![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npfctl
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.50.2.4 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (2 years, 11 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE,
netbsd-9-2-RELEASE,
netbsd-9-1-RELEASE
Changes since 1.50.2.3: +155 -114
lines
Diff to previous 1.50.2.3 (colored) to branchpoint 1.50 (colored) next main 1.51 (colored)
Pull up following revision(s) (requested by rmind in ticket #956):
usr.sbin/npf/npf-params.7: revision 1.4
sys/net/npf/npf_worker.c: revision 1.9
usr.sbin/npf/npftest/npftest.h: revision 1.17
usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
usr.sbin/npf/npf-params.7: revision 1.5
sys/net/npf/npf_state_tcp.c: revision 1.21
usr.sbin/npf/npfctl/npf_build.c: revision 1.55
usr.sbin/npf/npf-params.7: revision 1.6
sys/net/npf/npfkern.h: revision 1.5
lib/libnpf/npf.c: revision 1.49
usr.sbin/npf/npf-params.7: revision 1.7
sys/net/npf/npf_impl.h: revision 1.81
sys/net/npf/npf_ext_log.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.h: revision 1.53
usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.50
sys/net/npf/npf_mbuf.c: revision 1.24
sys/net/npf/npf_alg.c: revision 1.22
usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
sys/net/npf/npf.h: revision 1.63
usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
usr.sbin/npf/npfctl/npf_var.c: revision 1.13
sys/net/npf/files.npf: revision 1.23
usr.sbin/npf/npfctl/npf_show.c: revision 1.32
usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
sys/net/npf/npf_os.c: revision 1.18
sys/net/npf/npf_connkey.c: revision 1.2
sys/net/npf/npf_conf.c: revision 1.17
lib/libnpf/libnpf.3: revision 1.12
usr.sbin/npf/npftest/npftest.c: revision 1.25
usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
sys/net/npf/npf_tableset.c: revision 1.35
usr.sbin/npf/npftest/npftest.conf: revision 1.9
sys/net/npf/npf_sendpkt.c: revision 1.22
usr.sbin/npf/npfctl/npf_var.h: revision 1.10
sys/net/npf/npf_state.c: revision 1.23
sys/net/npf/npf_conn.h: revision 1.20
usr.sbin/npf/npfctl/npfctl.c: revision 1.64
usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
sys/net/npf/npf_portmap.c: revision 1.5
sys/net/npf/npf_params.c: revision 1.3
usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
tests/net/npf/t_npf.sh: revision 1.4
sys/net/npf/npf_ext_rndblock.c: revision 1.9
lib/libnpf/npf.h: revision 1.39
sys/net/npf/npf_ruleset.c: revision 1.51
sys/net/npf/npf_alg_icmp.c: revision 1.33
sys/net/npf/npf.c: revision 1.43
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.8: revision 1.25
sys/net/npf/npf_ctl.c: revision 1.60
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
sys/net/npf/npf_handler.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.57
sys/net/npf/npf_ifaddr.c: revision 1.7
sys/net/npf/npf_conndb.c: revision 1.9
sys/net/npf/npf_if.c: revision 1.13
usr.sbin/npf/npfctl/Makefile: revision 1.15
sys/net/npf/npf_conn.c: revision 1.32
sys/net/npf/npf_ext_normalize.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.20
sys/net/npf/npf_worker.c: revision 1.8
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.
npftest -- npf_test_init(): add a workaround for NetBSD.
npf-params(7): fix the state.key defaults.
npf-params.7: s/filer/filter/
Adjust to "npfctl debug" command line changes, from rmind@.
Use more markup.
Revision 1.55 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (2 years, 11 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-10-base,
netbsd-10,
cjep_sun2x-base1,
cjep_sun2x-base,
cjep_sun2x,
cjep_staticlib_x-base1,
cjep_staticlib_x-base,
cjep_staticlib_x,
HEAD
Changes since 1.54: +155 -114
lines
Diff to previous 1.54 (colored)
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
Revision 1.50.2.3 / (download) - annotate - [select for diffs], Mon May 25 17:25:28 2020 UTC (3 years ago) by martin
Branch: netbsd-9
Changes since 1.50.2.2: +40 -8
lines
Diff to previous 1.50.2.2 (colored) to branchpoint 1.50 (colored)
Pull up following revision(s) (requested by rmind in ticket #930):
usr.sbin/npf/npfctl/npf_build.c: revision 1.54
sys/net/npf/npf_conn.h: revision 1.19
usr.sbin/npf/npfctl/npfctl.h: revision 1.52
usr.sbin/npf/npfctl/npf_show.c: revision 1.31
sys/net/npf/npf_conf.c: revision 1.16
sys/net/npf/npf_nat.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.56
sys/net/npf/npf_conndb.c: revision 1.8
sys/net/npf/npf_conn.c: revision 1.31
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9),
instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes
with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not
wait for reference draining on destruction; destroy the policy on the
last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
Revision 1.54 / (download) - annotate - [select for diffs], Sat May 23 19:56:00 2020 UTC (3 years ago) by rmind
Branch: MAIN
Changes since 1.53: +40 -8
lines
Diff to previous 1.53 (colored)
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9),
instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes
with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not
wait for reference draining on destruction; destroy the policy on the
last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
Revision 1.45.4.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:55 2020 UTC (3 years, 1 month ago) by martin
Branch: phil-wifi
Changes since 1.45.4.1: +149 -51
lines
Diff to previous 1.45.4.1 (colored) to branchpoint 1.45 (colored) next main 1.46 (colored)
Mostly merge changes from HEAD upto 20200411
Revision 1.50.2.2 / (download) - annotate - [select for diffs], Fri Oct 4 08:06:34 2019 UTC (3 years, 7 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE,
netbsd-9-0-RC2,
netbsd-9-0-RC1
Changes since 1.50.2.1: +77 -28
lines
Diff to previous 1.50.2.1 (colored) to branchpoint 1.50 (colored)
Pull up following revision(s) (requested by rmind in ticket #282): usr.sbin/npf/npfctl/npf_build.c: revision 1.53 lib/libnpf/npf.c: revision 1.48 usr.sbin/npf/npfctl/npfctl.h: revision 1.50 sys/net/npf/npf_impl.h: revision 1.80 usr.sbin/npf/npfctl/npfctl.h: revision 1.51 sys/net/npf/npf_ruleset.c: revision 1.49 usr.sbin/npf/npfctl/npf.conf.5: revision 1.90 sys/net/npf/npf_ctl.c: revision 1.59 lib/libnpf/libnpf.3: revision 1.11 usr.sbin/npf/npfctl/npf_parse.y: revision 1.50 usr.sbin/npf/npftest/npftest.conf: revision 1.8 usr.sbin/npf/npfctl/npfctl.c: revision 1.62 usr.sbin/npf/npfctl/npfctl.c: revision 1.63 usr.sbin/npf/npfctl/npf_scan.l: revision 1.30 usr.sbin/npf/npfctl/npfctl.8: revision 1.22 lib/libnpf/npf.h: revision 1.38 usr.sbin/npf/npfctl/npfctl.8: revision 1.23 usr.sbin/npf/npfctl/npfctl.8: revision 1.24 sys/net/npf/npf_if.c: revision 1.11 sys/net/npf/npf_if.c: revision 1.12 usr.sbin/npf/npfctl/npf.conf.5: revision 1.89 sys/net/npf/npf_conn.c: revision 1.30 usr.sbin/npf/npfctl/npf_build.c: revision 1.52 npfctl: implement table replace subcommand. Contributed by Timshel Knoll-Miller. NPF ifmap: rework and fix a few small bugs. npfctl: implement table replace subcommand. Contributed by Timshel Knoll-Miller. (missed a file in previous commit; cvs is so helpful..) libnpf/npfctl: support dynamic NAT rulesets using a name prefix. Use -width Pa for FILES. Fix pasto in table replace -t type Use -width Pa for FILES. npf_ifmap_copylogname: be more defensive.
