![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npfctl
Request diff between arbitrary revisions
Default branch: MAIN
Revision 1.33 / (download) - annotate - [select for diffs], Tue Aug 1 20:09:12 2023 UTC (8 months, 2 weeks ago) by andvar
Branch: MAIN
CVS Tags: HEAD
Changes since 1.32: +1 -1
lines
Diff to previous 1.32 (colored)
fix RCSIDs.
Revision 1.28.2.4 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE,
netbsd-9-2-RELEASE,
netbsd-9-1-RELEASE
Changes since 1.28.2.3: +266 -132
lines
Diff to previous 1.28.2.3 (colored) to branchpoint 1.28 (colored) next main 1.29 (colored)
Pull up following revision(s) (requested by rmind in ticket #956):
usr.sbin/npf/npf-params.7: revision 1.4
sys/net/npf/npf_worker.c: revision 1.9
usr.sbin/npf/npftest/npftest.h: revision 1.17
usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
usr.sbin/npf/npf-params.7: revision 1.5
sys/net/npf/npf_state_tcp.c: revision 1.21
usr.sbin/npf/npfctl/npf_build.c: revision 1.55
usr.sbin/npf/npf-params.7: revision 1.6
sys/net/npf/npfkern.h: revision 1.5
lib/libnpf/npf.c: revision 1.49
usr.sbin/npf/npf-params.7: revision 1.7
sys/net/npf/npf_impl.h: revision 1.81
sys/net/npf/npf_ext_log.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.h: revision 1.53
usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
sys/net/npf/npf_nat.c: revision 1.50
sys/net/npf/npf_mbuf.c: revision 1.24
sys/net/npf/npf_alg.c: revision 1.22
usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
sys/net/npf/npf.h: revision 1.63
usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
usr.sbin/npf/npfctl/npf_var.c: revision 1.13
sys/net/npf/files.npf: revision 1.23
usr.sbin/npf/npfctl/npf_show.c: revision 1.32
usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
sys/net/npf/npf_os.c: revision 1.18
sys/net/npf/npf_connkey.c: revision 1.2
sys/net/npf/npf_conf.c: revision 1.17
lib/libnpf/libnpf.3: revision 1.12
usr.sbin/npf/npftest/npftest.c: revision 1.25
usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
sys/net/npf/npf_tableset.c: revision 1.35
usr.sbin/npf/npftest/npftest.conf: revision 1.9
sys/net/npf/npf_sendpkt.c: revision 1.22
usr.sbin/npf/npfctl/npf_var.h: revision 1.10
sys/net/npf/npf_state.c: revision 1.23
sys/net/npf/npf_conn.h: revision 1.20
usr.sbin/npf/npfctl/npfctl.c: revision 1.64
usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
sys/net/npf/npf_portmap.c: revision 1.5
sys/net/npf/npf_params.c: revision 1.3
usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
tests/net/npf/t_npf.sh: revision 1.4
sys/net/npf/npf_ext_rndblock.c: revision 1.9
lib/libnpf/npf.h: revision 1.39
sys/net/npf/npf_ruleset.c: revision 1.51
sys/net/npf/npf_alg_icmp.c: revision 1.33
sys/net/npf/npf.c: revision 1.43
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
usr.sbin/npf/npfctl/npfctl.8: revision 1.25
sys/net/npf/npf_ctl.c: revision 1.60
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
sys/net/npf/npf_handler.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.57
sys/net/npf/npf_ifaddr.c: revision 1.7
sys/net/npf/npf_conndb.c: revision 1.9
sys/net/npf/npf_if.c: revision 1.13
usr.sbin/npf/npfctl/Makefile: revision 1.15
sys/net/npf/npf_conn.c: revision 1.32
sys/net/npf/npf_ext_normalize.c: revision 1.10
sys/net/npf/npf_rproc.c: revision 1.20
sys/net/npf/npf_worker.c: revision 1.8
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.
npftest -- npf_test_init(): add a workaround for NetBSD.
npf-params(7): fix the state.key defaults.
npf-params.7: s/filer/filter/
Adjust to "npfctl debug" command line changes, from rmind@.
Use more markup.
