summaryrefslogtreecommitdiff
path: root/usr.sbin/npf
AgeCommit message (Collapse)Author
2023-02-12PR kern/55654:kardel
Switch default for parameter npf ip4.reassembly to 1. This makes the NPF default configuration comply with host requirements for IPv4.
2022-04-30Handle warnings and errors from pcap_activate properly (from bch)christos
2021-07-14PR/56307: Konrad Schroder: npfctl's error messages don't report the failingchristos
filename. Add the filename (but in quotes for consistency with other places in the file). Also fix an err -> errx
2021-07-07Allow to set sanitizer flags for the rump build from themartin
build.sh command line, like: -V RUMP_SANITIZE=address
2020-12-17Change second gc.interval_min to gc.interval_max.taca
Obviously, second gc.interval_min should be gc.interval_max. Should be pulled up to netbnsd-9.
2020-10-30Fix tcpdump example from "‐i npflog0.pcap" to "‐i npflog0"abs
2020-08-27npftest: Wait at least one tick in each gc busy wait iteration.riastradh
Otherwise the busy wait loop runs a little too fast for the gc about half the times I run the test. XXX We should really arrange mstohz to round up!
2020-08-27npf: Make sure to initialize portmap_lock only once.riastradh
PR kern/55586
2020-06-06Use more markup.wiz
2020-05-31npf-params.7: s/filer/filter/tnn
2020-05-31npf-params(7): fix the state.key defaults.rmind
2020-05-30npftest -- npf_test_init(): add a workaround for NetBSD.rmind
2020-05-30Major NPF improvements (merge from upstream):rmind
- Switch to the C11-style atomic primitives using atomic_loadstore(9). - npfkern: introduce the 'state.key.interface' and 'state.key.direction' settings. Users can now choose whether the connection state should be strictly per-interface or global at the configuration level. Keep NAT logic to be always per-interface, though. - npfkern: rewrite the G/C worker logic and make it self-tuning. - npfkern and libnpf: multiple bug fixes; add param exporting; introduce more parameters. Remove npf_nvlist_{copyin,copyout}() functions and refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have a single entry point for operations. Introduce npf_flow_t and clean up some code. - npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list' more informative; misc usability improvements and more user-friendly error messages. - Amend and improve the manual pages.
2020-05-24PR/55288: npfctl: change parameter syntax to be more permissive.rmind
2020-05-23Backport selected NPF fixes from the upstream (to be pulled up):rmind
- npf_conndb_lookup: protect the connection lookup with pserialize(9), instead of incorrectly assuming that the handler always runs at IPL_SOFNET. Should fix crashes reported on high load (PR/55182). - npf_config_destroy: handle partially initialized config; fixes crashes with some invalid configurations. - NAT policy creation / destruction: set the initial reference and do not wait for reference draining on destruction; destroy the policy on the last reference drop instead. Fixes a lockup with the dynamic NAT rules. - npf_nat_{export,import}: fix a regression since dynamic NAT rules. - npfctl: fix a regression and restore the default group behaviour. - Add npf_cache_tcp() and validate the TCP data offset (from maxv@).
2020-05-16more nofifofs lossagechristos
2020-04-23npftest_mbufops and npftest_ifops are owned by npf_mbuf_subr.cjoerg
2019-11-01PR/54670: Azuma OKAMOTO: Consistently use 'W' for TH_CWN, and bump bufferchristos
size.
2019-09-30Use -width Pa for FILES.uwe
2019-09-30Fix pasto in table replace -t typeuwe
2019-09-30Use -width Pa for FILES.uwe
2019-09-30libnpf/npfctl: support dynamic NAT rulesets using a name prefix.rmind
2019-09-29npfctl: implement table replace subcommand.rmind
Contributed by Timshel Knoll-Miller. (missed a file in previous commit; cvs is so helpful..)
2019-09-29npfctl: implement table replace subcommand.rmind
Contributed by Timshel Knoll-Miller.
2019-08-25- npfctl_load_nvlist: simplify the config loading logic.rmind
- Fix a small race condition in npf_nat_getaddr(). - Rework pserialize/EBR wrappers, make it easier to maintain.
2019-08-24libnpf fix: link the library itself to libnv; libnpf users should not bermind
expected to assume this dependency.
2019-08-21- npftest: fix a memleak in a unit test (standalone path only).rmind
- Minor style fixes. No functional change.
2019-08-11npf.7: add xref to npf-params.7gutteridge
(Adding directly here since this particular file isn't included in rmind@'s upstream GitHub repo at present.)
