summaryrefslogtreecommitdiff
path: root/usr.sbin/npf/npfctl/npf_parse.y
AgeCommit message (Collapse)Author
2020-05-30Major NPF improvements (merge from upstream):rmind
- Switch to the C11-style atomic primitives using atomic_loadstore(9). - npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though. - npfkern: rewrite the G/C worker logic and make it self-tuning. - npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code. - npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages. - Amend and improve the manual pages.
2019-09-30libnpf/npfctl: support dynamic NAT rulesets using a name prefix.rmind
2019-07-23NPF improvements:rmind
- Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
2019-01-19Major NPF improvements:rmind
- Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
2018-09-29NPF: Major rework -- migrate NPF to the libnv library.rmind
- This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
2017-12-10npfctl: add support for the 'no-ports' flag in the 'map' statements.rmind
This allows us to create a NAT policy without the port translation.
2017-12-03allow PASS opt_proto ALL syntax in map statement.mlelstv
2017-01-20npfctl: fix shift/reduce conflicts, thanks to riastradh@.rmind
2017-01-20Add missing ; - hopefully unbreak build.kre
2017-01-19npfctl:rmind
- Add protocol filter option for "map". - Print user-friendly error if table contains an entry with invalid netmask. - Add support for inline ports.
2017-01-11Don't silently take the first element of multiple element variables.christos
2017-01-03npfctl: dynamic interface address handling; update npf.conf(8).rmind
2016-12-27npf.conf: add support for logical NOT, e.g.: pass from ! 10.0.0.1 to anyrmind
2015-03-24allow lists as filter addresses.christos
2015-01-04Don't depend on yacc to include stdlib.h or string.h.joerg
2014-12-26allow turning off the bpf jit loading.christos
2014-03-15Convert right-recursive rules to left-recursive ones.riastradh
This should obviate the need for the workaround of a large stack in order to handle many rules. No change in the resulting plists. ok rmind
2014-03-14NPF: add support for "stateful-ends".rmind
2014-02-17npfctl: take into account all addresses when multiple interfaces arermind
specified in a set of elements.
2014-02-13NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6),rmind
as per RFC 6296. Add a unit test. Also, bump NPF_VERSION. Thanks to S.P.Zeidler for the help with NPTv6 work!
2014-02-08NPF:rmind
- Adjust the syntax - remove "inet" keyword in favour of more explicit "inet4" for the address family. Consistent with "inet6" for IPv6. - Adjust and improve the man page a little bit.
2014-02-06Add support for CDB based NPF tables.rmind
2013-11-19Simplify parsing of npf.conf elements, create the npfvar_t when a value isrmind
parsed (to be used as a general structured for variables and inlined values), few misc improvements.
2013-11-18Rename some tokens, use more accurate names (the current ones are incorrectrmind
or missleading) and add few comments in the parser code.
2013-11-08NPF: add support for specifying the interfaces before they are attached.rmind
If an interface is or gets detached, all associated rules and connections will be deactivated (it might be useful to have an option to invalidate the associated connections). Once the interface is reattached they will become active. Bump NPF_VERSION.
2013-09-20- NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual.rmind
- Add support for the inline pcap-filter(7) syntax in the rule, e.g.: block out final pcap-filter "tcp and dst 10.1.1.252"
2013-09-19- Convert NPF to use BPF byte-code by default. Compile BPF byte-code inrmind
npfctl(8) and generate separate marks to describe the filter criteria. - Rewrite 'npfctl show' functionality and fix some of the bugs. - npftest: add a test for BPF COP. - Bump NPF_VERSION.
2013-05-19- Add NPF table flushing functionality.rmind
- Fix line numbering for npfctl debug command.
2013-05-09always allow hex where decimal is allowed.christos
2013-03-20Make ALG's autoloadable by providing in the config file:christos
alg "algname"
2013-03-18- Extend npf.conf syntax to support dynamic NAT policies.rmind
- Imply dynamic group when using "ruleset" keyword.
2013-03-11handle port "ftp-data"christos
2013-03-10deal with strings as interfaceschristos
2013-02-09NPF:rmind
- Implement dynamic NPF rules. Controlled through npf(3) library of via npfctl rule command. A rule can be removed using a unique identifier, returned on addition, or using a key which is SHA1 hash of the rule. Adjust npftest and add a regression test. - Improvements to rule inspection mechanism. - Initial BPF support as an alternative to n-code. - Minor fixes; bump the version.
2012-11-26npfctl: extend syntax for extracting interface IP address(es) by the family.rmind
2012-11-15npfctl: switch to ecalloc(3).rmind
2012-11-05npfctl: switch to efun(3) routines.rmind
2012-10-02npfctl/yyerror(): print the right line number if we already parsed the line.rmind
2012-09-16Implement dynamic NPF extensions interface. An extension consists ofrmind
dynamically loaded module (.so) supplementing npfctl(8) and a kernel module. Move normalisation and logging functionality into their own extensions. More improvements to come.
2012-08-12- Extend npftest: add ruleset inspection testing from the config generatedrmind
by npfctl debug functionality. Auto-create npftest interfaces for this. - NPF sessions: combine protocol and interface into a separate substructure, share between the entries and thus fix the handling of them. Constify. - npftest: add regression tests for NAT policies. - npf_build_nat: simplify and fix bi-NAT regression. - Bump yacc stack size for npfctl.
2012-07-19teach npf ipv6-icmpspz
reviewed by rmind@
2012-07-15- Rework NPF tables and fix support for IPv6. Implement tree table typermind
using radix / Patricia tree. Universal IPv4/IPv6 comparator for ptree(3) was contributed by Matt Thomas. - NPF tables: update regression tests, improve npfctl(8) error messages. - Fix few bugs when using kernel modules and handle module autounloader. - Few other fixes and misc cleanups. - Bump the version.
2012-07-01NPF improvements:rmind
- Add NPF_OPCODE_PROTO to match the address and/or protocol only. - Update parser to support arbitrary "pass proto <name/number>". - Fix IPv6 address and protocol handling (add a regression test). - Fix few theorethical races in session handling module. - Misc fixes, simplifications and some clean up.
2012-06-15- Rework NPF NAT syntax to be more structured and support future additionsrmind
of different types and configurations of NAT. - npfctl: improve disassemble and show-config command functionality. - Fix custom ICMP code and type filtering.
2012-05-30npfctl(8): add show-config command. Also, update syntax.rmind
2012-02-26remove extra rule that got merged...christos
2012-02-26- make each element of a variable hold a typechristos
- change get_type to take an index, so we can get the individual types of each element (since primitive elements can be in lists) - make port_range primitive - add a routine to convert a variable of primitives to a variable containing - only port ranges.
2012-02-26Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.rmind
2012-01-15- Expire all sessions on flush.rmind
- Enable checking for zero mask in IP{4,6}MATCH after npfctl changes. - Make locking symmetric for npf_ruleset_inspect(). - Sync function prototypes in npf(3) man page with reality. - Rename NPF_TABLE_RBTREE to NPF_TABLE_TREE.
2012-01-12handle variables that contain variableschristos