Revision 1.32 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-10-base,
netbsd-10-0-RELEASE,
netbsd-10-0-RC6,
netbsd-10-0-RC5,
netbsd-10-0-RC4,
netbsd-10-0-RC3,
netbsd-10-0-RC2,
netbsd-10-0-RC1,
netbsd-10,
cjep_sun2x-base1,
cjep_sun2x-base,
cjep_sun2x,
cjep_staticlib_x-base1,
cjep_staticlib_x-base,
cjep_staticlib_x
Changes since 1.31: +266 -132
lines
Diff to previous 1.31 (colored)
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
settings. Users can now choose whether the connection state should be
strictly per-interface or global at the configuration level. Keep NAT
logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
more parameters. Remove npf_nvlist_{copyin,copyout}() functions and
refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
a single entry point for operations. Introduce npf_flow_t and clean up
some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
more informative; misc usability improvements and more user-friendly
error messages.
- Amend and improve the manual pages.
Revision 1.28.2.3 / (download) - annotate - [select for diffs], Mon May 25 17:27:19 2020 UTC (3 years, 10 months ago) by martin
Branch: netbsd-9
Changes since 1.28.2.2: +3 -3
lines
Diff to previous 1.28.2.2 (colored) to branchpoint 1.28 (colored)
Pull up following revision(s) (requested by rmind in ticket #931): usr.sbin/npf/npfctl/npf_show.c: revision 1.30 PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
Revision 1.28.2.2 / (download) - annotate - [select for diffs], Mon May 25 17:25:28 2020 UTC (3 years, 10 months ago) by martin
Branch: netbsd-9
Changes since 1.28.2.1: +2 -2
lines
Diff to previous 1.28.2.1 (colored) to branchpoint 1.28 (colored)
Pull up following revision(s) (requested by rmind in ticket #930):
usr.sbin/npf/npfctl/npf_build.c: revision 1.54
sys/net/npf/npf_conn.h: revision 1.19
usr.sbin/npf/npfctl/npfctl.h: revision 1.52
usr.sbin/npf/npfctl/npf_show.c: revision 1.31
sys/net/npf/npf_conf.c: revision 1.16
sys/net/npf/npf_nat.c: revision 1.49
sys/net/npf/npf_inet.c: revision 1.56
sys/net/npf/npf_conndb.c: revision 1.8
sys/net/npf/npf_conn.c: revision 1.31
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9),
instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes
with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not
wait for reference draining on destruction; destroy the policy on the
last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
Revision 1.31 / (download) - annotate - [select for diffs], Sat May 23 19:56:00 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.30: +2 -2
lines
Diff to previous 1.30 (colored)
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9),
instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes
with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not
wait for reference draining on destruction; destroy the policy on the
last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
Revision 1.25.4.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:55 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.25.4.1: +57 -29
lines
Diff to previous 1.25.4.1 (colored) to branchpoint 1.25 (colored) next main 1.26 (colored)
Mostly merge changes from HEAD upto 20200411
Revision 1.30 / (download) - annotate - [select for diffs], Fri Nov 1 13:58:32 2019 UTC (4 years, 5 months ago) by christos
Branch: MAIN
CVS Tags: phil-wifi-20200421,
phil-wifi-20200411,
phil-wifi-20200406,
phil-wifi-20191119,
is-mlppp-base,
is-mlppp
Changes since 1.29: +3 -3
lines
Diff to previous 1.29 (colored)
PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
Revision 1.28.2.1 / (download) - annotate - [select for diffs], Sun Aug 11 10:12:18 2019 UTC (4 years, 8 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE,
netbsd-9-0-RC2,
netbsd-9-0-RC1
Changes since 1.28: +30 -16
lines
Diff to previous 1.28 (colored)
Pull up following revision(s) (requested by rmind in ticket #45): usr.sbin/npf/npfctl/npf_show.c: revision 1.29 npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
Revision 1.29 / (download) - annotate - [select for diffs], Sat Aug 10 22:23:55 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.28: +30 -16
lines
Diff to previous 1.28 (colored)
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
Revision 1.28 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:02 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.27: +26 -12
lines
Diff to previous 1.27 (colored)
