The NetBSD Project

CVS log for src/usr.sbin/npf/npfctl/npfctl.c

[BACK] Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npfctl

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.65 / (download) - annotate - [select for diffs], Wed Jul 14 09:15:01 2021 UTC (2 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: netbsd-10-base, netbsd-10-0-RELEASE, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, HEAD
Changes since 1.64: +12 -10 lines
Diff to previous 1.64 (colored)

PR/56307: Konrad Schroder: npfctl's error messages don't report the failing
filename.
Add the filename (but in quotes for consistency with other places in the file).
Also fix an err -> errx

Revision 1.60.2.3 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Changes since 1.60.2.2: +151 -498 lines
Diff to previous 1.60.2.2 (colored) to branchpoint 1.60 (colored) next main 1.61 (colored)

Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@.

Use more markup.

Revision 1.64 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
CVS Tags: cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x
Changes since 1.63: +151 -498 lines
Diff to previous 1.63 (colored)

Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.

Revision 1.55.2.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:55 2020 UTC (4 years ago) by martin
Branch: phil-wifi
Changes since 1.55.2.1: +148 -33 lines
Diff to previous 1.55.2.1 (colored) to branchpoint 1.55 (colored) next main 1.56 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.60.2.2 / (download) - annotate - [select for diffs], Fri Oct 4 08:06:34 2019 UTC (4 years, 6 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Changes since 1.60.2.1: +127 -16 lines
Diff to previous 1.60.2.1 (colored) to branchpoint 1.60 (colored)

Pull up following revision(s) (requested by rmind in ticket #282):

	usr.sbin/npf/npfctl/npf_build.c: revision 1.53
	lib/libnpf/npf.c: revision 1.48
	usr.sbin/npf/npfctl/npfctl.h: revision 1.50
	sys/net/npf/npf_impl.h: revision 1.80
	usr.sbin/npf/npfctl/npfctl.h: revision 1.51
	sys/net/npf/npf_ruleset.c: revision 1.49
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.90
	sys/net/npf/npf_ctl.c: revision 1.59
	lib/libnpf/libnpf.3: revision 1.11
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.50
	usr.sbin/npf/npftest/npftest.conf: revision 1.8
	usr.sbin/npf/npfctl/npfctl.c: revision 1.62
	usr.sbin/npf/npfctl/npfctl.c: revision 1.63
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.30
	usr.sbin/npf/npfctl/npfctl.8: revision 1.22
	lib/libnpf/npf.h: revision 1.38
	usr.sbin/npf/npfctl/npfctl.8: revision 1.23
	usr.sbin/npf/npfctl/npfctl.8: revision 1.24
	sys/net/npf/npf_if.c: revision 1.11
	sys/net/npf/npf_if.c: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.89
	sys/net/npf/npf_conn.c: revision 1.30
	usr.sbin/npf/npfctl/npf_build.c: revision 1.52

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.

NPF ifmap: rework and fix a few small bugs.

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.
(missed a file in previous commit; cvs is so helpful..)

libnpf/npfctl: support dynamic NAT rulesets using a name prefix.

Use -width Pa for FILES.

Fix pasto in table replace -t type

Use -width Pa for FILES.

npf_ifmap_copylogname: be more defensive.

Revision 1.63 / (download) - annotate - [select for diffs], Mon Sep 30 00:37:11 2019 UTC (4 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp
Changes since 1.62: +26 -15 lines
Diff to previous 1.62 (colored)

libnpf/npfctl: support dynamic NAT rulesets using a name prefix.

Revision 1.62 / (download) - annotate - [select for diffs], Sun Sep 29 16:58:35 2019 UTC (4 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.61: +108 -8 lines
Diff to previous 1.61 (colored)

npfctl: implement table replace subcommand.
Contributed by Timshel Knoll-Miller.

Revision 1.60.2.1 / (download) - annotate - [select for diffs], Sun Sep 1 13:13:14 2019 UTC (4 years, 7 months ago) by martin
Branch: netbsd-9
Changes since 1.60: +2 -2 lines
Diff to previous 1.60 (colored)

Pull up following revision(s) (requested by rmind in ticket #139):

	lib/libnpf/npf.c: revision 1.47
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.10
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.10
	sys/net/npf/npf.h: revision 1.61
	sys/net/npf/npf_ctl.c: revision 1.56
	sys/net/npf/npf_os.c: revision 1.15
	lib/libnpf/libnpf.3: revision 1.10
	sys/net/npf/npf_tableset.c: revision 1.34
	usr.sbin/npf/npfctl/npfctl.c: revision 1.61
	sys/net/npf/npf_impl.h: revision 1.77
	lib/libnpf/npf.h: revision 1.37

- npftest: fix a memleak in a unit test (standalone path only).
- Minor style fixes.  No functional change.
npfkern/libnpf: Add support for the table replace/swap operation.
Contributed by Timshel Knoll-Miller.

Revision 1.61 / (download) - annotate - [select for diffs], Wed Aug 21 21:41:53 2019 UTC (4 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.60: +2 -2 lines
Diff to previous 1.60 (colored)

- npftest: fix a memleak in a unit test (standalone path only).
- Minor style fixes.  No functional change.

Revision 1.60 / (download) - annotate - [select for diffs], Thu Jul 25 00:48:55 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.59: +2 -2 lines
Diff to previous 1.59 (colored)

npfctl: fix the bpf.jit parameter handling.

Revision 1.59 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:02 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.58: +20 -16 lines
Diff to previous 1.58 (colored)

NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Revision 1.55.2.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:10:34 2019 UTC (4 years, 10 months ago) by christos
Branch: phil-wifi
Changes since 1.55: +11 -12 lines
Diff to previous 1.55 (colored)

Sync with HEAD

Revision 1.58 / (download) - annotate - [select for diffs], Sun Feb 3 03:19:31 2019 UTC (5 years, 2 months ago) by mrg
Branch: MAIN
CVS Tags: phil-wifi-20190609
Changes since 1.57: +2 -1 lines
Diff to previous 1.57 (colored)

- add or adjust /* FALLTHROUGH */ where appropriate
- add __unreachable() after functions that can return but won't in
  this case, and thus can't be marked __dead easily

Revision 1.54.2.3 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:39 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.54.2.2: +6 -3 lines
Diff to previous 1.54.2.2 (colored) to branchpoint 1.54 (colored) next main 1.55 (colored)

Sync with HEAD

Revision 1.57 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:32 2019 UTC (5 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190127
Changes since 1.56: +6 -3 lines
Diff to previous 1.56 (colored)

Major NPF improvements:
- Convert NPF connection table to thmap.  State lookup is now lock-free.
- Improve connection state G/C: it is now incremental and tunable.
- Add support for dynamic NAT address.  Translation addresses can now be
  selected from a pool of addresses.  There are two selection algorithms,
  "ip-hash" and "round-robin" (see the man page).
- Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf
  to dynamically choose an IP from the interface address(es).
- Add support for the NETMAP algorithm with static NAT for net-to-net
  translation (it is equivalent to iptables NETMAP logic).
- Convert 'ipset' tables to use thmap; the table lookup is now lock-free.
- Misc improvements, bug fixes and more unit tests.
- Bump NPF_VERSION (will also bump libnpf).

