The NetBSD Project

CVS log for src/usr.sbin/npf/npfctl/npf.conf.5

[BACK] Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npfctl

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.88.2.2 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Changes since 1.88.2.1: +43 -11 lines
Diff to previous 1.88.2.1 (colored) to branchpoint 1.88 (colored) next main 1.89 (colored)

Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@.

Use more markup.

Revision 1.91 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-10-base, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, HEAD
Changes since 1.90: +43 -11 lines
Diff to previous 1.90 (colored)

Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.

Revision 1.51.4.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:55 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.51.4.1: +34 -17 lines
Diff to previous 1.51.4.1 (colored) to branchpoint 1.51 (colored) next main 1.52 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.88.2.1 / (download) - annotate - [select for diffs], Fri Oct 4 08:06:34 2019 UTC (4 years, 6 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Changes since 1.88: +12 -5 lines
Diff to previous 1.88 (colored)

Pull up following revision(s) (requested by rmind in ticket #282):

	usr.sbin/npf/npfctl/npf_build.c: revision 1.53
	lib/libnpf/npf.c: revision 1.48
	usr.sbin/npf/npfctl/npfctl.h: revision 1.50
	sys/net/npf/npf_impl.h: revision 1.80
	usr.sbin/npf/npfctl/npfctl.h: revision 1.51
	sys/net/npf/npf_ruleset.c: revision 1.49
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.90
	sys/net/npf/npf_ctl.c: revision 1.59
	lib/libnpf/libnpf.3: revision 1.11
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.50
	usr.sbin/npf/npftest/npftest.conf: revision 1.8
	usr.sbin/npf/npfctl/npfctl.c: revision 1.62
	usr.sbin/npf/npfctl/npfctl.c: revision 1.63
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.30
	usr.sbin/npf/npfctl/npfctl.8: revision 1.22
	lib/libnpf/npf.h: revision 1.38
	usr.sbin/npf/npfctl/npfctl.8: revision 1.23
	usr.sbin/npf/npfctl/npfctl.8: revision 1.24
	sys/net/npf/npf_if.c: revision 1.11
	sys/net/npf/npf_if.c: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.89
	sys/net/npf/npf_conn.c: revision 1.30
	usr.sbin/npf/npfctl/npf_build.c: revision 1.52

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.

NPF ifmap: rework and fix a few small bugs.

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.
(missed a file in previous commit; cvs is so helpful..)

libnpf/npfctl: support dynamic NAT rulesets using a name prefix.

Use -width Pa for FILES.

Fix pasto in table replace -t type

Use -width Pa for FILES.

npf_ifmap_copylogname: be more defensive.

Revision 1.90 / (download) - annotate - [select for diffs], Mon Sep 30 20:44:51 2019 UTC (4 years, 6 months ago) by uwe
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp
Changes since 1.89: +2 -2 lines
Diff to previous 1.89 (colored)

Use -width Pa for FILES.

Revision 1.89 / (download) - annotate - [select for diffs], Mon Sep 30 00:37:11 2019 UTC (4 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.88: +11 -4 lines
Diff to previous 1.88 (colored)

libnpf/npfctl: support dynamic NAT rulesets using a name prefix.

Revision 1.88 / (download) - annotate - [select for diffs], Tue Jul 23 14:20:22 2019 UTC (4 years, 8 months ago) by wiz
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.87: +6 -6 lines
Diff to previous 1.87 (colored)

New sentence, new line. Avoid formatting punctuation. Remove superfluous Pp.

Revision 1.87 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:02 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.86: +21 -11 lines
Diff to previous 1.86 (colored)

NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Revision 1.51.4.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:10:34 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.51: +413 -165 lines
Diff to previous 1.51 (colored)

Sync with HEAD

Revision 1.86 / (download) - annotate - [select for diffs], Mon Apr 8 07:58:45 2019 UTC (5 years ago) by wiz
Branch: MAIN
CVS Tags: phil-wifi-20190609
Changes since 1.85: +2 -2 lines
Diff to previous 1.85 (colored)

Improve wording.

Revision 1.85 / (download) - annotate - [select for diffs], Sun Apr 7 22:23:40 2019 UTC (5 years ago) by rmind
Branch: MAIN
Changes since 1.84: +15 -7 lines
Diff to previous 1.84 (colored)

npf.conf(5): Add more info about ifaddrs().

Revision 1.51.2.4 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:39 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.51.2.3: +58 -30 lines
Diff to previous 1.51.2.3 (colored) to branchpoint 1.51 (colored) next main 1.52 (colored)

Sync with HEAD

Revision 1.84 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:32 2019 UTC (5 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190127
Changes since 1.83: +58 -30 lines
Diff to previous 1.83 (colored)

Major NPF improvements:
- Convert NPF connection table to thmap.  State lookup is now lock-free.
- Improve connection state G/C: it is now incremental and tunable.
- Add support for dynamic NAT address.  Translation addresses can now be
  selected from a pool of addresses.  There are two selection algorithms,
  "ip-hash" and "round-robin" (see the man page).
- Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf
  to dynamically choose an IP from the interface address(es).
- Add support for the NETMAP algorithm with static NAT for net-to-net
  translation (it is equivalent to iptables NETMAP logic).
- Convert 'ipset' tables to use thmap; the table lookup is now lock-free.
- Misc improvements, bug fixes and more unit tests.
- Bump NPF_VERSION (will also bump libnpf).

Revision 1.51.2.3 / (download) - annotate - [select for diffs], Fri Jan 18 08:51:02 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.51.2.2: +12 -9 lines
Diff to previous 1.51.2.2 (colored) to branchpoint 1.51 (colored)

Synch with HEAD

Revision 1.83 / (download) - annotate - [select for diffs], Tue Jan 8 11:36:10 2019 UTC (5 years, 3 months ago) by uwe
Branch: MAIN
CVS Tags: pgoyette-compat-20190118
Changes since 1.82: +2 -2 lines
Diff to previous 1.82 (colored)

Actually, according to the grammar the square brackets in the "tcp
flags" are not literal, so use .Op to show that /mask is optional.

Revision 1.82 / (download) - annotate - [select for diffs], Tue Jan 8 11:28:01 2019 UTC (5 years, 3 months ago) by uwe
Branch: MAIN
Changes since 1.81: +2 -2 lines
Diff to previous 1.81 (colored)

Restore macro with effect.  Fix the real problem that prevented it to
have the effect.

