Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
227,648 Commits 606 Branches 0 Tags 3.1 GiB
ff58b21755
Commit Graph

158 Commits

Author SHA1 Message Date
rmind
410bae3ffd npfctl_build_code: generate TCP/UDP check for ports case when other blocks 
do not imply L4 check; add an assert in npfctl_bpf_proto() and elsewhere.
 2014-05-31 22:41:37 +00:00
rmind
5866b12dae npfctl: allow group of zeroes in IPv6 address; noted by spz@. 2014-05-31 22:37:05 +00:00
wiz
8f7d248eb8 Wording, typo fixes. 2014-05-15 23:52:32 +00:00
rmind
e05005e0b3 NPF: imply SYN-only check for the stateful rules by default (when inspecting 
TCP packets).  Many users trip here.  This behaviour can be overriden with the
explicit "flags" keyword, but other configuration does not really make sense.
 2014-05-15 02:34:29 +00:00
rmind
7da3b338d7 npftest: fix the example in the README file. 2014-05-14 21:46:50 +00:00
riastradh
4ec7cf26b7 Convert right-recursive rules to left-recursive ones. 
This should obviate the need for the workaround of a large stack in
order to handle many rules.

No change in the resulting plists.

ok rmind
 2014-03-15 15:22:37 +00:00
rmind
f1567f86d3 npfctl_bpf_cidr: another buf fix in handling IPv6 masks (bug found on ARM). 2014-03-15 08:46:01 +00:00
rmind
167f6f25d6 NPF: add support for "stateful-ends". 2014-03-14 11:29:44 +00:00
rmind
27b83b3d9e npfctl_print_nat: fix the byte-order of the port. 2014-02-19 01:43:16 +00:00
rmind
247d861365 npfctl: take into account all addresses when multiple interfaces are 
specified in a set of elements.
 2014-02-17 00:45:24 +00:00
rmind
a732dba5fc G/C some todo items 2014-02-14 02:01:12 +00:00
rmind
d199f930bb Document NAT algorithm option in the grammar of "map". 2014-02-14 01:52:58 +00:00
rmind
068cee2998 NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6), 
as per RFC 6296.  Add a unit test.  Also, bump NPF_VERSION.

Thanks to S.P.Zeidler for the help with NPTv6 work!
 2014-02-13 03:34:40 +00:00
rmind
82f6ff32b1 npfctl_bpf_cidr: fix a bug in handling of smaller IPv6 masks. 2014-02-13 00:42:01 +00:00
rmind
1e2389ed0b npfctl_print_table: add a "cdb" type. 2014-02-12 01:42:50 +00:00
rmind
8b83480d27 NPF: 
- Adjust the syntax - remove "inet" keyword in favour of more explicit
  "inet4" for the address family.  Consistent with "inet6" for IPv6.
- Adjust and improve the man page a little bit.
 2014-02-08 01:20:09 +00:00
rmind
8274d601f9 NPF: add support for static (stateless) NAT. 2014-02-07 23:45:22 +00:00
christos
61a4b10e07 fix vax build. 2014-02-06 18:48:09 +00:00
wiz
83d796ca12 Update count. Add serial comma. 2014-02-06 07:36:36 +00:00
rmind
ffcdc4af8d Add support for CDB based NPF tables. 2014-02-06 02:51:28 +00:00
rmind
e43f79569a npftest: fix previous harder - pass and use libc's random(3). 2014-02-05 03:49:48 +00:00
rmind
bb1fedd189 npftest: fix the failure of NAT test -- adjust for RUMP's conversion to 
the in-kernel CPRNG (hi pooka!).
 2014-02-05 03:30:13 +00:00
rmind
55b0c96054 - npfctl: fix table IDs (breakage since the table naming was added). 
- libnpf: remove npf_table_exists_p() from public API.
 2014-02-03 02:21:52 +00:00
rmind
1e9541dade npftest: adjust for the npf_bpf_filter() change. 2013-11-23 19:40:11 +00:00
rmind
e636c1e87f npfctl: need to rewind the list after calling print_table(). XXX libnpf. 2013-11-22 18:42:02 +00:00
rmind
805a41fbfe Add npf_tableset_syncdict() to sync the table IDs in the proplib dictionary, 
as they can change on reload now.  Also, fix table name checking in npfctl.
 2013-11-22 00:25:51 +00:00
christos
8216c37c22 CID 1129614: dereference after null 2013-11-19 17:01:45 +00:00
rmind
d116583e69 Simplify parsing of npf.conf elements, create the npfvar_t when a value is 
parsed (to be used as a general structured for variables and inlined values),
few misc improvements.
 2013-11-19 00:28:41 +00:00
rmind
3fb1890bf5 Rename some tokens, use more accurate names (the current ones are incorrect 
or missleading) and add few comments in the parser code.
 2013-11-18 21:39:03 +00:00
rmind
2566fe9fff Add bsd.own.mk for MKSLJIT, reorder some vars. 2013-11-16 17:12:35 +00:00
alnsn
a36c412b37 Link to -lrumpnet_bpfjit and -lrumpkern_sljit iff MKSLJIT != "no". 2013-11-16 15:58:30 +00:00
rmind
467de1619d Enable bpfjit for npftest. 2013-11-16 01:41:43 +00:00
wiz
d8099589ae Remove trailing whitespace. 2013-11-12 06:07:30 +00:00
rmind
1e7342c150 NPF: add support for table naming and remove NPF_TABLE_SLOTS (there is 
just an arbitrary sanity limit of NPF_MAX_TABLES currently set to 128).