Revision 1.53 / (download) - annotate - [select for diffs], Mon Sep 30 00:37:11 2019 UTC (3 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20200421,
phil-wifi-20200411,
phil-wifi-20200406,
phil-wifi-20191119,
is-mlppp-base,
is-mlppp
Changes since 1.52: +39 -10
lines
Diff to previous 1.52 (colored)
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
Revision 1.52 / (download) - annotate - [select for diffs], Sun Sep 29 18:51:08 2019 UTC (3 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.51: +39 -19
lines
Diff to previous 1.51 (colored)
npfctl: implement table replace subcommand. Contributed by Timshel Knoll-Miller. (missed a file in previous commit; cvs is so helpful..)
Revision 1.50.2.1 / (download) - annotate - [select for diffs], Sun Aug 11 10:10:23 2019 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
Changes since 1.50: +5 -5
lines
Diff to previous 1.50 (colored)
Pull up following revision(s) (requested by rmind in ticket #44): usr.sbin/npf/npfctl/npfctl.h: revision 1.49 usr.sbin/npf/npfctl/npf_build.c: revision 1.51 usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.14 NPF: fix BPF byte-code generation for a port-range used in a group. Resolved PR/52609 and PR/54169.
Revision 1.51 / (download) - annotate - [select for diffs], Thu Aug 8 21:29:15 2019 UTC (3 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.50: +5 -5
lines
Diff to previous 1.50 (colored)
NPF: fix BPF byte-code generation for a port-range used in a group. Resolved PR/52609 and PR/54169.
Revision 1.50 / (download) - annotate - [select for diffs], Thu Jul 25 00:48:55 2019 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.49: +2 -1
lines
Diff to previous 1.49 (colored)
npfctl: fix the bpf.jit parameter handling.
Revision 1.49 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:02 2019 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.48: +72 -24
lines
Diff to previous 1.48 (colored)
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Revision 1.45.4.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:10:34 2019 UTC (3 years, 11 months ago) by christos
Branch: phil-wifi
Changes since 1.45: +199 -131
lines
Diff to previous 1.45 (colored)
Sync with HEAD
Revision 1.44.4.1 / (download) - annotate - [select for diffs], Fri Apr 19 09:10:49 2019 UTC (4 years, 1 month ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE,
netbsd-8-1-RELEASE,
netbsd-8-1-RC1
Changes since 1.44: +5 -4
lines
Diff to previous 1.44 (colored) next main 1.45 (colored)
Pull up following revision(s) (requested by tih in ticket #1232): usr.sbin/npf/npfctl/npf_build.c: revision 1.48 usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.12 Summary: Ensure default TCP flags are applied to rules like 'pass stateful all' The documented default "flags S/SAFR" for stateful rules that affect TCP packets but don't specify any flags, doesn't actually get applied to a rule like "pass stateful out all". The big problem with this is that when you then do a "block return-rst" for an incoming packet, the generated RST packet will create state for the connection attempt it's blocking, so that a second attempt from the same source will pass. This change makes the default flags actually apply to such simple rules. It also fixes a related bug in the code generation for the flag matching, where part of the action could erroneously be omitted. Reviewed by <rmind> Closes PR bin/54124 Pullup to NetBSD 8
Revision 1.48 / (download) - annotate - [select for diffs], Wed Apr 17 20:41:58 2019 UTC (4 years, 1 month ago) by tih
Branch: MAIN
CVS Tags: phil-wifi-20190609
Changes since 1.47: +4 -3
lines
Diff to previous 1.47 (colored)
Summary: Ensure default TCP flags are applied to rules like 'pass stateful all' The documented default "flags S/SAFR" for stateful rules that affect TCP packets but don't specify any flags, doesn't actually get applied to a rule like "pass stateful out all". The big problem with this is that when you then do a "block return-rst" for an incoming packet, the generated RST packet will create state for the connection attempt it's blocking, so that a second attempt from the same source will pass. This change makes the default flags actually apply to such simple rules. It also fixes a related bug in the code generation for the flag matching, where part of the action could erroneously be omitted. Reviewed by <rmind> Closes PR bin/54124 Pullup to NetBSD 8
Revision 1.45.2.2 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:39 2019 UTC (4 years, 4 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.45.2.1: +157 -53
lines
Diff to previous 1.45.2.1 (colored) to branchpoint 1.45 (colored) next main 1.46 (colored)
Sync with HEAD
Revision 1.47 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:32 2019 UTC (4 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190127
Changes since 1.46: +157 -53
lines
Diff to previous 1.46 (colored)
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Revision 1.45.2.1 / (download) - annotate - [select for diffs], Sun Sep 30 01:46:01 2018 UTC (4 years, 7 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.45: +40 -77
lines
Diff to previous 1.45 (colored)
Ssync with HEAD
Revision 1.46 / (download) - annotate - [select for diffs], Sat Sep 29 14:41:36 2018 UTC (4 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190118,
pgoyette-compat-1226,
pgoyette-compat-1126,
pgoyette-compat-1020,
pgoyette-compat-0930
Changes since 1.45: +40 -77
lines
Diff to previous 1.45 (colored)
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
Revision 1.45 / (download) - annotate - [select for diffs], Sun Dec 10 22:04:41 2017 UTC (5 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-base,
pgoyette-compat-base,
pgoyette-compat-0906,
pgoyette-compat-0728,
pgoyette-compat-0625,
pgoyette-compat-0521,
pgoyette-compat-0502,
pgoyette-compat-0422,
pgoyette-compat-0415,
pgoyette-compat-0407,
pgoyette-compat-0330,
pgoyette-compat-0322,
pgoyette-compat-0315
Branch point for: phil-wifi,
pgoyette-compat
Changes since 1.44: +16 -4
lines
Diff to previous 1.44 (colored)
npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
Revision 1.43.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:18 2017 UTC (6 years, 1 month ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.43: +11 -8
lines
Diff to previous 1.43 (colored) next main 1.44 (colored)
Sync with HEAD
Revision 1.40.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:58:08 2017 UTC (6 years, 2 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.40.2.1: +11 -8
lines
Diff to previous 1.40.2.1 (colored) to branchpoint 1.40 (colored) next main 1.41 (colored)
Sync with HEAD
Revision 1.44 / (download) - annotate - [select for diffs], Thu Jan 19 20:18:17 2017 UTC (6 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: prg-localcount2-base3,
prg-localcount2-base2,
prg-localcount2-base1,
prg-localcount2-base,
prg-localcount2,
pgoyette-localcount-20170426,
pgoyette-localcount-20170320,
perseant-stdc-iso10646-base,
perseant-stdc-iso10646,
netbsd-8-base,
netbsd-8-0-RELEASE,
netbsd-8-0-RC2,
netbsd-8-0-RC1,
matt-nb8-mediatek-base,
matt-nb8-mediatek,
bouyer-socketcan-base1
Branch point for: netbsd-8
Changes since 1.43: +11 -8
lines
Diff to previous 1.43 (colored)
npfctl: - Add protocol filter option for "map". - Print user-friendly error if table contains an entry with invalid netmask. - Add support for inline ports.
