#
1.52 |
|
08-Aug-2023 |
riastradh |
libnpf(3): No need for weird padding any more.
cdbw_output never needed it at runtime, and the declaration no longer makes gcc angry about not having it.
|
#
1.51 |
|
01-Aug-2023 |
mrg |
cdbw_output()'s 3rd argument must be a 16-byte char array, so pad the string literals passed to it with enough nuls to make this true.
found by GCC 12.
|
Revision tags: netbsd-10-base
|
#
1.50 |
|
07-Jun-2022 |
christos |
Add method to initialize errinfo so that npfctl does not print random strings.
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base
|
#
1.49 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.48 |
|
30-Sep-2019 |
rmind |
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
branches: 1.46.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.51 |
|
01-Aug-2023 |
mrg |
cdbw_output()'s 3rd argument must be a 16-byte char array, so pad the string literals passed to it with enough nuls to make this true.
found by GCC 12.
|
Revision tags: netbsd-10-base
|
#
1.50 |
|
07-Jun-2022 |
christos |
Add method to initialize errinfo so that npfctl does not print random strings.
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base
|
#
1.49 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.48 |
|
30-Sep-2019 |
rmind |
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
branches: 1.46.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.50 |
|
07-Jun-2022 |
christos |
Add method to initialize errinfo so that npfctl does not print random strings.
|
Revision tags: cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base
|
#
1.49 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.48 |
|
30-Sep-2019 |
rmind |
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
branches: 1.46.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.49 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.48 |
|
30-Sep-2019 |
rmind |
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
branches: 1.46.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.48 |
|
30-Sep-2019 |
rmind |
libnpf/npfctl: support dynamic NAT rulesets using a name prefix.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
branches: 1.46.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.47 |
|
21-Aug-2019 |
rmind |
npfkern/libnpf: Add support for the table replace/swap operation. Contributed by Timshel Knoll-Miller.
|
Revision tags: netbsd-9-base
|
#
1.46 |
|
23-Jul-2019 |
rmind |
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.46 |
|
23-Jul-2019 |
rmind |
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; 1.43.14; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
Revision tags: pgoyette-compat-20190127
|
#
1.45 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.44 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
branches: 1.43.12; set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
Revision tags: pgoyette-localcount-20170107
|
#
1.43 |
|
03-Jan-2017 |
christos |
set to NULL after releasing to avoid double free.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
branches: 1.35.2; libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|
#
1.42 |
|
27-Dec-2016 |
rmind |
KNF
|
#
1.41 |
|
27-Dec-2016 |
christos |
Add a function to iterate over endpoints
|
#
1.40 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
#
1.39 |
|
10-Dec-2016 |
christos |
use array notation
|
#
1.38 |
|
10-Dec-2016 |
christos |
update for v18 conn list; more error checks
|
#
1.37 |
|
10-Dec-2016 |
kre |
Remove what was probably a left over remnant of a debugging printf which was incompletely deleted. Hopefully fix the build.
|
#
1.36 |
|
10-Dec-2016 |
christos |
add npf_nat_lookup()
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.35 |
|
02-Feb-2015 |
rmind |
libnpf: add npf_rule_getid() and npf_rule_getcode(). Missed in the previous commit.
|
#
1.34 |
|
24-Aug-2014 |
rmind |
npf_config_submit: finally, include the saved connections.
|
#
1.33 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-maxphys-base
|
#
1.32 |
|
10-Aug-2014 |
rmind |
branches: 1.32.2; - Add npf_ruleset_export(), npf_rule_export() and npf_nat_policyexport(). - Split off npf_conn_export(). Add npf_ifmap_getname() and use it to save the interface name; pick it up on npf_conn_import(). - Misc fixes. Bump NPF_VERSION.
|
Revision tags: tls-earlyentropy-base
|
#
1.31 |
|
23-Jul-2014 |
htodd |
Build fix (use error when defined).
|
#
1.30 |
|
23-Jul-2014 |
rmind |
NPF: rework of the connection saving and restoring: - Add support for saving a snapshot of the current connections together with a full configuration. Support a reverse load operation. Eliminate the old 'sess-save' and 'sess-load' in favour of the new mechanism. - Share code between load and reload operations: the latter performs load from npf.conf without affecting the connections. - Simplify and fix races with connection loading. - Bump NPF_VERSION.
|
#
1.29 |
|
19-May-2014 |
jakllsch |
add npf_ext_param_string()
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.28 |
|
13-Feb-2014 |
rmind |
branches: 1.28.2; NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. Add a unit test. Also, bump NPF_VERSION.
