![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npftest / libnpftest
Request diff between arbitrary revisions
Keyword substitution: kv
Default branch: MAIN
Mostly merge changes from HEAD upto 20200411
Pull up following revision(s) (requested by rmind in ticket #139): lib/libnpf/npf.c: revision 1.47 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.10 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.10 sys/net/npf/npf.h: revision 1.61 sys/net/npf/npf_ctl.c: revision 1.56 sys/net/npf/npf_os.c: revision 1.15 lib/libnpf/libnpf.3: revision 1.10 sys/net/npf/npf_tableset.c: revision 1.34 usr.sbin/npf/npfctl/npfctl.c: revision 1.61 sys/net/npf/npf_impl.h: revision 1.77 lib/libnpf/npf.h: revision 1.37 - npftest: fix a memleak in a unit test (standalone path only). - Minor style fixes. No functional change. npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
- npftest: fix a memleak in a unit test (standalone path only). - Minor style fixes. No functional change.
npftest: fix double-free in npf_nbuf_test().
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Sync with HEAD
Sync with HEAD
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
Rebase to HEAD as of a few days ago.
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
resync with head
Pull up following revision(s) (requested by rmind in ticket #777): usr.sbin/npf/npfctl/npfctl.c: revision 1.27 sys/net/npf/npf_session.c: revision 1.19 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.4 sys/net/npf/npf_rproc.c: revision 1.5 usr.sbin/npf/npftest/README: revision 1.3 sys/sys/mbuf.h: revision 1.151 sys/net/npf/npf_ruleset.c: revision 1.15 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.3 sys/net/npf/npf_ruleset.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.4 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.4 sys/net/npf/npf_inet.c: revision 1.19 sys/net/npf/npf_instr.c: revision 1.15 sys/net/npf/npf_handler.c: revision 1.24 sys/net/npf/npf_handler.c: revision 1.25 sys/net/npf/npf_state_tcp.c: revision 1.12 sys/net/npf/npf_processor.c: revision 1.13 sys/net/npf/npf_impl.h: revision 1.25 sys/net/npf/npf_processor.c: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.10 sys/net/npf/npf_alg_icmp.c: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.9 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.3 sys/net/npf/npf_session.c: revision 1.20 sys/net/npf/npf_alg.c: revision 1.6 sys/kern/uipc_mbuf.c: revision 1.148 sys/net/npf/npf_inet.c: revision 1.20 sys/net/npf/npf.h: revision 1.25 sys/net/npf/npf_nat.c: revision 1.18 sys/net/npf/npf_state.c: revision 1.13 sys/net/npf/npf_sendpkt.c: revision 1.13 sys/net/npf/npf_ext_log.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.4 sys/net/npf/npf_ext_normalise.c: revision 1.2 - Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup. Silence gcc in npf_recache(). Add m_ensure_contig() routine, which is equivalent to m_pullup, but does not destroy the mbuf chain on failure (it is kept valid). - nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free the mbuf chain on failure. Fixes some corner cases. Improve regression test and sprinkle some asserts. - npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix). The problem was found and fix provided by Anthony Mallet.
sync with head
- nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free the mbuf chain on failure. Fixes some corner cases. Improve regression test and sprinkle some asserts. - npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix). The problem was found and fix provided by Anthony Mallet.
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
Pull up following revision(s) (requested by rmind in ticket #679): sys/net/npf/npf_session.c: revision 1.18 usr.sbin/npf/npftest/npftest.c: revision 1.6 usr.sbin/npf/npftest/npftest.c: revision 1.7 usr.sbin/npf/npftest/npftest.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.5 sys/net/npf/npf_alg_icmp.c: revision 1.13 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.2 usr.sbin/npf/npftest/npfstream.c: revision 1.4 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.3 npftest: - Do not stop running other tests, if some tests fail. - Fix some endianness bugs in the test cases. Tested on sparc64 by martin@, all tests pass. Add two new command line options to help integration into ATF: -L lists the available test cases, -T executes a single named test. Fix printf format Mark npf_session_worker as __dead. More __dead npf_icmp_uniqid: split into npf_icmp_uniqid4() and npf_icmp_uniqid6() parts.
sync with head
npftest: - Do not stop running other tests, if some tests fail. - Fix some endianness bugs in the test cases. Tested on sparc64 by martin@, all tests pass.