Revision 1.40.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:57:00 2017 UTC (6 years, 4 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.40: +64 -22
lines
Diff to previous 1.40 (colored)
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
Revision 1.43 / (download) - annotate - [select for diffs], Tue Jan 3 01:29:49 2017 UTC (6 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107,
bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.42: +23 -5
lines
Diff to previous 1.42 (colored)
npfctl: dynamic interface address handling; update npf.conf(8).
Revision 1.42 / (download) - annotate - [select for diffs], Tue Dec 27 22:35:33 2016 UTC (6 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.41: +9 -6
lines
Diff to previous 1.41 (colored)
npf.conf: add support for logical NOT, e.g.: pass from ! 10.0.0.1 to any
Revision 1.41 / (download) - annotate - [select for diffs], Mon Dec 26 23:05:05 2016 UTC (6 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.40: +36 -15
lines
Diff to previous 1.40 (colored)
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
Revision 1.38.2.2 / (download) - annotate - [select for diffs], Wed Jun 10 16:57:58 2015 UTC (7 years, 11 months ago) by snj
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116,
netbsd-7-nhusb-base,
netbsd-7-nhusb,
netbsd-7-2-RELEASE,
netbsd-7-1-RELEASE,
netbsd-7-1-RC2,
netbsd-7-1-RC1,
netbsd-7-1-2-RELEASE,
netbsd-7-1-1-RELEASE,
netbsd-7-1,
netbsd-7-0-RELEASE,
netbsd-7-0-RC3,
netbsd-7-0-RC2,
netbsd-7-0-RC1,
netbsd-7-0-2-RELEASE,
netbsd-7-0-1-RELEASE,
netbsd-7-0
Changes since 1.38.2.1: +6 -2
lines
Diff to previous 1.38.2.1 (colored) to branchpoint 1.38 (colored) next main 1.39 (colored)
Pull up following revision(s) (requested by rmind in ticket #835): sys/net/npf/npf_ctl.c: revision 1.42 usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.8 usr.sbin/npf/npfctl/npf_build.c: revision 1.40 - npfctl: fix the confusion in the parser (0/0 case with no other filter). - Always populate the error dictionary, not only for DEBUG/DIAGNOSTIC.
Revision 1.40 / (download) - annotate - [select for diffs], Mon Jun 8 01:00:43 2015 UTC (7 years, 11 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-base,
pgoyette-localcount-20161104,
pgoyette-localcount-20160806,
pgoyette-localcount-20160726,
localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.39: +6 -2
lines
Diff to previous 1.39 (colored)
- npfctl: fix the confusion in the parser (0/0 case with no other filter). - Always populate the error dictionary, not only for DEBUG/DIAGNOSTIC.
Revision 1.38.2.1 / (download) - annotate - [select for diffs], Sat Mar 21 17:49:03 2015 UTC (8 years, 2 months ago) by snj
Branch: netbsd-7
Changes since 1.38: +6 -2
lines
Diff to previous 1.38 (colored)
Pull up following revision(s) (requested by rmind in ticket #630): sys/net/npf/npf_ctl.c: revision 1.41 sys/net/npf/npf_ruleset.c: revision 1.42 usr.sbin/npf/npfctl/npf_build.c: revision 1.39 usr.sbin/npf/npfctl/npf_show.c: revision 1.18 NPF: replace the TAILQ of the dynamic rules with a linked list and fix the inheriting of the active dynamic rules during the reload; also, fix a bug in the insert path by putting a memory barrier in the right place. -- npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
Revision 1.39 / (download) - annotate - [select for diffs], Sat Mar 21 00:49:07 2015 UTC (8 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.38: +6 -2
lines
Diff to previous 1.38 (colored)
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
Revision 1.13.2.4 / (download) - annotate - [select for diffs], Wed Aug 20 00:05:11 2014 UTC (8 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.13.2.3: +318 -236
lines
Diff to previous 1.13.2.3 (colored) next main 1.14 (colored)
Rebase to HEAD as of a few days ago.
Revision 1.36.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 07:00:01 2014 UTC (8 years, 9 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.36: +24 -4
lines
Diff to previous 1.36 (colored) next main 1.37 (colored)
Rebase.
Revision 1.38 / (download) - annotate - [select for diffs], Sat May 31 22:41:37 2014 UTC (8 years, 11 months ago) by rmind
Branch: MAIN
CVS Tags: tls-maxphys-base,
tls-earlyentropy-base,
netbsd-7-base
Branch point for: netbsd-7
Changes since 1.37: +12 -3
lines
Diff to previous 1.37 (colored)
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
Revision 1.6.2.6 / (download) - annotate - [select for diffs], Thu May 22 11:43:07 2014 UTC (9 years ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.5: +391 -252
lines
Diff to previous 1.6.2.5 (colored) to branchpoint 1.6 (colored) next main 1.7 (colored)
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
Revision 1.37 / (download) - annotate - [select for diffs], Thu May 15 02:34:29 2014 UTC (9 years ago) by rmind
Branch: MAIN
Changes since 1.36: +14 -3
lines
Diff to previous 1.36 (colored)
NPF: imply SYN-only check for the stateful rules by default (when inspecting TCP packets). Many users trip here. This behaviour can be overriden with the explicit "flags" keyword, but other configuration does not really make sense.
Revision 1.36 / (download) - annotate - [select for diffs], Thu Feb 13 03:34:40 2014 UTC (9 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9,
riastradh-xf86-video-intel-2-7-1-pre-2-21-15,
riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.35: +53 -22
lines
Diff to previous 1.35 (colored)
NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION. Thanks to S.P.Zeidler for the help with NPTv6 work!
Revision 1.35 / (download) - annotate - [select for diffs], Fri Feb 7 23:45:22 2014 UTC (9 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.34: +30 -38
lines
Diff to previous 1.34 (colored)
NPF: add support for static (stateless) NAT.
Revision 1.34 / (download) - annotate - [select for diffs], Thu Feb 6 18:48:09 2014 UTC (9 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.33: +3 -3
lines
Diff to previous 1.33 (colored)
fix vax build.