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Revision 1.25.4.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:10:34 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.25: +83 -41
lines
Diff to previous 1.25 (colored)
Sync with HEAD
Revision 1.25.2.2 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:39 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.25.2.1: +79 -35
lines
Diff to previous 1.25.2.1 (colored) to branchpoint 1.25 (colored) next main 1.26 (colored)
Sync with HEAD
Revision 1.27 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:32 2019 UTC (5 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20190609,
pgoyette-compat-20190127
Changes since 1.26: +79 -35
lines
Diff to previous 1.26 (colored)
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Revision 1.25.2.1 / (download) - annotate - [select for diffs], Sun Sep 30 01:46:01 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.25: +5 -7
lines
Diff to previous 1.25 (colored)
Ssync with HEAD
Revision 1.26 / (download) - annotate - [select for diffs], Sat Sep 29 14:41:36 2018 UTC (5 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190118,
pgoyette-compat-1226,
pgoyette-compat-1126,
pgoyette-compat-1020,
pgoyette-compat-0930
Changes since 1.25: +5 -7
lines
Diff to previous 1.25 (colored)
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
Revision 1.25 / (download) - annotate - [select for diffs], Sun Dec 10 22:04:41 2017 UTC (6 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-base,
pgoyette-compat-base,
pgoyette-compat-0906,
pgoyette-compat-0728,
pgoyette-compat-0625,
pgoyette-compat-0521,
pgoyette-compat-0502,
pgoyette-compat-0422,
pgoyette-compat-0415,
pgoyette-compat-0407,
pgoyette-compat-0330,
pgoyette-compat-0322,
pgoyette-compat-0315
Branch point for: phil-wifi,
pgoyette-compat
Changes since 1.24: +5 -3
lines
Diff to previous 1.24 (colored)
npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
Revision 1.23.2.1 / (download) - annotate - [select for diffs], Fri May 19 00:23:00 2017 UTC (6 years, 11 months ago) by pgoyette
Branch: prg-localcount2
Changes since 1.23: +3 -3
lines
Diff to previous 1.23 (colored) next main 1.24 (colored)
Resolve conflicts from previous merge (all resulting from $NetBSD keywork expansion)
Revision 1.24 / (download) - annotate - [select for diffs], Sun May 14 21:38:23 2017 UTC (6 years, 11 months ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base3,
perseant-stdc-iso10646-base,
perseant-stdc-iso10646,
netbsd-8-base,
netbsd-8-2-RELEASE,
netbsd-8-1-RELEASE,
netbsd-8-1-RC1,
netbsd-8-0-RELEASE,
netbsd-8-0-RC2,
netbsd-8-0-RC1,
netbsd-8,
matt-nb8-mediatek-base,
matt-nb8-mediatek
Changes since 1.23: +3 -3
lines
Diff to previous 1.23 (colored)
don't print decimal and parse hex!
Revision 1.22.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:18 2017 UTC (6 years, 11 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.22: +13 -10
lines
Diff to previous 1.22 (colored) next main 1.23 (colored)
Sync with HEAD
Revision 1.19.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:58:08 2017 UTC (7 years, 1 month ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.19.2.1: +13 -10
lines
Diff to previous 1.19.2.1 (colored) to branchpoint 1.19 (colored) next main 1.20 (colored)
Sync with HEAD
Revision 1.23 / (download) - annotate - [select for diffs], Sun Jan 29 00:18:15 2017 UTC (7 years, 2 months ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base2,
prg-localcount2-base1,
prg-localcount2-base,
pgoyette-localcount-20170426,
pgoyette-localcount-20170320,
bouyer-socketcan-base1
Branch point for: prg-localcount2
Changes since 1.22: +13 -10
lines
Diff to previous 1.22 (colored)
Always print the rule id associated with a rule.
Revision 1.19.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:57:00 2017 UTC (7 years, 3 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.19: +19 -13
lines
Diff to previous 1.19 (colored)
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
Revision 1.22 / (download) - annotate - [select for diffs], Thu Dec 29 20:48:50 2016 UTC (7 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107,
bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.21: +3 -3
lines
Diff to previous 1.21 (colored)
Improve 'npfctl debug' a little bit.
Revision 1.21 / (download) - annotate - [select for diffs], Tue Dec 27 20:14:35 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.20: +4 -4
lines
Diff to previous 1.20 (colored)
Add a list command to iterate over connection and nat endpoints.
