#
1.22 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
Revision tags: bouyer-xenpvh-base2 phil-wifi-20200421 bouyer-xenpvh-base1 phil-wifi-20200411 bouyer-xenpvh-base is-mlppp-base phil-wifi-20200406 ad-namecache-base3 ad-namecache-base2 ad-namecache-base1 ad-namecache-base phil-wifi-20191119
|
#
1.21 |
|
25-Aug-2019 |
rmind |
- npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
|
Revision tags: netbsd-9-base
|
#
1.20 |
|
23-Jul-2019 |
rmind |
branches: 1.20.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 isaki-audio2-base pgoyette-compat-20190127
|
#
1.19 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.18 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
#
1.17 |
|
12-Sep-2018 |
christos |
Fix lockdebug diagnostic error of trying to acquire an rw_lock from a pserialized active context. From riastradh@
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base tls-maxphys-base-20171202 matt-nb8-mediatek-base nick-nhusb-base-20170825 perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 jdolecek-ncq-base pgoyette-localcount-20170320 nick-nhusb-base-20170204 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.16 |
|
26-Dec-2016 |
christos |
branches: 1.16.14; 1.16.16; Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: nick-nhusb-base-20161204 pgoyette-localcount-20161104 nick-nhusb-base-20161004 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 nick-nhusb-base-20150921 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base
|
#
1.15 |
|
11-Aug-2014 |
rmind |
branches: 1.15.2; 1.15.4; - Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.14 |
|
20-Jul-2014 |
rmind |
branches: 1.14.2; NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
|
#
1.13 |
|
19-Jul-2014 |
rmind |
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 rmind-smpnet-nbase rmind-smpnet-base
|
#
1.12 |
|
17-Feb-2014 |
rmind |
branches: 1.12.2; npf_alg_session: fix inverted logic in the previous commit.
|
#
1.11 |
|
16-Feb-2014 |
rmind |
NPF: pass ALG functions via npfa_funcs_t structure.
|
#
1.10 |
|
06-Dec-2013 |
rmind |
NPF: - Adjust NAT to not assume flow direction in some cases and thus support less usual setups which are possible when using 'map' with a custom filter criteria. - Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2] for more convenient handling. - ICMP ALG: restrict matching only to the outgoing traffic, but be more direction-agnostic elsewhere.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base
|
#
1.9 |
|
02-Jun-2013 |
rmind |
branches: 1.9.2; - NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
|
Revision tags: agc-symver-base
|
#
1.8 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.7 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.6 |
|
24-Dec-2012 |
rmind |
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.5 |
|
15-Jul-2012 |
rmind |
branches: 1.5.2; - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.4 |
|
22-Jun-2012 |
rmind |
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
|
Revision tags: jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3
|
#
1.3 |
|
20-Feb-2012 |
rmind |
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the packet handler. Change the default policy to block when the config is loaded and set it to pass when flush operation is performed. - Use kmem_zalloc(9) instead of kmem_alloc(9) in few places. - npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction of rule procedure might happen in the interrupt handler (under a very rare condition, if config reload races with the handler). - npf_session_establish: check whether layer 3 and 4 are cached. - npfctl_build_group: do not make groups as passing rules. - Remove some unecessary header inclusion.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base2 netbsd-6-base jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base rmind-uvmplock-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231
|
#
1.2 |
|
11-Nov-2010 |
rmind |
branches: 1.2.6; 1.2.10; 1.2.14; 1.2.16; NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
|
Revision tags: uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11
|
#
1.1 |
|
22-Aug-2010 |
rmind |
branches: 1.1.2; 1.1.4; Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@
|
#
1.21 |
|
25-Aug-2019 |
rmind |
- npfctl_load_nvlist: simplify the config loading logic. - Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
|
Revision tags: netbsd-9-base
|
#
1.20 |
|
23-Jul-2019 |
rmind |
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 isaki-audio2-base pgoyette-compat-20190127
|
#
1.19 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.18 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
#
1.17 |
|
12-Sep-2018 |
christos |
Fix lockdebug diagnostic error of trying to acquire an rw_lock from a pserialized active context. From riastradh@
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base tls-maxphys-base-20171202 matt-nb8-mediatek-base nick-nhusb-base-20170825 perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 jdolecek-ncq-base pgoyette-localcount-20170320 nick-nhusb-base-20170204 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.16 |
|
26-Dec-2016 |
christos |
branches: 1.16.14; 1.16.16; Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: nick-nhusb-base-20161204 pgoyette-localcount-20161104 nick-nhusb-base-20161004 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 nick-nhusb-base-20150921 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base
|
#
1.15 |
|
11-Aug-2014 |
rmind |
branches: 1.15.2; 1.15.4; - Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.14 |
|
20-Jul-2014 |
rmind |
branches: 1.14.2; NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
|
#
1.13 |
|
19-Jul-2014 |
rmind |
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 rmind-smpnet-nbase rmind-smpnet-base
|
#
1.12 |
|
17-Feb-2014 |
rmind |
branches: 1.12.2; npf_alg_session: fix inverted logic in the previous commit.