Thanks to S.P.Zeidler for the help with NPTv6 work!
|
#
1.27 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.26 |
|
06-Feb-2014 |
rmind |
Add support for CDB based NPF tables.
|
#
1.25 |
|
03-Feb-2014 |
rmind |
- npfctl: fix table IDs (breakage since the table naming was added). - libnpf: remove npf_table_exists_p() from public API.
|
#
1.24 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.23 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.22 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.21 |
|
19-Sep-2013 |
rmind |
NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
#
1.20 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base agc-symver-base
|
#
1.19 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.18 |
|
16-Feb-2013 |
rmind |
- Convert NPF dynamic rule ID to just incremented 64-bit counter. - Fix multiple bugs. Also, update the man page.
|
#
1.17 |
|
10-Feb-2013 |
rmind |
- Fix NPF config reload with dynamic rules present. - Implement list and flush commands on a dynamic ruleset.
|
#
1.16 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.15 |
|
23-Dec-2012 |
rmind |
- Add NPF version check in proplist as well, not only ioctl. Bump the version. - Fix a bug in table entry lookup. - Updates/fixes to the man pages. Misc.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.14 |
|
28-Oct-2012 |
rmind |
Fix for npfctl show case. Improve some description while here.
|
#
1.13 |
|
16-Sep-2012 |
rmind |
Implement dynamic NPF extensions interface. An extension consists of dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
|
#
1.12 |
|
15-Aug-2012 |
rmind |
branches: 1.12.2; - {npf_mk_rproc,npf_nat_save}: fix the fetching of {rproc-ptr,id_ptr}. - npf_rproc_setlog: initialise variables to 0, as keys may not exist.
Bugs found by mlelstv@ while testing on Amiga.
|
#
1.11 |
|
12-Aug-2012 |
rmind |
- Extend npftest: add ruleset inspection testing from the config generated by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
|
#
1.10 |
|
15-Jul-2012 |
rmind |
- Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.9 |
|
01-Jul-2012 |
rmind |
NPF improvements: - Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
|
Revision tags: yamt-pagecache-base5 yamt-pagecache-base4
|
#
1.8 |
|
01-Apr-2012 |
rmind |
Add NPF config retrieval routines.
|
Revision tags: netbsd-6-base
|
#
1.7 |
|
05-Feb-2012 |
rmind |
branches: 1.7.2; Multiple NPF fixes, add better error reporting from kernel side, add some asserts, bump the version.
|
#
1.6 |
|
15-Jan-2012 |
rmind |
- Expire all sessions on flush. - Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
|
#
1.5 |
|
26-Nov-2011 |
christos |
- consistency with types - prefer sizeof(*var)
|
#
1.4 |
|
26-Nov-2011 |
rmind |
Add _npf_config_setsubmit() function.
|
Revision tags: yamt-pagecache-base3 yamt-pagecache-base2
|
#
1.3 |
|
04-Nov-2011 |
zoltan |
Add IPv6 support for NPF.
|
Revision tags: yamt-pagecache-base cherry-xenmp-base bouyer-quota2-base bouyer-quota2-nbase
|
#
1.2 |
|
02-Feb-2011 |
rmind |
branches: 1.2.2; 1.2.6; npf_nat_create: fix attributes.
|
#
1.1 |
|
02-Feb-2011 |
rmind |
NPF checkpoint: - Add libnpf(3) - a library to control NPF (configuration, ruleset, etc). - Add NPF support for ftp-proxy(8). - Add rc.d script for NPF. - Convert npfctl(8) to use libnpf(3) and thus make it less depressive. Note: next clean-up step should be a parser, once dholland@ will finish it. - Add more documentation. - Various fixes.
|