Revision 1.20 / (download) - annotate - [select for diffs], Mon Dec 26 23:05:05 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.19: +16 -10
lines
Diff to previous 1.19 (colored)
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
Revision 1.15.2.3 / (download) - annotate - [select for diffs], Thu Jun 4 07:34:26 2015 UTC (8 years, 10 months ago) by msaitoh
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116,
netbsd-7-nhusb-base,
netbsd-7-nhusb,
netbsd-7-2-RELEASE,
netbsd-7-1-RELEASE,
netbsd-7-1-RC2,
netbsd-7-1-RC1,
netbsd-7-1-2-RELEASE,
netbsd-7-1-1-RELEASE,
netbsd-7-1,
netbsd-7-0-RELEASE,
netbsd-7-0-RC3,
netbsd-7-0-RC2,
netbsd-7-0-RC1,
netbsd-7-0-2-RELEASE,
netbsd-7-0-1-RELEASE,
netbsd-7-0
Changes since 1.15.2.2: +9 -8
lines
Diff to previous 1.15.2.2 (colored) to branchpoint 1.15 (colored) next main 1.16 (colored)
Pull up following revision(s) (requested by rmind in ticket #820): usr.sbin/npf/npfctl/npf_show.c: revision 1.19 npfctl: fix the from/to port mess up when showing the rules.
Revision 1.19 / (download) - annotate - [select for diffs], Wed Jun 3 23:36:05 2015 UTC (8 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-base,
pgoyette-localcount-20161104,
pgoyette-localcount-20160806,
pgoyette-localcount-20160726,
localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.18: +9 -8
lines
Diff to previous 1.18 (colored)
npfctl: fix the from/to port mess up when showing the rules.
Revision 1.15.2.2 / (download) - annotate - [select for diffs], Sat Mar 21 17:49:03 2015 UTC (9 years, 1 month ago) by snj
Branch: netbsd-7
Changes since 1.15.2.1: +38 -18
lines
Diff to previous 1.15.2.1 (colored) to branchpoint 1.15 (colored)
Pull up following revision(s) (requested by rmind in ticket #630): sys/net/npf/npf_ctl.c: revision 1.41 sys/net/npf/npf_ruleset.c: revision 1.42 usr.sbin/npf/npfctl/npf_build.c: revision 1.39 usr.sbin/npf/npfctl/npf_show.c: revision 1.18 NPF: replace the TAILQ of the dynamic rules with a linked list and fix the inheriting of the active dynamic rules during the reload; also, fix a bug in the insert path by putting a memory barrier in the right place. -- npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
Revision 1.18 / (download) - annotate - [select for diffs], Sat Mar 21 00:49:07 2015 UTC (9 years, 1 month ago) by rmind
Branch: MAIN
Changes since 1.17: +38 -18
lines
Diff to previous 1.17 (colored)
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
Revision 1.15.2.1 / (download) - annotate - [select for diffs], Wed Feb 4 07:13:04 2015 UTC (9 years, 2 months ago) by snj
Branch: netbsd-7
Changes since 1.15: +28 -6
lines
Diff to previous 1.15 (colored)
Pull up following revision(s) (requested by rmind in ticket #479): lib/libnpf/npf.c: revision 1.35 lib/libnpf/npf.h: revision 1.28 sys/net/npf/npf_conn.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.61 sys/net/npf/npf_ruleset.c: revision 1.41 usr.sbin/npf/npfctl/npf.conf.5: revision 1.44 usr.sbin/npf/npfctl/npf_parse.y: revision 1.37 usr.sbin/npf/npfctl/npf_show.c: revisions 1.16, 1.17 usr.sbin/npf/npfctl/npfctl.c: revision 1.46 load the config file before bpfjit so that we can disable the warning. -- Don't depend on yacc to include stdlib.h or string.h. -- - npf_conn_establish: remove a rare race condition when we might destroy a connection when it is still referenced by another thread. - npf_conn_destroy: remove the backwards entry using the saved key, PR/49488. - Sprinkle some asserts. -- npf.conf(5): mention alg, include in the example, minor fix. -- npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel. -- libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit. -- npfctl_print_rule: print the ID in hex, not decimal.
Revision 1.17 / (download) - annotate - [select for diffs], Mon Feb 2 19:08:32 2015 UTC (9 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.16: +3 -3
lines
Diff to previous 1.16 (colored)
npfctl_print_rule: print the ID in hex, not decimal.
Revision 1.16 / (download) - annotate - [select for diffs], Mon Feb 2 00:31:39 2015 UTC (9 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.15: +28 -6
lines
Diff to previous 1.15 (colored)
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
Revision 1.15.4.2 / (download) - annotate - [select for diffs], Wed Aug 20 00:05:11 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-maxphys
Changes since 1.15.4.1: +519 -0
lines
Diff to previous 1.15.4.1 (colored) to branchpoint 1.15 (colored) next main 1.16 (colored)
Rebase to HEAD as of a few days ago.
Revision 1.13.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 07:00:01 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.13: +4 -4
lines
Diff to previous 1.13 (colored) next main 1.14 (colored)
Rebase.