Revision 1.54.2.2 / (download) - annotate - [select for diffs], Sun Sep 30 01:46:01 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.54.2.1: +8 -13 lines
Diff to previous 1.54.2.1 (colored) to branchpoint 1.54 (colored)

Ssync with HEAD

Revision 1.56 / (download) - annotate - [select for diffs], Sat Sep 29 14:41:36 2018 UTC (5 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930
Changes since 1.55: +7 -12 lines
Diff to previous 1.55 (colored)

NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
  a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
  previous versions.  Also, different serialisation format means NPF
  connection/config saving and loading is not compatible with the
  previous versions either.

Thanks to christos@ for extra testing.

Revision 1.54.2.1 / (download) - annotate - [select for diffs], Mon Apr 16 02:00:10 2018 UTC (6 years ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.54: +5 -2 lines
Diff to previous 1.54 (colored)

Sync with HEAD, resolve some conflicts

Revision 1.55 / (download) - annotate - [select for diffs], Fri Apr 13 17:43:37 2018 UTC (6 years ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-0906, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415
Branch point for: phil-wifi
Changes since 1.54: +5 -2 lines
Diff to previous 1.54 (colored)

Document "debug" in usage().

Revision 1.53.6.1 / (download) - annotate - [select for diffs], Fri Nov 17 20:43:11 2017 UTC (6 years, 5 months ago) by snj
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2, netbsd-8-0-RC1
Changes since 1.53: +3 -3 lines
Diff to previous 1.53 (colored) next main 1.54 (colored)

Pull up following revision(s) (requested by ozaki-r in ticket #357):
	distrib/sets/lists/debug/mi: 1.228
	distrib/sets/lists/tests/mi: 1.765-1.766
	etc/mtree/NetBSD.dist.tests: 1.149
	sys/net/npf/npf_ctl.c: 1.49
	tests/net/ipsec/Makefile: 1.10
	tests/net/ipsec/algorithms.sh: 1.6
	tests/net/ipsec/natt_terminator.c: 1.1
	tests/net/ipsec/t_ipsec_natt.sh: 1.1
	tests/net/net_common.sh: 1.23-1.24
	usr.sbin/npf/npfctl/npfctl.c: 1.54
Handle esp-udp for NAT-T
--
Fix npfclt reload on rump kernels
It fails because npfctl cannot get an errno when it calls ioctl to the (rump)
kernel; npfctl (libnpf) expects that an errno is returned via proplib,
however, the rump library of npf doesn't so. It happens because of mishandlings
of complicate npf kernel options.
PR kern/52643
--
Fix showing translated port (ntohs-ed twice wrongly)
--
Add test cases of NAT-T (transport mode)
A small C program is added to make a special socket (UDP_ENCAP_ESPINUDP)
and keep it to handle UDP-encapsulated ESP packets.
--
Add net/ipsec debug lib directory
--
Add ./usr/libdata/debug/usr/tests/net/ipsec
--
Stop using bpfjit
Because most architectures don't support it and npf still works without it.

Revision 1.54 / (download) - annotate - [select for diffs], Mon Oct 30 04:53:43 2017 UTC (6 years, 5 months ago) by ozaki-r
Branch: MAIN
CVS Tags: pgoyette-compat-base, pgoyette-compat-0407, pgoyette-compat-0330, pgoyette-compat-0322, pgoyette-compat-0315
Branch point for: pgoyette-compat
Changes since 1.53: +3 -3 lines
Diff to previous 1.53 (colored)

Fix showing translated port (ntohs-ed twice wrongly)

Revision 1.47.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:58:08 2017 UTC (7 years, 1 month ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.47.2.1: +4 -3 lines
Diff to previous 1.47.2.1 (colored) to branchpoint 1.47 (colored) next main 1.48 (colored)

Sync with HEAD

Revision 1.53 / (download) - annotate - [select for diffs], Wed Jan 11 02:10:44 2017 UTC (7 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-20170426, pgoyette-localcount-20170320, perseant-stdc-iso10646-base, perseant-stdc-iso10646, netbsd-8-base, matt-nb8-mediatek-base, matt-nb8-mediatek, bouyer-socketcan-base1, bouyer-socketcan-base, bouyer-socketcan
Branch point for: netbsd-8
Changes since 1.52: +4 -3 lines
Diff to previous 1.52 (colored)

fix hint.

Revision 1.47.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:57:00 2017 UTC (7 years, 3 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.47: +220 -74 lines
Diff to previous 1.47 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.52 / (download) - annotate - [select for diffs], Thu Dec 29 20:48:50 2016 UTC (7 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107
Changes since 1.51: +45 -31 lines
Diff to previous 1.51 (colored)

Improve 'npfctl debug' a little bit.

Revision 1.51 / (download) - annotate - [select for diffs], Tue Dec 27 20:24:32 2016 UTC (7 years, 3 months ago) by wiz
Branch: MAIN
Changes since 1.50: +3 -3 lines
Diff to previous 1.50 (colored)

Sort options in usage.

Revision 1.50 / (download) - annotate - [select for diffs], Tue Dec 27 20:14:35 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.49: +115 -6 lines
Diff to previous 1.49 (colored)

Add a list command to iterate over connection and nat endpoints.

Revision 1.49 / (download) - annotate - [select for diffs], Tue Dec 27 13:43:38 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.48: +7 -5 lines
Diff to previous 1.48 (colored)

We don't use openssl for NPF in NetBSD, so don't include the header, and
provide a compatibility define.

Revision 1.48 / (download) - annotate - [select for diffs], Mon Dec 26 23:05:05 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.47: +72 -51 lines
Diff to previous 1.47 (colored)

Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)

Revision 1.47 / (download) - annotate - [select for diffs], Wed Jun 29 21:40:20 2016 UTC (7 years, 9 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.46: +16 -6 lines
Diff to previous 1.46 (colored)

use sha1 from libc

Revision 1.42.2.3 / (download) - annotate - [select for diffs], Wed Feb 4 07:13:04 2015 UTC (9 years, 2 months ago) by snj
Branch: netbsd-7
CVS Tags: netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-2-RELEASE, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-1, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE, netbsd-7-0
Changes since 1.42.2.2: +3 -3 lines
Diff to previous 1.42.2.2 (colored) to branchpoint 1.42 (colored) next main 1.43 (colored)

Pull up following revision(s) (requested by rmind in ticket #479):
	lib/libnpf/npf.c: revision 1.35
	lib/libnpf/npf.h: revision 1.28
	sys/net/npf/npf_conn.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.61
	sys/net/npf/npf_ruleset.c: revision 1.41
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.44
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.37
	usr.sbin/npf/npfctl/npf_show.c: revisions 1.16, 1.17
	usr.sbin/npf/npfctl/npfctl.c: revision 1.46
load the config file before bpfjit so that we can disable the warning.
--
Don't depend on yacc to include stdlib.h or string.h.
--
- npf_conn_establish: remove a rare race condition when we might destroy a
  connection when it is still referenced by another thread.
- npf_conn_destroy: remove the backwards entry using the saved key, PR/49488.
- Sprinkle some asserts.
--
npf.conf(5): mention alg, include in the example, minor fix.
--
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap
is used correctly.  Also, add npf_ruleset_dump() helper in the kernel.
--
libnpf: add npf_rule_getid() and npf_rule_getcode().
Missed in the previous commit.
--
npfctl_print_rule: print the ID in hex, not decimal.