|
#
1.11 |
|
16-Feb-2014 |
rmind |
NPF: pass ALG functions via npfa_funcs_t structure.
|
#
1.10 |
|
06-Dec-2013 |
rmind |
NPF: - Adjust NAT to not assume flow direction in some cases and thus support less usual setups which are possible when using 'map' with a custom filter criteria. - Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2] for more convenient handling. - ICMP ALG: restrict matching only to the outgoing traffic, but be more direction-agnostic elsewhere.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base
|
#
1.9 |
|
02-Jun-2013 |
rmind |
branches: 1.9.2; - NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
|
Revision tags: agc-symver-base
|
#
1.8 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.7 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.6 |
|
24-Dec-2012 |
rmind |
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.5 |
|
15-Jul-2012 |
rmind |
branches: 1.5.2; - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.4 |
|
22-Jun-2012 |
rmind |
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
|
Revision tags: jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3
|
#
1.3 |
|
20-Feb-2012 |
rmind |
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the packet handler. Change the default policy to block when the config is loaded and set it to pass when flush operation is performed. - Use kmem_zalloc(9) instead of kmem_alloc(9) in few places. - npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction of rule procedure might happen in the interrupt handler (under a very rare condition, if config reload races with the handler). - npf_session_establish: check whether layer 3 and 4 are cached. - npfctl_build_group: do not make groups as passing rules. - Remove some unecessary header inclusion.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base2 netbsd-6-base jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base rmind-uvmplock-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231
|
#
1.2 |
|
11-Nov-2010 |
rmind |
branches: 1.2.6; 1.2.10; 1.2.14; 1.2.16; NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
|
Revision tags: uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11
|
#
1.1 |
|
22-Aug-2010 |
rmind |
branches: 1.1.2; 1.1.4; Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@
|
#
1.20 |
|
23-Jul-2019 |
rmind |
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 isaki-audio2-base pgoyette-compat-20190127
|
#
1.19 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.18 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
#
1.17 |
|
12-Sep-2018 |
christos |
Fix lockdebug diagnostic error of trying to acquire an rw_lock from a pserialized active context. From riastradh@
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base tls-maxphys-base-20171202 matt-nb8-mediatek-base nick-nhusb-base-20170825 perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 jdolecek-ncq-base pgoyette-localcount-20170320 nick-nhusb-base-20170204 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.16 |
|
26-Dec-2016 |
christos |
branches: 1.16.14; 1.16.16; Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: nick-nhusb-base-20161204 pgoyette-localcount-20161104 nick-nhusb-base-20161004 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 nick-nhusb-base-20150921 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base
|
#
1.15 |
|
11-Aug-2014 |
rmind |
branches: 1.15.2; 1.15.4; - Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.14 |
|
20-Jul-2014 |
rmind |
branches: 1.14.2; NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
|
#
1.13 |
|
19-Jul-2014 |
rmind |
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 rmind-smpnet-nbase rmind-smpnet-base
|
#
1.12 |
|
17-Feb-2014 |
rmind |
branches: 1.12.2; npf_alg_session: fix inverted logic in the previous commit.
|
#
1.11 |
|
16-Feb-2014 |
rmind |
NPF: pass ALG functions via npfa_funcs_t structure.
