head	1.25;
access;
symbols
	netbsd-11-0-RC3:1.24
	netbsd-11-0-RC2:1.24
	netbsd-11-0-RC1:1.24
	perseant-exfatfs-base-20250801:1.24
	netbsd-11:1.24.0.2
	netbsd-11-base:1.24
	netbsd-10-1-RELEASE:1.23
	perseant-exfatfs-base-20240630:1.23
	perseant-exfatfs:1.23.0.26
	perseant-exfatfs-base:1.23
	netbsd-8-3-RELEASE:1.20
	netbsd-9-4-RELEASE:1.22.2.1
	netbsd-10-0-RELEASE:1.23
	netbsd-10-0-RC6:1.23
	netbsd-10-0-RC5:1.23
	netbsd-10-0-RC4:1.23
	netbsd-10-0-RC3:1.23
	netbsd-10-0-RC2:1.23
	thorpej-ifq:1.23.0.24
	thorpej-ifq-base:1.23
	thorpej-altq-separation:1.23.0.22
	thorpej-altq-separation-base:1.23
	netbsd-10-0-RC1:1.23
	netbsd-10:1.23.0.20
	netbsd-10-base:1.23
	bouyer-sunxi-drm:1.23.0.18
	bouyer-sunxi-drm-base:1.23
	netbsd-9-3-RELEASE:1.22.2.1
	thorpej-i2c-spi-conf2:1.23.0.16
	thorpej-i2c-spi-conf2-base:1.23
	thorpej-futex2:1.23.0.14
	thorpej-futex2-base:1.23
	thorpej-cfargs2:1.23.0.12
	thorpej-cfargs2-base:1.23
	cjep_sun2x-base1:1.23
	cjep_sun2x:1.23.0.10
	cjep_sun2x-base:1.23
	cjep_staticlib_x-base1:1.23
	netbsd-9-2-RELEASE:1.22.2.1
	cjep_staticlib_x:1.23.0.8
	cjep_staticlib_x-base:1.23
	thorpej-i2c-spi-conf:1.23.0.6
	thorpej-i2c-spi-conf-base:1.23
	thorpej-cfargs:1.23.0.4
	thorpej-cfargs-base:1.23
	thorpej-futex:1.23.0.2
	thorpej-futex-base:1.23
	netbsd-9-1-RELEASE:1.22.2.1
	bouyer-xenpvh-base2:1.22
	phil-wifi-20200421:1.22
	bouyer-xenpvh-base1:1.22
	phil-wifi-20200411:1.22
	bouyer-xenpvh:1.22.0.8
	bouyer-xenpvh-base:1.22
	is-mlppp:1.22.0.6
	is-mlppp-base:1.22
	phil-wifi-20200406:1.22
	netbsd-8-2-RELEASE:1.20
	ad-namecache-base3:1.22
	netbsd-9-0-RELEASE:1.22
	netbsd-9-0-RC2:1.22
	ad-namecache-base2:1.22
	ad-namecache-base1:1.22
	ad-namecache:1.22.0.4
	ad-namecache-base:1.22
	netbsd-9-0-RC1:1.22
	phil-wifi-20191119:1.22
	netbsd-9:1.22.0.2
	netbsd-9-base:1.22
	phil-wifi-20190609:1.21
	netbsd-8-1-RELEASE:1.20
	netbsd-8-1-RC1:1.20
	isaki-audio2:1.21.0.2
	isaki-audio2-base:1.21
	pgoyette-compat-merge-20190127:1.20.14.1
	pgoyette-compat-20190127:1.21
	pgoyette-compat-20190118:1.21
	pgoyette-compat-1226:1.21
	pgoyette-compat-1126:1.21
	pgoyette-compat-1020:1.21
	pgoyette-compat-0930:1.21
	pgoyette-compat-0906:1.20
	netbsd-7-2-RELEASE:1.17.2.1
	pgoyette-compat-0728:1.20
	netbsd-8-0-RELEASE:1.20
	phil-wifi:1.20.0.16
	phil-wifi-base:1.20
	pgoyette-compat-0625:1.20
	netbsd-8-0-RC2:1.20
	pgoyette-compat-0521:1.20
	pgoyette-compat-0502:1.20
	pgoyette-compat-0422:1.20
	netbsd-8-0-RC1:1.20
	pgoyette-compat-0415:1.20
	pgoyette-compat-0407:1.20
	pgoyette-compat-0330:1.20
	pgoyette-compat-0322:1.20
	pgoyette-compat-0315:1.20
	netbsd-7-1-2-RELEASE:1.17.2.1
	pgoyette-compat:1.20.0.14
	pgoyette-compat-base:1.20
	netbsd-7-1-1-RELEASE:1.17.2.1
	tls-maxphys-base-20171202:1.20
	matt-nb8-mediatek:1.20.0.12
	matt-nb8-mediatek-base:1.20
	nick-nhusb-base-20170825:1.20
	perseant-stdc-iso10646:1.20.0.10
	perseant-stdc-iso10646-base:1.20
	netbsd-8:1.20.0.8
	netbsd-8-base:1.20
	prg-localcount2-base3:1.20
	prg-localcount2-base2:1.20
	prg-localcount2-base1:1.20
	prg-localcount2:1.20.0.6
	prg-localcount2-base:1.20
	pgoyette-localcount-20170426:1.20
	bouyer-socketcan-base1:1.20
	jdolecek-ncq:1.20.0.4
	jdolecek-ncq-base:1.20
	pgoyette-localcount-20170320:1.20
	netbsd-7-1:1.17.2.1.0.2
	netbsd-7-1-RELEASE:1.17.2.1
