| History log of /src/sys/modules/npf |
| Revision | Date | Author | Comments |
| 1.31 | 01-Jun-2025 |
joe | kernel: extract rules, lookup socket, process filtering, reviews by christos@
|
| 1.30 | 03-Jun-2023 |
lukem | branches: 1.30.6;
bsd.own.mk: rename to CC_WNO_ADDRESS_OF_PACKED_MEMBER
Provide a single variable
CC_WNO_ADDRESS_OF_PACKED_MEMBER
with options for both clang and gcc, to replace
CLANG_NO_ADDR_OF_PACKED_MEMBER
CC_NO_ADDR_OF_PACKED_MEMBER
GCC_NO_ADDR_OF_PACKED_MEMBER
Using the convention CC_compilerflag, where compilerflag
is based on the full compiler flag name.
|
| 1.29 | 29-May-2023 |
lukem | bsd.own.mk: rename NO_ADDR_OF_PACKED_MEMBER to CC_NO_ADDR_OF_PACKED_MEMBER
Add "CC_" prefix to NO_ADDR_OF_PACKED_MEMBER.
We now have the following convention:
GCC_NO_*: Disable specific warnings from GCC.
CLANG_NO_*: Disable specific warnings from Clang.
CC_NO_*: Disable specific warnings from both Clang and GCC.
This reserves "NO_*" Makefile variables to disable other features.
Some space->tab fixes.
|
| 1.28 | 18-Oct-2020 |
christos | Provide a global no-packed-address for both gcc and clang
|
| 1.27 | 18-Oct-2020 |
christos | use the GCC_ warning variable
|
| 1.26 | 18-Oct-2020 |
christos | Avoid alignment of packed member
|
| 1.25 | 26-Sep-2019 |
christos | kill WARNS = 3
|
| 1.24 | 24-Jul-2019 |
rmind | Update the NPF kernel module Makefile. Missed in the previous commit.
|
| 1.23 | 17-Feb-2019 |
rin | Bump default value of WARNS for modules from 3 to 5, and
explicitly set WARNS for modules that fail with WARNS=5.
Also, turn on -Wno-missing-noreturn for clang for some files.
At the moment, among ~ 360 modules,
- 2 (lua and zfs) need WARNS=0
- 1 (solaris) needs WARNS=1
- 136 need WARNS=3 (mostly due to sign-compare)
- 4 need WARNS=4
- others can be compiled with WARNS=5
Discussed on tech-kern.
|
| 1.22 | 29-Sep-2018 |
rmind | NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
previous versions. Also, different serialisation format means NPF
connection/config saving and loading is not compatible with the
previous versions either.
Thanks to christos@ for extra testing.
|
| 1.21 | 02-Jan-2017 |
rmind | branches: 1.21.14; 1.21.16;
NPF: implement dynamic handling of interface addresses (the kernel part).
|
| 1.20 | 28-Dec-2016 |
christos | oops forgot to commit this one.
|
| 1.19 | 09-Dec-2016 |
christos | ditch ptree and use lpm
|
| 1.18 | 20-Aug-2015 |
christos | branches: 1.18.2;
Add ioconf entries to the pseudo-devices.
|
| 1.17 | 19-Jul-2014 |
rmind | branches: 1.17.2; 1.17.4; 1.17.8;
NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.
|
| 1.16 | 08-Nov-2013 |
rmind | branches: 1.16.2;
NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections). Once the interface is reattached they will
become active.
Bump NPF_VERSION.
|
| 1.15 | 19-Sep-2013 |
rmind | NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!
|
| 1.14 | 19-Sep-2013 |
rmind | - Convert NPF to use BPF byte-code by default. Compile BPF byte-code in
npfctl(8) and generate separate marks to describe the filter criteria.
- Rewrite 'npfctl show' functionality and fix some of the bugs.
- npftest: add a test for BPF COP.