Revision 1.33 / (download) - annotate - [select for diffs], Thu Feb 6 02:51:28 2014 UTC (9 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.32: +57 -10
lines
Diff to previous 1.32 (colored)
Add support for CDB based NPF tables.
Revision 1.32 / (download) - annotate - [select for diffs], Mon Feb 3 02:21:52 2014 UTC (9 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.31: +22 -6
lines
Diff to previous 1.31 (colored)
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
Revision 1.31 / (download) - annotate - [select for diffs], Fri Nov 22 00:25:51 2013 UTC (9 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.30: +4 -4
lines
Diff to previous 1.30 (colored)
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
Revision 1.30 / (download) - annotate - [select for diffs], Tue Nov 19 00:28:41 2013 UTC (9 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.29: +7 -7
lines
Diff to previous 1.29 (colored)
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
Revision 1.29 / (download) - annotate - [select for diffs], Tue Nov 12 00:46:34 2013 UTC (9 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.28: +7 -7
lines
Diff to previous 1.28 (colored)
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128). Few misc fixes. Bump NPF_VERSION.
Revision 1.28 / (download) - annotate - [select for diffs], Fri Nov 8 00:38:26 2013 UTC (9 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.27: +23 -27
lines
Diff to previous 1.27 (colored)
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
Revision 1.27 / (download) - annotate - [select for diffs], Fri Sep 20 03:03:52 2013 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.26: +52 -20
lines
Diff to previous 1.26 (colored)
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
Revision 1.26 / (download) - annotate - [select for diffs], Thu Sep 19 12:05:11 2013 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.25: +3 -3
lines
Diff to previous 1.25 (colored)
npfctl: remove some n-code leftovers, fix the build, update the man pages.
Revision 1.25 / (download) - annotate - [select for diffs], Thu Sep 19 01:04:45 2013 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.24: +90 -142
lines
Diff to previous 1.24 (colored)
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
Revision 1.13.2.3 / (download) - annotate - [select for diffs], Sun Jun 23 06:29:05 2013 UTC (9 years, 11 months ago) by tls
Branch: tls-maxphys
Changes since 1.13.2.2: +34 -4
lines
Diff to previous 1.13.2.2 (colored)
resync from head
Revision 1.24 / (download) - annotate - [select for diffs], Sun May 19 20:45:34 2013 UTC (10 years ago) by rmind
Branch: MAIN
CVS Tags: riastradh-drm2-base2,
riastradh-drm2-base1,
riastradh-drm2-base,
riastradh-drm2
Changes since 1.23: +5 -3
lines
Diff to previous 1.23 (colored)
- Add NPF table flushing functionality. - Fix line numbering for npfctl debug command.
Revision 1.23 / (download) - annotate - [select for diffs], Wed Mar 20 00:29:47 2013 UTC (10 years, 2 months ago) by christos
Branch: MAIN
CVS Tags: agc-symver-base,
agc-symver
Changes since 1.22: +15 -3
lines
Diff to previous 1.22 (colored)
Make ALG's autoloadable by providing in the config file: alg "algname"
Revision 1.22 / (download) - annotate - [select for diffs], Mon Mar 18 02:17:49 2013 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.21: +18 -2
lines
Diff to previous 1.21 (colored)
- Extend npf.conf syntax to support dynamic NAT policies. - Imply dynamic group when using "ruleset" keyword.
Revision 1.13.2.2 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:46 2013 UTC (10 years, 3 months ago) by tls
Branch: tls-maxphys
Changes since 1.13.2.1: +99 -45
lines
Diff to previous 1.13.2.1 (colored)
resync with head
Revision 1.4.2.12 / (download) - annotate - [select for diffs], Mon Feb 18 18:26:14 2013 UTC (10 years, 3 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE,
netbsd-6-1-RC4,
netbsd-6-1-RC3,
netbsd-6-1-RC2,
netbsd-6-1-RC1,
netbsd-6-1-5-RELEASE,
netbsd-6-1-4-RELEASE,
netbsd-6-1-3-RELEASE,
netbsd-6-1-2-RELEASE,
netbsd-6-1-1-RELEASE,
netbsd-6-1
Changes since 1.4.2.11: +4 -3
lines
Diff to previous 1.4.2.11 (colored) to branchpoint 1.4 (colored) next main 1.5 (colored)
Pull up following revision(s) (requested by rmind in ticket #829): usr.sbin/npf/npfctl/npfctl.8: revision 1.13 usr.sbin/npf/npfctl/npf_build.c: revision 1.21 lib/libnpf/npf.c: revision 1.18 sys/net/npf/npf_ctl.c: revision 1.23 usr.sbin/npf/npfctl/npfctl.h: revision 1.27 lib/libnpf/npf.h: revision 1.15 sys/net/npf/npf_ruleset.c: revision 1.19 sys/net/npf/npf_impl.h: revision 1.28 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.17 usr.sbin/npf/npfctl/npfctl.c: revision 1.31 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.6 - Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
Revision 1.21 / (download) - annotate - [select for diffs], Sat Feb 16 21:11:14 2013 UTC (10 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.20: +4 -3
lines
Diff to previous 1.20 (colored)
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
Revision 1.4.2.11 / (download) - annotate - [select for diffs], Mon Feb 11 21:49:48 2013 UTC (10 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.10: +88 -42
lines
Diff to previous 1.4.2.10 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #817): usr.sbin/npf/npfctl/npfctl.8: revision 1.12 usr.sbin/npf/npfctl/npf.conf.5: revision 1.27 usr.sbin/npf/npfctl/npf_parse.y: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.20 usr.sbin/npf/npfctl/npfctl.c: revision 1.28 lib/libnpf/npf.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.c: revision 1.29 lib/libnpf/npf.c: revision 1.17 sys/modules/npf/Makefile: revision 1.12 sys/net/npf/npf_rproc.c: revision 1.6 usr.sbin/npf/npftest/README: revision 1.4 sys/net/npf/npf_tableset.c: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.21 sys/net/npf/npf_ctl.c: revision 1.22 usr.sbin/npf/npfctl/npfctl.h: revision 1.25 lib/libnpf/npf.h: revision 1.13 usr.sbin/npf/npftest/npftest.conf: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.26 sys/net/npf/npf_ruleset.c: revision 1.17 lib/libnpf/npf.h: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.18 sys/net/npf/npf_conf.c: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.10 sys/net/npf/npf_conf.c: revision 1.2 sys/net/npf/npf_instr.c: revision 1.16 sys/net/npf/npf_handler.c: revision 1.26 sys/net/npf/npf_impl.h: revision 1.26 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14 sys/net/npf/npf_processor.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.27 sys/net/npf/npf_alg_icmp.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16 sys/net/npf/npf_ncode.h: revision 1.11 sys/net/npf/files.npf: revision 1.10 usr.sbin/npf/npftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.c: revision 1.30 lib/libnpf/npf.3: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4 sys/net/npf/npf_session.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5 usr.sbin/npf/npfctl/npf_build.c: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.19 sys/net/npf/npf_alg.c: revision 1.7 usr.sbin/npf/npfctl/Makefile: revision 1.10 sys/net/npf/npf_inet.c: revision 1.21 sys/net/npf/npf.h: revision 1.26 sys/net/npf/npf.h: revision 1.27 usr.sbin/pf/ftp-proxy/Makefile: revision 1.8 sys/net/npf/npf_nat.c: revision 1.19 sys/net/npf/npf.c: revision 1.15 sys/net/npf/npf_state.c: revision 1.14 sys/net/npf/npf_sendpkt.c: revision 1.14 sys/rump/net/lib/libnpf/Makefile: revision 1.4 IPv6 linklocal address printing cosmetics NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version. Disable -DWITH_NPF for now; will be converted to BPF mechanism. - Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset. Allow filtering on IP addresses even if the L4 protocol is unknown. Patch from spz@. npftest: adjust for recent change.