	netbsd-7-1-RC2:1.17.2.1
	nick-nhusb-base-20170204:1.20
	netbsd-7-nhusb-base-20170116:1.17.2.1
	bouyer-socketcan:1.20.0.2
	bouyer-socketcan-base:1.20
	pgoyette-localcount-20170107:1.20
	netbsd-7-1-RC1:1.17.2.1
	nick-nhusb-base-20161204:1.17
	pgoyette-localcount-20161104:1.17
	netbsd-7-0-2-RELEASE:1.17
	nick-nhusb-base-20161004:1.17
	localcount-20160914:1.17
	netbsd-7-nhusb:1.17.0.10
	netbsd-7-nhusb-base:1.17
	pgoyette-localcount-20160806:1.17
	pgoyette-localcount-20160726:1.17
	pgoyette-localcount:1.17.0.8
	pgoyette-localcount-base:1.17
	nick-nhusb-base-20160907:1.17
	nick-nhusb-base-20160529:1.17
	netbsd-7-0-1-RELEASE:1.17
	nick-nhusb-base-20160422:1.17
	nick-nhusb-base-20160319:1.17
	nick-nhusb-base-20151226:1.17
	netbsd-7-0:1.17.0.6
	netbsd-7-0-RELEASE:1.17
	nick-nhusb-base-20150921:1.17
	netbsd-7-0-RC3:1.17
	netbsd-7-0-RC2:1.17
	netbsd-7-0-RC1:1.17
	nick-nhusb-base-20150606:1.17
	nick-nhusb-base-20150406:1.17
	nick-nhusb:1.17.0.4
	nick-nhusb-base:1.17
	netbsd-6-0-6-RELEASE:1.6.2.1
	netbsd-6-1-5-RELEASE:1.6.2.4
	netbsd-7:1.17.0.2
	netbsd-7-base:1.17
	yamt-pagecache-base9:1.16
	yamt-pagecache-tag8:1.4.10.3
	netbsd-6-1-4-RELEASE:1.6.2.4
	netbsd-6-0-5-RELEASE:1.6.2.1
	tls-earlyentropy:1.16.0.2
	tls-earlyentropy-base:1.17
	riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.16
	riastradh-drm2-base3:1.16
	netbsd-6-1-3-RELEASE:1.6.2.4
	netbsd-6-0-4-RELEASE:1.6.2.1
	netbsd-6-1-2-RELEASE:1.6.2.4
	netbsd-6-0-3-RELEASE:1.6.2.1
	rmind-smpnet-nbase:1.16
	netbsd-6-1-1-RELEASE:1.6.2.4
	riastradh-drm2-base2:1.13
	riastradh-drm2-base1:1.13
	riastradh-drm2:1.13.0.4
	riastradh-drm2-base:1.13
	rmind-smpnet:1.13.0.2
	rmind-smpnet-base:1.16
	netbsd-6-1:1.6.2.4.0.2
	netbsd-6-0-2-RELEASE:1.6.2.1
	netbsd-6-1-RELEASE:1.6.2.4
	khorben-n900:1.12.0.4
	netbsd-6-1-RC4:1.6.2.4
	netbsd-6-1-RC3:1.6.2.4
	agc-symver:1.12.0.2
	agc-symver-base:1.12
	netbsd-6-1-RC2:1.6.2.4
	netbsd-6-1-RC1:1.6.2.4
	yamt-pagecache-base8:1.9
	netbsd-6-0-1-RELEASE:1.6.2.1
	yamt-pagecache-base7:1.9
	matt-nb6-plus-nbase:1.6.2.1
	yamt-pagecache-base6:1.8
	netbsd-6-0:1.6.2.1.0.4
	netbsd-6-0-RELEASE:1.6.2.1
	netbsd-6-0-RC2:1.6.2.1
	tls-maxphys:1.7.0.2
	tls-maxphys-base:1.17
	matt-nb6-plus:1.6.2.1.0.2
	matt-nb6-plus-base:1.6.2.1
	netbsd-6-0-RC1:1.6.2.1
	jmcneill-usbmp-base10:1.6
	yamt-pagecache-base5:1.6
	jmcneill-usbmp-base9:1.6
	yamt-pagecache-base4:1.6
	jmcneill-usbmp-base8:1.6
	jmcneill-usbmp-base7:1.6
	jmcneill-usbmp-base6:1.6
	jmcneill-usbmp-base5:1.6
	jmcneill-usbmp-base4:1.6
	jmcneill-usbmp-base3:1.6
	jmcneill-usbmp-pre-base2:1.5
	jmcneill-usbmp-base2:1.6
	netbsd-6:1.6.0.2
	netbsd-6-base:1.6
	jmcneill-usbmp:1.5.0.2
	jmcneill-usbmp-base:1.5
	jmcneill-audiomp3:1.4.0.12
	jmcneill-audiomp3-base:1.4
	yamt-pagecache-base3:1.4
	yamt-pagecache-base2:1.4
	yamt-pagecache:1.4.0.10
	yamt-pagecache-base:1.4
	rmind-uvmplock-nbase:1.4
	cherry-xenmp:1.4.0.8
	cherry-xenmp-base:1.4
	rmind-uvmplock-base:1.4
	rmind-uvmplock:1.4.0.6
	bouyer-quota2-nbase:1.4
	bouyer-quota2:1.4.0.4
	bouyer-quota2-base:1.4
	jruoho-x86intr:1.4.0.2
	jruoho-x86intr-base:1.4
	matt-mips64-premerge-20101231:1.4
	uebayasi-xip-base4:1.2
	uebayasi-xip:1.2.0.4
	uebayasi-xip-base3:1.2
	yamt-nfs-mp:1.2.0.2
	yamt-nfs-mp-base11:1.2;
locks; strict;
comment	@# @;