Revision 1.15.4.1, Sun Jul 20 00:48:51 2014 UTC (9 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.15: +0 -519
lines
FILE REMOVED
file npf_show.c was added on branch tls-maxphys on 2014-08-20 00:05:11 +0000
Revision 1.15 / (download) - annotate - [select for diffs], Sun Jul 20 00:48:51 2014 UTC (9 years, 9 months ago) by rmind
Branch: MAIN
CVS Tags: tls-maxphys-base,
tls-earlyentropy-base,
netbsd-7-base
Branch point for: tls-maxphys,
netbsd-7
Changes since 1.14: +3 -3
lines
Diff to previous 1.14 (colored)
formatting
Revision 1.14 / (download) - annotate - [select for diffs], Sat May 31 22:41:37 2014 UTC (9 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.13: +3 -3
lines
Diff to previous 1.13 (colored)
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
Revision 1.13.4.2 / (download) - annotate - [select for diffs], Thu May 22 11:43:07 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.13.4.1: +519 -0
lines
Diff to previous 1.13.4.1 (colored) to branchpoint 1.13 (colored) next main 1.14 (colored)
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
Revision 1.13.4.1, Fri Mar 14 11:29:45 2014 UTC (10 years, 1 month ago) by yamt
Branch: yamt-pagecache
Changes since 1.13: +0 -519
lines
FILE REMOVED
file npf_show.c was added on branch yamt-pagecache on 2014-05-22 11:43:07 +0000
Revision 1.13 / (download) - annotate - [select for diffs], Fri Mar 14 11:29:45 2014 UTC (10 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9,
riastradh-xf86-video-intel-2-7-1-pre-2-21-15,
riastradh-drm2-base3
Branch point for: yamt-pagecache,
tls-earlyentropy
Changes since 1.12: +5 -3
lines
Diff to previous 1.12 (colored)
NPF: add support for "stateful-ends".
Revision 1.12 / (download) - annotate - [select for diffs], Wed Feb 19 01:43:16 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.11: +3 -3
lines
Diff to previous 1.11 (colored)
npfctl_print_nat: fix the byte-order of the port.
Revision 1.11 / (download) - annotate - [select for diffs], Wed Feb 12 01:42:50 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.10: +10 -8
lines
Diff to previous 1.10 (colored)
npfctl_print_table: add a "cdb" type.
Revision 1.10 / (download) - annotate - [select for diffs], Sat Feb 8 01:20:09 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.9: +3 -3
lines
Diff to previous 1.9 (colored)
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
Revision 1.9 / (download) - annotate - [select for diffs], Fri Feb 7 23:45:22 2014 UTC (10 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.8: +8 -5
lines
Diff to previous 1.8 (colored)
NPF: add support for static (stateless) NAT.
Revision 1.8 / (download) - annotate - [select for diffs], Fri Nov 22 18:42:02 2013 UTC (10 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.7: +7 -6
lines
Diff to previous 1.7 (colored)
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
Revision 1.7 / (download) - annotate - [select for diffs], Fri Nov 22 00:25:51 2013 UTC (10 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.6: +7 -8
lines
Diff to previous 1.6 (colored)
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
Revision 1.6 / (download) - annotate - [select for diffs], Tue Nov 19 17:01:45 2013 UTC (10 years, 5 months ago) by christos
Branch: MAIN
Changes since 1.5: +4 -2
lines
Diff to previous 1.5 (colored)
CID 1129614: dereference after null
Revision 1.5 / (download) - annotate - [select for diffs], Tue Nov 19 00:28:41 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.4: +7 -2
lines
Diff to previous 1.4 (colored)
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
Revision 1.4 / (download) - annotate - [select for diffs], Tue Nov 12 00:46:34 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.3: +34 -15
lines
Diff to previous 1.3 (colored)
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128). Few misc fixes. Bump NPF_VERSION.
Revision 1.3 / (download) - annotate - [select for diffs], Fri Nov 8 00:38:26 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.2: +8 -11
lines
Diff to previous 1.2 (colored)
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
Revision 1.2 / (download) - annotate - [select for diffs], Fri Sep 20 03:03:52 2013 UTC (10 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.1: +2 -3
lines
Diff to previous 1.1 (colored)
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
Revision 1.1 / (download) - annotate - [select for diffs], Thu Sep 19 01:04:45 2013 UTC (10 years, 7 months ago) by rmind
Branch: MAIN
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.