|
#
1.10 |
|
06-Dec-2013 |
rmind |
NPF: - Adjust NAT to not assume flow direction in some cases and thus support less usual setups which are possible when using 'map' with a custom filter criteria. - Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2] for more convenient handling. - ICMP ALG: restrict matching only to the outgoing traffic, but be more direction-agnostic elsewhere.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base
|
#
1.9 |
|
02-Jun-2013 |
rmind |
branches: 1.9.2; - NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
|
Revision tags: agc-symver-base
|
#
1.8 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.7 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.6 |
|
24-Dec-2012 |
rmind |
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.5 |
|
15-Jul-2012 |
rmind |
branches: 1.5.2; - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.4 |
|
22-Jun-2012 |
rmind |
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
|
Revision tags: jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3
|
#
1.3 |
|
20-Feb-2012 |
rmind |
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the packet handler. Change the default policy to block when the config is loaded and set it to pass when flush operation is performed. - Use kmem_zalloc(9) instead of kmem_alloc(9) in few places. - npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction of rule procedure might happen in the interrupt handler (under a very rare condition, if config reload races with the handler). - npf_session_establish: check whether layer 3 and 4 are cached. - npfctl_build_group: do not make groups as passing rules. - Remove some unecessary header inclusion.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base2 netbsd-6-base jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base rmind-uvmplock-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231
|
#
1.2 |
|
11-Nov-2010 |
rmind |
branches: 1.2.6; 1.2.10; 1.2.14; 1.2.16; NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
|
Revision tags: uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11
|
#
1.1 |
|
22-Aug-2010 |
rmind |
branches: 1.1.2; 1.1.4; Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@
|
Revision tags: isaki-audio2-base pgoyette-compat-20190127
|
#
1.19 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.18 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
#
1.17 |
|
12-Sep-2018 |
christos |
Fix lockdebug diagnostic error of trying to acquire an rw_lock from a pserialized active context. From riastradh@
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base tls-maxphys-base-20171202 matt-nb8-mediatek-base nick-nhusb-base-20170825 perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 jdolecek-ncq-base pgoyette-localcount-20170320 nick-nhusb-base-20170204 bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.16 |
|
26-Dec-2016 |
christos |
branches: 1.16.14; Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: nick-nhusb-base-20161204 pgoyette-localcount-20161104 nick-nhusb-base-20161004 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 nick-nhusb-base-20150921 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base
|
#
1.15 |
|
11-Aug-2014 |
rmind |
branches: 1.15.2; 1.15.4; - Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.14 |
|
20-Jul-2014 |
rmind |
branches: 1.14.2; NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
|
#
1.13 |
|
19-Jul-2014 |
rmind |
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 rmind-smpnet-nbase rmind-smpnet-base
|
#
1.12 |
|
17-Feb-2014 |
rmind |
branches: 1.12.2; npf_alg_session: fix inverted logic in the previous commit.
|
#
1.11 |
|
16-Feb-2014 |
rmind |
NPF: pass ALG functions via npfa_funcs_t structure.
|
#
1.10 |
|
06-Dec-2013 |
rmind |
NPF: - Adjust NAT to not assume flow direction in some cases and thus support less usual setups which are possible when using 'map' with a custom filter criteria. - Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2] for more convenient handling. - ICMP ALG: restrict matching only to the outgoing traffic, but be more direction-agnostic elsewhere.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base
|
#
1.9 |
|
02-Jun-2013 |
rmind |
branches: 1.9.2; - NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
|
Revision tags: agc-symver-base
|
#
1.8 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.7 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.6 |
|
24-Dec-2012 |
rmind |
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.5 |
|
15-Jul-2012 |
rmind |
branches: 1.5.2; - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.4 |
|
22-Jun-2012 |
rmind |
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
|
Revision tags: jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3
|
#
1.3 |
|
20-Feb-2012 |
rmind |
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the packet handler. Change the default policy to block when the config is loaded and set it to pass when flush operation is performed. - Use kmem_zalloc(9) instead of kmem_alloc(9) in few places. - npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction of rule procedure might happen in the interrupt handler (under a very rare condition, if config reload races with the handler). - npf_session_establish: check whether layer 3 and 4 are cached. - npfctl_build_group: do not make groups as passing rules. - Remove some unecessary header inclusion.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base2 netbsd-6-base jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base rmind-uvmplock-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231
|
#
1.2 |
|
11-Nov-2010 |
rmind |
branches: 1.2.6; 1.2.10; 1.2.14; 1.2.16; NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
|
Revision tags: uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11
|
#
1.1 |
|
22-Aug-2010 |
rmind |
branches: 1.1.2; 1.1.4; Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@
|
#
1.16 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: nick-nhusb-base-20161204 pgoyette-localcount-20161104 nick-nhusb-base-20161004 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base nick-nhusb-base-20160907 nick-nhusb-base-20160529 nick-nhusb-base-20160422 nick-nhusb-base-20160319 nick-nhusb-base-20151226 nick-nhusb-base-20150921 nick-nhusb-base-20150606 nick-nhusb-base-20150406 nick-nhusb-base
|
#
1.15 |
|
11-Aug-2014 |
rmind |
- Add and use npf_alg_export(). - npf_conn_import: handle NAT metadata correctly. - npf_nat_newpolicy: restore the policy ID. - npfctl_load: fix error code handling for the limit cases. - npf_config_import: fix the inverted logic. - npfctl_load: improve error handling.
|
Revision tags: netbsd-7-base tls-earlyentropy-base tls-maxphys-base
|
#
1.14 |
|
20-Jul-2014 |
rmind |
branches: 1.14.2; NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.