1.25
date	2026.04.08.00.33.07;	author joe;	state Exp;
branches;
next	1.24;
commitid	BN4kN8qNqKcgB5BG;

1.24
date	2025.06.01.00.24.19;	author joe;	state Exp;
branches;
next	1.23;
commitid	ehQ4nypQyUw2y7XF;

1.23
date	2020.05.30.14.16.56;	author rmind;	state Exp;
branches
	1.23.26.1;
next	1.22;
commitid	fZlE4LRokUrgTgaC;

1.22
date	2019.07.23.00.52.01;	author rmind;	state Exp;
branches
	1.22.2.1;
next	1.21;
commitid	wZghwo6mmoF6u6wB;

1.21
date	2018.09.29.14.41.36;	author rmind;	state Exp;
branches;
next	1.20;
commitid	1PaZzhI9AYpgB0UA;

1.20
date	2017.01.02.21.49.51;	author rmind;	state Exp;
branches
	1.20.14.1
	1.20.16.1;
next	1.19;
commitid	mqwuYwjXqIsbprAz;

1.19
date	2016.12.26.23.05.06;	author christos;	state Exp;
branches;
next	1.18;
commitid	dJFKmYYqK2NG2yzz;

1.18
date	2016.12.09.02.40.38;	author christos;	state Exp;
branches;
next	1.17;
commitid	ARuPhTz4A7qFOfxz;

1.17
date	2014.07.19.18.24.16;	author rmind;	state Exp;
branches
	1.17.2.1
	1.17.4.1
	1.17.8.1
	1.17.10.1;
next	1.16;
commitid	Elg6KqjwD1P381Jx;

1.16
date	2013.11.08.00.38.26;	author rmind;	state Exp;
branches
	1.16.2.1;
next	1.15;
commitid	XM3mgnNRQpczlpcx;

1.15
date	2013.09.19.01.49.07;	author rmind;	state Exp;
branches;
next	1.14;
commitid	VSNgsNtP8JYImZ5x;

1.14
date	2013.09.19.01.04.46;	author rmind;	state Exp;
branches;
next	1.13;
commitid	p3Zzinm4v6Ct7Z5x;

1.13
date	2013.06.02.02.20.04;	author rmind;	state Exp;
branches
	1.13.2.1;
next	1.12;
commitid	egs2nvL6L2rz2ZRw;

1.12
date	2013.03.12.20.47.48;	author christos;	state Exp;
branches;
next	1.11;

1.11
date	2013.03.10.20.51.44;	author christos;	state Exp;
branches;
next	1.10;

1.10
date	2013.02.09.03.35.31;	author rmind;	state Exp;
branches;
next	1.9;

1.9
date	2012.12.10.00.32.23;	author rmind;	state Exp;
branches;
next	1.8;

1.8
date	2012.09.16.13.47.41;	author rmind;	state Exp;
branches;
next	1.7;

1.7
date	2012.07.15.00.22.59;	author rmind;	state Exp;
branches
	1.7.2.1;
next	1.6;

1.6
date	2012.02.06.23.30.14;	author rmind;	state Exp;
branches
	1.6.2.1;
next	1.5;

1.5
date	2011.11.29.20.05.30;	author rmind;	state Exp;
branches
	1.5.2.1;
next	1.4;

1.4
date	2010.12.18.01.07.25;	author rmind;	state Exp;
branches
	1.4.6.1
	1.4.10.1;
next	1.3;

1.3
date	2010.11.11.06.30.39;	author rmind;	state Exp;
branches;
next	1.2;

1.2
date	2010.09.16.04.53.27;	author rmind;	state Exp;
branches
	1.2.2.1
	1.2.4.1;
next	1.1;

1.1
date	2010.08.22.18.56.22;	author rmind;	state Exp;
branches;
next	;

1.23.26.1
date	2025.08.02.05.57.48;	author perseant;	state Exp;
branches;
next	;
commitid	23j6GFaDws3O875G;

1.22.2.1
date	2020.06.20.15.46.47;	author martin;	state Exp;
branches;
next	;
commitid	1R3KrEVYbMGFJYcC;