Revision 1.46 / (download) - annotate - [select for diffs], Sun Jan 4 20:02:15 2015 UTC (9 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.45: +3 -3 lines
Diff to previous 1.45 (colored)

load the config file before bpfjit so that we can disable the warning.

Revision 1.42.2.2 / (download) - annotate - [select for diffs], Mon Dec 29 17:31:47 2014 UTC (9 years, 3 months ago) by martin
Branch: netbsd-7
Changes since 1.42.2.1: +37 -2 lines
Diff to previous 1.42.2.1 (colored) to branchpoint 1.42 (colored)

Pull up following revision(s) (requested by rmind in ticket #359):
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.22
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.43
	usr.sbin/npf/npfctl/npfctl.c: revision 1.44
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.36
	usr.sbin/npf/npfctl/npfctl.c: revision 1.45
	usr.sbin/npf/npfctl/npfctl.h: revision 1.39
npfctl(8): attempt to preload bpfjit kernel module and print the
warning on failure.
allow turning off the bpf jit loading.

Revision 1.45 / (download) - annotate - [select for diffs], Fri Dec 26 22:44:54 2014 UTC (9 years, 3 months ago) by christos
Branch: MAIN
Changes since 1.44: +20 -4 lines
Diff to previous 1.44 (colored)

allow turning off the bpf jit loading.

Revision 1.44 / (download) - annotate - [select for diffs], Fri Dec 26 20:44:38 2014 UTC (9 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.43: +21 -2 lines
Diff to previous 1.43 (colored)

npfctl(8): attempt to preload bpfjit kernel module and print the
warning on failure.

Revision 1.42.2.1 / (download) - annotate - [select for diffs], Fri Aug 29 11:14:14 2014 UTC (9 years, 7 months ago) by martin
Branch: netbsd-7
Changes since 1.42: +8 -3 lines
Diff to previous 1.42 (colored)

Pull up following revision(s) (requested by rmind in ticket #56):
	sys/net/npf/npf_ctl.c: revision 1.39
	usr.sbin/npf/npfctl/npfctl.c: revision 1.43
	lib/libnpf/npf.c: revision 1.33
	lib/libnpf/npf.c: revision 1.34
	sys/net/npf/npf_impl.h: revision 1.59
	sys/net/npf/npf_ctl.c: revision 1.40
	sys/net/npf/npf_conn.c: revision 1.11
	sys/net/npf/npf_alg.c: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.12
	sys/net/npf/npf_nat.c: revision 1.33
	sys/net/npf/npf_nat.c: revision 1.34
Add and use npf_alg_export().
npf_conn_import: handle NAT metadata correctly.
npf_nat_newpolicy: restore the policy ID.
npfctl_load: fix error code handling for the limit cases.
npf_config_import: fix the inverted logic.
npfctl_load: improve error handling.
npf_conn_import: add a missing stat counter increment.
npf_nat_import: add a missing reference and make a comment.
npf_config_submit: finally, include the saved connections.

Revision 1.19.2.4 / (download) - annotate - [select for diffs], Wed Aug 20 00:05:11 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-maxphys
Changes since 1.19.2.3: +73 -56 lines
Diff to previous 1.19.2.3 (colored) next main 1.20 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.43 / (download) - annotate - [select for diffs], Mon Aug 11 23:48:01 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.42: +8 -3 lines
Diff to previous 1.42 (colored)

- Add and use npf_alg_export().
- npf_conn_import: handle NAT metadata correctly.
- npf_nat_newpolicy: restore the policy ID.
- npfctl_load: fix error code handling for the limit cases.
- npf_config_import: fix the inverted logic.
- npfctl_load: improve error handling.

Revision 1.40.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 07:00:01 2014 UTC (9 years, 8 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.40: +63 -36 lines
Diff to previous 1.40 (colored) next main 1.41 (colored)

Rebase.

Revision 1.42 / (download) - annotate - [select for diffs], Wed Jul 23 05:00:38 2014 UTC (9 years, 8 months ago) by htodd
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, netbsd-7-base
Branch point for: netbsd-7
Changes since 1.41: +3 -3 lines
Diff to previous 1.41 (colored)

Build fix (use error when defined).

Revision 1.41 / (download) - annotate - [select for diffs], Wed Jul 23 01:25:34 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.40: +63 -36 lines
Diff to previous 1.40 (colored)

NPF: rework of the connection saving and restoring:
- Add support for saving a snapshot of the current connections together
  with a full configuration.  Support a reverse load operation.  Eliminate
  the old 'sess-save' and 'sess-load' in favour of the new mechanism.
- Share code between load and reload operations: the latter performs
  load from npf.conf without affecting the connections.
- Simplify and fix races with connection loading.
- Bump NPF_VERSION.

Revision 1.6.2.6 / (download) - annotate - [select for diffs], Thu May 22 11:43:07 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.5: +212 -67 lines
Diff to previous 1.6.2.5 (colored) to branchpoint 1.6 (colored) next main 1.7 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.40 / (download) - annotate - [select for diffs], Tue Nov 12 00:46:34 2013 UTC (10 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.39: +5 -4 lines
Diff to previous 1.39 (colored)

NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is
just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).

Few misc fixes.  Bump NPF_VERSION.

Revision 1.39 / (download) - annotate - [select for diffs], Thu Sep 19 12:05:11 2013 UTC (10 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.38: +2 -14 lines
Diff to previous 1.38 (colored)

npfctl: remove some n-code leftovers, fix the build, update the man pages.

Revision 1.38 / (download) - annotate - [select for diffs], Thu Sep 19 01:04:45 2013 UTC (10 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.37: +11 -10 lines
Diff to previous 1.37 (colored)

- Convert NPF to use BPF byte-code by default.  Compile BPF byte-code in
  npfctl(8) and generate separate marks to describe the filter criteria.
- Rewrite 'npfctl show' functionality and fix some of the bugs.
- npftest: add a test for BPF COP.
- Bump NPF_VERSION.

Revision 1.19.2.3 / (download) - annotate - [select for diffs], Sun Jun 23 06:29:05 2013 UTC (10 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.19.2.2: +46 -25 lines
Diff to previous 1.19.2.2 (colored)

resync from head

Revision 1.37 / (download) - annotate - [select for diffs], Sun May 19 20:45:34 2013 UTC (10 years, 11 months ago) by rmind
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Changes since 1.36: +20 -9 lines
Diff to previous 1.36 (colored)

- Add NPF table flushing functionality.
- Fix line numbering for npfctl debug command.