Revision 1.81 / (download) - annotate - [select for diffs], Tue Jan 8 10:25:26 2019 UTC (5 years, 3 months ago) by wiz
Branch: MAIN
Changes since 1.80: +10 -7 lines
Diff to previous 1.80 (colored)

New sentence, new line. Punctuation fixes. Remove macros without effect.

Revision 1.80 / (download) - annotate - [select for diffs], Tue Jan 8 01:19:16 2019 UTC (5 years, 3 months ago) by gutteridge
Branch: MAIN
Changes since 1.79: +3 -3 lines
Diff to previous 1.79 (colored)

npf.conf(5): add a minor clarification about table types that can't
accept masks on IP addresses. Prompted by Rob Hunter in PR bin/51900.

Revision 1.51.2.2 / (download) - annotate - [select for diffs], Sun Sep 30 01:46:01 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.51.2.1: +182 -144 lines
Diff to previous 1.51.2.1 (colored) to branchpoint 1.51 (colored)

Ssync with HEAD

Revision 1.48.4.2 / (download) - annotate - [select for diffs], Thu Sep 27 14:33:30 2018 UTC (5 years, 6 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1
Changes since 1.48.4.1: +250 -168 lines
Diff to previous 1.48.4.1 (colored) to branchpoint 1.48 (colored) next main 1.49 (colored)

Pull up the following, requested by maxv in ticket #1030:

	usr.sbin/npf/npfctl/npf.conf.5	1.71-1.79	(patch)

npf.conf(5): fix some of the previous incorrect or inaccurate changes.
The TCP flags option is not only for the stateful tracking.  Dynamic NAT
implies NAPT; algorithms, at least for now, are for static NAT mappings.
Mention that ALG ICMP is also for traceroute behind NAT; also mention
"MSS clamping" (some users might search for this term, so keeping the
terminology is helpful).

--------------------------------------------------------------------------------

Remove superfluous Pp.

--------------------------------------------------------------------------------

Be clearer about the difference between static vs dynamic interface list,
and slightly improve wording.

My understanding is that when none of inet4/inet6/ifaddrs is passed, NPF
assumes ifaddrs.

--------------------------------------------------------------------------------

New sentence, new line. Use Fn for functions.

--------------------------------------------------------------------------------

Fix the "Interfaces" section, I understood wrong. Talk about inference,
because it was not mentioned before, and it plays an important role.
Discussed with rmind. Probably not the last pass.

--------------------------------------------------------------------------------

Switch back to tabs, it was nicer this way.

--------------------------------------------------------------------------------

Wrap long lines, so that nothing overflows.

--------------------------------------------------------------------------------

Improve markup.

--------------------------------------------------------------------------------

According to the grammar and examples the static table is defined with
"file" keyword, not "static".

Revision 1.79 / (download) - annotate - [select for diffs], Fri Sep 21 10:59:11 2018 UTC (5 years, 6 months ago) by uwe
Branch: MAIN
CVS Tags: pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930
Changes since 1.78: +4 -4 lines
Diff to previous 1.78 (colored)

According to the grammar and examples the static table is defined with
"file" keyword, not "static".

Revision 1.78 / (download) - annotate - [select for diffs], Fri Sep 21 09:42:18 2018 UTC (5 years, 6 months ago) by uwe
Branch: MAIN
Changes since 1.77: +154 -124 lines
Diff to previous 1.77 (colored)

Improve markup.

Revision 1.77 / (download) - annotate - [select for diffs], Fri Sep 21 07:22:26 2018 UTC (5 years, 6 months ago) by maxv
Branch: MAIN
Changes since 1.76: +18 -10 lines
Diff to previous 1.76 (colored)

Wrap long lines, so that nothing overflows.

Revision 1.76 / (download) - annotate - [select for diffs], Wed Sep 19 15:36:12 2018 UTC (5 years, 6 months ago) by maxv
Branch: MAIN
Changes since 1.75: +18 -18 lines
Diff to previous 1.75 (colored)

Switch back to tabs, it was nicer this way.

Revision 1.51.2.1 / (download) - annotate - [select for diffs], Thu Sep 6 06:56:51 2018 UTC (5 years, 7 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.51: +301 -130 lines
Diff to previous 1.51 (colored)

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Revision 1.75 / (download) - annotate - [select for diffs], Tue Sep 4 15:36:01 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0906
Changes since 1.74: +34 -30 lines
Diff to previous 1.74 (colored)

Fix the "Interfaces" section, I understood wrong. Talk about inference,
because it was not mentioned before, and it plays an important role.
Discussed with rmind. Probably not the last pass.

Revision 1.74 / (download) - annotate - [select for diffs], Sun Sep 2 18:03:23 2018 UTC (5 years, 7 months ago) by wiz
Branch: MAIN
Changes since 1.73: +9 -6 lines
Diff to previous 1.73 (colored)

New sentence, new line. Use Fn for functions.

Revision 1.73 / (download) - annotate - [select for diffs], Sun Sep 2 17:45:18 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.72: +47 -27 lines
Diff to previous 1.72 (colored)

Be clearer about the difference between static vs dynamic interface list,
and slightly improve wording.

My understanding is that when none of inet4/inet6/ifaddrs is passed, NPF
assumes ifaddrs.

Revision 1.72 / (download) - annotate - [select for diffs], Sat Sep 1 19:26:46 2018 UTC (5 years, 7 months ago) by wiz
Branch: MAIN
Changes since 1.71: +1 -2 lines
Diff to previous 1.71 (colored)

Remove superfluous Pp.

Revision 1.71 / (download) - annotate - [select for diffs], Sat Sep 1 16:28:57 2018 UTC (5 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.70: +80 -63 lines
Diff to previous 1.70 (colored)

npf.conf(5): fix some of the previous incorrect or inaccurate changes.
The TCP flags option is not only for the stateful tracking.  Dynamic NAT
implies NAPT; algorithms, at least for now, are for static NAT mappings.
Mention that ALG ICMP is also for traceroute behind NAT; also mention
"MSS clamping" (some users might search for this term, so keeping the
terminology is helpful).

Revision 1.48.4.1 / (download) - annotate - [select for diffs], Sat Sep 1 06:19:12 2018 UTC (5 years, 7 months ago) by martin
Branch: netbsd-8
Changes since 1.48: +219 -85 lines
Diff to previous 1.48 (colored)

Sync the following with -current, with minor modifications as the
"[ map-flags ]" feature is not available in netbsd-8, requested by
maxv in ticket #1001:

	usr.sbin/npf/npfctl/npf.conf.5	1.49,1.50(partly),1.51-1.70 (via patch)

Remove workaround for ancient HTML generation code.