- Bump NPF_VERSION.
|
| 1.13 | 02-Jun-2013 |
rmind | branches: 1.13.2;
- NPF connection tracking: rework synchronisation on tracking disable/enable
points and document it. Split the worker thread into a separate module
with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.
|
| 1.12 | 09-Feb-2013 |
rmind | NPF:
- Implement dynamic NPF rules. Controlled through npf(3) library of via
npfctl rule command. A rule can be removed using a unique identifier,
returned on addition, or using a key which is SHA1 hash of the rule.
Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
|
| 1.11 | 16-Sep-2012 |
rmind | Implement dynamic NPF extensions interface. An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module. Move normalisation and logging functionality into their own
extensions. More improvements to come.
|
| 1.10 | 12-Aug-2012 |
rmind | branches: 1.10.2;
- Extend npftest: add ruleset inspection testing from the config generated
by npfctl debug functionality. Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
share between the entries and thus fix the handling of them. Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.
|
| 1.9 | 06-Feb-2012 |
rmind | branches: 1.9.2;
- Split NPF rule procedure code into a separate module (no functional changes).
- Simplify some code, add more comments, some asserts.
- G/C unused rule hook code.
|
| 1.8 | 29-Nov-2011 |
rmind | branches: 1.8.2;
- Rework and improve TCP state tracking.
- Fix regressions after IPv6 patch merge.
Note: npfctl(8) rework will come soon.
|
| 1.7 | 06-Nov-2011 |
tron | Fix breakage caused by last commit. "npf_alg_icmp.c" is supposed to be
its own kernel module.
|
| 1.6 | 06-Nov-2011 |
tron | Define "INET6" to get IPv6 support.
|
| 1.5 | 06-Nov-2011 |
tron | Update list of source files.
|
| 1.4 | 18-Dec-2010 |
rmind | branches: 1.4.6; 1.4.10;
NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.
|
| 1.3 | 11-Nov-2010 |
rmind | NPF checkpoint:
- Add proper TCP state tracking as described in Guido van Rooij paper,
plus handle TCP Window Scaling option.
- Completely rework npf_cache_t, reduce granularity, simplify code.
- Add npf_addr_t as an abstraction, amend session handling code, as well
as NAT code et al, to use it. Now design is prepared for IPv6 support.
- Handle IPv4 fragments i.e. perform packet reassembly.
- Add support for IPv4 ID randomization and minimum TTL enforcement.
- Add support for TCP MSS "clamping".
- Random bits for IPv6. Various fixes and clean-up.
|
| 1.2 | 16-Sep-2010 |
rmind | branches: 1.2.2; 1.2.4;
NPF checkpoint:
- Add support for bi-directional NAT and redirection / port forwarding.
- Finish filtering on ICMP type/code and add filtering on TCP flags.
- Add support for TCP reset (RST) or ICMP destination unreachable on block.
- Fix a bunch of bugs; misc cleanup.
|
| 1.1 | 22-Aug-2010 |
rmind | Import NPF - a packet filter. Some features:
- Designed to be fully MP-safe and highly efficient.
- Tables/IP sets (hash or red-black tree) for high performance lookups.
- Stateful filtering and Network Address Port Translation (NAPT).
Framework for application level gateways (ALGs).
- Packet inspection engine called n-code processor - inspired by BPF -
supporting generic RISC-like and specific CISC-like instructions for
common patterns (e.g. IPv4 address matching). See npf_ncode(9) manual.
- Convenient userland utility npfctl(8) with npf.conf(8).
NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.
Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@
|
| 1.2.4.2 | 22-Oct-2010 |
uebayasi | Sync with HEAD (-D20101022).
|
| 1.2.4.1 | 16-Sep-2010 |
uebayasi | file Makefile was added on branch uebayasi-xip on 2010-10-22 09:23:13 +0000
|
| 1.2.2.2 | 09-Oct-2010 |
yamt | sync with head
|
| 1.2.2.1 | 16-Sep-2010 |
yamt | file Makefile was added on branch yamt-nfs-mp on 2010-10-09 03:32:36 +0000
|
| 1.4.10.4 | 22-May-2014 |
yamt | sync with head.
for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid
a limitation of cvs. ("Protocol error: too many arguments")
|
| 1.4.10.3 | 30-Oct-2012 |
yamt | sync with head
|
| 1.4.10.2 | 17-Apr-2012 |
yamt | sync with head
|
| 1.4.10.1 | 10-Nov-2011 |
yamt | sync with head
|
| 1.4.6.2 | 05-Mar-2011 |
rmind | sync with head
|
| 1.4.6.1 | 18-Dec-2010 |
rmind | file Makefile was added on branch rmind-uvmplock on 2011-03-05 20:55:46 +0000
|
| 1.8.2.1 | 18-Feb-2012 |
mrg | merge to -current.
|
| 1.9.2.3 | 11-Feb-2013 |
riz | Pull up following revision(s) (requested by rmind in ticket #817):
usr.sbin/npf/npfctl/npfctl.8: revision 1.12
usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
usr.sbin/npf/npfctl/npf_build.c: revision 1.20
usr.sbin/npf/npfctl/npfctl.c: revision 1.28
lib/libnpf/npf.c: revision 1.16
usr.sbin/npf/npfctl/npfctl.c: revision 1.29
lib/libnpf/npf.c: revision 1.17
sys/modules/npf/Makefile: revision 1.12
sys/net/npf/npf_rproc.c: revision 1.6
usr.sbin/npf/npftest/README: revision 1.4
sys/net/npf/npf_tableset.c: revision 1.17
sys/net/npf/npf_ctl.c: revision 1.21
sys/net/npf/npf_ctl.c: revision 1.22
usr.sbin/npf/npfctl/npfctl.h: revision 1.25
lib/libnpf/npf.h: revision 1.13
usr.sbin/npf/npftest/npftest.conf: revision 1.2
usr.sbin/npf/npfctl/npfctl.h: revision 1.26
sys/net/npf/npf_ruleset.c: revision 1.17
lib/libnpf/npf.h: revision 1.14
sys/net/npf/npf_ruleset.c: revision 1.18
sys/net/npf/npf_conf.c: revision 1.1
usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
sys/net/npf/npf_conf.c: revision 1.2
sys/net/npf/npf_instr.c: revision 1.16
sys/net/npf/npf_handler.c: revision 1.26
sys/net/npf/npf_impl.h: revision 1.26
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
sys/net/npf/npf_processor.c: revision 1.15
sys/net/npf/npf_impl.h: revision 1.27
sys/net/npf/npf_alg_icmp.c: revision 1.15
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
sys/net/npf/npf_ncode.h: revision 1.11
sys/net/npf/files.npf: revision 1.10
usr.sbin/npf/npftest/Makefile: revision 1.4
usr.sbin/npf/npfctl/npfctl.c: revision 1.30
lib/libnpf/npf.3: revision 1.8
usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
sys/net/npf/npf_session.c: revision 1.21
usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
usr.sbin/npf/npfctl/npf_build.c: revision 1.18
usr.sbin/npf/npfctl/npf_build.c: revision 1.19
sys/net/npf/npf_alg.c: revision 1.7
usr.sbin/npf/npfctl/Makefile: revision 1.10
sys/net/npf/npf_inet.c: revision 1.21
sys/net/npf/npf.h: revision 1.26
sys/net/npf/npf.h: revision 1.27
usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
sys/net/npf/npf_nat.c: revision 1.19
sys/net/npf/npf.c: revision 1.15
sys/net/npf/npf_state.c: revision 1.14
sys/net/npf/npf_sendpkt.c: revision 1.14
sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules. Controlled through npf(3) library of via
npfctl rule command. A rule can be removed using a unique identifier,
returned on addition, or using a key which is SHA1 hash of the rule.
Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.
|
| 1.9.2.2 | 18-Nov-2012 |
riz | Pull up following revision(s) (requested by rmind in ticket #693):
lib/npf/ext_normalise/shlib_version: revision 1.1
lib/libnpf/npf.c: revision 1.13
distrib/sets/lists/modules/mi: revision 1.48
sys/net/npf/npf_rproc.c: revision 1.3
sys/net/npf/npf_rproc.c: revision 1.4
sys/modules/npf/Makefile: revision 1.11
usr.sbin/npf/npfctl/npfctl.h: revision 1.20
lib/npf/ext_log/npfext_log.c: revision 1.1
lib/libnpf/npf.h: revision 1.11
sys/net/npf/npf_inet.c: revision 1.17
sys/net/npf/npf_log.c: file removal
sys/net/npf/npf_handler.c: revision 1.22
distrib/sets/lists/base/shl.mi: revision 1.636
sys/net/npf/npf_impl.h: revision 1.23
usr.sbin/npf/npfctl/Makefile: revision 1.8
lib/npf/Makefile: revision 1.1
lib/npf/ext_log/shlib_version: revision 1.1
lib/Makefile: revision 1.189
distrib/sets/lists/comp/shl.mi: revision 1.236
usr.sbin/npf/npfctl/npf_build.c: revision 1.14
distrib/sets/lists/base/mi: revision 1.1007
usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
distrib/sets/lists/base/mi: revision 1.1009
sys/net/npf/npf.h: revision 1.21
lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
etc/mtree/NetBSD.dist.base: revision 1.105
lib/libnpf/Makefile: revision 1.3
etc/mtree/NetBSD.dist.base: revision 1.106
usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
sys/net/npf/npf_ctl.c: revision 1.18
lib/npf/ext_log/Makefile: revision 1.1
distrib/sets/lists/comp/mi: revision 1.1781
usr.sbin/npf/npfctl/npf_var.h: revision 1.4
sys/net/npf/npf.c: revision 1.13
sys/modules/Makefile: revision 1.111
sys/net/npf/npf_ext_log.c: revision 1.1
lib/npf/Makefile.inc: revision 1.1
sys/net/npf/npf_ext_normalise.c: revision 1.1
sys/net/npf/files.npf: revision 1.8
sys/rump/net/lib/libnpf/Makefile: revision 1.2
sys/modules/npf_ext_log/Makefile: revision 1.1
lib/npf/ext_normalise/Makefile: revision 1.1
usr.sbin/npf/npfctl/npfctl.c: revision 1.20
usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface. An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module. Move normalisation and logging functionality into their own
extensions. More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@
|
| 1.9.2.1 | 13-Aug-2012 |
riz | Pull up following revision(s) (requested by rmind in ticket #485):
lib/libnpf/npf.c: revision 1.11
sys/net/npf/npf_session.c: revision 1.17
sys/modules/npf/Makefile: revision 1.10
usr.sbin/npf/npftest/npftest.c: revision 1.4
usr.sbin/npf/npftest/README: revision 1.1
sys/net/npf/npf_tableset.c: revision 1.14
usr.sbin/npf/npftest/npftest.h: revision 1.4
lib/libnpf/npf.h: revision 1.10
sys/net/npf/npf_ruleset.c: revision 1.14
usr.sbin/npf/npfctl/npf_data.c: revision 1.18
usr.sbin/npf/npftest/npftest.conf: revision 1.1
sys/net/npf/npf_handler.c: revision 1.21
sys/net/npf/npf_impl.h: revision 1.21
usr.sbin/npf/npfctl/npfctl.c: revision 1.18
usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.1
usr.sbin/npf/npfctl/npf_build.c: revision 1.13
usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.1
usr.sbin/npf/npftest/npfstream.c: revision 1.3
usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.4
usr.sbin/npf/npfctl/npfctl.h: revision 1.19
sys/net/npf/npf_nat.c: revision 1.16
sys/net/npf/npf_state.c: revision 1.11
usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.3
usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.5
usr.sbin/npf/npfctl/npf_parse.y: revision 1.12
- Extend npftest: add ruleset inspection testing from the config generated
by npfctl debug functionality. Auto-create npftest interfaces for this.
