![[BACK]](/icons/back.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / usr.sbin / npf / npftest / libnpftest
Request diff between arbitrary revisions
Keyword substitution: kv
Default branch: MAIN
Pull up following revision(s) (requested by riastradh in ticket #1918): usr.sbin/npf/npftest/npftest.conf: revision 1.10 usr.sbin/npf/npftest/npftest.conf: revision 1.11 usr.sbin/npf/npftest/npftest.conf: revision 1.12 usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.17 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.20 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.22 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.23 tests/net/npf/t_npf.sh: revision 1.5 tests/net/npf/t_npf.sh: revision 1.6 tests/net/npf/t_npf.sh: revision 1.7 npftest: Add AF_* parameter to test cases. No functional change intended. Preparation to add test cases for: PR bin/55403: npfctl miscompiles IPv6 rules npftest: Add a test to match groups of IPv6 addresses. The npf_rule test group is now an xfail. (npftest doesn't have a way to mark individual cases in a test group as xfail, so this will have to do for now.) PR bin/55403: npfctl miscompiles IPv6 rules npftest: Fix newly added test. - Adapt new test to actually exercise new rules. - Mark the right test xfail. PR bin/55403: npfctl miscompiles IPv6 rules npftest: Expand test cases to cover more compiler paths. Cover masked ranges with full- and partial-word sizes. PR bin/55403: npfctl miscompiles IPv6 rules npfctl(8): Fix compiling multiword comparisons, i.e., IPv6 addrs. PR bin/55403: npfctl miscompiles IPv6 rules
Pull up following revision(s) (requested by riastradh in ticket #1002): usr.sbin/npf/npftest/npftest.conf: revision 1.10 usr.sbin/npf/npftest/npftest.conf: revision 1.11 usr.sbin/npf/npftest/npftest.conf: revision 1.12 usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.17 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.20 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.22 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.23 tests/net/npf/t_npf.sh: revision 1.5 tests/net/npf/t_npf.sh: revision 1.6 tests/net/npf/t_npf.sh: revision 1.7 npftest: Add AF_* parameter to test cases. No functional change intended. Preparation to add test cases for: PR bin/55403: npfctl miscompiles IPv6 rules npftest: Add a test to match groups of IPv6 addresses. The npf_rule test group is now an xfail. (npftest doesn't have a way to mark individual cases in a test group as xfail, so this will have to do for now.) PR bin/55403: npfctl miscompiles IPv6 rules npftest: Fix newly added test. - Adapt new test to actually exercise new rules. - Mark the right test xfail. PR bin/55403: npfctl miscompiles IPv6 rules npftest: Expand test cases to cover more compiler paths. Cover masked ranges with full- and partial-word sizes. PR bin/55403: npfctl miscompiles IPv6 rules npfctl(8): Fix compiling multiword comparisons, i.e., IPv6 addrs. PR bin/55403: npfctl miscompiles IPv6 rules
npftest: Expand test cases to cover more compiler paths. Cover masked ranges with full- and partial-word sizes. PR bin/55403: npfctl miscompiles IPv6 rules
npftest: Fix newly added test. - Adapt new test to actually exercise new rules. - Mark the right test xfail. PR bin/55403: npfctl miscompiles IPv6 rules
npftest: Add a test to match groups of IPv6 addresses. The npf_rule test group is now an xfail. (npftest doesn't have a way to mark individual cases in a test group as xfail, so this will have to do for now.) PR bin/55403: npfctl miscompiles IPv6 rules
npftest: Add AF_* parameter to test cases. No functional change intended. Preparation to add test cases for: PR bin/55403: npfctl miscompiles IPv6 rules
Mostly merge changes from HEAD upto 20200411
Pull up following revision(s) (requested by rmind in ticket #141): usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.15 sys/net/npf/npf_alg.c: revision 1.21 sys/net/npf/npf.h: revision 1.62 sys/net/npf/npf_ctl.c: revision 1.57 sys/net/npf/npf_ctl.c: revision 1.58 sys/net/npf/npf_os.c: revision 1.16 sys/net/npf/npf_os.c: revision 1.17 sys/net/npf/npf_conf.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.78 sys/sys/mbuf.h: revision 1.220 sys/net/npf/npf_impl.h: revision 1.79 sys/net/npf/npf.c: revision 1.41 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.19 sys/net/npf/npf_nat.c: revision 1.48 sys/net/npf/npf_handler.c: revision 1.48 sys/net/npf/npf_ifaddr.c: revision 1.6 - npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain. Move PACKET_TAG_NPF where it belongs to. Make npfctl_switch() and pfil private to OS-specific module.
- npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
Pull up following revision(s) (requested by rmind in ticket #49): usr.sbin/npf/npf.7: revision 1.7 sys/net/npf/npfkern.h: revision 1.4 sys/net/npf/npf_conn.h: revision 1.18 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.13 sys/net/npf/npf_ctl.c: revision 1.55 sys/net/npf/npf_os.c: revision 1.14 sys/net/npf/npf_conf.c: revision 1.14 usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_perf_test.c: revision 1.9 sys/net/npf/npf_impl.h: revision 1.76 sys/net/npf/npf_portmap.c: revision 1.4 sys/net/npf/npf_params.c: revision 1.2 sys/net/npf/npf.c: revision 1.40 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.18 sys/net/npf/npf_nat.c: revision 1.47 sys/net/npf/npf_handler.c: revision 1.47 sys/net/npf/npf_inet.c: revision 1.55 sys/net/npf/npf_if.c: revision 1.10 sys/net/npf/npf_worker.c: revision 1.7 usr.sbin/npf/npf-params.7: revision 1.3 npf-params(7): add more bpf.jit details. From David H. Gutteridge. Adjust some internal NPF APIs: * npfkern: use the npfk_ prefix. * NPF portmap: amend the API so it could be used elsewhere. * Make npf_connkey_t public. npf.7: add xref to npf-params.7 (Adding directly here since this particular file isn't included in rmind@'s upstream GitHub repo at present.)
Adjust some internal NPF APIs: * npfkern: use the npfk_ prefix. * NPF portmap: amend the API so it could be used elsewhere. * Make npf_connkey_t public.
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
Sync with HEAD
Sync with HEAD
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
Ssync with HEAD
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
Sync with HEAD
Sync with HEAD
fix function argument.
Sync with HEAD. (Note that most of these changes are simply $NetBSD$ tag issues.)
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
Rebase to HEAD as of a few days ago.
- Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
Rebase.
NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
npftest: add some concurrency testing code.
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
resync with head
npftest/npf_blockall_rule: set NPF_RULE_DYNAMIC flag for the test rule.
Pull up following revision(s) (requested by rmind in ticket #829): usr.sbin/npf/npfctl/npfctl.8: revision 1.13 usr.sbin/npf/npfctl/npf_build.c: revision 1.21 lib/libnpf/npf.c: revision 1.18 sys/net/npf/npf_ctl.c: revision 1.23 usr.sbin/npf/npfctl/npfctl.h: revision 1.27 lib/libnpf/npf.h: revision 1.15 sys/net/npf/npf_ruleset.c: revision 1.19 sys/net/npf/npf_impl.h: revision 1.28 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.17 usr.sbin/npf/npfctl/npfctl.c: revision 1.31 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.6 - Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
Pull up following revision(s) (requested by rmind in ticket #817): usr.sbin/npf/npfctl/npfctl.8: revision 1.12 usr.sbin/npf/npfctl/npf.conf.5: revision 1.27 usr.sbin/npf/npfctl/npf_parse.y: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.20 usr.sbin/npf/npfctl/npfctl.c: revision 1.28 lib/libnpf/npf.c: revision 1.16 usr.sbin/npf/npfctl/npfctl.c: revision 1.29 lib/libnpf/npf.c: revision 1.17 sys/modules/npf/Makefile: revision 1.12 sys/net/npf/npf_rproc.c: revision 1.6 usr.sbin/npf/npftest/README: revision 1.4 sys/net/npf/npf_tableset.c: revision 1.17 sys/net/npf/npf_ctl.c: revision 1.21 sys/net/npf/npf_ctl.c: revision 1.22 usr.sbin/npf/npfctl/npfctl.h: revision 1.25 lib/libnpf/npf.h: revision 1.13 usr.sbin/npf/npftest/npftest.conf: revision 1.2 usr.sbin/npf/npfctl/npfctl.h: revision 1.26 sys/net/npf/npf_ruleset.c: revision 1.17 lib/libnpf/npf.h: revision 1.14 sys/net/npf/npf_ruleset.c: revision 1.18 sys/net/npf/npf_conf.c: revision 1.1 usr.sbin/npf/npfctl/npf_scan.l: revision 1.10 sys/net/npf/npf_conf.c: revision 1.2 sys/net/npf/npf_instr.c: revision 1.16 sys/net/npf/npf_handler.c: revision 1.26 sys/net/npf/npf_impl.h: revision 1.26 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14 sys/net/npf/npf_processor.c: revision 1.15 sys/net/npf/npf_impl.h: revision 1.27 sys/net/npf/npf_alg_icmp.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15 usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16 sys/net/npf/npf_ncode.h: revision 1.11 sys/net/npf/files.npf: revision 1.10 usr.sbin/npf/npftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.c: revision 1.30 lib/libnpf/npf.3: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4 sys/net/npf/npf_session.c: revision 1.21 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5 usr.sbin/npf/npfctl/npf_build.c: revision 1.18 usr.sbin/npf/npfctl/npf_build.c: revision 1.19 sys/net/npf/npf_alg.c: revision 1.7 usr.sbin/npf/npfctl/Makefile: revision 1.10 sys/net/npf/npf_inet.c: revision 1.21 sys/net/npf/npf.h: revision 1.26 sys/net/npf/npf.h: revision 1.27 usr.sbin/pf/ftp-proxy/Makefile: revision 1.8 sys/net/npf/npf_nat.c: revision 1.19 sys/net/npf/npf.c: revision 1.15 sys/net/npf/npf_state.c: revision 1.14 sys/net/npf/npf_sendpkt.c: revision 1.14 sys/rump/net/lib/libnpf/Makefile: revision 1.4 IPv6 linklocal address printing cosmetics NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version. Disable -DWITH_NPF for now; will be converted to BPF mechanism. - Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset. Allow filtering on IP addresses even if the L4 protocol is unknown. Patch from spz@. npftest: adjust for recent change.
npftest: adjust for recent change.