Revision 1.10.2.16 / (download) - annotate - [select for diffs], Sun Mar 31 17:43:16 2013 UTC (11 years ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE, netbsd-6-1-1-RELEASE, netbsd-6-1
Changes since 1.10.2.15: +14 -9 lines
Diff to previous 1.10.2.15 (colored) to branchpoint 1.10 (colored) next main 1.11 (colored)

Pull up following revision(s) (requested by rmind in ticket #852):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.28
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.19
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.32
Fix the example (deja vu?).
deal with strings as interfaces
centralize error handling and print what went wrong instead of "ioctl"
handle port "ftp-data"

Revision 1.36 / (download) - annotate - [select for diffs], Mon Mar 18 02:17:49 2013 UTC (11 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: agc-symver-base, agc-symver
Changes since 1.35: +15 -13 lines
Diff to previous 1.35 (colored)

- Extend npf.conf syntax to support dynamic NAT policies.
- Imply dynamic group when using "ruleset" keyword.

Revision 1.35 / (download) - annotate - [select for diffs], Mon Mar 11 00:39:32 2013 UTC (11 years, 1 month ago) by christos
Branch: MAIN
Changes since 1.34: +6 -4 lines
Diff to previous 1.34 (colored)

separate sess commands.

Revision 1.34 / (download) - annotate - [select for diffs], Mon Mar 11 00:34:43 2013 UTC (11 years, 1 month ago) by christos
Branch: MAIN
Changes since 1.33: +2 -5 lines
Diff to previous 1.33 (colored)

remove dup usage.

Revision 1.33 / (download) - annotate - [select for diffs], Mon Mar 11 00:16:59 2013 UTC (11 years, 1 month ago) by christos
Branch: MAIN
Changes since 1.32: +7 -3 lines
Diff to previous 1.32 (colored)

fix usage

Revision 1.32 / (download) - annotate - [select for diffs], Sun Mar 10 23:59:00 2013 UTC (11 years, 1 month ago) by christos
Branch: MAIN
Changes since 1.31: +14 -9 lines
Diff to previous 1.31 (colored)

centralize error handling and print what went wrong instead of "ioctl"

Revision 1.19.2.2 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:46 2013 UTC (11 years, 1 month ago) by tls
Branch: tls-maxphys
Changes since 1.19.2.1: +189 -43 lines
Diff to previous 1.19.2.1 (colored)

resync with head

Revision 1.10.2.15 / (download) - annotate - [select for diffs], Mon Feb 18 18:26:14 2013 UTC (11 years, 2 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RC2, netbsd-6-1-RC1
Changes since 1.10.2.14: +11 -8 lines
Diff to previous 1.10.2.14 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #829):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.13
	usr.sbin/npf/npfctl/npf_build.c: revision 1.21
	lib/libnpf/npf.c: revision 1.18
	sys/net/npf/npf_ctl.c: revision 1.23
	usr.sbin/npf/npfctl/npfctl.h: revision 1.27
	lib/libnpf/npf.h: revision 1.15
	sys/net/npf/npf_ruleset.c: revision 1.19
	sys/net/npf/npf_impl.h: revision 1.28
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.c: revision 1.31
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.6
- Convert NPF dynamic rule ID to just incremented 64-bit counter.
- Fix multiple bugs.  Also, update the man page.

Revision 1.31 / (download) - annotate - [select for diffs], Sat Feb 16 21:11:15 2013 UTC (11 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.30: +11 -8 lines
Diff to previous 1.30 (colored)

- Convert NPF dynamic rule ID to just incremented 64-bit counter.
- Fix multiple bugs.  Also, update the man page.

Revision 1.10.2.14 / (download) - annotate - [select for diffs], Mon Feb 11 21:49:48 2013 UTC (11 years, 2 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.13: +173 -42 lines
Diff to previous 1.10.2.13 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.

Revision 1.30 / (download) - annotate - [select for diffs], Sun Feb 10 23:47:37 2013 UTC (11 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.29: +12 -3 lines
Diff to previous 1.29 (colored)

- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.

Revision 1.29 / (download) - annotate - [select for diffs], Sat Feb 9 03:35:33 2013 UTC (11 years, 2 months ago) by rmind
Branch: MAIN
Changes since 1.28: +163 -42 lines
Diff to previous 1.28 (colored)

NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

Revision 1.10.2.13 / (download) - annotate - [select for diffs], Fri Feb 8 19:18:09 2013 UTC (11 years, 2 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.12: +6 -2 lines
Diff to previous 1.10.2.12 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #777):
	usr.sbin/npf/npfctl/npfctl.c: revision 1.27
	sys/net/npf/npf_session.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.4
	sys/net/npf/npf_rproc.c: revision 1.5
	usr.sbin/npf/npftest/README: revision 1.3
	sys/sys/mbuf.h: revision 1.151
	sys/net/npf/npf_ruleset.c: revision 1.15
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.3
	sys/net/npf/npf_ruleset.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.4
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.19
	sys/net/npf/npf_instr.c: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.24
	sys/net/npf/npf_handler.c: revision 1.25
	sys/net/npf/npf_state_tcp.c: revision 1.12
	sys/net/npf/npf_processor.c: revision 1.13
	sys/net/npf/npf_impl.h: revision 1.25
	sys/net/npf/npf_processor.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.10
	sys/net/npf/npf_alg_icmp.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.3
	sys/net/npf/npf_session.c: revision 1.20
	sys/net/npf/npf_alg.c: revision 1.6
	sys/kern/uipc_mbuf.c: revision 1.148
	sys/net/npf/npf_inet.c: revision 1.20
	sys/net/npf/npf.h: revision 1.25
	sys/net/npf/npf_nat.c: revision 1.18
	sys/net/npf/npf_state.c: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.13
	sys/net/npf/npf_ext_log.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.4
	sys/net/npf/npf_ext_normalise.c: revision 1.2
- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.
Silence gcc in npf_recache().
Add m_ensure_contig() routine, which is equivalent to m_pullup, but does not
destroy the mbuf chain on failure (it is kept valid).
- nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free
  the mbuf chain on failure.  Fixes some corner cases.  Improve regression
  test and sprinkle some asserts.
- npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix).
  The problem was found and fix provided by Anthony Mallet.

Revision 1.28 / (download) - annotate - [select for diffs], Fri Feb 1 05:40:07 2013 UTC (11 years, 2 months ago) by spz
Branch: MAIN
Changes since 1.27: +3 -2 lines
Diff to previous 1.27 (colored)

IPv6 linklocal address printing cosmetics

Revision 1.6.2.5 / (download) - annotate - [select for diffs], Wed Jan 23 00:06:43 2013 UTC (11 years, 2 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.6.2.4: +7 -3 lines
Diff to previous 1.6.2.4 (colored) to branchpoint 1.6 (colored)

sync with head

Revision 1.6.2.4 / (download) - annotate - [select for diffs], Wed Jan 16 05:34:10 2013 UTC (11 years, 3 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.3: +15 -55 lines
Diff to previous 1.6.2.3 (colored) to branchpoint 1.6 (colored)

sync with (a bit old) head

Revision 1.10.2.12 / (download) - annotate - [select for diffs], Mon Jan 7 18:41:37 2013 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.11: +2 -6 lines
Diff to previous 1.10.2.11 (colored) to branchpoint 1.10 (colored)

Back out part of ticket #777 accidentally committed with ticket #776,
to fix the netbsd-6 build.