- NPF sessions: combine protocol and interface into a separate substructure,
share between the entries and thus fix the handling of them. Constify.
- npftest: add regression tests for NAT policies.
- npf_build_nat: simplify and fix bi-NAT regression.
- Bump yacc stack size for npfctl.
|
| 1.10.2.5 | 03-Dec-2017 |
jdolecek | update from HEAD
|
| 1.10.2.4 | 20-Aug-2014 |
tls | Rebase to HEAD as of a few days ago.
|
| 1.10.2.3 | 23-Jun-2013 |
tls | resync from head
|
| 1.10.2.2 | 25-Feb-2013 |
tls | resync with head
|
| 1.10.2.1 | 20-Nov-2012 |
tls | Resync to 2012-11-19 00:00:00 UTC
|
| 1.13.2.1 | 18-May-2014 |
rmind | sync with head
|
| 1.16.2.1 | 10-Aug-2014 |
tls | Rebase.
|
| 1.17.8.1 | 18-Jan-2017 |
skrll | Sync with netbsd-5
|
| 1.17.4.2 | 05-Feb-2017 |
skrll | Sync with HEAD
|
| 1.17.4.1 | 22-Sep-2015 |
skrll | Sync with HEAD
|
| 1.17.2.1 | 18-Dec-2016 |
snj | Pull up following revision(s) (requested by rmind in ticket #1319):
sys/modules/npf/Makefile: revision 1.19
sys/net/npf/files.npf: revision 1.18
sys/net/npf/lpm.c: revision 1.1
sys/net/npf/lpm.h: revision 1.1
sys/net/npf/npf_impl.h: revision 1.62
sys/net/npf/npf_tableset.c: revision 1.24
sys/net/npf/npf_tableset_ptree.c: file removal
sys/rump/net/lib/libnpf/Makefile: revision 1.18
This patches ditches the ptree(3) library, because it is broken (you
can get missing entries!). Instead, as a temporary solution, we switch
to a simple linear scan of the hash tables for the longest-prefix-match
(lpm.c lpm.h) algorithm. In fact, with few unique prefixes in the set,
on modern hardware this simple algorithm is pretty fast anyway!
--
ditch ptree and use lpm
--
remove ptree add lpm
|
| 1.18.2.1 | 07-Jan-2017 |
pgoyette | Sync with HEAD. (Note that most of these changes are simply $NetBSD$
tag issues.)
|
| 1.21.16.2 | 13-Apr-2020 |
martin | Mostly merge changes from HEAD upto 20200411
|
| 1.21.16.1 | 10-Jun-2019 |
christos | Sync with HEAD
|
| 1.21.14.1 | 30-Sep-2018 |
pgoyette | Ssync with HEAD
|
| 1.30.6.1 | 02-Aug-2025 |
perseant | Sync with HEAD
|
| 1.1 | 20-Aug-2015 |
christos | branches: 1.1.2; 1.1.18;
Add ioconf entries to the pseudo-devices.
|
| 1.1.18.2 | 03-Dec-2017 |
jdolecek | update from HEAD
|
| 1.1.18.1 | 20-Aug-2015 |
jdolecek | file npf.ioconf was added on branch tls-maxphys on 2017-12-03 11:38:58 +0000
|
| 1.1.2.2 | 22-Sep-2015 |
skrll | Sync with HEAD
|
| 1.1.2.1 | 20-Aug-2015 |
skrll | file npf.ioconf was added on branch nick-nhusb on 2015-09-22 12:06:10 +0000
|