1.20.14.1
date	2018.09.30.01.45.56;	author pgoyette;	state Exp;
branches;
next	;
commitid	SQ44grEPCeKPh4UA;

1.20.16.1
date	2019.06.10.22.09.46;	author christos;	state Exp;
branches;
next	1.20.16.2;
commitid	jtc8rnCzWiEEHGqB;

1.20.16.2
date	2020.04.13.08.05.15;	author martin;	state Exp;
branches;
next	;
commitid	X01YhRUPVUDaec4C;

1.17.2.1
date	2016.12.18.07.40.50;	author snj;	state Exp;
branches;
next	;
commitid	7whfpxNdH8btbryz;

1.17.4.1
date	2017.02.05.13.40.58;	author skrll;	state Exp;
branches;
next	;
commitid	8hwpk1aHl2UuyLEz;

1.17.8.1
date	2017.01.07.08.56.50;	author pgoyette;	state Exp;
branches;
next	;
commitid	uEL0C1YuiJrlV0Bz;

1.17.10.1
date	2017.01.18.08.46.46;	author skrll;	state Exp;
branches;
next	;
commitid	M6f3RyDtiAR3wqCz;

1.16.2.1
date	2014.08.10.06.56.16;	author tls;	state Exp;
branches;
next	;
commitid	VywzU7NDeggtCMLx;

1.13.2.1
date	2014.05.18.17.46.13;	author rmind;	state Exp;
branches;
next	;
commitid	mL5ZYSzpqK6QS2Bx;

1.7.2.1
date	2012.11.20.03.02.47;	author tls;	state Exp;
branches;
next	1.7.2.2;

1.7.2.2
date	2013.02.25.00.30.02;	author tls;	state Exp;
branches;
next	1.7.2.3;

1.7.2.3
date	2013.06.23.06.20.25;	author tls;	state Exp;
branches;
next	1.7.2.4;
commitid	eVjr9caYRQbRGHUw;

1.7.2.4
date	2014.08.20.00.04.35;	author tls;	state Exp;
branches;
next	1.7.2.5;
commitid	jTnpym9Qu0o4R1Nx;

1.7.2.5
date	2017.12.03.11.39.02;	author jdolecek;	state Exp;
branches;
next	;
commitid	XcIYRZTAh1LmerhA;

1.6.2.1
date	2012.07.16.22.13.27;	author riz;	state Exp;
branches;
next	1.6.2.2;

1.6.2.2
date	2012.11.18.22.38.27;	author riz;	state Exp;
branches;
next	1.6.2.3;

1.6.2.3
date	2012.12.15.23.45.58;	author riz;	state Exp;
branches;
next	1.6.2.4;

1.6.2.4
date	2013.02.11.21.49.49;	author riz;	state Exp;
branches;
next	;

1.5.2.1
date	2012.02.18.07.35.38;	author mrg;	state Exp;
branches;
next	;

1.4.6.1
date	2010.12.18.01.07.25;	author rmind;	state dead;
branches;
next	1.4.6.2;

1.4.6.2
date	2011.03.05.20.55.54;	author rmind;	state Exp;
branches;
next	;

1.4.10.1
date	2012.04.17.00.08.38;	author yamt;	state Exp;
branches;
next	1.4.10.2;

1.4.10.2
date	2012.10.30.17.22.44;	author yamt;	state Exp;
branches;
next	1.4.10.3;

1.4.10.3
date	2013.01.16.05.33.49;	author yamt;	state Exp;
branches;
next	1.4.10.4;

1.4.10.4
date	2014.05.22.11.41.09;	author yamt;	state Exp;
branches;
next	;
commitid	VUUXuyNWnt3AKwBx;

1.2.2.1
date	2010.09.16.04.53.27;	author yamt;	state dead;
branches;
next	1.2.2.2;

1.2.2.2
date	2010.10.09.03.32.37;	author yamt;	state Exp;
branches;
next	;

1.2.4.1
date	2010.09.16.04.53.27;	author uebayasi;	state dead;
branches;
next	1.2.4.2;

1.2.4.2
date	2010.10.22.09.23.14;	author uebayasi;	state Exp;
branches;
next	;


desc
@@


1.25
log
@Add Policy based routing by interface in NPF
@
text
@# $NetBSD: files.npf,v 1.24 2025/06/01 00:24:19 joe Exp $
#
# Public Domain.
#