Revision 1.10.2.11 / (download) - annotate - [select for diffs], Mon Jan 7 16:51:07 2013 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.10: +7 -3 lines
Diff to previous 1.10.2.10 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #776):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.26
	usr.sbin/npf/npfctl/npfctl.c: revision 1.26
	dist/pf/usr.sbin/ftp-proxy/npf.c: revision 1.2
	lib/libnpf/npf.c: revision 1.15
	sys/net/npf/npf_ctl.c: revision 1.20
	lib/libnpf/npf.h: revision 1.12
	lib/libnpf/npf.3: revision 1.6
	lib/libnpf/npf.3: revision 1.7
	usr.sbin/npf/npfctl/npf_build.c: revision 1.17
	sys/net/npf/npf.h: revision 1.24
- Add NPF version check in proplist as well, not only ioctl.  Bump the version.
- Fix a bug in table entry lookup.
- Updates/fixes to the man pages.  Misc.
Remove a superfluous quote and fix a recurring typo.
ftp-proxy: disable NPF bits for now; it will be re-done.

Revision 1.27 / (download) - annotate - [select for diffs], Mon Dec 24 19:05:46 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base8
Changes since 1.26: +6 -2 lines
Diff to previous 1.26 (colored)

- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.

Revision 1.26 / (download) - annotate - [select for diffs], Sun Dec 23 21:01:04 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.25: +3 -3 lines
Diff to previous 1.25 (colored)

- Add NPF version check in proplist as well, not only ioctl.  Bump the version.
- Fix a bug in table entry lookup.
- Updates/fixes to the man pages.  Misc.

Revision 1.10.2.10 / (download) - annotate - [select for diffs], Sun Dec 16 19:41:37 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.9: +11 -3 lines
Diff to previous 1.10.2.9 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #750):
	usr.sbin/npf/npfctl/npfctl.c: revision 1.25
	usr.sbin/npf/npfctl/npfctl.h: revision 1.24
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.13
	usr.sbin/npf/npfctl/npf_build.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.8: revision 1.11
npfctl: add 'validate' command to check the config, but not load it.  Update
the man page.  Also add a small note about 'debug' command, PR/47298.

Revision 1.25 / (download) - annotate - [select for diffs], Mon Dec 10 02:26:04 2012 UTC (11 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base7
Changes since 1.24: +11 -3 lines
Diff to previous 1.24 (colored)

npfctl: add 'validate' command to check the config, but not load it.  Update
the man page.  Also add a small note about 'debug' command, PR/47298.

Revision 1.10.2.9 / (download) - annotate - [select for diffs], Mon Nov 26 17:39:29 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.8: +6 -54 lines
Diff to previous 1.10.2.8 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #718):
	usr.sbin/npf/npfctl/npfctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.c: revision 1.23
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.15
	usr.sbin/npf/npfctl/npfctl.c: revision 1.24
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.16
	usr.sbin/npf/npfctl/npfctl.h: revision 1.22
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.14
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.11
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.12
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.7
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.8
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.2
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.3
	usr.sbin/npf/npfctl/npf_var.c: revision 1.6
	usr.sbin/npf/npfctl/npf_var.c: revision 1.7
gcc 4.1 is not smart enough to notice "arg" is only used when initialized
correctly and produces a "might be used unintialized" warning.
npfctl: switch to efun(3) routines.
npfctl: switch to ecalloc(3).

Revision 1.10.2.8 / (download) - annotate - [select for diffs], Sat Nov 24 04:34:43 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.7: +112 -35 lines
Diff to previous 1.10.2.7 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #702):
	sys/net/npf/npf_tableset.c: revision 1.15
	usr.sbin/npf/npfctl/npfctl.h: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.6
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.10
	sys/net/npf/npf_state_tcp.c: revision 1.11
	sys/net/npf/npf_impl.h: revision 1.24
	sys/net/npf/npf.h: revision 1.22
	sys/net/npf/npf_ctl.c: revision 1.19
	sys/net/npf/npf.c: revision 1.14
	usr.sbin/npf/npfctl/npfctl.8: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.21
npf_tcp_inwindow: inspect the sequence numbers even if the packet contains no
data, fixing up only the RST to the initial SYN.  This makes off-path attacks
more difficult.  For the reference, see "Reflection Scan: an Off-Path Attack
on TCP" by Jan Wrobel.
Implement NPF table listing and preservation of entries on reload.
Bump the version.
npfctl(8): mention table listing.

Revision 1.19.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:03:03 2012 UTC (11 years, 5 months ago) by tls
Branch: tls-maxphys
Changes since 1.19: +111 -86 lines
Diff to previous 1.19 (colored)

Resync to 2012-11-19 00:00:00 UTC

Revision 1.10.2.7 / (download) - annotate - [select for diffs], Sun Nov 18 22:38:28 2012 UTC (11 years, 5 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.6: +2 -6 lines
Diff to previous 1.10.2.6 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #693):
	lib/npf/ext_normalise/shlib_version: revision 1.1
	lib/libnpf/npf.c: revision 1.13
	distrib/sets/lists/modules/mi: revision 1.48
	sys/net/npf/npf_rproc.c: revision 1.3
	sys/net/npf/npf_rproc.c: revision 1.4
	sys/modules/npf/Makefile: revision 1.11
	usr.sbin/npf/npfctl/npfctl.h: revision 1.20
	lib/npf/ext_log/npfext_log.c: revision 1.1
	lib/libnpf/npf.h: revision 1.11
	sys/net/npf/npf_inet.c: revision 1.17
	sys/net/npf/npf_log.c: file removal
	sys/net/npf/npf_handler.c: revision 1.22
	distrib/sets/lists/base/shl.mi: revision 1.636
	sys/net/npf/npf_impl.h: revision 1.23
	usr.sbin/npf/npfctl/Makefile: revision 1.8
	lib/npf/Makefile: revision 1.1
	lib/npf/ext_log/shlib_version: revision 1.1
	lib/Makefile: revision 1.189
	distrib/sets/lists/comp/shl.mi: revision 1.236
	usr.sbin/npf/npfctl/npf_build.c: revision 1.14
	distrib/sets/lists/base/mi: revision 1.1007
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
	distrib/sets/lists/base/mi: revision 1.1009
	sys/net/npf/npf.h: revision 1.21
	lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.105
	lib/libnpf/Makefile: revision 1.3
	etc/mtree/NetBSD.dist.base: revision 1.106
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
	sys/net/npf/npf_ctl.c: revision 1.18
	lib/npf/ext_log/Makefile: revision 1.1
	distrib/sets/lists/comp/mi: revision 1.1781
	usr.sbin/npf/npfctl/npf_var.h: revision 1.4
	sys/net/npf/npf.c: revision 1.13
	sys/modules/Makefile: revision 1.111
	sys/net/npf/npf_ext_log.c: revision 1.1
	lib/npf/Makefile.inc: revision 1.1
	sys/net/npf/npf_ext_normalise.c: revision 1.1
	sys/net/npf/files.npf: revision 1.8
	sys/rump/net/lib/libnpf/Makefile: revision 1.2
	sys/modules/npf_ext_log/Makefile: revision 1.1
	lib/npf/ext_normalise/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npfctl.c: revision 1.20
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
	sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@

Revision 1.24 / (download) - annotate - [select for diffs], Thu Nov 15 22:20:27 2012 UTC (11 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.23: +5 -5 lines
Diff to previous 1.23 (colored)

npfctl: switch to ecalloc(3).