 -

npfctl: add support for the 'no-ports' flag in the 'map' statements.
This allows us to create a NAT policy without the port translation.

 -

Remove superfluous Pp.

 -

First pass at editing this manual.
Add a link to the NPF documentation website and refer to it.
Switch the multiple structural elements to a list to make it easier to read and
extend.
Clarify tables, re-order so all terms are before the example.
Clarify obtaining addresses per family
Move the minimum requirement for a default group to the group section.

 -

Add missing El. Remove trailing whitespace.

 -

Enlighten the "Procedures" section. In particular document the "no-df"
option. Also replace "normalisation" -> "normalization", to match the
name of the rule.

 -

Add quotes around the option names, to match the actual npf conf.

 -

Improve the "Rules" section: better explain the "final" keyword (it is
the same as PF's "quick", so use the same wording), and document the
"return" options.

While here simplify the man code, suggested by wiz.

 -

Document the "flags" keyword.

 -

Improve the "Map" section a little.

 -

Improve wording.

 -

Replace () by [] in tcp-flags.

Fix proc-opts, the value is optional, noted by he@.

 -

Replace "rproc"->"proc" in the grammar (spotted by he@), and slightly
reword.

 -

Add missing quote in static-rule, it causes man-k.org (and other tools)
to wrongly highlight the grammar.

 -

Add the values of "algo" in the grammar, and use # as comment marker for
man-k.org (and others) not to highlight things in an incorrect way.

 -

Document ALGs.

 -

Improve the "Map" section.

 -

Add missing -width; remove unnecessary .Pp.

 -

Clarify the "Groups" section.

 -

should be port-opts

 -

"interface" already contains "var-name", so don't mention it in "filt-addr",
that's redundant

 -

rename net-seg -> map-seg, and document it

Revision 1.70 / (download) - annotate - [select for diffs], Fri Aug 31 11:18:35 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.69: +3 -2 lines
Diff to previous 1.69 (colored)

rename net-seg -> map-seg, and document it

Revision 1.69 / (download) - annotate - [select for diffs], Fri Aug 31 11:11:21 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.68: +2 -3 lines
Diff to previous 1.68 (colored)

"interface" already contains "var-name", so don't mention it in "filt-addr",
that's redundant

Revision 1.68 / (download) - annotate - [select for diffs], Fri Aug 31 11:01:09 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.67: +3 -2 lines
Diff to previous 1.67 (colored)

should be port-opts

Revision 1.67 / (download) - annotate - [select for diffs], Fri Aug 31 10:52:30 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.66: +16 -8 lines
Diff to previous 1.66 (colored)

Clarify the "Groups" section.

Revision 1.66 / (download) - annotate - [select for diffs], Mon Aug 27 13:20:47 2018 UTC (5 years, 7 months ago) by wiz
Branch: MAIN
Changes since 1.65: +2 -3 lines
Diff to previous 1.65 (colored)

Add missing -width; remove unnecessary .Pp.

Revision 1.65 / (download) - annotate - [select for diffs], Mon Aug 27 13:09:16 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.64: +13 -3 lines
Diff to previous 1.64 (colored)

Improve the "Map" section.

Revision 1.64 / (download) - annotate - [select for diffs], Mon Aug 27 12:46:03 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.63: +35 -3 lines
Diff to previous 1.63 (colored)

Document ALGs.

Revision 1.63 / (download) - annotate - [select for diffs], Fri Aug 17 12:20:49 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.62: +16 -15 lines
Diff to previous 1.62 (colored)

Add the values of "algo" in the grammar, and use # as comment marker for
man-k.org (and others) not to highlight things in an incorrect way.

Revision 1.62 / (download) - annotate - [select for diffs], Fri Aug 17 12:04:20 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.61: +2 -2 lines
Diff to previous 1.61 (colored)

Add missing quote in static-rule, it causes man-k.org (and other tools)
to wrongly highlight the grammar.

Revision 1.61 / (download) - annotate - [select for diffs], Fri Aug 17 10:24:19 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.60: +3 -3 lines
Diff to previous 1.60 (colored)

Replace "rproc"->"proc" in the grammar (spotted by he@), and slightly
reword.

Revision 1.60 / (download) - annotate - [select for diffs], Fri Aug 17 10:16:24 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.59: +4 -4 lines
Diff to previous 1.59 (colored)

Replace () by [] in tcp-flags.

Fix proc-opts, the value is optional, noted by he@.

Revision 1.59 / (download) - annotate - [select for diffs], Thu Aug 16 09:58:00 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.58: +2 -2 lines
Diff to previous 1.58 (colored)

Improve wording.

Revision 1.58 / (download) - annotate - [select for diffs], Thu Aug 16 09:50:37 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.57: +8 -4 lines
Diff to previous 1.57 (colored)

Improve the "Map" section a little.

Revision 1.57 / (download) - annotate - [select for diffs], Thu Aug 16 09:46:18 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.56: +24 -3 lines
Diff to previous 1.56 (colored)

Document the "flags" keyword.

Revision 1.56 / (download) - annotate - [select for diffs], Thu Aug 16 09:21:00 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.55: +30 -11 lines
Diff to previous 1.55 (colored)

Improve the "Rules" section: better explain the "final" keyword (it is
the same as PF's "quick", so use the same wording), and document the
"return" options.

While here simplify the man code, suggested by wiz.

Revision 1.55 / (download) - annotate - [select for diffs], Thu Aug 16 08:51:53 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.54: +10 -6 lines
Diff to previous 1.54 (colored)

Add quotes around the option names, to match the actual npf conf.

Revision 1.54 / (download) - annotate - [select for diffs], Thu Aug 16 08:37:51 2018 UTC (5 years, 7 months ago) by maxv
Branch: MAIN
Changes since 1.53: +36 -15 lines
Diff to previous 1.53 (colored)

Enlighten the "Procedures" section. In particular document the "no-df"
option. Also replace "normalisation" -> "normalization", to match the
name of the rule.

Revision 1.53 / (download) - annotate - [select for diffs], Mon Aug 13 06:06:13 2018 UTC (5 years, 8 months ago) by wiz
Branch: MAIN
Changes since 1.52: +3 -3 lines
Diff to previous 1.52 (colored)

Add missing El. Remove trailing whitespace.