Pull up following revision(s) (requested by rmind in ticket #354): sys/net/npf/npf_state_tcp.c: revision 1.4 sys/net/npf/npf_state_tcp.c: revision 1.5 sys/net/npf/npf_state_tcp.c: revision 1.6 usr.sbin/npf/npftest/npftest.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.1 usr.sbin/npf/npftest/npftest.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.2 usr.sbin/npf/npfctl/npf_data.c: revision 1.11 usr.sbin/npf/npftest/npftest.c: revision 1.3 usr.sbin/npf/npfctl/npf_data.c: revision 1.12 usr.sbin/npf/npftest/npftest.h: revision 1.1 usr.sbin/npf/npfctl/npf_parse.y: revision 1.5 usr.sbin/npf/npfctl/npf_data.c: revision 1.13 sys/net/npf/npf.h: revision 1.16 usr.sbin/npf/npftest/npftest.h: revision 1.2 usr.sbin/npf/npfctl/npf_parse.y: revision 1.6 usr.sbin/npf/npftest/npftest.h: revision 1.3 usr.sbin/npf/npfctl/npf_parse.y: revision 1.7 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.10 usr.sbin/npf/npfctl/npf_build.c: revision 1.6 usr.sbin/npf/npfctl/npf_parse.y: revision 1.8 usr.sbin/npf/npfctl/npf_build.c: revision 1.7 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.9 usr.sbin/npf/npfctl/npf.conf.5: revision 1.10 usr.sbin/npf/npfctl/npf.conf.5: revision 1.11 usr.sbin/npf/npfctl/npf.conf.5: revision 1.12 sys/net/npf/npf_state.c: revision 1.7 usr.sbin/npf/npfctl/npfctl.c: revision 1.11 usr.sbin/npf/npfctl/npfctl.c: revision 1.12 usr.sbin/npf/npfctl/Makefile: revision 1.7 sys/rump/net/lib/libnet/Makefile: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.7 usr.sbin/npf/npftest/Makefile: revision 1.1 usr.sbin/npf/npftest/Makefile: revision 1.2 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.2 usr.sbin/npf/npftest/npfstream.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.2 usr.sbin/npf/npfctl/npf_scan.l: revision 1.3 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.3 usr.sbin/npf/npfctl/npfctl.h: revision 1.12 sys/rump/dev/lib/libnpf/Makefile: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.14 sys/rump/dev/lib/libnpf/Makefile: revision 1.3 usr.sbin/npf/npfctl/npfctl.h: revision 1.15 usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.9 sys/net/npf/npf_ctl.c: revision 1.15 usr.sbin/npf/npfctl/npf_var.c: revision 1.4 usr.sbin/npf/npfctl/npf_var.h: revision 1.2 usr.sbin/npf/npfctl/npf_var.c: revision 1.5 sys/net/npf/npf_impl.h: revision 1.13 sys/net/npf/npf_sendpkt.c: revision 1.10 sys/net/npf/npf_impl.h: revision 1.14 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.4 sys/net/npf/npf_impl.h: revision 1.15 sys/net/npf/npf_handler.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.5 sys/net/npf/npf_handler.c: revision 1.17 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.2 sys/net/npf/npf_ncode.h: revision 1.7 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.1 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.3 sys/net/npf/npf_ncode.h: revision 1.8 npf_tcp_inwindow: in a case of negative skew, bump the maximum seen value of SEQ+LEN in the receiver's side correctly (using ACK from the sender's side). PR/46265 from Changli Gao. rumpnet_net: add pfil.c Update rumpdev_npf; use WARNS=4. Add initial NPF regression tests integrated with RUMP framework (running the kernel part of NPF in userland). Other tests will be added once converted to RUMP framework. All tests are in the public domain. Some Makefile fixes from christos@. - Fix double-free case on ICMP return case. - npf_pfil_register: handle kernels without INET6 option correctly. - Reduce some #ifdefs. npfctl(8): add show-config command. Also, update syntax. npftest: add a stream processor, which prints out the TCP state information. A tool for debugging connection tracking from tcpdump -w captured data. npftest: add a module for TCP state tracking and add few test cases. npf_state_tcp: add an assert; fix some comments while here. - Rework NPF NAT syntax to be more structured and support future additions of different types and configurations of NAT. - npfctl: improve disassemble and show-config command functionality. - Fix custom ICMP code and type filtering. make this compile again. remove error(1) output Remove superfluous Pp - make each element of a variable hold a type - change get_type to take an index, so we can get the individual types of each element (since primitive elements can be in lists) - make port_range primitive - add a routine to convert a variable of primitives to a variable containing - only port ranges. remove extra rule that got merged...
sync with head
file npf_nbuf_test.c was added on branch netbsd-6 on 2012-06-26 00:07:18 +0000
file npf_nbuf_test.c was added on branch yamt-pagecache on 2012-04-17 00:09:51 +0000
Add initial NPF regression tests integrated with RUMP framework (running the kernel part of NPF in userland). Other tests will be added once converted to RUMP framework. All tests are in the public domain. Some Makefile fixes from christos@.