Revision 1.23 / (download) - annotate - [select for diffs], Mon Nov 5 23:47:12 2012 UTC (11 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.22: +5 -53 lines
Diff to previous 1.22 (colored)

npfctl: switch to efun(3) routines.

Revision 1.10.2.5.2.1 / (download) - annotate - [select for diffs], Thu Nov 1 16:45:07 2012 UTC (11 years, 5 months ago) by matt
Branch: matt-nb6-plus
Changes since 1.10.2.5: +3 -3 lines
Diff to previous 1.10.2.5 (colored) next main 1.10.2.6 (colored)

sync with netbsd-6-0-RELEASE.

Revision 1.22 / (download) - annotate - [select for diffs], Wed Oct 31 08:54:39 2012 UTC (11 years, 5 months ago) by martin
Branch: MAIN
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored)

gcc 4.1 is not smart enough to notice "arg" is only used when initialized
correctly and produces a "might be used unintialized" warning.

Revision 1.6.2.3 / (download) - annotate - [select for diffs], Tue Oct 30 19:00:45 2012 UTC (11 years, 5 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.2: +223 -82 lines
Diff to previous 1.6.2.2 (colored) to branchpoint 1.6 (colored)

sync with head

Revision 1.21 / (download) - annotate - [select for diffs], Mon Oct 29 02:27:12 2012 UTC (11 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base6
Changes since 1.20: +112 -35 lines
Diff to previous 1.20 (colored)

Implement NPF table listing and preservation of entries on reload.
Bump the version.

Revision 1.10.2.6 / (download) - annotate - [select for diffs], Mon Oct 1 20:05:57 2012 UTC (11 years, 6 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RELEASE, netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE, netbsd-6-0, matt-nb6-plus-nbase, matt-nb6-plus-base
Changes since 1.10.2.5: +3 -3 lines
Diff to previous 1.10.2.5 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #582):
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.16
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.17
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.18
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.19
	usr.sbin/npf/npfctl/npfctl.c: revision 1.19
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.20
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.21
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.22
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.23
npfctl usage: minor formatting fix.
npf.conf(5): improve and explain grammar definition.
re-work the description part of the man page, as discussed with rmind@
npf.conf(5): add syntax section and a first cut describing the structural
elements.  Some improvements and fixes from spz@.
Whitespace fixes, remove unnecessary Pp
XXX: Subsections Rules and Procedures seem empty?
Add some content to the "Rules" section.
Use more markup. New sentence, new line.
Add some content to the Procedures section.
Wording, more macros.

Revision 1.20 / (download) - annotate - [select for diffs], Sun Sep 16 13:47:41 2012 UTC (11 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.19: +2 -6 lines
Diff to previous 1.19 (colored)

Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.

Revision 1.19 / (download) - annotate - [select for diffs], Sat Sep 1 19:08:01 2012 UTC (11 years, 7 months ago) by rmind
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.18: +3 -3 lines
Diff to previous 1.18 (colored)

npfctl usage: minor formatting fix.

Revision 1.10.2.5 / (download) - annotate - [select for diffs], Mon Aug 13 17:49:52 2012 UTC (11 years, 8 months ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-0-RC2, netbsd-6-0-RC1
Branch point for: matt-nb6-plus
Changes since 1.10.2.4: +6 -4 lines
Diff to previous 1.10.2.4 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #485):
	lib/libnpf/npf.c: revision 1.11
	sys/net/npf/npf_session.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.10
	usr.sbin/npf/npftest/npftest.c: revision 1.4
	usr.sbin/npf/npftest/README: revision 1.1
	sys/net/npf/npf_tableset.c: revision 1.14
	usr.sbin/npf/npftest/npftest.h: revision 1.4
	lib/libnpf/npf.h: revision 1.10
	sys/net/npf/npf_ruleset.c: revision 1.14
	usr.sbin/npf/npfctl/npf_data.c: revision 1.18
	usr.sbin/npf/npftest/npftest.conf: revision 1.1
	sys/net/npf/npf_handler.c: revision 1.21
	sys/net/npf/npf_impl.h: revision 1.21
	usr.sbin/npf/npfctl/npfctl.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.13
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1
	usr.sbin/npf/npftest/npfstream.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.19
	sys/net/npf/npf_nat.c: revision 1.16
	sys/net/npf/npf_state.c: revision 1.11
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.12
- Extend npftest: add ruleset inspection testing from the config generated
  by npfctl debug functionality.  Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
  share between the entries and thus fix the handling of them.  Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.

Revision 1.18 / (download) - annotate - [select for diffs], Sun Aug 12 03:35:13 2012 UTC (11 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.17: +6 -4 lines
Diff to previous 1.17 (colored)

- Extend npftest: add ruleset inspection testing from the config generated
  by npfctl debug functionality.  Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
  share between the entries and thus fix the handling of them.  Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.

Revision 1.10.2.4 / (download) - annotate - [select for diffs], Wed Jul 25 20:45:23 2012 UTC (11 years, 8 months ago) by jdc
Branch: netbsd-6
Changes since 1.10.2.3: +55 -39 lines
Diff to previous 1.10.2.3 (colored) to branchpoint 1.10 (colored)

Pull up revisions:
  src/usr.sbin/npf/npfctl/npfctl.c revisions 1.16,1.17
  src/sys/net/npf/npf.h revision 1.20
  src/sys/net/npf/npf_alg_icmp.c revision 1.11
  src/sys/net/npf/npf_impl.h revision 1.19
  src/sys/net/npf/npf_inet.c revisions 1.15,1.16
  src/sys/net/npf/npf_instr.c revision 1.14
  src/sys/net/npf/npf_ncode.h revision 1.10
  src/sys/net/npf/npf_processor.c revision 1.12
  src/sys/net/npf/npf_session.c revision 1.16
  src/usr.sbin/npf/npfctl/npf_build.c revision 1.12
  src/usr.sbin/npf/npfctl/npf_data.c revisions 1.16,1.17
  src/usr.sbin/npf/npfctl/npf_disassemble.c revision 1.8
  src/usr.sbin/npf/npfctl/npf_ncgen.c revision 1.13
  src/usr.sbin/npf/npfctl/npf_parse.y revision 1.11
  src/usr.sbin/npf/npfctl/npf_scan.l revision 1.5
  src/usr.sbin/npf/npfctl/npf_var.h revision 1.3
  src/usr.sbin/npf/npfctl/npfctl.h revision 1.18
  src/sys/net/npf/npf_state.c revision 1.10
  src/sys/net/npf/npf_state_tcp.c revision 1.10
  src/usr.sbin/npf/npftest/npfstream.c revision 1.2
  src/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c revision 1.2
(requested by rmind in ticket #435).

Add missing __dead.

teach npf ipv6-icmp
reviewed by rmind@

- npfctl_print_stats: beautification a la French style.
- npfctl_icmpcode: fix the build break.