#
# NPF pseudo device and modules.
#

defpseudo	npf:	ifnet, libnv

# Core
file	net/npf/npf.c				npf
file	net/npf/npf_conf.c			npf
file	net/npf/npf_ctl.c			npf
file	net/npf/npf_handler.c			npf
file	net/npf/npf_mbuf.c			npf
file	net/npf/npf_bpf.c			npf
file	net/npf/npf_params.c			npf
file	net/npf/npf_ruleset.c			npf
file	net/npf/npf_rproc.c			npf
file	net/npf/npf_tableset.c			npf
file	net/npf/npf_if.c			npf
file	net/npf/npf_inet.c			npf
file	net/npf/npf_conn.c			npf
file	net/npf/npf_connkey.c			npf
file	net/npf/npf_conndb.c			npf
file	net/npf/npf_state.c			npf
file	net/npf/npf_state_tcp.c			npf
file	net/npf/npf_nat.c			npf
file	net/npf/npf_portmap.c			npf
file	net/npf/npf_alg.c			npf
file	net/npf/npf_sendpkt.c			npf
file	net/npf/npf_worker.c			npf
file    net/npf/npf_socket.c			npf

file	net/npf/npf_os.c			npf
file	net/npf/npf_ifaddr.c			npf

# LPM
file	net/npf/lpm.c				npf

# Built-in extensions.
file	net/npf/npf_ext_log.c			npf
file	net/npf/npf_ext_normalize.c		npf
file	net/npf/npf_ext_rndblock.c		npf
file	net/npf/npf_ext_route.c			npf

# ALGs
file	net/npf/npf_alg_icmp.c			npf
# file	net/npf/npf_alg_pptp.c			npf

# Interfaces
file	net/npf/if_npflog.c			npf
@


1.24
log
@kernel: extract rules, lookup socket, process filtering, reviews by christos@@
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.23 2020/05/30 14:16:56 rmind Exp $
d47 1
@


1.23
log
@Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.22 2019/07/23 00:52:01 rmind Exp $
d35 1
@


1.23.26.1
log
@Sync with HEAD
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.24 2025/06/01 00:24:19 joe Exp $
a34 1
file    net/npf/npf_socket.c			npf
@


1.22
log
@NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.21 2018/09/29 14:41:36 rmind Exp $
d49 1
@


1.22.2.1
log
@Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@@.

Use more markup.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.22 2019/07/23 00:52:01 rmind Exp $
a48 1
# file	net/npf/npf_alg_pptp.c			npf
@


1.21
log
@NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
  a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
  previous versions.  Also, different serialisation format means NPF
  connection/config saving and loading is not compatible with the
  previous versions either.

Thanks to christos@@ for extra testing.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.20 2017/01/02 21:49:51 rmind Exp $
d19 1
d26 1
d31 1
@


1.20
log
@NPF: implement dynamic handling of interface addresses (the kernel part).
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.19 2016/12/26 23:05:06 christos Exp $
d10 1
a10 1
defpseudo	npf:	ifnet
@


1.20.16.1
log
@Sync with HEAD
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.21 2018/09/29 14:41:36 rmind Exp $
d10 1
a10 1
defpseudo	npf:	ifnet, libnv
@


1.20.16.2
log
@Mostly merge changes from HEAD upto 20200411
@
text
@d1 1
a1 1
# $NetBSD$
a18 1
file	net/npf/npf_params.c			npf
a24 1
file	net/npf/npf_connkey.c			npf
a28 1
file	net/npf/npf_portmap.c			npf
@


1.20.14.1
log
@Ssync with HEAD
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.21 2018/09/29 14:41:36 rmind Exp $
d10 1
a10 1
defpseudo	npf:	ifnet, libnv
@


1.19
log
@Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@@)
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.18 2016/12/09 02:40:38 christos Exp $
a13 1
file	net/npf/npf_os.c			npf
d33 3
@


1.18
log
@This patches ditches the ptree(3) library, because it is broken (you
can get missing entries!).  Instead, as a temporary solution, we switch
to a simple linear scan of the hash tables for the longest-prefix-match
(lpm.c lpm.h) algorithm. In fact, with few unique prefixes in the set,
on modern hardware this simple algorithm is pretty fast anyway!
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.17 2014/07/19 18:24:16 rmind Exp $
d14 1
@


1.17
log
@NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
  and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.16 2013/11/08 00:38:26 rmind Exp $
a21 1
file	net/npf/npf_tableset_ptree.c		npf
d33 3
@


1.17.4.1
log
@Sync with HEAD
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.20 2017/01/02 21:49:51 rmind Exp $
d22 1
a33 6
file	net/npf/npf_os.c			npf
file	net/npf/npf_ifaddr.c			npf

# LPM
file	net/npf/lpm.c				npf

@


1.17.10.1
log
@Sync with netbsd-5
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.17.2.1 2016/12/18 07:40:50 snj Exp $
d22 1
a33 3
# LPM
file	net/npf/lpm.c				npf

@


1.17.8.1
log
@Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.20 2017/01/02 21:49:51 rmind Exp $
d22 1
a33 6
file	net/npf/npf_os.c			npf
file	net/npf/npf_ifaddr.c			npf

# LPM
file	net/npf/lpm.c				npf

@


1.17.2.1
log
@Pull up following revision(s) (requested by rmind in ticket #1319):
	sys/modules/npf/Makefile: revision 1.19
	sys/net/npf/files.npf: revision 1.18
	sys/net/npf/lpm.c: revision 1.1
	sys/net/npf/lpm.h: revision 1.1
	sys/net/npf/npf_impl.h: revision 1.62
	sys/net/npf/npf_tableset.c: revision 1.24
	sys/net/npf/npf_tableset_ptree.c: file removal
	sys/rump/net/lib/libnpf/Makefile: revision 1.18
This patches ditches the ptree(3) library, because it is broken (you
can get missing entries!).  Instead, as a temporary solution, we switch
to a simple linear scan of the hash tables for the longest-prefix-match
(lpm.c lpm.h) algorithm. In fact, with few unique prefixes in the set,
on modern hardware this simple algorithm is pretty fast anyway!
--
ditch ptree and use lpm
--
remove ptree add lpm
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.17 2014/07/19 18:24:16 rmind Exp $
d22 1
a33 3
# LPM
file	net/npf/lpm.c				npf

@


1.16
log
@NPF: add support for specifying the interfaces before they are attached.
If an interface is or gets detached, all associated rules and connections
will be deactivated (it might be useful to have an option to invalidate
the associated connections).  Once the interface is reattached they will
become active.

