| Age | Commit message (Collapse) | Author |
|
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.
|
|
the calls, but only adds extra functionality.
|
|
|
|
It turns out _NPF_TESTING is needed for the (rump only) function
npf_state_setsampler() in sys/net/npf/npf_state.c
|
|
|
|
|
|
- This conversion significantly simplifies the code and moves NPF to
a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
previous versions. Also, different serialisation format means NPF
connection/config saving and loading is not compatible with the
previous versions either.
Thanks to christos@ for extra testing.
|
|
|
|
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)
|
|
|
|
sprinkling them around the faction directories. Avoids having
to add a CPPFLAGS (or several) to pretty much every component
Makefile.
Leave compat headers around in the old locations.
The commit changes some autogenerated files, but I'll fix the
generators shortly and regen.
|
|
"make describe" prints the comment.
Requested/inspired by Vincent Schwarzer on rumpkernel-users
|
|
|
|
with the default provided by Makefile.rump (they're all 0.0 anyway)
|
|
- Separate the tracking interface from the storage (state table)
and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.
|
|
|
|
|
|
|
|
with RUMP_NPF_TESTING_=no. This in turn makes it possible to use npf
in a rump kernel for real packet filtering instead of just testing.
no change to default
|
|
(rumpdev no longer necessary)
|
|
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections). Once the interface is reattached they will
become active.
Bump NPF_VERSION.
|
|
|
|
points and document it. Split the worker thread into a separate module
with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.
|
|
|
|
|
|
- Implement dynamic NPF rules. Controlled through npf(3) library of via
npfctl rule command. A rule can be removed using a unique identifier,
returned on addition, or using a key which is SHA1 hash of the rule.
Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
|
|
which does signed-unsigned comparison in an inline function). Why it
compiled at all is one of those marvels of compiler technology.
|
|
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module. Move normalisation and logging functionality into their own
extensions. More improvements to come.
|
|
|