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
Pull up following revision(s) (requested by rmind in ticket #777): usr.sbin/npf/npfctl/npfctl.c: revision 1.27 sys/net/npf/npf_session.c: revision 1.19 usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.4 sys/net/npf/npf_rproc.c: revision 1.5 usr.sbin/npf/npftest/README: revision 1.3 sys/sys/mbuf.h: revision 1.151 sys/net/npf/npf_ruleset.c: revision 1.15 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.3 sys/net/npf/npf_ruleset.c: revision 1.16 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.4 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.4 sys/net/npf/npf_inet.c: revision 1.19 sys/net/npf/npf_instr.c: revision 1.15 sys/net/npf/npf_handler.c: revision 1.24 sys/net/npf/npf_handler.c: revision 1.25 sys/net/npf/npf_state_tcp.c: revision 1.12 sys/net/npf/npf_processor.c: revision 1.13 sys/net/npf/npf_impl.h: revision 1.25 sys/net/npf/npf_processor.c: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.10 sys/net/npf/npf_alg_icmp.c: revision 1.14 sys/net/npf/npf_mbuf.c: revision 1.9 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.3 sys/net/npf/npf_session.c: revision 1.20 sys/net/npf/npf_alg.c: revision 1.6 sys/kern/uipc_mbuf.c: revision 1.148 sys/net/npf/npf_inet.c: revision 1.20 sys/net/npf/npf.h: revision 1.25 sys/net/npf/npf_nat.c: revision 1.18 sys/net/npf/npf_state.c: revision 1.13 sys/net/npf/npf_sendpkt.c: revision 1.13 sys/net/npf/npf_ext_log.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.4 sys/net/npf/npf_ext_normalise.c: revision 1.2 - Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup. Silence gcc in npf_recache(). Add m_ensure_contig() routine, which is equivalent to m_pullup, but does not destroy the mbuf chain on failure (it is kept valid). - nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free the mbuf chain on failure. Fixes some corner cases. Improve regression test and sprinkle some asserts. - npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix). The problem was found and fix provided by Anthony Mallet.
sync with head
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
Pull up following revision(s) (requested by rmind in ticket #679): sys/net/npf/npf_session.c: revision 1.18 usr.sbin/npf/npftest/npftest.c: revision 1.6 usr.sbin/npf/npftest/npftest.c: revision 1.7 usr.sbin/npf/npftest/npftest.c: revision 1.8 usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.2 usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.5 sys/net/npf/npf_alg_icmp.c: revision 1.13 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.2 usr.sbin/npf/npftest/npfstream.c: revision 1.4 usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.3 npftest: - Do not stop running other tests, if some tests fail. - Fix some endianness bugs in the test cases. Tested on sparc64 by martin@, all tests pass. Add two new command line options to help integration into ATF: -L lists the available test cases, -T executes a single named test. Fix printf format Mark npf_session_worker as __dead. More __dead npf_icmp_uniqid: split into npf_icmp_uniqid4() and npf_icmp_uniqid6() parts.
sync with head
file npf_rule_test.c was added on branch yamt-pagecache on 2012-10-30 19:00:48 +0000
npftest: - Do not stop running other tests, if some tests fail. - Fix some endianness bugs in the test cases. Tested on sparc64 by martin@, all tests pass.
Pull up following revision(s) (requested by rmind in ticket #485): lib/libnpf/npf.c: revision 1.11 sys/net/npf/npf_session.c: revision 1.17 sys/modules/npf/Makefile: revision 1.10 usr.sbin/npf/npftest/npftest.c: revision 1.4 usr.sbin/npf/npftest/README: revision 1.1 sys/net/npf/npf_tableset.c: revision 1.14 usr.sbin/npf/npftest/npftest.h: revision 1.4 lib/libnpf/npf.h: revision 1.10 sys/net/npf/npf_ruleset.c: revision 1.14 usr.sbin/npf/npfctl/npf_data.c: revision 1.18 usr.sbin/npf/npftest/npftest.conf: revision 1.1 sys/net/npf/npf_handler.c: revision 1.21 sys/net/npf/npf_impl.h: revision 1.21 usr.sbin/npf/npfctl/npfctl.c: revision 1.18 usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1 usr.sbin/npf/npfctl/npf_build.c: revision 1.13 usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1 usr.sbin/npf/npftest/npfstream.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4 usr.sbin/npf/npfctl/npfctl.h: revision 1.19 sys/net/npf/npf_nat.c: revision 1.16 sys/net/npf/npf_state.c: revision 1.11 usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3 usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5 usr.sbin/npf/npfctl/npf_parse.y: revision 1.12 - Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
file npf_rule_test.c was added on branch netbsd-6 on 2012-08-13 17:49:53 +0000
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.