Revision 1.52 / (download) - annotate - [select for diffs], Tue Aug 7 00:22:13 2018 UTC (5 years, 8 months ago) by sevan
Branch: MAIN
Changes since 1.51: +43 -35 lines
Diff to previous 1.51 (colored)

First pass at editing this manual.
Add a link to the NPF documentation website and refer to it.
Switch the multiple structural elements to a list to make it easier to read and
extend.
Clarify tables, re-order so all terms are before the example.
Clarify obtaining addresses per family
Move the minimum requirement for a default group to the group section.

Revision 1.51 / (download) - annotate - [select for diffs], Mon Dec 11 23:07:49 2017 UTC (6 years, 4 months ago) by wiz
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-base, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: phil-wifi, pgoyette-compat
Changes since 1.50: +1 -3 lines
Diff to previous 1.50 (colored)

Remove superfluous Pp.

Revision 1.50 / (download) - annotate - [select for diffs], Sun Dec 10 22:04:41 2017 UTC (6 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.49: +18 -8 lines
Diff to previous 1.49 (colored)

npfctl: add support for the 'no-ports' flag in the 'map' statements.
This allows us to create a NAT policy without the port translation.

Revision 1.49 / (download) - annotate - [select for diffs], Mon Jul 3 21:35:31 2017 UTC (6 years, 9 months ago) by wiz
Branch: MAIN
CVS Tags: perseant-stdc-iso10646-base, perseant-stdc-iso10646
Changes since 1.48: +5 -5 lines
Diff to previous 1.48 (colored)

Remove workaround for ancient HTML generation code.

Revision 1.46.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:18 2017 UTC (6 years, 11 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.46: +12 -8 lines
Diff to previous 1.46 (colored) next main 1.47 (colored)

Sync with HEAD

Revision 1.44.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:58:08 2017 UTC (7 years ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.44.2.1: +12 -8 lines
Diff to previous 1.44.2.1 (colored) to branchpoint 1.44 (colored) next main 1.45 (colored)

Sync with HEAD

Revision 1.48 / (download) - annotate - [select for diffs], Fri Jan 20 08:48:14 2017 UTC (7 years, 2 months ago) by wiz
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-20170426, pgoyette-localcount-20170320, netbsd-8-base, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1, matt-nb8-mediatek-base, matt-nb8-mediatek, bouyer-socketcan-base1
Branch point for: netbsd-8
Changes since 1.47: +2 -2 lines
Diff to previous 1.47 (colored)

Bump date for previous.

Revision 1.47 / (download) - annotate - [select for diffs], Thu Jan 19 20:18:17 2017 UTC (7 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.46: +11 -7 lines
Diff to previous 1.46 (colored)

npfctl:
- Add protocol filter option for "map".
- Print user-friendly error if table contains an entry with invalid netmask.
- Add support for inline ports.

Revision 1.44.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:57:00 2017 UTC (7 years, 3 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.44: +23 -4 lines
Diff to previous 1.44 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.46 / (download) - annotate - [select for diffs], Tue Jan 3 01:29:49 2017 UTC (7 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.45: +21 -3 lines
Diff to previous 1.45 (colored)

npfctl: dynamic interface address handling; update npf.conf(8).

Revision 1.45 / (download) - annotate - [select for diffs], Tue Dec 27 22:35:33 2016 UTC (7 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.44: +4 -3 lines
Diff to previous 1.44 (colored)

npf.conf: add support for logical NOT, e.g.: pass from ! 10.0.0.1 to any

Revision 1.42.2.2 / (download) - annotate - [select for diffs], Wed Feb 4 07:13:04 2015 UTC (9 years, 2 months ago) by snj
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0
Changes since 1.42.2.1: +15 -8 lines
Diff to previous 1.42.2.1 (colored) to branchpoint 1.42 (colored) next main 1.43 (colored)

Pull up following revision(s) (requested by rmind in ticket #479):
	lib/libnpf/npf.c: revision 1.35
	lib/libnpf/npf.h: revision 1.28
	sys/net/npf/npf_conn.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.61
	sys/net/npf/npf_ruleset.c: revision 1.41
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.44
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.37
	usr.sbin/npf/npfctl/npf_show.c: revisions 1.16, 1.17
	usr.sbin/npf/npfctl/npfctl.c: revision 1.46
load the config file before bpfjit so that we can disable the warning.
--
Don't depend on yacc to include stdlib.h or string.h.
--
- npf_conn_establish: remove a rare race condition when we might destroy a
  connection when it is still referenced by another thread.
- npf_conn_destroy: remove the backwards entry using the saved key, PR/49488.
- Sprinkle some asserts.
--
npf.conf(5): mention alg, include in the example, minor fix.
--
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap
is used correctly.  Also, add npf_ruleset_dump() helper in the kernel.
--
libnpf: add npf_rule_getid() and npf_rule_getcode().
Missed in the previous commit.
--
npfctl_print_rule: print the ID in hex, not decimal.

Revision 1.44 / (download) - annotate - [select for diffs], Sun Feb 1 22:57:21 2015 UTC (9 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.43: +15 -8 lines
Diff to previous 1.43 (colored)

npf.conf(5): mention alg, include in the example, minor fix.

Revision 1.42.2.1 / (download) - annotate - [select for diffs], Mon Dec 29 17:31:47 2014 UTC (9 years, 3 months ago) by martin
Branch: netbsd-7
Changes since 1.42: +5 -2 lines
Diff to previous 1.42 (colored)

Pull up following revision(s) (requested by rmind in ticket #359):
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.22
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.43
	usr.sbin/npf/npfctl/npfctl.c: revision 1.44
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.36
	usr.sbin/npf/npfctl/npfctl.c: revision 1.45
	usr.sbin/npf/npfctl/npfctl.h: revision 1.39
npfctl(8): attempt to preload bpfjit kernel module and print the
warning on failure.
allow turning off the bpf jit loading.

Revision 1.43 / (download) - annotate - [select for diffs], Fri Dec 26 22:44:54 2014 UTC (9 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.42: +5 -2 lines
Diff to previous 1.42 (colored)

allow turning off the bpf jit loading.

Revision 1.15.2.4 / (download) - annotate - [select for diffs], Wed Aug 20 00:05:11 2014 UTC (9 years, 7 months ago) by tls
Branch: tls-maxphys
Changes since 1.15.2.3: +75 -37 lines
Diff to previous 1.15.2.3 (colored) next main 1.16 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.39.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 07:00:01 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.39: +24 -3 lines
Diff to previous 1.39 (colored) next main 1.40 (colored)

Rebase.

Revision 1.42 / (download) - annotate - [select for diffs], Sun Aug 3 00:02:56 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, netbsd-7-base
Branch point for: netbsd-7
Changes since 1.41: +3 -2 lines
Diff to previous 1.41 (colored)

Cross-link npf(7).

