#
1.33 |
|
01-Aug-2023 |
andvar |
fix RCSIDs.
|
Revision tags: netbsd-10-base cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 cjep_staticlib_x-base
|
#
1.32 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
#
1.31 |
|
23-May-2020 |
rmind |
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9), instead of incorrectly assuming that the handler always runs at IPL_SOFNET. Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not wait for reference draining on destruction; destroy the policy on the last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.30 |
|
01-Nov-2019 |
christos |
PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
|
#
1.29 |
|
10-Aug-2019 |
rmind |
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
|
Revision tags: netbsd-9-base
|
#
1.28 |
|
23-Jul-2019 |
rmind |
branches: 1.28.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.32 |
|
30-May-2020 |
rmind |
Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages.
- Amend and improve the manual pages.
|
#
1.31 |
|
23-May-2020 |
rmind |
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9), instead of incorrectly assuming that the handler always runs at IPL_SOFNET. Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not wait for reference draining on destruction; destroy the policy on the last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.30 |
|
01-Nov-2019 |
christos |
PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
|
#
1.29 |
|
10-Aug-2019 |
rmind |
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
|
Revision tags: netbsd-9-base
|
#
1.28 |
|
23-Jul-2019 |
rmind |
branches: 1.28.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.31 |
|
23-May-2020 |
rmind |
Backport selected NPF fixes from the upstream (to be pulled up):
- npf_conndb_lookup: protect the connection lookup with pserialize(9), instead of incorrectly assuming that the handler always runs at IPL_SOFNET. Should fix crashes reported on high load (PR/55182).
- npf_config_destroy: handle partially initialized config; fixes crashes with some invalid configurations.
- NAT policy creation / destruction: set the initial reference and do not wait for reference draining on destruction; destroy the policy on the last reference drop instead. Fixes a lockup with the dynamic NAT rules.
- npf_nat_{export,import}: fix a regression since dynamic NAT rules.
- npfctl: fix a regression and restore the default group behaviour.
- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
|
Revision tags: phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 phil-wifi-20191119
|
#
1.30 |
|
01-Nov-2019 |
christos |
PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
|
#
1.29 |
|
10-Aug-2019 |
rmind |
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
|
Revision tags: netbsd-9-base
|
#
1.28 |
|
23-Jul-2019 |
rmind |
branches: 1.28.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-2-RELEASE netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.30 |
|
01-Nov-2019 |
christos |
PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump buffer size.
|
#
1.29 |
|
10-Aug-2019 |
rmind |
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
|
Revision tags: netbsd-9-base
|
#
1.28 |
|
23-Jul-2019 |
rmind |
branches: 1.28.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.29 |
|
10-Aug-2019 |
rmind |
npfctl show/validate: fix couple bugs in multiple table/port representation. Fixes PR/54122.
|
Revision tags: netbsd-9-base
|
#
1.28 |
|
23-Jul-2019 |
rmind |
branches: 1.28.2; NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.28 |
|
23-Jul-2019 |
rmind |
NPF improvements: - Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
Revision tags: phil-wifi-20190609 pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; 1.25.4; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-1-RELEASE netbsd-8-1-RC1 netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
Revision tags: pgoyette-compat-20190127
|
#
1.27 |
|
19-Jan-2019 |
rmind |
Major NPF improvements: - Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
|
Revision tags: pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930
|
#
1.26 |
|
29-Sep-2018 |
rmind |
NPF: Major rework -- migrate NPF to the libnv library. - This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either.