Revision 1.20 / (download) - annotate - [select for diffs], Mon Feb 11 00:00:20 2013 UTC (10 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.19: +22 -18
lines
Diff to previous 1.19 (colored)
Allow filtering on IP addresses even if the L4 protocol is unknown. Patch from spz@.
Revision 1.19 / (download) - annotate - [select for diffs], Sun Feb 10 23:47:37 2013 UTC (10 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.18: +3 -2
lines
Diff to previous 1.18 (colored)
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
Revision 1.18 / (download) - annotate - [select for diffs], Sat Feb 9 03:35:32 2013 UTC (10 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.17: +67 -26
lines
Diff to previous 1.17 (colored)
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
Revision 1.6.2.5 / (download) - annotate - [select for diffs], Wed Jan 23 00:06:43 2013 UTC (10 years, 4 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.6.2.4: +4 -3
lines
Diff to previous 1.6.2.4 (colored) to branchpoint 1.6 (colored)
sync with head
Revision 1.6.2.4 / (download) - annotate - [select for diffs], Wed Jan 16 05:34:10 2013 UTC (10 years, 4 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.3: +9 -3
lines
Diff to previous 1.6.2.3 (colored) to branchpoint 1.6 (colored)
sync with (a bit old) head
Revision 1.4.2.10 / (download) - annotate - [select for diffs], Mon Jan 7 16:51:07 2013 UTC (10 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.9: +4 -3
lines
Diff to previous 1.4.2.9 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #776): usr.sbin/npf/npfctl/npf.conf.5: revision 1.26 usr.sbin/npf/npfctl/npfctl.c: revision 1.26 dist/pf/usr.sbin/ftp-proxy/npf.c: revision 1.2 lib/libnpf/npf.c: revision 1.15 sys/net/npf/npf_ctl.c: revision 1.20 lib/libnpf/npf.h: revision 1.12 lib/libnpf/npf.3: revision 1.6 lib/libnpf/npf.3: revision 1.7 usr.sbin/npf/npfctl/npf_build.c: revision 1.17 sys/net/npf/npf.h: revision 1.24 - Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc. Remove a superfluous quote and fix a recurring typo. ftp-proxy: disable NPF bits for now; it will be re-done.
Revision 1.17 / (download) - annotate - [select for diffs], Sun Dec 23 21:01:04 2012 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base8
Changes since 1.16: +4 -3
lines
Diff to previous 1.16 (colored)
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
Revision 1.4.2.9 / (download) - annotate - [select for diffs], Sun Dec 16 19:41:37 2012 UTC (10 years, 5 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.8: +8 -2
lines
Diff to previous 1.4.2.8 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #750): usr.sbin/npf/npfctl/npfctl.c: revision 1.25 usr.sbin/npf/npfctl/npfctl.h: revision 1.24 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.13 usr.sbin/npf/npfctl/npf_build.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.8: revision 1.11 npfctl: add 'validate' command to check the config, but not load it. Update the man page. Also add a small note about 'debug' command, PR/47298.
Revision 1.4.2.8 / (download) - annotate - [select for diffs], Tue Dec 11 04:31:52 2012 UTC (10 years, 5 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.7: +3 -3
lines
Diff to previous 1.4.2.7 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #736): usr.sbin/npf/npfctl/npf_parse.y: revision 1.17 sys/net/npf/npf_tableset.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.h: revision 1.23 usr.sbin/npf/npfctl/npf_data.c: revision 1.19 usr.sbin/npf/npfctl/npf_build.c: revision 1.15 share/examples/npf/host-npf.conf: revision 1.3 usr.sbin/npf/npfctl/npf_scan.l: revision 1.9 share/examples/npf/soho_gw-npf.conf: revision 1.3 usr.sbin/npf/npfctl/npf_var.h: revision 1.6 usr.sbin/npf/npfctl/npf.conf.5: revision 1.24 npfctl: extend syntax for extracting interface IP address(es) by the family. adjust to current npf.conf syntax npf_table_list: avoid triggering assert on diagnostic.
Revision 1.16 / (download) - annotate - [select for diffs], Mon Dec 10 02:26:04 2012 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base7
Changes since 1.15: +8 -2
lines
Diff to previous 1.15 (colored)
npfctl: add 'validate' command to check the config, but not load it. Update the man page. Also add a small note about 'debug' command, PR/47298.
Revision 1.15 / (download) - annotate - [select for diffs], Mon Nov 26 20:34:28 2012 UTC (10 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.14: +3 -3
lines
Diff to previous 1.14 (colored)
npfctl: extend syntax for extracting interface IP address(es) by the family.