Revision 1.5.4.5 / (download) - annotate - [select for diffs], Thu May 22 11:43:07 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5.4.4: +58 -41 lines
Diff to previous 1.5.4.4 (colored) to branchpoint 1.5 (colored) next main 1.6 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.41 / (download) - annotate - [select for diffs], Thu May 15 23:52:32 2014 UTC (9 years, 11 months ago) by wiz
Branch: MAIN
Changes since 1.40: +4 -4 lines
Diff to previous 1.40 (colored)

Wording, typo fixes.

Revision 1.40 / (download) - annotate - [select for diffs], Thu May 15 02:34:29 2014 UTC (9 years, 11 months ago) by rmind
Branch: MAIN
Changes since 1.39: +23 -3 lines
Diff to previous 1.39 (colored)

NPF: imply SYN-only check for the stateful rules by default (when inspecting
TCP packets).  Many users trip here.  This behaviour can be overriden with the
explicit "flags" keyword, but other configuration does not really make sense.

Revision 1.39 / (download) - annotate - [select for diffs], Fri Feb 14 01:52:58 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.38: +4 -3 lines
Diff to previous 1.38 (colored)

Document NAT algorithm option in the grammar of "map".

Revision 1.38 / (download) - annotate - [select for diffs], Sat Feb 8 01:20:09 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.37: +9 -9 lines
Diff to previous 1.37 (colored)

NPF:
- Adjust the syntax - remove "inet" keyword in favour of more explicit
  "inet4" for the address family.  Consistent with "inet6" for IPv6.
- Adjust and improve the man page a little bit.

Revision 1.37 / (download) - annotate - [select for diffs], Thu Feb 6 07:36:36 2014 UTC (10 years, 2 months ago) by wiz
Branch: MAIN
Changes since 1.36: +2 -2 lines
Diff to previous 1.36 (colored)

Update count. Add serial comma.

Revision 1.36 / (download) - annotate - [select for diffs], Thu Feb 6 02:51:28 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.35: +7 -6 lines
Diff to previous 1.35 (colored)

Add support for CDB based NPF tables.

Revision 1.35 / (download) - annotate - [select for diffs], Tue Nov 19 00:28:41 2013 UTC (10 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.34: +6 -6 lines
Diff to previous 1.34 (colored)

Simplify parsing of npf.conf elements, create the npfvar_t when a value is
parsed (to be used as a general structured for variables and inlined values),
few misc improvements.

Revision 1.34 / (download) - annotate - [select for diffs], Tue Nov 12 06:07:30 2013 UTC (10 years, 5 months ago) by wiz
Branch: MAIN
Changes since 1.33: +2 -2 lines
Diff to previous 1.33 (colored)

Remove trailing whitespace.

Revision 1.33 / (download) - annotate - [select for diffs], Tue Nov 12 00:46:34 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.32: +23 -13 lines
Diff to previous 1.32 (colored)

NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is
just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).

Few misc fixes.  Bump NPF_VERSION.

Revision 1.32 / (download) - annotate - [select for diffs], Tue Nov 5 13:09:12 2013 UTC (10 years, 5 months ago) by kefren
Branch: MAIN
Changes since 1.31: +3 -3 lines
Diff to previous 1.31 (colored)

sync an example with the latest group syntax change

Revision 1.31 / (download) - annotate - [select for diffs], Fri Sep 20 03:03:52 2013 UTC (10 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.30: +20 -15 lines
Diff to previous 1.30 (colored)

- NPF: change the group/ruleset syntax - simplify.  Update npf.conf(5) manual.
- Add support for the inline pcap-filter(7) syntax in the rule, e.g.:
	block out final pcap-filter "tcp and dst 10.1.1.252"

Revision 1.30 / (download) - annotate - [select for diffs], Thu Sep 19 12:05:11 2013 UTC (10 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.29: +4 -4 lines
Diff to previous 1.29 (colored)

npfctl: remove some n-code leftovers, fix the build, update the man pages.

Revision 1.15.2.3 / (download) - annotate - [select for diffs], Sun Jun 23 06:29:05 2013 UTC (10 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.15.2.2: +4 -4 lines
Diff to previous 1.15.2.2 (colored)

resync from head

Revision 1.9.2.9 / (download) - annotate - [select for diffs], Sun Mar 31 17:43:16 2013 UTC (11 years ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1
Changes since 1.9.2.8: +2 -2 lines
Diff to previous 1.9.2.8 (colored) to branchpoint 1.9 (colored) next main 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #852):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.28
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.19
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.32
Fix the example (deja vu?).
deal with strings as interfaces
centralize error handling and print what went wrong instead of "ioctl"
handle port "ftp-data"

Revision 1.29 / (download) - annotate - [select for diffs], Sun Mar 10 21:55:40 2013 UTC (11 years, 1 month ago) by christos
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2, agc-symver-base, agc-symver
Changes since 1.28: +3 -3 lines
Diff to previous 1.28 (colored)

normalise -> normalize

Revision 1.28 / (download) - annotate - [select for diffs], Sun Mar 10 21:17:30 2013 UTC (11 years, 1 month ago) by rmind
Branch: MAIN
Changes since 1.27: +2 -2 lines
Diff to previous 1.27 (colored)

Fix the example (deja vu?).

Revision 1.15.2.2 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:46 2013 UTC (11 years, 1 month ago) by tls
Branch: tls-maxphys
Changes since 1.15.2.1: +24 -8 lines
Diff to previous 1.15.2.1 (colored)

resync with head

Revision 1.9.2.8 / (download) - annotate - [select for diffs], Mon Feb 11 21:49:47 2013 UTC (11 years, 2 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RC2, netbsd-6-1-RC1
Changes since 1.9.2.7: +4 -4 lines
Diff to previous 1.9.2.7 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.