|
#
1.13 |
|
19-Jul-2014 |
rmind |
NPF: partially rewrite the connection tracking mechanism: - Separate the tracking interface from the storage (state table) and thus prepare to use a new data structure for the storage. - Fix some race conditions in NAT association logic.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 rmind-smpnet-nbase rmind-smpnet-base
|
#
1.12 |
|
17-Feb-2014 |
rmind |
branches: 1.12.2; npf_alg_session: fix inverted logic in the previous commit.
|
#
1.11 |
|
16-Feb-2014 |
rmind |
NPF: pass ALG functions via npfa_funcs_t structure.
|
#
1.10 |
|
06-Dec-2013 |
rmind |
NPF: - Adjust NAT to not assume flow direction in some cases and thus support less usual setups which are possible when using 'map' with a custom filter criteria. - Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2] for more convenient handling. - ICMP ALG: restrict matching only to the outgoing traffic, but be more direction-agnostic elsewhere.
|
Revision tags: riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base
|
#
1.9 |
|
02-Jun-2013 |
rmind |
branches: 1.9.2; - NPF connection tracking: rework synchronisation on tracking disable/enable points and document it. Split the worker thread into a separate module with an interface, so it could be re-used for other tasks. - Replace ALG list with arrays and thus hit fewer cache lines. - Misc bug fixes.
|
Revision tags: agc-symver-base
|
#
1.8 |
|
20-Mar-2013 |
christos |
Make ALG's autoloadable by providing in the config file: alg "algname"
|
#
1.7 |
|
09-Feb-2013 |
rmind |
NPF: - Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
|
Revision tags: yamt-pagecache-base8
|
#
1.6 |
|
24-Dec-2012 |
rmind |
- Rework NPF's nbuf interface: use advancing and ensuring as a main method. Eliminate unnecessary copy and simplify. Adapt regression tests. - Simplify ICMP ALG a little. While here, handle ICMP ECHO for traceroute. - Minor fixes, misc cleanup.
|
Revision tags: yamt-pagecache-base7 yamt-pagecache-base6
|
#
1.5 |
|
15-Jul-2012 |
rmind |
branches: 1.5.2; - Rework NPF tables and fix support for IPv6. Implement tree table type using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
|
#
1.4 |
|
22-Jun-2012 |
rmind |
NPF: - Rename some functions for consistency and de-inline them. - Fix few invalid asserts (add regressoin test). - Use pserialize(9) for ALG interface. - Minor fixes, sprinkle many comments.
|
Revision tags: jmcneill-usbmp-base10 yamt-pagecache-base5 jmcneill-usbmp-base9 yamt-pagecache-base4 jmcneill-usbmp-base8 jmcneill-usbmp-base7 jmcneill-usbmp-base6 jmcneill-usbmp-base5 jmcneill-usbmp-base4 jmcneill-usbmp-base3
|
#
1.3 |
|
20-Feb-2012 |
rmind |
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS. Be more defensive in the packet handler. Change the default policy to block when the config is loaded and set it to pass when flush operation is performed. - Use kmem_zalloc(9) instead of kmem_alloc(9) in few places. - npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction of rule procedure might happen in the interrupt handler (under a very rare condition, if config reload races with the handler). - npf_session_establish: check whether layer 3 and 4 are cached. - npfctl_build_group: do not make groups as passing rules. - Remove some unecessary header inclusion.
|
Revision tags: jmcneill-usbmp-pre-base2 jmcneill-usbmp-base2 netbsd-6-base jmcneill-usbmp-base jmcneill-audiomp3-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base rmind-uvmplock-nbase cherry-xenmp-base rmind-uvmplock-base bouyer-quota2-nbase bouyer-quota2-base jruoho-x86intr-base matt-mips64-premerge-20101231
|
#
1.2 |
|
11-Nov-2010 |
rmind |
branches: 1.2.6; 1.2.10; 1.2.14; 1.2.16; NPF checkpoint: - Add proper TCP state tracking as described in Guido van Rooij paper, plus handle TCP Window Scaling option. - Completely rework npf_cache_t, reduce granularity, simplify code. - Add npf_addr_t as an abstraction, amend session handling code, as well as NAT code et al, to use it. Now design is prepared for IPv6 support. - Handle IPv4 fragments i.e. perform packet reassembly. - Add support for IPv4 ID randomization and minimum TTL enforcement. - Add support for TCP MSS "clamping". - Random bits for IPv6. Various fixes and clean-up.
|
Revision tags: uebayasi-xip-base4 uebayasi-xip-base3 yamt-nfs-mp-base11
|
#
1.1 |
|
22-Aug-2010 |
rmind |
branches: 1.1.2; 1.1.4; Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT). Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF - supporting generic RISC-like and specific CISC-like instructions for common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter. Further work (support for binat/rdr, return-rst/return-icmp, common ALGs, state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review. Aye by: board@
|