Revision 1.13.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:03:03 2012 UTC (10 years, 6 months ago) by tls
Branch: tls-maxphys
Changes since 1.13: +31 -52
lines
Diff to previous 1.13 (colored)
Resync to 2012-11-19 00:00:00 UTC
Revision 1.4.2.7 / (download) - annotate - [select for diffs], Sun Nov 18 22:38:28 2012 UTC (10 years, 6 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.6: +31 -52
lines
Diff to previous 1.4.2.6 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #693): lib/npf/ext_normalise/shlib_version: revision 1.1 lib/libnpf/npf.c: revision 1.13 distrib/sets/lists/modules/mi: revision 1.48 sys/net/npf/npf_rproc.c: revision 1.3 sys/net/npf/npf_rproc.c: revision 1.4 sys/modules/npf/Makefile: revision 1.11 usr.sbin/npf/npfctl/npfctl.h: revision 1.20 lib/npf/ext_log/npfext_log.c: revision 1.1 lib/libnpf/npf.h: revision 1.11 sys/net/npf/npf_inet.c: revision 1.17 sys/net/npf/npf_log.c: file removal sys/net/npf/npf_handler.c: revision 1.22 distrib/sets/lists/base/shl.mi: revision 1.636 sys/net/npf/npf_impl.h: revision 1.23 usr.sbin/npf/npfctl/Makefile: revision 1.8 lib/npf/Makefile: revision 1.1 lib/npf/ext_log/shlib_version: revision 1.1 lib/Makefile: revision 1.189 distrib/sets/lists/comp/shl.mi: revision 1.236 usr.sbin/npf/npfctl/npf_build.c: revision 1.14 distrib/sets/lists/base/mi: revision 1.1007 usr.sbin/npf/npfctl/npf_scan.l: revision 1.6 distrib/sets/lists/base/mi: revision 1.1009 sys/net/npf/npf.h: revision 1.21 lib/npf/ext_normalise/npfext_normalise.c: revision 1.1 etc/mtree/NetBSD.dist.base: revision 1.105 lib/libnpf/Makefile: revision 1.3 etc/mtree/NetBSD.dist.base: revision 1.106 usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1 sys/net/npf/npf_ctl.c: revision 1.18 lib/npf/ext_log/Makefile: revision 1.1 distrib/sets/lists/comp/mi: revision 1.1781 usr.sbin/npf/npfctl/npf_var.h: revision 1.4 sys/net/npf/npf.c: revision 1.13 sys/modules/Makefile: revision 1.111 sys/net/npf/npf_ext_log.c: revision 1.1 lib/npf/Makefile.inc: revision 1.1 sys/net/npf/npf_ext_normalise.c: revision 1.1 sys/net/npf/files.npf: revision 1.8 sys/rump/net/lib/libnpf/Makefile: revision 1.2 sys/modules/npf_ext_log/Makefile: revision 1.1 lib/npf/ext_normalise/Makefile: revision 1.1 usr.sbin/npf/npfctl/npfctl.c: revision 1.20 usr.sbin/npf/npfctl/npf_parse.y: revision 1.13 sys/modules/npf_ext_normalise/Makefile: revision 1.1 Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come. Add /usr/lib/npf. Add ./usr/libdata/debug/usr/lib/npf for rmind Fix MKDEBUG set lists ext_ops does not change during the life cycle and can be fetched without the mutex held. This avoids confusion in the compiler about an uninitialized variable ext_ops. ok rmind@
Revision 1.6.2.3 / (download) - annotate - [select for diffs], Tue Oct 30 19:00:43 2012 UTC (10 years, 6 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.2: +225 -133
lines
Diff to previous 1.6.2.2 (colored) to branchpoint 1.6 (colored)
sync with head
Revision 1.14 / (download) - annotate - [select for diffs], Sun Sep 16 13:47:41 2012 UTC (10 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base6
Changes since 1.13: +31 -52
lines
Diff to previous 1.13 (colored)
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
Revision 1.4.2.6 / (download) - annotate - [select for diffs], Mon Aug 13 17:49:52 2012 UTC (10 years, 9 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RELEASE,
netbsd-6-0-RC2,
netbsd-6-0-RC1,
netbsd-6-0-6-RELEASE,
netbsd-6-0-5-RELEASE,
netbsd-6-0-4-RELEASE,
netbsd-6-0-3-RELEASE,
netbsd-6-0-2-RELEASE,
netbsd-6-0-1-RELEASE,
netbsd-6-0,
matt-nb6-plus-nbase,
matt-nb6-plus-base,
matt-nb6-plus
Changes since 1.4.2.5: +102 -91
lines
Diff to previous 1.4.2.5 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #485): lib/libnpf/npf.c: revision 1.11 sys/net/npf/npf_session.c: revision 1.17 sys/modules/npf/Makefile: revision 1.10 usr.sbin/npf/npftest/npftest.c: revision 1.4 usr.sbin/npf/npftest/README: revision 1.1 sys/net/npf/npf_tableset.c: revision 1.14 usr.sbin/npf/npftest/npftest.h: revision 1.4 lib/libnpf/npf.h: revision 1.10 sys/net/npf/npf_ruleset.c: revision 1.14 usr.sbin/npf/npfctl/npf_data.c: revision 1.18 usr.sbin/npf/npftest/npftest.conf: revision 1.1 sys/net/npf/npf_handler.c: revision 1.21 sys/net/npf/npf_impl.h: revision 1.21 usr.sbin/npf/npfctl/npfctl.c: revision 1.18 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.13 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1 usr.sbin/npf/npftest/npfstream.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.19 sys/net/npf/npf_nat.c: revision 1.16 sys/net/npf/npf_state.c: revision 1.11 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5 usr.sbin/npf/npfctl/npf_parse.y: revision 1.12 - Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
Revision 1.13 / (download) - annotate - [select for diffs], Sun Aug 12 03:35:13 2012 UTC (10 years, 9 months ago) by rmind
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.12: +102 -91
lines
Diff to previous 1.12 (colored)
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
Revision 1.4.2.5 / (download) - annotate - [select for diffs], Wed Jul 25 20:45:23 2012 UTC (10 years, 10 months ago) by jdc
Branch: netbsd-6
Changes since 1.4.2.4: +17 -2
lines
Diff to previous 1.4.2.4 (colored) to branchpoint 1.4 (colored)
Pull up revisions: src/usr.sbin/npf/npfctl/npfctl.c revisions 1.16,1.17 src/sys/net/npf/npf.h revision 1.20 src/sys/net/npf/npf_alg_icmp.c revision 1.11 src/sys/net/npf/npf_impl.h revision 1.19 src/sys/net/npf/npf_inet.c revisions 1.15,1.16 src/sys/net/npf/npf_instr.c revision 1.14 src/sys/net/npf/npf_ncode.h revision 1.10 src/sys/net/npf/npf_processor.c revision 1.12 src/sys/net/npf/npf_session.c revision 1.16 src/usr.sbin/npf/npfctl/npf_build.c revision 1.12 src/usr.sbin/npf/npfctl/npf_data.c revisions 1.16,1.17 src/usr.sbin/npf/npfctl/npf_disassemble.c revision 1.8 src/usr.sbin/npf/npfctl/npf_ncgen.c revision 1.13 src/usr.sbin/npf/npfctl/npf_parse.y revision 1.11 src/usr.sbin/npf/npfctl/npf_scan.l revision 1.5 src/usr.sbin/npf/npfctl/npf_var.h revision 1.3 src/usr.sbin/npf/npfctl/npfctl.h revision 1.18 src/sys/net/npf/npf_state.c revision 1.10 src/sys/net/npf/npf_state_tcp.c revision 1.10 src/usr.sbin/npf/npftest/npfstream.c revision 1.2 src/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c revision 1.2 (requested by rmind in ticket #435). Add missing __dead. teach npf ipv6-icmp reviewed by rmind@ - npfctl_print_stats: beautification a la French style. - npfctl_icmpcode: fix the build break. - npf_fetch_tcpopts: fix off-by-one when validating TCP option length against the maximum allowed. - npf_tcp_inwindow: be more liberal with npf_fetch_tcpopts(). - Few minor improvements to npftest.