Bump NPF_VERSION.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.15 2013/09/19 01:49:07 rmind Exp $
d25 2
a26 1
file	net/npf/npf_session.c			npf
@


1.16.2.1
log
@Rebase.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.17 2014/07/19 18:24:16 rmind Exp $
d25 1
a25 2
file	net/npf/npf_conn.c			npf
file	net/npf/npf_conndb.c			npf
@


1.15
log
@NPF: G/C n-code in favour of BPF byte-code.  Delete lots of code, mmm!
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.14 2013/09/19 01:04:46 rmind Exp $
d23 1
@


1.14
log
@- Convert NPF to use BPF byte-code by default.  Compile BPF byte-code in
  npfctl(8) and generate separate marks to describe the filter criteria.
- Rewrite 'npfctl show' functionality and fix some of the bugs.
- npftest: add a test for BPF COP.
- Bump NPF_VERSION.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.13 2013/06/02 02:20:04 rmind Exp $
a16 1
file	net/npf/npf_instr.c			npf
a17 1
file	net/npf/npf_processor.c			npf
@


1.13
log
@- NPF connection tracking: rework synchronisation on tracking disable/enable
  points and document it.  Split the worker thread into a separate module
  with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.12 2013/03/12 20:47:48 christos Exp $
d20 1
@


1.13.2.1
log
@sync with head
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.13 2013/06/02 02:20:04 rmind Exp $
d17 1
d19 1
a19 1
file	net/npf/npf_bpf.c			npf
a23 1
file	net/npf/npf_if.c			npf
@


1.12
log
@normali{s,z}e
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.11 2013/03/10 20:51:44 christos Exp $
d31 1
@


1.11
log
@Split the npflog cloner and auto-load the extensions.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.10 2013/02/09 03:35:31 rmind Exp $
d34 1
a34 1
file	net/npf/npf_ext_normalise.c		npf
@


1.10
log
@NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.9 2012/12/10 00:32:23 rmind Exp $
d39 3
@


1.9
log
@Add NPF "rndblock" extension to randomly drop packets (using a random function
with a percentage or modulo operation).  This is a demo module, although it can
be used for packet loss simulation.  Example of a procedure in npf.conf:

procedure "somedrop" {
	# Drop 1.9% of the traffic
	rndblock: percentage 1.9
}
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.8 2012/09/16 13:47:41 rmind Exp $
d14 1
@


1.8
log
@Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.7 2012/07/15 00:22:59 rmind Exp $
d34 1
@


1.7
log
@- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.6 2012/02/06 23:30:14 rmind Exp $
d30 4
a33 1
file	net/npf/npf_log.c			npf
@


1.7.2.1
log
@Resync to 2012-11-19 00:00:00 UTC
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.8 2012/09/16 13:47:41 rmind Exp $
d30 1
a30 4

# Built-in extensions.
file	net/npf/npf_ext_log.c			npf
file	net/npf/npf_ext_normalise.c		npf
@


1.7.2.2
log
@resync with head
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.7.2.1 2012/11/20 03:02:47 tls Exp $
a13 1
file	net/npf/npf_conf.c			npf
a33 1
file	net/npf/npf_ext_rndblock.c		npf
@


1.7.2.3
log
@resync from head
@
text
@d1 1
a1 1
# $NetBSD$
a30 1
file	net/npf/npf_worker.c			npf
d34 1
a34 1
file	net/npf/npf_ext_normalize.c		npf
a38 3

# Interfaces
file	net/npf/if_npflog.c			npf
@


1.7.2.4
log
@Rebase to HEAD as of a few days ago.
@
text
@d17 1
d19 1
a19 1
file	net/npf/npf_bpf.c			npf
a23 1
file	net/npf/npf_if.c			npf
d25 1
a25 2
file	net/npf/npf_conn.c			npf
file	net/npf/npf_conndb.c			npf
@


1.7.2.5
log
@update from HEAD
@
text
@d22 1
a33 6
file	net/npf/npf_os.c			npf
file	net/npf/npf_ifaddr.c			npf

# LPM
file	net/npf/lpm.c				npf

@


1.6
log
@- Split NPF rule procedure code into a separate module (no functional changes).
- Simplify some code, add more comments, some asserts.
- G/C unused rule hook code.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.5 2011/11/29 20:05:30 rmind Exp $
d22 1
@


