- Add libnpf(3) - a library to control NPF (configuration, ruleset, etc).
- Add NPF support for ftp-proxy(8).
- Add rc.d script for NPF.
- Convert npfctl(8) to use libnpf(3) and thus make it less depressive.
Note: next clean-up step should be a parser, once dholland@ will finish it.
- Add more documentation.
- Various fixes.
Change the initialization state of gtagsmode to 0, (unset).
This brings about least astonishment for users, permittings tags
functionality to work as expected.
using an EXTERN_INLINE definition for functions that are defined as
inline but provide an externally callable reference.
(these are externally called in ipftest)
4.1.34 - Release 11 March 2010
2964907 uninitialised use compile error
2959506 ipfstat does not display rules with compat
2949139 FR_T_BUILTIN masked out incorrectly
2937422 packets filtered with pools should not be cached
2935529 use of rules with tags leads to deadlock
2917501 whitespace cleanup required
2881514 in/out object functions not wired for compatibility
2841771 ipf/ippool rule maintenace bugs: memory leak, ref-counter bug
2839698 H.323 proxy does not clear fin_state/fin_nat
pam_end() already contains a NULL check, and it is not unreasonable to
call it with a NULL pamh in a cleanup / error-handling situation. Remove
OPENPAM_NONNULL, which may cause gcc to optimize away the NULL check.
to "(void)0". This is what similar code in bind9 (up to 9.5) does.
(native NetBSD code usually does "do { } while (/* CONSTCOND */ 0)"
in this case)
Anyway, I've checked the code, didn't find ambiguities due to
the empty statements, so the whole thing is harmless.
hostname.if(5) is ifconfig.if(5) on NetBSD
Don't speak about enc, as we don't support it at the moment
Make clear that we don't support ipsec protection of pfsync traffic (as long we
doesn't support enc, or similar thing)
Catched by wiz@
Pfsync interface exposes change in the pf(4) over a pseudo-interface, and can
be used to synchronise different pf.
This work was part of my 2009 GSoC
No objection on tech-net@
Fixes problem pointed out by Nicolas Joly.
XXX: would probably be better to forget canon_dev from the parseargs
interface completely and do rump_sys_statvfs() in p2k after mounting
the fail system in the virtual kernel.
(yes, this is dist, but considering the last and only import from
upstream was 7 years ago, I'm not exactly worried this will make
importing future versions harder)
4.1.33 - Release 16 August 2009
2837931 wrong mode selected in ipf program for hash-entries
2826168 load_http can make ippool core dump
2825150 IPL_LOGMAX used to index some arrays
2825084 ipv6 fragments should not be allowed past 64k
2824713 ipfstat top output alternates between entries and nothing
2824712 ipfstat top output is shows negative ttl
2820965 a single bad ipv6 extension header should not impact others
2818197 ignored fragment bits defined as being reserved
2817667 IPv6 fragment header verification needs attention
2817098 fr_getrulen() finds the wrong rule
2817096 fr_rulen is unused
2741019 Lingering states (Established/Listen - 5/0) in state table
2702887 use of PBR/fastroute causes panic with ipv6
2671913 regression test in7 fails to execute
2598625 parsing empty config file results in an error
2698656 test parsing empty config files
2597956 not all pointers in a clone are reset
2543934 nat_t gets assigned ifp too early
2535795 No need to always bump fr_ref
2535778 Bad IPv6 packets droped by default
2031730 4.1.31 Nat drops fragmented packets after the first
2214661 ipf does not handle IPv6 fragments
2473273 NAT removed before RST/ICMP sent
2216500 fin_state serves no purpose
2424604 adding random MD5 data causes panic
2304435 Ineffecient lock usage in logging
2216491 fin_nat serves little purpose
2055619 duplicating a free-d packet will fail
2042949 Excessive locking when creating nat_t
2035610 nat_update does not need to get locks
2214658 ipf mostly ignores locking in NetBSD
1979427 Memory leak in user utilities - token never freed (rel br)
* SunOS4 does not have a curproc, but it does have u.
* The fix for 2020447 generated random port numbers but not within the
range specified in the map rule. Add in a regression test to verify
that the "random" part works.
2020447 NAT can undo name server random port selection
1988795 NetBSD does not build with kernel malloc stats
1988782 fr_movequeue can take a short cut
1988669 first nat creation failure prevents further success
1988668 hostmap searching does not work properly
* on some 64bit architectures (such as alpha), the addrfamily_t is packed
differently, throwing off the calculations for adf_len
* one too many READ_ENTERs in ip_sync code.
* clean up fr_fastroute a little by removing some #ifdefs and pushing the
code around a bit to use the same variables (NetBSD)
* more recent NetBSDs use VOP related macros differently
- Avoid atomics in more places.
- Remove the per-descriptor mutex, and just use filedesc_t::fd_lock.
It was only being used to synchronize close, and in any case we needed
to take fd_lock to free the descriptor slot.
- Optimize certain paths for the <NDFDFILE case.
- Sprinkle more comments and assertions.
- Cache more stuff in filedesc_t.
- Fix numerous minor bugs spotted along the way.
- Restructure how the open files array is maintained, for clarity and so
that we can eliminate the membar_consumer() call in fd_getfile(). This is
mostly syntactic sugar; the main functional change is that fd_nfiles now
lives alongside the open file array.
Some measurements with libmicro:
- simple file syscalls are like close() are between 1 to 10% faster.
- some nice improvements, e.g. poll(1000) which is ~50% faster.
characters and we allocated only 1024.
While here:
- use snprintf to prevent this from happening in the future.
- don't close fd twice on error.
- pass unsigned char to ctype.h functions.
we don't have. Replace ".Dd $Mdocdate" with ".Dd Month Day Year" so
that the date comes out right when man pages get built. This will
doubtless need hand conflict resolution whenever these pages are
re-imported.
Note that it would be interesting to have some similar facility for
NetBSD, but I don't think a custom rcs keyword is the right thing --
maybe we can teach groff to parse $Date$
rmind