Revision 1.27 / (download) - annotate - [select for diffs], Sat Feb 9 03:35:32 2013 UTC (11 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.26: +4 -4 lines
Diff to previous 1.26 (colored)

NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

Revision 1.5.4.4 / (download) - annotate - [select for diffs], Wed Jan 23 00:06:43 2013 UTC (11 years, 2 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.5.4.3: +5 -2 lines
Diff to previous 1.5.4.3 (colored) to branchpoint 1.5 (colored)

sync with head

Revision 1.5.4.3 / (download) - annotate - [select for diffs], Wed Jan 16 05:34:10 2013 UTC (11 years, 2 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5.4.2: +19 -6 lines
Diff to previous 1.5.4.2 (colored) to branchpoint 1.5 (colored)

sync with (a bit old) head

Revision 1.9.2.7 / (download) - annotate - [select for diffs], Mon Jan 7 16:51:07 2013 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.9.2.6: +5 -2 lines
Diff to previous 1.9.2.6 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #776):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.26
	usr.sbin/npf/npfctl/npfctl.c: revision 1.26
	dist/pf/usr.sbin/ftp-proxy/npf.c: revision 1.2
	lib/libnpf/npf.c: revision 1.15
	sys/net/npf/npf_ctl.c: revision 1.20
	lib/libnpf/npf.h: revision 1.12
	lib/libnpf/npf.3: revision 1.6
	lib/libnpf/npf.3: revision 1.7
	usr.sbin/npf/npfctl/npf_build.c: revision 1.17
	sys/net/npf/npf.h: revision 1.24
- Add NPF version check in proplist as well, not only ioctl.  Bump the version.
- Fix a bug in table entry lookup.
- Updates/fixes to the man pages.  Misc.
Remove a superfluous quote and fix a recurring typo.
ftp-proxy: disable NPF bits for now; it will be re-done.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Dec 23 21:01:04 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base8
Changes since 1.25: +5 -2 lines
Diff to previous 1.25 (colored)

- Add NPF version check in proplist as well, not only ioctl.  Bump the version.
- Fix a bug in table entry lookup.
- Updates/fixes to the man pages.  Misc.

Revision 1.9.2.4.2.1 / (download) - annotate - [select for diffs], Sat Dec 15 23:34:31 2012 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6-0
CVS Tags: netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE
Changes since 1.9.2.4: +4 -3 lines
Diff to previous 1.9.2.4 (colored) next main 1.9.2.5 (colored)

Pull up following revision(s) (requested by rmind in ticket #744):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.25
- npf.conf(5): fix of the example config.
- Mention npf_ext_log in a comment.

Revision 1.9.2.6 / (download) - annotate - [select for diffs], Sat Dec 15 23:31:07 2012 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.9.2.5: +4 -3 lines
Diff to previous 1.9.2.5 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #744):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.25
	share/examples/npf/host-npf.conf: revision 1.4
	share/examples/npf/soho_gw-npf.conf: revision 1.4
Fix syntax error in the example, fix one rule and G/C "rid" procedure.
- npf.conf(5): fix of the example config.
- Mention npf_ext_log in a comment.

Revision 1.9.2.5 / (download) - annotate - [select for diffs], Tue Dec 11 04:31:53 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.9.2.4: +17 -5 lines
Diff to previous 1.9.2.4 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #736):
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.17
	sys/net/npf/npf_tableset.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.h: revision 1.23
	usr.sbin/npf/npfctl/npf_data.c: revision 1.19
	usr.sbin/npf/npfctl/npf_build.c: revision 1.15
	share/examples/npf/host-npf.conf: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.9
	share/examples/npf/soho_gw-npf.conf: revision 1.3
	usr.sbin/npf/npfctl/npf_var.h: revision 1.6
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.24
npfctl: extend syntax for extracting interface IP address(es) by the family.
adjust to current npf.conf syntax
npf_table_list: avoid triggering assert on diagnostic.

Revision 1.25 / (download) - annotate - [select for diffs], Thu Dec 6 22:36:51 2012 UTC (11 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base7
Changes since 1.24: +4 -3 lines
Diff to previous 1.24 (colored)

- npf.conf(5): fix of the example config.
- Mention npf_ext_log in a comment.

Revision 1.24 / (download) - annotate - [select for diffs], Mon Nov 26 20:34:28 2012 UTC (11 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.23: +17 -5 lines
Diff to previous 1.23 (colored)

npfctl: extend syntax for extracting interface IP address(es) by the family.

Revision 1.15.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:03:03 2012 UTC (11 years, 4 months ago) by tls
Branch: tls-maxphys
Changes since 1.15: +207 -133 lines
Diff to previous 1.15 (colored)

Resync to 2012-11-19 00:00:00 UTC

Revision 1.9.2.3.2.1 / (download) - annotate - [select for diffs], Thu Nov 1 16:45:07 2012 UTC (11 years, 5 months ago) by matt
Branch: matt-nb6-plus
Changes since 1.9.2.3: +207 -133 lines
Diff to previous 1.9.2.3 (colored) next main 1.9.2.4 (colored)

sync with netbsd-6-0-RELEASE.

Revision 1.5.4.2 / (download) - annotate - [select for diffs], Tue Oct 30 19:00:43 2012 UTC (11 years, 5 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5.4.1: +225 -142 lines
Diff to previous 1.5.4.1 (colored) to branchpoint 1.5 (colored)

sync with head

Revision 1.9.2.4 / (download) - annotate - [select for diffs], Mon Oct 1 20:05:56 2012 UTC (11 years, 6 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RELEASE, matt-nb6-plus-nbase, matt-nb6-plus-base
Branch point for: netbsd-6-0
Changes since 1.9.2.3: +207 -133 lines
Diff to previous 1.9.2.3 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #582):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.16
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.17
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.18
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.19
	usr.sbin/npf/npfctl/npfctl.c: revision 1.19
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.20
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.21
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.22
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.23
npfctl usage: minor formatting fix.
npf.conf(5): improve and explain grammar definition.
re-work the description part of the man page, as discussed with rmind@
npf.conf(5): add syntax section and a first cut describing the structural
elements.  Some improvements and fixes from spz@.
Whitespace fixes, remove unnecessary Pp
XXX: Subsections Rules and Procedures seem empty?
Add some content to the "Rules" section.
Use more markup. New sentence, new line.
Add some content to the Procedures section.
Wording, more macros.

Revision 1.23 / (download) - annotate - [select for diffs], Sun Sep 30 21:15:08 2012 UTC (11 years, 6 months ago) by wiz
Branch: MAIN
CVS Tags: yamt-pagecache-base6
Changes since 1.22: +13 -9 lines
Diff to previous 1.22 (colored)

Wording, more macros.

Revision 1.22 / (download) - annotate - [select for diffs], Sun Sep 30 21:09:30 2012 UTC (11 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.21: +17 -2 lines
Diff to previous 1.21 (colored)

Add some content to the Procedures section.

Revision 1.21 / (download) - annotate - [select for diffs], Sun Sep 30 13:15:03 2012 UTC (11 years, 6 months ago) by wiz
Branch: MAIN
Changes since 1.20: +5 -2 lines
Diff to previous 1.20 (colored)

Use more markup. New sentence, new line.