1.6.2.1
log
@Pull up following revision(s) (requested by rmind in ticket #421):
	lib/libnpf/npf.c: revision 1.10
	sys/net/npf/npf_session.c: revision 1.15
	sys/net/npf/npf_tableset.c: revision 1.13
	sys/net/npf/npf_state_tcp.c: revision 1.9
	usr.sbin/npf/npfctl/npf_data.c: revision 1.15
	sys/net/npf/npf_inet.c: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.13
	sys/net/npf/npf.h: revision 1.19
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12
	sys/net/npf/npf_instr.c: revision 1.13
	sys/net/npf/npf_handler.c: revision 1.20
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4
	sys/net/npf/npf_alg_icmp.c: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.11
	lib/libnpf/npf.h: revision 1.9
	sys/net/npf/npf_alg.c: revision 1.5
	sys/rump/dev/lib/libnpf/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.15
	sys/net/npf/npf_tableset_ptree.c: revision 1.1
	sys/net/npf/npf.c: revision 1.12
	sys/net/npf/npf_sendpkt.c: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.18
	sys/net/npf/files.npf: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.10
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.
@
text
@d1 1
a1 1
# $NetBSD$
a21 1
file	net/npf/npf_tableset_ptree.c		npf
@


1.6.2.2
log
@Pull up following revision(s) (requested by rmind in ticket #693):
	lib/npf/ext_normalise/shlib_version: revision 1.1
	lib/libnpf/npf.c: revision 1.13
	distrib/sets/lists/modules/mi: revision 1.48
	sys/net/npf/npf_rproc.c: revision 1.3
	sys/net/npf/npf_rproc.c: revision 1.4
	sys/modules/npf/Makefile: revision 1.11
	usr.sbin/npf/npfctl/npfctl.h: revision 1.20
	lib/npf/ext_log/npfext_log.c: revision 1.1
	lib/libnpf/npf.h: revision 1.11
	sys/net/npf/npf_inet.c: revision 1.17
	sys/net/npf/npf_log.c: file removal
	sys/net/npf/npf_handler.c: revision 1.22
	distrib/sets/lists/base/shl.mi: revision 1.636
	sys/net/npf/npf_impl.h: revision 1.23
	usr.sbin/npf/npfctl/Makefile: revision 1.8
	lib/npf/Makefile: revision 1.1
	lib/npf/ext_log/shlib_version: revision 1.1
	lib/Makefile: revision 1.189
	distrib/sets/lists/comp/shl.mi: revision 1.236
	usr.sbin/npf/npfctl/npf_build.c: revision 1.14
	distrib/sets/lists/base/mi: revision 1.1007
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
	distrib/sets/lists/base/mi: revision 1.1009
	sys/net/npf/npf.h: revision 1.21
	lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.105
	lib/libnpf/Makefile: revision 1.3
	etc/mtree/NetBSD.dist.base: revision 1.106
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
	sys/net/npf/npf_ctl.c: revision 1.18
	lib/npf/ext_log/Makefile: revision 1.1
	distrib/sets/lists/comp/mi: revision 1.1781
	usr.sbin/npf/npfctl/npf_var.h: revision 1.4
	sys/net/npf/npf.c: revision 1.13
	sys/modules/Makefile: revision 1.111
	sys/net/npf/npf_ext_log.c: revision 1.1
	lib/npf/Makefile.inc: revision 1.1
	sys/net/npf/npf_ext_normalise.c: revision 1.1
	sys/net/npf/files.npf: revision 1.8
	sys/rump/net/lib/libnpf/Makefile: revision 1.2
	sys/modules/npf_ext_log/Makefile: revision 1.1
	lib/npf/ext_normalise/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npfctl.c: revision 1.20
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
	sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@@
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.6.2.1 2012/07/16 22:13:27 riz Exp $
d30 1
a30 4

# Built-in extensions.
file	net/npf/npf_ext_log.c			npf
file	net/npf/npf_ext_normalise.c		npf
@


1.6.2.3
log
@Pull up following revision(s) (requested by rmind in ticket #745):
	distrib/sets/lists/comp/shl.mi: revision 1.241
	distrib/sets/lists/modules/mi: revision 1.49
	distrib/sets/lists/base/md.sparc64: revision 1.171
	lib/npf/ext_rndblock/npfext_rndblock.c: revision 1.1
	distrib/sets/lists/base/ad.mips64eb: revision 1.106
	distrib/sets/lists/modules/md.evbppc: revision 1.29
	sys/net/npf/npf_ext_rndblock.c: revision 1.1
	lib/npf/Makefile: revision 1.2
	sys/modules/npf_ext_rndblock/Makefile: revision 1.1
	lib/npf/ext_rndblock/Makefile: revision 1.1
	distrib/sets/lists/base/ad.mips64el: revision 1.106
	lib/npf/ext_rndblock/shlib_version: revision 1.1
	distrib/sets/lists/base/md.amd64: revision 1.182
	distrib/sets/lists/base/shl.mi: revision 1.643
	sys/net/npf/files.npf: revision 1.9
	sys/modules/Makefile: revision 1.117
Add NPF "rndblock" extension to randomly drop packets (using a random function
with a percentage or modulo operation).  This is a demo module, although it can
be used for packet loss simulation.  Example of a procedure in npf.conf:
procedure "somedrop" {
        # Drop 1.9% of the traffic
        rndblock: percentage 1.9
}
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.6.2.2 2012/11/18 22:38:27 riz Exp $
a33 1
file	net/npf/npf_ext_rndblock.c		npf
@


1.6.2.4
log
@Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@@.
npftest: adjust for recent change.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.6.2.3 2012/12/15 23:45:58 riz Exp $
a13 1
file	net/npf/npf_conf.c			npf
@


1.5
log
@- Rework and improve TCP state tracking.
- Fix regressions after IPv6 patch merge.