Revision 1.12 / (download) - annotate - [select for diffs], Thu Jul 19 21:52:29 2012 UTC (10 years, 10 months ago) by spz
Branch: MAIN
Changes since 1.11: +17 -2
lines
Diff to previous 1.11 (colored)
teach npf ipv6-icmp reviewed by rmind@
Revision 1.4.2.4 / (download) - annotate - [select for diffs], Mon Jul 16 22:13:28 2012 UTC (10 years, 10 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.3: +15 -11
lines
Diff to previous 1.4.2.3 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #421): lib/libnpf/npf.c: revision 1.10 sys/net/npf/npf_session.c: revision 1.15 sys/net/npf/npf_tableset.c: revision 1.13 sys/net/npf/npf_state_tcp.c: revision 1.9 usr.sbin/npf/npfctl/npf_data.c: revision 1.15 sys/net/npf/npf_inet.c: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.13 sys/net/npf/npf.h: revision 1.19 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12 sys/net/npf/npf_instr.c: revision 1.13 sys/net/npf/npf_handler.c: revision 1.20 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4 sys/net/npf/npf_alg_icmp.c: revision 1.10 usr.sbin/npf/npfctl/npfctl.c: revision 1.15 usr.sbin/npf/npfctl/npf_build.c: revision 1.11 lib/libnpf/npf.h: revision 1.9 sys/net/npf/npf_alg.c: revision 1.5 sys/rump/dev/lib/libnpf/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.16 sys/net/npf/npf_nat.c: revision 1.15 sys/net/npf/npf_tableset_ptree.c: revision 1.1 sys/net/npf/npf.c: revision 1.12 sys/net/npf/npf_sendpkt.c: revision 1.12 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7 sys/net/npf/npf_impl.h: revision 1.18 sys/net/npf/files.npf: revision 1.7 usr.sbin/npf/npfctl/npf_parse.y: revision 1.10 - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
Revision 1.11 / (download) - annotate - [select for diffs], Sun Jul 15 00:22:58 2012 UTC (10 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.10: +15 -11
lines
Diff to previous 1.10 (colored)
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
Revision 1.4.2.3 / (download) - annotate - [select for diffs], Thu Jul 5 17:48:44 2012 UTC (10 years, 10 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.2: +67 -29
lines
Diff to previous 1.4.2.2 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #399): sys/net/npf/npf_session.c: revision 1.14 sys/net/npf/npf_tableset.c: revision 1.12 sys/net/npf/npf_state_tcp.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3 usr.sbin/npf/npfctl/npf_data.c: revision 1.14 sys/net/npf/npf_inet.c: revision 1.13 sys/net/npf/npf_ruleset.c: revision 1.12 sys/net/npf/npf.h: revision 1.18 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.8: revision 1.7 usr.sbin/npf/npfctl/npf_parse.y: revision 1.9 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2 usr.sbin/npf/npfctl/npfctl.8: revision 1.8 sys/net/npf/npf_instr.c: revision 1.12 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3 usr.sbin/npf/npfctl/npf.conf.5: revision 1.13 usr.sbin/npf/npfctl/npf.conf.5: revision 1.14 sys/net/npf/npf_state.c: revision 1.9 sys/net/npf/npf_processor.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.c: revision 1.13 usr.sbin/npf/npfctl/npfctl.c: revision 1.14 usr.sbin/npf/npfctl/npf_build.c: revision 1.10 lib/libnpf/npf.3: revision 1.5 lib/libnpf/npf.h: revision 1.8 share/man/man9/npf_ncode.9: revision 1.9 usr.sbin/npf/npfctl/npf_scan.l: revision 1.4 lib/libnpf/npf.c: revision 1.9 usr.sbin/npf/npfctl/npfctl.h: revision 1.16 sys/net/npf/npf_nat.c: revision 1.14 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6 sys/net/npf/npf_impl.h: revision 1.17 sys/net/npf/npf_handler.c: revision 1.18 sys/net/npf/npf_handler.c: revision 1.19 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4 sys/net/npf/npf_ncode.h: revision 1.9 Fix and update npf.conf(5), npfctl(8) and its usage message. npf_state_tcp: fix for FIN retransmission and out-of-order ACK case. NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up. npf_packet_handler: fix gcc unused warning.
Revision 1.10 / (download) - annotate - [select for diffs], Sun Jul 1 23:21:06 2012 UTC (10 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.9: +67 -29
lines
Diff to previous 1.9 (colored)
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
Revision 1.4.2.2 / (download) - annotate - [select for diffs], Tue Jun 26 00:07:19 2012 UTC (10 years, 11 months ago) by riz
Branch: netbsd-6
Changes since 1.4.2.1: +89 -44
lines
Diff to previous 1.4.2.1 (colored) to branchpoint 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #354): sys/net/npf/npf_state_tcp.c: revision 1.4 sys/net/npf/npf_state_tcp.c: revision 1.5 sys/net/npf/npf_state_tcp.c: revision 1.6 usr.sbin/npf/npftest/npftest.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.1 usr.sbin/npf/npftest/npftest.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.2 usr.sbin/npf/npfctl/npf_data.c: revision 1.11 usr.sbin/npf/npftest/npftest.c: revision 1.3 usr.sbin/npf/npfctl/npf_data.c: revision 1.12 usr.sbin/npf/npftest/npftest.h: revision 1.1 usr.sbin/npf/npfctl/npf_parse.y: revision 1.5 usr.sbin/npf/npfctl/npf_data.c: revision 1.13 sys/net/npf/npf.h: revision 1.16 usr.sbin/npf/npftest/npftest.h: revision 1.2 usr.sbin/npf/npfctl/npf_parse.y: revision 1.6 usr.sbin/npf/npftest/npftest.h: revision 1.3 usr.sbin/npf/npfctl/npf_parse.y: revision 1.7 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.10 usr.sbin/npf/npfctl/npf_build.c: revision 1.6 usr.sbin/npf/npfctl/npf_parse.y: revision 1.8 usr.sbin/npf/npfctl/npf_build.c: revision 1.7 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.9 usr.sbin/npf/npfctl/npf.conf.5: revision 1.10 usr.sbin/npf/npfctl/npf.conf.5: revision 1.11 usr.sbin/npf/npfctl/npf.conf.5: revision 1.12 sys/net/npf/npf_state.c: revision 1.7 usr.sbin/npf/npfctl/npfctl.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.c: revision 1.12 usr.sbin/npf/npfctl/Makefile: revision 1.7 sys/rump/net/lib/libnet/Makefile: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.7 usr.sbin/npf/npftest/Makefile: revision 1.1 usr.sbin/npf/npftest/Makefile: revision 1.2 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.2 usr.sbin/npf/npftest/npfstream.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.2 usr.sbin/npf/npfctl/npf_scan.l: revision 1.3 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.3 usr.sbin/npf/npfctl/npfctl.h: revision 1.12 sys/rump/dev/lib/libnpf/Makefile: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.14 sys/rump/dev/lib/libnpf/Makefile: revision 1.3 usr.sbin/npf/npfctl/npfctl.h: revision 1.15 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.9 sys/net/npf/npf_ctl.c: revision 1.15 usr.sbin/npf/npfctl/npf_var.c: revision 1.4 usr.sbin/npf/npfctl/npf_var.h: revision 1.2 usr.sbin/npf/npfctl/npf_var.c: revision 1.5 sys/net/npf/npf_impl.h: revision 1.13 sys/net/npf/npf_sendpkt.c: revision 1.10 sys/net/npf/npf_impl.h: revision 1.14 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.4 sys/net/npf/npf_impl.h: revision 1.15 sys/net/npf/npf_handler.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.5 sys/net/npf/npf_handler.c: revision 1.17 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.2 sys/net/npf/npf_ncode.h: revision 1.7 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.3 sys/net/npf/npf_ncode.h: revision 1.8 npf_tcp_inwindow: in a case of negative skew, bump the maximum seen value of SEQ+LEN in the receiver's side correctly (using ACK from the sender's side). PR/46265 from Changli Gao. rumpnet_net: add pfil.c Update rumpdev_npf; use WARNS=4. Add initial NPF regression tests integrated with RUMP framework (running the kernel part of NPF in userland). Other tests will be added once converted to RUMP framework. All tests are in the public domain. Some Makefile fixes from christos@. - Fix double-free case on ICMP return case. - npf_pfil_register: handle kernels without INET6 option correctly. - Reduce some #ifdefs. npfctl(8): add show-config command. Also, update syntax. npftest: add a stream processor, which prints out the TCP state information. A tool for debugging connection tracking from tcpdump -w captured data. npftest: add a module for TCP state tracking and add few test cases. npf_state_tcp: add an assert; fix some comments while here. - Rework NPF NAT syntax to be more structured and support future additions of different types and configurations of NAT. - npfctl: improve disassemble and show-config command functionality. - Fix custom ICMP code and type filtering. make this compile again. remove error(1) output Remove superfluous Pp - make each element of a variable hold a type - change get_type to take an index, so we can get the individual types of each element (since primitive elements can be in lists) - make port_range primitive - add a routine to convert a variable of primitives to a variable containing - only port ranges. remove extra rule that got merged...
