sbin/npf/npfctl/npf_build.c: revision 1.10 lib/libnpf/npf.3: revision 1.5 lib/libnpf/npf.h: revision 1.8 share/man/man9/npf_ncode.9: revision 1.9 usr.sbin/npf/npfctl/npf_scan.l: revision 1.4 lib/libnpf/npf.c: revision 1.9 usr.sbin/npf/npfctl/npfctl.h: revision 1.16 sys/net/npf/npf_nat.c: revision 1.14 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6 sys/net/npf/npf_impl.h: revision 1.17 sys/net/npf/npf_handler.c: revision 1.18 sys/net/npf/npf_handler.c: revision 1.19 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4 sys/net/npf/npf_ncode.h: revision 1.9 Fix and update npf.conf(5), npfctl(8) and its usage message. npf_state_tcp: fix for FIN retransmission and out-of-order ACK case. NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up. npf_packet_handler: fix gcc unused warning.
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
Pull up following revision(s) (requested by rmind in ticket #365):
sys/rump/librump/rumpkern/rumpcpu_generic.c: revision 1.4
sys/net/npf/npf_session.c: revision 1.13
sys/net/npf/npf_tableset.c: revision 1.11
sys/net/npf/npf_state_tcp.c: revision 1.7
sys/net/npf/npf_inet.c: revision 1.12
sys/net/npf/npf.h: revision 1.17
sys/net/npf/npf_instr.c: revision 1.11
usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.2
sys/net/npf/npf_state.c: revision 1.8
sys/net/npf/npf_log.c: revision 1.4
sys/net/npf/npf_alg.c: revision 1.4
sys/rump/librump/rumpkern/Makefile.rumpkern: revision 1.118
sys/net/npf/npf_nat.c: revision 1.13
sys/net/npf/npf.c: revision 1.11
sys/net/npf/npf_sendpkt.c: revision 1.11
sys/net/npf/npf_impl.h: revision 1.16
sys/rump/librump/rumpkern/scheduler.c: revision 1.28
rumpkern:
- Add subr_kcpuset.c and subr_pserialize.c modules.
- Add kcpuset_{running,attached} for RUMP env.
NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
sync with head
Pull up following revision(s) (requested by rmind in ticket #158):
sys/net/npf/npf_session.c: revision 1.12
sys/net/npf/npf_tableset.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.2
usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
sys/net/npf/npf_inet.c: revision 1.11
sys/net/npf/npf.h: revision 1.15
usr.sbin/npf/npfctl/npf_build.c: revision 1.5
sys/net/npf/npf_ruleset.c: revision 1.11
sys/net/npf/npf_instr.c: revision 1.10
usr.sbin/npf/npfctl/Makefile: revision 1.6
sys/net/npf/npf_processor.c: revision 1.10
sys/net/npf/npf_log.c: revision 1.3
lib/libnpf/npf.h: revision 1.7
sys/net/npf/npf_alg.c: revision 1.3
sys/net/npf/npf_sendpkt.c: revision 1.9
lib/libnpf/npf.c: revision 1.8
usr.sbin/npf/npfctl/npfctl.h: revision 1.13
sys/net/npf/npf_ctl.c: revision 1.13
usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
sys/net/npf/npf_ctl.c: revision 1.14
sys/net/npf/npf_nat.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.12
sys/net/npf/npf_impl.h: revision 1.11
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
sys/net/npf/npf_impl.h: revision 1.12
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
sys/net/npf/npf_handler.c: revision 1.14
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
sys/net/npf/npf_handler.c: revision 1.15
sys/net/npf/npf_ncode.h: revision 1.6
sys/net/npf/npf.c: revision 1.8
sys/net/npf/npf.c: revision 1.9
sys/net/npf/npf_alg_icmp.c: revision 1.9
sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes. Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.
sync to -current.
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
merge to -current.
- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
- Rework and improve TCP state tracking. - Fix regressions after IPv6 patch merge. Note: npfctl(8) rework will come soon.
sync with head
Few fixes, KNF/style, bump the NPF version.
Add IPv6 support for NPF.
Sync with HEAD.
sync with head
Sync with HEAD
file npf_tableset.c was added on branch rmind-uvmplock on 2011-03-05 20:55:56 +0000
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
NPF checkpoint: - Add support for session saving/restoring. - Add packet logging support (can tcpdump a pseudo-interface). - Support reload without flushing of sessions; rework some locking. - Revisit session mangement, replace linking with npf_sentry_t entries. - Add some counters for statistics, using percpu(9). - Add IP_DF flag cleansing. - Fix various bugs; misc clean-up.
NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
Sync with HEAD (-D20101022).
sync with head
file npf_tableset.c was added on branch uebayasi-xip on 2010-10-22 09:23:15 +0000
file npf_tableset.c was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000
Fixes/improvements to RB-tree implementation: 1. Fix inverted node order, so that negative value from comparison operator would represent lower (left) node, and positive - higher (right) node. 2. Add an argument (i.e. "context"), passed to comparison operators. 3. Change rb_tree_insert_node() to return a node - either inserted one or already existing one. 4. Amend the interface to manipulate the actual object, instead of the rb_node (in a similar way as Patricia-tree interface does). 5. Update all RB-tree users accordingly. XXX: Perhaps rename rb.h to rbtree.h, since cleaning-up.. 1-3 address the PR/43488 by Jeremy Huddleston. Passes RB-tree regression tests. Reviewed by: matt@, christos@
Import NPF - a packet filter. Some features: - Designed to be fully MP-safe and highly efficient. - Tables/IP sets (hash or red-black tree) for high performance lookups. - Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs). - Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual. - Convenient userland utility npfctl(8) with npf.conf(8). NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress. Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@