Thanks to christos@ for extra testing.
|
Revision tags: pgoyette-compat-0906 pgoyette-compat-0728 phil-wifi-base pgoyette-compat-0625 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 pgoyette-compat-base
|
#
1.25 |
|
10-Dec-2017 |
rmind |
branches: 1.25.2; npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: netbsd-8-0-RELEASE netbsd-8-0-RC2 netbsd-8-0-RC1 matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.25 |
|
10-Dec-2017 |
rmind |
npfctl: add support for the 'no-ports' flag in the 'map' statements. This allows us to create a NAT policy without the port translation.
|
Revision tags: matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
branches: 1.23.2; Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.24 |
|
14-May-2017 |
christos |
don't print decimal and parse hex!
|
Revision tags: prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320
|
#
1.23 |
|
29-Jan-2017 |
christos |
Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
branches: 1.22.2; Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.23 |
|
29-Jan-2017 |
christos |
Always print the rule id associated with a rule.
|
Revision tags: bouyer-socketcan-base pgoyette-localcount-20170107
|
#
1.22 |
|
29-Dec-2016 |
rmind |
Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
branches: 1.19.2; npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|
#
1.22 |
|
29-Dec-2016 |
rmind |
Improve 'npfctl debug' a little bit.
|
#
1.21 |
|
27-Dec-2016 |
christos |
Add a list command to iterate over connection and nat endpoints.
|
#
1.20 |
|
26-Dec-2016 |
christos |
Sync NPF with the version on github: backport standalone NPF changes, which allow us to create and run separate NPF instances. Minor fixes. (from rmind@)
|
Revision tags: pgoyette-localcount-20161104 localcount-20160914 pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base
|
#
1.19 |
|
03-Jun-2015 |
rmind |
npfctl: fix the from/to port mess up when showing the rules.
|
#
1.18 |
|
21-Mar-2015 |
rmind |
npfctl: - Fix the filter criteria when to/from is omitted but port used. - Print more user-friendly error if an NPF table has a duplicate entry.
|
#
1.17 |
|
02-Feb-2015 |
rmind |
npfctl_print_rule: print the ID in hex, not decimal.
|
#
1.16 |
|
02-Feb-2015 |
rmind |
npfctl(8): report dynamic rule ID in a comment, print the case when libpcap is used correctly. Also, add npf_ruleset_dump() helper in the kernel.
|
Revision tags: tls-maxphys-base netbsd-7-base tls-earlyentropy-base
|
#
1.15 |
|
20-Jul-2014 |
rmind |
branches: 1.15.2; 1.15.4; formatting
|
#
1.14 |
|
31-May-2014 |
rmind |
npfctl_build_code: generate TCP/UDP check for ports case when other blocks do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
|
Revision tags: yamt-pagecache-base9 riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3
|
#
1.13 |
|
14-Mar-2014 |
rmind |
branches: 1.13.2; 1.13.4; NPF: add support for "stateful-ends".
|
#
1.12 |
|
19-Feb-2014 |
rmind |
npfctl_print_nat: fix the byte-order of the port.
|
#
1.11 |
|
12-Feb-2014 |
rmind |
npfctl_print_table: add a "cdb" type.
|
#
1.10 |
|
08-Feb-2014 |
rmind |
NPF: - Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
|
#
1.9 |
|
07-Feb-2014 |
rmind |
NPF: add support for static (stateless) NAT.
|
#
1.8 |
|
22-Nov-2013 |
rmind |
npfctl: need to rewind the list after calling print_table(). XXX libnpf.
|
#
1.7 |
|
22-Nov-2013 |
rmind |
Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, as they can change on reload now. Also, fix table name checking in npfctl.
|
#
1.6 |
|
19-Nov-2013 |
christos |
CID 1129614: dereference after null
|
#
1.5 |
|
19-Nov-2013 |
rmind |
Simplify parsing of npf.conf elements, create the npfvar_t when a value is parsed (to be used as a general structured for variables and inlined values), few misc improvements.
|
#
1.4 |
|
12-Nov-2013 |
rmind |
NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).
Few misc fixes. Bump NPF_VERSION.
|
#
1.3 |
|
08-Nov-2013 |
rmind |
NPF: add support for specifying the interfaces before they are attached. If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active.
Bump NPF_VERSION.
|
#
1.2 |
|
20-Sep-2013 |
rmind |
- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. - Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
|
#
1.1 |
|
19-Sep-2013 |
rmind |
- Convert NPF to use BPF byte-code by default. Compile BPF byte-code in npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
|