- npf_fetch_tcpopts: fix off-by-one when validating TCP option length
  against the maximum allowed.
- npf_tcp_inwindow: be more liberal with npf_fetch_tcpopts().
- Few minor improvements to npftest.

Revision 1.17 / (download) - annotate - [select for diffs], Thu Jul 19 22:22:53 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.16: +54 -38 lines
Diff to previous 1.16 (colored)

- npfctl_print_stats: beautification a la French style.
- npfctl_icmpcode: fix the build break.

Revision 1.16 / (download) - annotate - [select for diffs], Thu Jul 19 06:31:26 2012 UTC (11 years, 9 months ago) by joerg
Branch: MAIN
Changes since 1.15: +3 -3 lines
Diff to previous 1.15 (colored)

Add missing __dead.

Revision 1.10.2.3 / (download) - annotate - [select for diffs], Mon Jul 16 22:13:28 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.2: +78 -35 lines
Diff to previous 1.10.2.2 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #421):
	lib/libnpf/npf.c: revision 1.10
	sys/net/npf/npf_session.c: revision 1.15
	sys/net/npf/npf_tableset.c: revision 1.13
	sys/net/npf/npf_state_tcp.c: revision 1.9
	usr.sbin/npf/npfctl/npf_data.c: revision 1.15
	sys/net/npf/npf_inet.c: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.13
	sys/net/npf/npf.h: revision 1.19
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12
	sys/net/npf/npf_instr.c: revision 1.13
	sys/net/npf/npf_handler.c: revision 1.20
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4
	sys/net/npf/npf_alg_icmp.c: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.11
	lib/libnpf/npf.h: revision 1.9
	sys/net/npf/npf_alg.c: revision 1.5
	sys/rump/dev/lib/libnpf/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.15
	sys/net/npf/npf_tableset_ptree.c: revision 1.1
	sys/net/npf/npf.c: revision 1.12
	sys/net/npf/npf_sendpkt.c: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.18
	sys/net/npf/files.npf: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.10
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.15 / (download) - annotate - [select for diffs], Sun Jul 15 00:22:59 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.14: +78 -35 lines
Diff to previous 1.14 (colored)

- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.10.2.2 / (download) - annotate - [select for diffs], Thu Jul 5 17:48:44 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.10.2.1: +6 -6 lines
Diff to previous 1.10.2.1 (colored) to branchpoint 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #399):
	sys/net/npf/npf_session.c: revision 1.14
	sys/net/npf/npf_tableset.c: revision 1.12
	sys/net/npf/npf_state_tcp.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.14
	sys/net/npf/npf_inet.c: revision 1.13
	sys/net/npf/npf_ruleset.c: revision 1.12
	sys/net/npf/npf.h: revision 1.18
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.8: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2
	usr.sbin/npf/npfctl/npfctl.8: revision 1.8
	sys/net/npf/npf_instr.c: revision 1.12
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.13
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.14
	sys/net/npf/npf_state.c: revision 1.9
	sys/net/npf/npf_processor.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.13
	usr.sbin/npf/npfctl/npfctl.c: revision 1.14
	usr.sbin/npf/npfctl/npf_build.c: revision 1.10
	lib/libnpf/npf.3: revision 1.5
	lib/libnpf/npf.h: revision 1.8
	share/man/man9/npf_ncode.9: revision 1.9
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.4
	lib/libnpf/npf.c: revision 1.9
	usr.sbin/npf/npfctl/npfctl.h: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6
	sys/net/npf/npf_impl.h: revision 1.17
	sys/net/npf/npf_handler.c: revision 1.18
	sys/net/npf/npf_handler.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4
	sys/net/npf/npf_ncode.h: revision 1.9
Fix and update npf.conf(5), npfctl(8) and its usage message.
npf_state_tcp: fix for FIN retransmission and out-of-order ACK case.
NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.
npf_packet_handler: fix gcc unused warning.

Revision 1.14 / (download) - annotate - [select for diffs], Sun Jul 1 23:21:07 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.13: +5 -5 lines
Diff to previous 1.13 (colored)

NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.

Revision 1.13 / (download) - annotate - [select for diffs], Wed Jun 27 23:05:28 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.12: +3 -3 lines
Diff to previous 1.12 (colored)

Fix and update npf.conf(5), npfctl(8) and its usage message.

Revision 1.10.2.1 / (download) - annotate - [select for diffs], Tue Jun 26 00:07:20 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.10: +19 -12 lines
Diff to previous 1.10 (colored)

Pull up following revision(s) (requested by rmind in ticket #354):
	sys/net/npf/npf_state_tcp.c: revision 1.4
	sys/net/npf/npf_state_tcp.c: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.6
	usr.sbin/npf/npftest/npftest.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.1
	usr.sbin/npf/npftest/npftest.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.2
	usr.sbin/npf/npfctl/npf_data.c: revision 1.11
	usr.sbin/npf/npftest/npftest.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.12
	usr.sbin/npf/npftest/npftest.h: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.5
	usr.sbin/npf/npfctl/npf_data.c: revision 1.13
	sys/net/npf/npf.h: revision 1.16
	usr.sbin/npf/npftest/npftest.h: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.6
	usr.sbin/npf/npftest/npftest.h: revision 1.3
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.7
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.10
	usr.sbin/npf/npfctl/npf_build.c: revision 1.6
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.8
	usr.sbin/npf/npfctl/npf_build.c: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_build.c: revision 1.9
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.10
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.11
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.12
	sys/net/npf/npf_state.c: revision 1.7
	usr.sbin/npf/npfctl/npfctl.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.12
	usr.sbin/npf/npfctl/Makefile: revision 1.7
	sys/rump/net/lib/libnet/Makefile: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.7
	usr.sbin/npf/npftest/Makefile: revision 1.1
	usr.sbin/npf/npftest/Makefile: revision 1.2
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.2
	usr.sbin/npf/npftest/npfstream.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.3
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.12
	sys/rump/dev/lib/libnpf/Makefile: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.14
	sys/rump/dev/lib/libnpf/Makefile: revision 1.3
	usr.sbin/npf/npfctl/npfctl.h: revision 1.15
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.9
	sys/net/npf/npf_ctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_var.c: revision 1.4
	usr.sbin/npf/npfctl/npf_var.h: revision 1.2
	usr.sbin/npf/npfctl/npf_var.c: revision 1.5
	sys/net/npf/npf_impl.h: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.10
	sys/net/npf/npf_impl.h: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.4
	sys/net/npf/npf_impl.h: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.5
	sys/net/npf/npf_handler.c: revision 1.17
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.2
	sys/net/npf/npf_ncode.h: revision 1.7
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.1
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.3
	sys/net/npf/npf_ncode.h: revision 1.8
npf_tcp_inwindow: in a case of negative skew, bump the maximum seen value of
SEQ+LEN in the receiver's side correctly (using ACK from the sender's side).
PR/46265 from Changli Gao.
rumpnet_net: add pfil.c
Update rumpdev_npf; use WARNS=4.
Add initial NPF regression tests integrated with RUMP framework (running the
kernel part of NPF in userland).  Other tests will be added once converted to
RUMP framework.  All tests are in the public domain.
Some Makefile fixes from christos@.
- Fix double-free case on ICMP return case.
- npf_pfil_register: handle kernels without INET6 option correctly.
- Reduce some #ifdefs.
npfctl(8): add show-config command.  Also, update syntax.
npftest: add a stream processor, which prints out the TCP state information.
A tool for debugging connection tracking from tcpdump -w captured data.
npftest: add a module for TCP state tracking and add few test cases.
npf_state_tcp: add an assert; fix some comments while here.
- Rework NPF NAT syntax to be more structured and support future additions
  of different types and configurations of NAT.
- npfctl: improve disassemble and show-config command functionality.
- Fix custom ICMP code and type filtering.
make this compile again.
remove error(1) output
Remove superfluous Pp
- make each element of a variable hold a type
- change get_type to take an index, so we can get the individual types of
  each element (since primitive elements can be in lists)
- make port_range primitive
- add a routine to convert a variable of primitives to a variable containing
- only port ranges.
remove extra rule that got merged...