Revision 1.9 / (download) - annotate - [select for diffs], Sat Jun 16 01:34:10 2012 UTC (10 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.8: +2 -4
lines
Diff to previous 1.8 (colored)
remove error(1) output
Revision 1.8 / (download) - annotate - [select for diffs], Sat Jun 16 01:31:33 2012 UTC (10 years, 11 months ago) by christos
Branch: MAIN
Changes since 1.7: +17 -10
lines
Diff to previous 1.7 (colored)
make this compile again.
Revision 1.7 / (download) - annotate - [select for diffs], Fri Jun 15 23:24:08 2012 UTC (10 years, 11 months ago) by rmind
Branch: MAIN
Changes since 1.6: +79 -39
lines
Diff to previous 1.6 (colored)
- Rework NPF NAT syntax to be more structured and support future additions of different types and configurations of NAT. - npfctl: improve disassemble and show-config command functionality. - Fix custom ICMP code and type filtering.
Revision 1.6.2.2 / (download) - annotate - [select for diffs], Tue Apr 17 00:09:50 2012 UTC (11 years, 1 month ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.1: +550 -0
lines
Diff to previous 1.6.2.1 (colored) to branchpoint 1.6 (colored)
sync with head
Revision 1.4.2.1 / (download) - annotate - [select for diffs], Tue Apr 3 17:22:53 2012 UTC (11 years, 1 month ago) by riz
Branch: netbsd-6
Changes since 1.4: +3 -4
lines
Diff to previous 1.4 (colored)
Pull up following revision(s) (requested by rmind in ticket #158):
sys/net/npf/npf_session.c: revision 1.12
sys/net/npf/npf_tableset.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.2
usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
sys/net/npf/npf_inet.c: revision 1.11
sys/net/npf/npf.h: revision 1.15
usr.sbin/npf/npfctl/npf_build.c: revision 1.5
sys/net/npf/npf_ruleset.c: revision 1.11
sys/net/npf/npf_instr.c: revision 1.10
usr.sbin/npf/npfctl/Makefile: revision 1.6
sys/net/npf/npf_processor.c: revision 1.10
sys/net/npf/npf_log.c: revision 1.3
lib/libnpf/npf.h: revision 1.7
sys/net/npf/npf_alg.c: revision 1.3
sys/net/npf/npf_sendpkt.c: revision 1.9
lib/libnpf/npf.c: revision 1.8
usr.sbin/npf/npfctl/npfctl.h: revision 1.13
sys/net/npf/npf_ctl.c: revision 1.13
usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
sys/net/npf/npf_ctl.c: revision 1.14
sys/net/npf/npf_nat.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.12
sys/net/npf/npf_impl.h: revision 1.11
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
sys/net/npf/npf_impl.h: revision 1.12
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
sys/net/npf/npf_handler.c: revision 1.14
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
sys/net/npf/npf_handler.c: revision 1.15
sys/net/npf/npf_ncode.h: revision 1.6
sys/net/npf/npf.c: revision 1.8
sys/net/npf/npf.c: revision 1.9
sys/net/npf/npf_alg_icmp.c: revision 1.9
sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes. Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.
Revision 1.6.2.1, Sun Feb 26 21:50:05 2012 UTC (11 years, 3 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6: +0 -550
lines
FILE REMOVED
file npf_build.c was added on branch yamt-pagecache on 2012-04-17 00:09:50 +0000
Revision 1.6 / (download) - annotate - [select for diffs], Sun Feb 26 21:50:05 2012 UTC (11 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: yamt-pagecache-base5,
yamt-pagecache-base4
Branch point for: yamt-pagecache
Changes since 1.5: +4 -4
lines
Diff to previous 1.5 (colored)
- make each element of a variable hold a type - change get_type to take an index, so we can get the individual types of each element (since primitive elements can be in lists) - make port_range primitive - add a routine to convert a variable of primitives to a variable containing - only port ranges.
Revision 1.5 / (download) - annotate - [select for diffs], Mon Feb 20 00:18:19 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.4: +3 -4
lines
Diff to previous 1.4 (colored)
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the
packet handler. Change the default policy to block when the config is
loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
of rule procedure might happen in the interrupt handler (under a very rare
condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Revision 1.4 / (download) - annotate - [select for diffs], Mon Feb 6 00:37:52 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-6-base
Branch point for: netbsd-6
Changes since 1.3: +69 -3
lines
Diff to previous 1.3 (colored)
- Handle NPF rule procedures in the parser and thus re-enable them. - Few small updates to the man page.
Revision 1.3 / (download) - annotate - [select for diffs], Sun Feb 5 00:37:13 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.2: +7 -2
lines
Diff to previous 1.2 (colored)
Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
Revision 1.2 / (download) - annotate - [select for diffs], Sun Jan 15 00:49:48 2012 UTC (11 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.1: +2 -17
lines
Diff to previous 1.1 (colored)
- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
Revision 1.1 / (download) - annotate - [select for diffs], Sun Jan 8 21:34:21 2012 UTC (11 years, 4 months ago) by rmind
Branch: MAIN
Full rewrite of npfctl(8) parser and rework of n-code generation part. Fixes most of the known bugs and issues with the utility. Note: rule procedures are not yet (as we want to make them fully modular). Huge thanks to Martin Husemann who wrote the parser and Christos Zoulas who wrote intermediate structures and helped to complete the work.