kernel: extract rules, lookup socket, process filtering, reviews by christos@

branches: 1.27.34;
NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Back to using _NPF_TESTING now that it does not change the semantics of
the calls, but only adds extra functionality.

add an _NPF_RUMP define to expose the sampling function.

Revert previous (unbreak build) - for now anyway.

It turns out _NPF_TESTING is needed for the (rump only) function
npf_state_setsampler() in sys/net/npf/npf_state.c

Comment out _NPF_TESTING (really should be removed)

need libnvpair

NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
previous versions. Also, different serialisation format means NPF
connection/config saving and loading is not compatible with the
previous versions either.

Thanks to christos@ for extra testing.

branches: 1.20.14; 1.20.16;
need new file

Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)

remove ptree add lpm

branches: 1.17.2;
Put the kernelside rump kernel headers into <rump-sys> instead of
sprinkling them around the faction directories. Avoids having
to add a CPPFLAGS (or several) to pretty much every component
Makefile.

Leave compat headers around in the old locations.

The commit changes some autogenerated files, but I'll fix the
generators shortly and regen.

Add a COMMENT describing what each component roughly does.

"make describe" prints the comment.

Requested/inspired by Vincent Schwarzer on rumpkernel-users

add ioconf files for pseudo device attach prototypes

branches: 1.14.2; 1.14.4; 1.14.8;
NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.

branches: 1.13.2;
No lint for rumpnet npf library.

rename component.c -> npf_component.c

also include bsd.own.mk, so value for RUMP_NPF_TESTING can come from mk.conf

For now, make it possible to not specify -D_NPF_TESTING by compiling
with RUMP_NPF_TESTING_=no. This in turn makes it possible to use npf
in a rump kernel for real packet filtering instead of just testing.

no change to default

NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections). Once the interface is reattached they will
become active.

Bump NPF_VERSION.

NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm!

branches: 1.7.2;
- NPF connection tracking: rework synchronisation on tracking disable/enable
points and document it. Split the worker thread into a separate module
with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.

normali{s,z}e

remember to detach and add if_npflog module

NPF:
- Implement dynamic NPF rules. Controlled through npf(3) library of via
npfctl rule command. A rule can be removed using a unique identifier,
returned on addition, or using a key which is SHA1 hash of the rule.
Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

This component is not WARNS>3 clean (example: it includes socketvar.h
which does signed-unsigned comparison in an inline function). Why it
compiled at all is one of those marvels of compiler technology.

branches: 1.2.2; 1.2.4;
Implement dynamic NPF extensions interface. An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module. Move normalisation and logging functionality into their own
extensions. More improvements to come.

branches: 1.1.2;
Move and rename librumpdev_npf to librumpnet_npf.