Few misc fixes.  Bump NPF_VERSION.
 2013-11-12 00:46:34 +00:00
rmind
a79812ea10 NPF: add support for specifying the interfaces before they are attached. 
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections).  Once the interface is reattached they will
become active.

Bump NPF_VERSION.
 2013-11-08 00:38:26 +00:00
kefren
915c0cd28e sync an example with the latest group syntax change 2013-11-05 13:09:12 +00:00
rmind
05a7a9a52e npfctl: optimise fetch_l3() to avoid unnecessary call to NPF_COP_L3. 2013-11-05 01:50:30 +00:00
joerg
d41a00c8da Add missing dead. 2013-09-24 22:52:14 +00:00
rmind
a99ac6280c npftest: add a choice of "rule" or "state" for -b option. 2013-09-24 02:44:20 +00:00
rmind
a484105289 npftest: add some concurrency testing code. 2013-09-24 02:04:21 +00:00
rmind
5f3b7e2652 Update npftest.conf for the recent syntax adjustments. 2013-09-23 15:30:32 +00:00
wiz
4fe1cb8b61 Remove trailing whitespace. 2013-09-20 21:30:49 +00:00
rmind
f797733a7e - NPF: change the group/ruleset syntax - simplify. Update npf.conf(5) manual. 
- Add support for the inline pcap-filter(7) syntax in the rule, e.g.:
	block out final pcap-filter "tcp and dst 10.1.1.252"
 2013-09-20 03:03:52 +00:00
rmind
f5730e945b npfctl: remove some n-code leftovers, fix the build, update the man pages. 2013-09-19 12:05:11 +00:00
rmind
7b5edfdc0d NPF: G/C n-code in favour of BPF byte-code. Delete lots of code, mmm! 2013-09-19 01:49:07 +00:00
rmind
4e592132ab - Convert NPF to use BPF byte-code by default. Compile BPF byte-code in 
npfctl(8) and generate separate marks to describe the filter criteria.
- Rewrite 'npfctl show' functionality and fix some of the bugs.
- npftest: add a test for BPF COP.
- Bump NPF_VERSION.
 2013-09-19 01:04:45 +00:00
rmind
ce38978248 - Add NPF table flushing functionality. 
- Fix line numbering for npfctl debug command.
 2013-05-19 20:45:34 +00:00
christos
464306f9db always allow hex where decimal is allowed. 2013-05-09 19:12:03 +00:00
christos
bc0f55de88 Make ALG's autoloadable by providing in the config file: 
alg "algname"
 2013-03-20 00:29:46 +00:00
rmind
543d2971ab - Extend npf.conf syntax to support dynamic NAT policies. 
- Imply dynamic group when using "ruleset" keyword.
 2013-03-18 02:17:49 +00:00