Revision 1.20 / (download) - annotate - [select for diffs], Sun Sep 30 12:59:31 2012 UTC (11 years, 6 months ago) by spz
Branch: MAIN
Changes since 1.19: +26 -1 lines
Diff to previous 1.19 (colored)

Add some content to the "Rules" section.

Revision 1.19 / (download) - annotate - [select for diffs], Sun Sep 30 07:43:03 2012 UTC (11 years, 6 months ago) by wiz
Branch: MAIN
Changes since 1.18: +3 -7 lines
Diff to previous 1.18 (colored)

Whitespace fixes, remove unnecessary Pp
XXX: Subsections Rules and Procedures seem empty?

Revision 1.18 / (download) - annotate - [select for diffs], Sat Sep 29 19:50:03 2012 UTC (11 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.17: +99 -16 lines
Diff to previous 1.17 (colored)

npf.conf(5): add syntax section and a first cut describing the structural
elements.  Some improvements and fixes from spz@.

Revision 1.17 / (download) - annotate - [select for diffs], Fri Sep 28 18:36:02 2012 UTC (11 years, 6 months ago) by spz
Branch: MAIN
Changes since 1.16: +22 -94 lines
Diff to previous 1.16 (colored)

re-work the description part of the man page, as discussed with rmind@

Revision 1.16 / (download) - annotate - [select for diffs], Wed Sep 26 21:58:27 2012 UTC (11 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.15: +59 -39 lines
Diff to previous 1.15 (colored)

npf.conf(5): improve and explain grammar definition.

Revision 1.9.2.3 / (download) - annotate - [select for diffs], Mon Aug 13 19:43:44 2012 UTC (11 years, 8 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RC2, netbsd-6-0-RC1
Branch point for: matt-nb6-plus
Changes since 1.9.2.2: +8 -4 lines
Diff to previous 1.9.2.2 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #489):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.9
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.9
- npfctl show: add most of the missing cases.
- Few minor improvements to NPF man pages.

Revision 1.15 / (download) - annotate - [select for diffs], Mon Aug 13 01:18:31 2012 UTC (11 years, 8 months ago) by rmind
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.14: +8 -4 lines
Diff to previous 1.14 (colored)

- npfctl show: add most of the missing cases.
- Few minor improvements to NPF man pages.

Revision 1.9.2.2 / (download) - annotate - [select for diffs], Thu Jul 5 17:48:44 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.9.2.1: +19 -15 lines
Diff to previous 1.9.2.1 (colored) to branchpoint 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #399):
	sys/net/npf/npf_session.c: revision 1.14
	sys/net/npf/npf_tableset.c: revision 1.12
	sys/net/npf/npf_state_tcp.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.14
	sys/net/npf/npf_inet.c: revision 1.13
	sys/net/npf/npf_ruleset.c: revision 1.12
	sys/net/npf/npf.h: revision 1.18
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.8: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2
	usr.sbin/npf/npfctl/npfctl.8: revision 1.8
	sys/net/npf/npf_instr.c: revision 1.12
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.13
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.14
	sys/net/npf/npf_state.c: revision 1.9
	sys/net/npf/npf_processor.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.13
	usr.sbin/npf/npfctl/npfctl.c: revision 1.14
	usr.sbin/npf/npfctl/npf_build.c: revision 1.10
	lib/libnpf/npf.3: revision 1.5
	lib/libnpf/npf.h: revision 1.8
	share/man/man9/npf_ncode.9: revision 1.9
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.4
	lib/libnpf/npf.c: revision 1.9
	usr.sbin/npf/npfctl/npfctl.h: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6
	sys/net/npf/npf_impl.h: revision 1.17
	sys/net/npf/npf_handler.c: revision 1.18
	sys/net/npf/npf_handler.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4
	sys/net/npf/npf_ncode.h: revision 1.9
Fix and update npf.conf(5), npfctl(8) and its usage message.
npf_state_tcp: fix for FIN retransmission and out-of-order ACK case.
NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.
npf_packet_handler: fix gcc unused warning.

Revision 1.14 / (download) - annotate - [select for diffs], Sun Jul 1 23:21:06 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.13: +3 -2 lines
Diff to previous 1.13 (colored)

NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.

Revision 1.13 / (download) - annotate - [select for diffs], Wed Jun 27 23:05:28 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.12: +18 -15 lines
Diff to previous 1.12 (colored)

Fix and update npf.conf(5), npfctl(8) and its usage message.

Revision 1.9.2.1 / (download) - annotate - [select for diffs], Tue Jun 26 00:07:20 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.9: +25 -24 lines
Diff to previous 1.9 (colored)

Pull up following revision(s) (requested by rmind in ticket #354):
	sys/net/npf/npf_state_tcp.c: revision 1.4
	sys/net/npf/npf_state_tcp.c: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.6
	usr.sbin/npf/npftest/npftest.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.1
	usr.sbin/npf/npftest/npftest.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.2
	usr.sbin/npf/npfctl/npf_data.c: revision 1.11
	usr.sbin/npf/npftest/npftest.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.12
	usr.sbin/npf/npftest/npftest.h: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.5
	usr.sbin/npf/npfctl/npf_data.c: revision 1.13
	sys/net/npf/npf.h: revision 1.16
	usr.sbin/npf/npftest/npftest.h: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.6
	usr.sbin/npf/npftest/npftest.h: revision 1.3
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.7
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.10
	usr.sbin/npf/npfctl/npf_build.c: revision 1.6
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.8
	usr.sbin/npf/npfctl/npf_build.c: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.9
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.10
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.11
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.12
	sys/net/npf/npf_state.c: revision 1.7
	usr.sbin/npf/npfctl/npfctl.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.12
	usr.sbin/npf/npfctl/Makefile: revision 1.7
	sys/rump/net/lib/libnet/Makefile: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.7
	usr.sbin/npf/npftest/Makefile: revision 1.1
	usr.sbin/npf/npftest/Makefile: revision 1.2
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.2
	usr.sbin/npf/npftest/npfstream.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.3
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.12
	sys/rump/dev/lib/libnpf/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.14
	sys/rump/dev/lib/libnpf/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.15
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.9
	sys/net/npf/npf_ctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_var.c: revision 1.4
	usr.sbin/npf/npfctl/npf_var.h: revision 1.2
	usr.sbin/npf/npfctl/npf_var.c: revision 1.5
	sys/net/npf/npf_impl.h: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.10
	sys/net/npf/npf_impl.h: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.4
	sys/net/npf/npf_impl.h: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.5
	sys/net/npf/npf_handler.c: revision 1.17
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.2
	sys/net/npf/npf_ncode.h: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.3
	sys/net/npf/npf_ncode.h: revision 1.8
npf_tcp_inwindow: in a case of negative skew, bump the maximum seen value of
SEQ+LEN in the receiver's side correctly (using ACK from the sender's side).
PR/46265 from Changli Gao.
rumpnet_net: add pfil.c
Update rumpdev_npf; use WARNS=4.
Add initial NPF regression tests integrated with RUMP framework (running the
kernel part of NPF in userland).  Other tests will be added once converted to
RUMP framework.  All tests are in the public domain.
Some Makefile fixes from christos@.
- Fix double-free case on ICMP return case.
- npf_pfil_register: handle kernels without INET6 option correctly.
- Reduce some #ifdefs.
npfctl(8): add show-config command.  Also, update syntax.
npftest: add a stream processor, which prints out the TCP state information.
A tool for debugging connection tracking from tcpdump -w captured data.
npftest: add a module for TCP state tracking and add few test cases.
npf_state_tcp: add an assert; fix some comments while here.
- Rework NPF NAT syntax to be more structured and support future additions
  of different types and configurations of NAT.
- npfctl: improve disassemble and show-config command functionality.
- Fix custom ICMP code and type filtering.
make this compile again.
remove error(1) output
Remove superfluous Pp
- make each element of a variable hold a type
- change get_type to take an index, so we can get the individual types of
  each element (since primitive elements can be in lists)
- make port_range primitive
- add a routine to convert a variable of primitives to a variable containing
- only port ranges.
remove extra rule that got merged...