Revision 1.12 / (download) - annotate - [select for diffs], Fri Jun 15 23:24:08 2012 UTC (11 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.11: +4 -4 lines
Diff to previous 1.11 (colored)

- Rework NPF NAT syntax to be more structured and support future additions
  of different types and configurations of NAT.
- npfctl: improve disassemble and show-config command functionality.
- Fix custom ICMP code and type filtering.

Revision 1.11 / (download) - annotate - [select for diffs], Wed May 30 21:30:07 2012 UTC (11 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.10: +17 -10 lines
Diff to previous 1.10 (colored)

npfctl(8): add show-config command.  Also, update syntax.

Revision 1.6.2.2 / (download) - annotate - [select for diffs], Tue Apr 17 00:09:50 2012 UTC (12 years ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.2.1: +85 -50 lines
Diff to previous 1.6.2.1 (colored) to branchpoint 1.6 (colored)

sync with head

Revision 1.10 / (download) - annotate - [select for diffs], Sun Feb 5 00:37:13 2012 UTC (12 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, netbsd-6-base
Branch point for: netbsd-6
Changes since 1.9: +27 -2 lines
Diff to previous 1.9 (colored)

Multiple NPF fixes, add better error reporting from kernel side, add some
asserts, bump the version.

Revision 1.9 / (download) - annotate - [select for diffs], Sun Jan 15 00:49:48 2012 UTC (12 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.8: +3 -3 lines
Diff to previous 1.8 (colored)

- Expire all sessions on flush.
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes.
- Make locking symmetric for npf_ruleset_inspect().
- Sync function prototypes in npf(3) man page with reality.
- Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.

Revision 1.8 / (download) - annotate - [select for diffs], Sun Jan 8 21:34:21 2012 UTC (12 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.7: +60 -50 lines
Diff to previous 1.7 (colored)

Full rewrite of npfctl(8) parser and rework of n-code generation part.
Fixes most of the known bugs and issues with the utility.  Note: rule
procedures are not yet (as we want to make them fully modular).

Huge thanks to Martin Husemann who wrote the parser and Christos Zoulas
who wrote intermediate structures and helped to complete the work.

Revision 1.6.2.1 / (download) - annotate - [select for diffs], Thu Nov 10 14:31:55 2011 UTC (12 years, 5 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6: +5 -4 lines
Diff to previous 1.6 (colored)

sync with head

Revision 1.7 / (download) - annotate - [select for diffs], Fri Nov 4 01:00:28 2011 UTC (12 years, 5 months ago) by zoltan
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2
Changes since 1.6: +5 -4 lines
Diff to previous 1.6 (colored)

Add IPv6 support for NPF.

Revision 1.6 / (download) - annotate - [select for diffs], Wed Aug 31 13:32:38 2011 UTC (12 years, 7 months ago) by joerg
Branch: MAIN
CVS Tags: yamt-pagecache-base
Branch point for: yamt-pagecache
Changes since 1.5: +3 -3 lines
Diff to previous 1.5 (colored)

Use __dead

Revision 1.4.2.1 / (download) - annotate - [select for diffs], Tue Feb 8 16:20:15 2011 UTC (13 years, 2 months ago) by bouyer
Branch: bouyer-quota2
Changes since 1.4: +13 -5 lines
Diff to previous 1.4 (colored) next main 1.5 (colored)

Sync with HEAD

Revision 1.5 / (download) - annotate - [select for diffs], Wed Feb 2 02:20:25 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base
Changes since 1.4: +13 -5 lines
Diff to previous 1.4 (colored)

NPF checkpoint:
- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc).
- Add NPF support for ftp-proxy(8).
- Add rc.d script for NPF.
- Convert npfctl(8) to use libnpf(3) and thus make it less depressive.
  Note: next clean-up step should be a parser, once dholland@ will finish it.
- Add more documentation.
- Various fixes.

Revision 1.4 / (download) - annotate - [select for diffs], Tue Jan 18 20:33:45 2011 UTC (13 years, 3 months ago) by rmind
Branch: MAIN
Branch point for: bouyer-quota2
Changes since 1.3: +32 -18 lines
Diff to previous 1.3 (colored)

NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
  potentially other functions from the rule structure.  Rule procedure can be
  shared amongst the rules.  Separation is both at kernel level (npf_rproc_t)
  and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic.  Use TCP FSM definitions.
- Add if_byindex(), OK by matt@.  Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.

Revision 1.3 / (download) - annotate - [select for diffs], Sat Dec 18 01:07:26 2010 UTC (13 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: matt-mips64-premerge-20101231
Changes since 1.2: +75 -16 lines
Diff to previous 1.2 (colored)

NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.

Revision 1.2 / (download) - annotate - [select for diffs], Thu Nov 11 06:30:39 2010 UTC (13 years, 5 months ago) by rmind
Branch: MAIN
Changes since 1.1: +10 -7 lines
Diff to previous 1.1 (colored)

NPF checkpoint:
- Add proper TCP state tracking as described in Guido van Rooij paper,
  plus handle TCP Window Scaling option.
- Completely rework npf_cache_t, reduce granularity, simplify code.
- Add npf_addr_t as an abstraction, amend session handling code, as well
  as NAT code et al, to use it.  Now design is prepared for IPv6 support.
- Handle IPv4 fragments i.e. perform packet reassembly.
- Add support for IPv4 ID randomization and minimum TTL enforcement.
- Add support for TCP MSS "clamping".
- Random bits for IPv6.  Various fixes and clean-up.

Revision 1.1 / (download) - annotate - [select for diffs], Sun Aug 22 18:56:24 2010 UTC (13 years, 7 months ago) by rmind
Branch: MAIN

Import NPF - a packet filter.  Some features:

- Designed to be fully MP-safe and highly efficient.

- Tables/IP sets (hash or red-black tree) for high performance lookups.

- Stateful filtering and Network Address Port Translation (NAPT).
  Framework for application level gateways (ALGs).

- Packet inspection engine called n-code processor - inspired by BPF -
  supporting generic RISC-like and specific CISC-like instructions for
  common patterns (e.g. IPv4 address matching).  See npf_ncode(9) manual.

- Convenient userland utility npfctl(8) with npf.conf(8).

NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.

Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>