2019-08-11Adjust some internal NPF APIs:rmind
* npfkern: use the npfk_ prefix. * NPF portmap: amend the API so it could be used elsewhere. * Make npf_connkey_t public.
2019-08-11npf-params(7): add more bpf.jit details.rmind
From David H. Gutteridge.
2019-08-10npfctl show/validate: fix couple bugs in multiple table/port representation.rmind
Fixes PR/54122.
2019-08-08NPF: fix BPF byte-code generation for a port-range used in a group.rmind
Resolved PR/52609 and PR/54169.
2019-07-25npftest: fix double-free in npf_nbuf_test().rmind
2019-07-25npfctl: fix the bpf.jit parameter handling.rmind
2019-07-25Install the npf-params(7) man page.rmind
2019-07-23Add RCS Id.wiz
2019-07-23New sentence, new line. Avoid formatting punctuation. Remove superfluous Pp.wiz
2019-07-23NPF improvements:rmind
- Add support for dynamic NETMAP algorithm (stateful net-to-net). - Add most of the support for the dynamic NAT rules; a little bit more userland work is needed to finish this up and enable. - Replace 'stateful-ends' with more permissive 'stateful-all'. - Add various tunable parameters and document them, see npf-params(7). - Reduce the memory usage of the connection state table (conndb). - Portmap rewrite: use memory more efficiently, handle addresses dynamically. - Bug fix: add splsoftnet()/splx() around the thmap writers and comment. - npftest: clean up and simplify; fix some memleaks to make ASAN happy.
2019-05-13Get rid of all the -lrumpdev and -lrumpvfs that are no longer neededbad
after moving rump's mainbus from rumpdev to rumpkern. Produces the same atf-run results as before.
2019-04-17Summary: Ensure default TCP flags are applied to rules like 'pass stateful all'tih
The documented default "flags S/SAFR" for stateful rules that affect TCP packets but don't specify any flags, doesn't actually get applied to a rule like "pass stateful out all". The big problem with this is that when you then do a "block return-rst" for an incoming packet, the generated RST packet will create state for the connection attempt it's blocking, so that a second attempt from the same source will pass. This change makes the default flags actually apply to such simple rules. It also fixes a related bug in the code generation for the flag matching, where part of the action could erroneously be omitted. Reviewed by <rmind> Closes PR bin/54124 Pullup to NetBSD 8
2019-04-08Improve wording.wiz
2019-04-07npf.conf(5): Add more info about ifaddrs().rmind
2019-02-04check for snprintf() truncation and fail sanely if so, rather thanmrg
attempting to use a file that won't exist or isn't secure.
2019-02-03- add or adjust /* FALLTHROUGH */ where appropriatemrg
- add __unreachable() after functions that can return but won't in this case, and thus can't be marked __dead easily
2019-01-19Major NPF improvements:rmind
- Convert NPF connection table to thmap. State lookup is now lock-free. - Improve connection state G/C: it is now incremental and tunable. - Add support for dynamic NAT address. Translation addresses can now be selected from a pool of addresses. There are two selection algorithms, "ip-hash" and "round-robin" (see the man page). - Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf to dynamically choose an IP from the interface address(es). - Add support for the NETMAP algorithm with static NAT for net-to-net translation (it is equivalent to iptables NETMAP logic). - Convert 'ipset' tables to use thmap; the table lookup is now lock-free. - Misc improvements, bug fixes and more unit tests. - Bump NPF_VERSION (will also bump libnpf).
2019-01-08Actually, according to the grammar the square brackets in the "tcpuwe
flags" are not literal, so use .Op to show that /mask is optional.
2019-01-08Restore macro with effect. Fix the real problem that prevented it touwe
have the effect.
2019-01-08New sentence, new line. Punctuation fixes. Remove macros without effect.wiz
2019-01-08npf.conf(5): add a minor clarification about table types that can'tgutteridge
accept masks on IP addresses. Prompted by Rob Hunter in PR bin/51900.
2018-09-29NPF: Major rework -- migrate NPF to the libnv library.rmind
- This conversion significantly simplifies the code and moves NPF to a binary serialisation format (replacing the XML-like format). - Fix some memory/reference leaks and possibly use-after-free bugs. - Bump NPF_VERSION as this change makes libnpf incompatible with the previous versions. Also, different serialisation format means NPF connection/config saving and loading is not compatible with the previous versions either. Thanks to christos@ for extra testing.