summaryrefslogtreecommitdiff
path: root/usr.sbin/npf/npfctl
AgeCommit message (Collapse)Author
2021-07-14PR/56307: Konrad Schroder: npfctl's error messages don't report the failingchristos
filename. Add the filename (but in quotes for consistency with other places in the file). Also fix an err -> errx
2020-05-30Major NPF improvements (merge from upstream):rmind
- Switch to the C11-style atomic primitives using atomic_loadstore(9). - npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though. - npfkern: rewrite the G/C worker logic and make it self-tuning. - npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code. - npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages. - Amend and improve the manual pages.
2020-05-24PR/55288: npfctl: change parameter syntax to be more permissive.rmind
2020-05-23Backport selected NPF fixes from the upstream (to be pulled up):rmind
- npf_conndb_lookup: protect the connection lookup with pserialize(9), instead of incorrectly assuming that the handler always runs at IPL_SOFNET. Should fix crashes reported on high load (PR/55182). - npf_config_destroy: handle partially initialized config; fixes crashes with some invalid configurations. - NAT policy creation / destruction: set the initial reference and do not wait for reference draining on destruction; destroy the policy on the last reference drop instead. Fixes a lockup with the dynamic NAT rules. - npf_nat_{export,import}: fix a regression since dynamic NAT rules. - npfctl: fix a regression and restore the default group behaviour. - Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
2019-11-01PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump bufferchristos
size.
2019-09-30Use -width Pa for FILES.uwe
2019-09-30Fix pasto in table replace -t typeuwe
2019-09-30Use -width Pa for FILES.uwe
2019-09-30libnpf/npfctl: support dynamic NAT rulesets using a name prefix.rmind
2019-09-29npfctl: implement table replace subcommand.rmind
Contributed by Timshel Knoll-Miller. (missed a file in previous commit; cvs is so helpful..)
2019-09-29npfctl: implement table replace subcommand.rmind
Contributed by Timshel Knoll-Miller.
2019-08-25- npfctl_load_nvlist: simplify the config loading logic.rmind
- Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
2019-08-24libnpf fix: link the library itself to libnv; libnpf users should not bermind
expected to assume this dependency.
2019-08-21- npftest: fix a memleak in a unit test (standalone path only).rmind
- Minor style fixes. No functional change.
2019-08-10npfctl show/validate: fix couple bugs in multiple table/port representation.rmind
Fixes PR/54122.
2019-08-08NPF: fix BPF byte-code generation for a port-range used in a group.rmind
Resolved PR/52609 and PR/54169.
2019-07-25npfctl: fix the bpf.jit parameter handling.rmind
2019-07-23New sentence, new line. Avoid formatting punctuation. Remove superfluous Pp.wiz
2019-07-23NPF improvements:rmind
- Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
2019-04-17Summary: Ensure default TCP flags are applied to rules like 'pass stateful all'tih
The documented default "flags S/SAFR" for stateful rules that affect TCP packets but don't specify any flags, doesn't actually get applied to a rule like "pass stateful out all". The big problem with this is that when you then do a "block return-rst" for an incoming packet, the generated RST packet will create state for the connection attempt it's blocking, so that a second attempt from the same source will pass. This change makes the default flags actually apply to such simple rules. It also fixes a related bug in the code generation for the flag matching, where part of the action could erroneously be omitted. Reviewed by <rmind> Closes PR bin/54124 Pullup to NetBSD 8
2019-04-08Improve wording.wiz
2019-04-07npf.conf(5): Add more info about ifaddrs().rmind
2019-02-03- add or adjust /* FALLTHROUGH */ where appropriatemrg
- add __unreachable() after functions that can return but won't in this case, and thus can't be marked __dead easily
2019-01-19Major NPF improvements:rmind
- Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
2019-01-08Actually, according to the grammar the square brackets in the "tcpuwe
flags" are not literal, so use .Op to show that /mask is optional.
2019-01-08Restore macro with effect. Fix the real problem that prevented it touwe
have the effect.
2019-01-08New sentence, new line. Punctuation fixes. Remove macros without effect.wiz
2019-01-08npf.conf(5): add a minor clarification about table types that can'tgutteridge
accept masks on IP addresses. Prompted by Rob Hunter in PR bin/51900.
2018-09-29NPF: Major rework -- migrate NPF to the libnv library.rmind
- This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.
2018-09-21According to the grammar and examples the static table is defined withuwe
"file" keyword, not "static".
2018-09-21Improve markup.uwe
2018-09-21Wrap long lines, so that nothing overflows.maxv
2018-09-19Switch back to tabs, it was nicer this way.maxv
2018-09-04Fix the "Interfaces" section, I understood wrong. Talk about inference,maxv
because it was not mentioned before, and it plays an important role. Discussed with rmind. Probably not the last pass.
2018-09-02New sentence, new line. Use Fn for functions.wiz
2018-09-02Be clearer about the difference between static vs dynamic interface list,maxv
and slightly improve wording. My understanding is that when none of inet4/inet6/ifaddrs is passed, NPF assumes ifaddrs.
2018-09-01Remove superfluous Pp.wiz
2018-09-01npf.conf(5): fix some of the previous incorrect or inaccurate changes.rmind
The TCP flags option is not only for the stateful tracking. Dynamic NAT implies NAPT; algorithms, at least for now, are for static NAT mappings. Mention that ALG ICMP is also for traceroute behind NAT; also mention "MSS clamping" (some users might search for this term, so keeping the terminology is helpful).
2018-08-31rename net-seg -> map-seg, and document itmaxv
2018-08-31"interface" already contains "var-name", so don't mention it in "filt-addr",maxv
that's redundant
2018-08-31should be port-optsmaxv
2018-08-31Clarify the "Groups" section.maxv
2018-08-27Add missing -width; remove unnecessary .Pp.wiz
2018-08-27Improve the "Map" section.maxv
2018-08-27Document ALGs.maxv
2018-08-17Add the values of "algo" in the grammar, and use # as comment marker formaxv
man-k.org (and others) not to highlight things in an incorrect way.
2018-08-17Add missing quote in static-rule, it causes man-k.org (and other tools)maxv
to wrongly highlight the grammar.
2018-08-17Replace "rproc"->"proc" in the grammar (spotted by he@), and slightlymaxv
reword.
2018-08-17Replace () by [] in tcp-flags.maxv
Fix proc-opts, the value is optional, noted by he@.
2018-08-16Improve wording.maxv