Revision 1.12 / (download) - annotate - [select for diffs], Fri Jun 15 23:24:08 2012 UTC (11 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.11: +13 -11 lines
Diff to previous 1.11 (colored)

- Rework NPF NAT syntax to be more structured and support future additions
  of different types and configurations of NAT.
- npfctl: improve disassemble and show-config command functionality.
- Fix custom ICMP code and type filtering.

Revision 1.11 / (download) - annotate - [select for diffs], Wed May 30 22:00:44 2012 UTC (11 years, 10 months ago) by wiz
Branch: MAIN
Changes since 1.10: +1 -2 lines
Diff to previous 1.10 (colored)

Remove superfluous Pp

Revision 1.10 / (download) - annotate - [select for diffs], Wed May 30 21:30:07 2012 UTC (11 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.9: +15 -15 lines
Diff to previous 1.9 (colored)

npfctl(8): add show-config command.  Also, update syntax.

Revision 1.5.4.1 / (download) - annotate - [select for diffs], Tue Apr 17 00:09:50 2012 UTC (11 years, 11 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.5: +32 -26 lines
Diff to previous 1.5 (colored)

sync with head

Revision 1.9 / (download) - annotate - [select for diffs], Mon Feb 6 00:41:36 2012 UTC (12 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, netbsd-6-base
Branch point for: netbsd-6
Changes since 1.8: +3 -3 lines
Diff to previous 1.8 (colored)

Fix the family option in the grammar and example.

Revision 1.8 / (download) - annotate - [select for diffs], Mon Feb 6 00:37:52 2012 UTC (12 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.7: +16 -10 lines
Diff to previous 1.7 (colored)

- Handle NPF rule procedures in the parser and thus re-enable them.
- Few small updates to the man page.

Revision 1.7 / (download) - annotate - [select for diffs], Sun Jan 8 22:14:55 2012 UTC (12 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.6: +17 -17 lines
Diff to previous 1.6 (colored)

update.

Revision 1.6 / (download) - annotate - [select for diffs], Tue Nov 29 01:12:09 2011 UTC (12 years, 4 months ago) by riz
Branch: MAIN
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)

Remove quotes from "hash" and "tree" in the table examples so
the example stands a chance of actually working as written.  There appear
to be other problems, too.

Revision 1.5 / (download) - annotate - [select for diffs], Tue Mar 22 07:31:42 2011 UTC (13 years ago) by jruoho
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2, yamt-pagecache-base, cherry-xenmp-base, cherry-xenmp
Branch point for: yamt-pagecache
Changes since 1.4: +8 -8 lines
Diff to previous 1.4 (colored)

Use .Ss for non-standard subtitles in the DESCRIPTION.

Revision 1.3.2.1 / (download) - annotate - [select for diffs], Tue Feb 8 16:20:15 2011 UTC (13 years, 2 months ago) by bouyer
Branch: bouyer-quota2
Changes since 1.3: +43 -9 lines
Diff to previous 1.3 (colored) next main 1.4 (colored)

Sync with HEAD

Revision 1.4 / (download) - annotate - [select for diffs], Wed Feb 2 02:20:25 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: bouyer-quota2-nbase, bouyer-quota2-base
Changes since 1.3: +43 -9 lines
Diff to previous 1.3 (colored)

NPF checkpoint:
- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc).
- Add NPF support for ftp-proxy(8).
- Add rc.d script for NPF.
- Convert npfctl(8) to use libnpf(3) and thus make it less depressive.
  Note: next clean-up step should be a parser, once dholland@ will finish it.
- Add more documentation.
- Various fixes.

Revision 1.3 / (download) - annotate - [select for diffs], Tue Jan 18 20:33:45 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
Branch point for: bouyer-quota2
Changes since 1.2: +26 -13 lines
Diff to previous 1.2 (colored)

NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
  potentially other functions from the rule structure.  Rule procedure can be
  shared amongst the rules.  Separation is both at kernel level (npf_rproc_t)
  and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic.  Use TCP FSM definitions.
- Add if_byindex(), OK by matt@.  Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.

Revision 1.2 / (download) - annotate - [select for diffs], Thu Sep 16 04:53:27 2010 UTC (13 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: matt-mips64-premerge-20101231
Changes since 1.1: +10 -6 lines
Diff to previous 1.1 (colored)

NPF checkpoint:
- Add support for bi-directional NAT and redirection / port forwarding.
- Finish filtering on ICMP type/code and add filtering on TCP flags.
- Add support for TCP reset (RST) or ICMP destination unreachable on block.
- Fix a bunch of bugs; misc cleanup.

Revision 1.1 / (download) - annotate - [select for diffs], Tue Aug 24 23:55:05 2010 UTC (13 years, 7 months ago) by rmind
Branch: MAIN

Move npf.conf(5-8) into the correct section, hence npf.conf(5).

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>