Note: npfctl(8) rework will come soon.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.4 2010/12/18 01:07:25 rmind Exp $
d20 1
@


1.5.2.1
log
@merge to -current.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.6 2012/02/06 23:30:14 rmind Exp $
a19 1
file	net/npf/npf_rproc.c			npf
@


1.4
log
@NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.3 2010/11/11 06:30:39 rmind Exp $
d24 1
@


1.4.10.1
log
@sync with head
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.4 2010/12/18 01:07:25 rmind Exp $
a19 1
file	net/npf/npf_rproc.c			npf
a23 1
file	net/npf/npf_state_tcp.c			npf
@


1.4.10.2
log
@sync with head
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.4.10.1 2012/04/17 00:08:38 yamt Exp $
a21 1
file	net/npf/npf_tableset_ptree.c		npf
d29 1
a29 4

# Built-in extensions.
file	net/npf/npf_ext_log.c			npf
file	net/npf/npf_ext_normalise.c		npf
@


1.4.10.3
log
@sync with (a bit old) head
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.4.10.2 2012/10/30 17:22:44 yamt Exp $
a33 1
file	net/npf/npf_ext_rndblock.c		npf
@


1.4.10.4
log
@sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.4.10.3 2013/01/16 05:33:49 yamt Exp $
a13 1
file	net/npf/npf_conf.c			npf
d16 1
d18 1
a18 1
file	net/npf/npf_bpf.c			npf
a22 1
file	net/npf/npf_if.c			npf
a29 1
file	net/npf/npf_worker.c			npf
d33 1
a33 1
file	net/npf/npf_ext_normalize.c		npf
a37 3

# Interfaces
file	net/npf/if_npflog.c			npf
@


1.4.6.1
log
@file files.npf was added on branch rmind-uvmplock on 2011-03-05 20:55:54 +0000
@
text
@d1 30
@


1.4.6.2
log
@sync with head
@
text
@a0 30
# $NetBSD$
#
# Public Domain.
#

#
# NPF pseudo device and modules.
#

defpseudo	npf:	ifnet

# Core
file	net/npf/npf.c				npf
file	net/npf/npf_ctl.c			npf
file	net/npf/npf_handler.c			npf
file	net/npf/npf_instr.c			npf
file	net/npf/npf_mbuf.c			npf
file	net/npf/npf_processor.c			npf
file	net/npf/npf_ruleset.c			npf
file	net/npf/npf_tableset.c			npf
file	net/npf/npf_inet.c			npf
file	net/npf/npf_session.c			npf
file	net/npf/npf_state.c			npf
file	net/npf/npf_nat.c			npf
file	net/npf/npf_alg.c			npf
file	net/npf/npf_sendpkt.c			npf
file	net/npf/npf_log.c			npf

# ALGs
file	net/npf/npf_alg_icmp.c			npf
@


1.3
log
@NPF checkpoint:
- Add proper TCP state tracking as described in Guido van Rooij paper,
  plus handle TCP Window Scaling option.
- Completely rework npf_cache_t, reduce granularity, simplify code.
- Add npf_addr_t as an abstraction, amend session handling code, as well
  as NAT code et al, to use it.  Now design is prepared for IPv6 support.
- Handle IPv4 fragments i.e. perform packet reassembly.
- Add support for IPv4 ID randomization and minimum TTL enforcement.
- Add support for TCP MSS "clamping".
- Random bits for IPv6.  Various fixes and clean-up.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.2 2010/09/16 04:53:27 rmind Exp $
d27 1
@


1.2
log
@NPF checkpoint:
- Add support for bi-directional NAT and redirection / port forwarding.
- Finish filtering on ICMP type/code and add filtering on TCP flags.
- Add support for TCP reset (RST) or ICMP destination unreachable on block.
- Fix a bunch of bugs; misc cleanup.
@
text
@d1 1
a1 1
# $NetBSD: files.npf,v 1.1 2010/08/22 18:56:22 rmind Exp $
d23 1
@


1.2.4.1
log
@file files.npf was added on branch uebayasi-xip on 2010-10-22 09:23:14 +0000
@
text
@d1 28
@


1.2.4.2
log
@Sync with HEAD (-D20101022).
@
text
@a0 28
# $NetBSD$
#
# Public Domain.
#

#
# NPF pseudo device and modules.
#

defpseudo	npf:	ifnet

# Core
file	net/npf/npf.c				npf
file	net/npf/npf_ctl.c			npf
file	net/npf/npf_handler.c			npf
file	net/npf/npf_instr.c			npf
file	net/npf/npf_mbuf.c			npf
file	net/npf/npf_processor.c			npf
file	net/npf/npf_ruleset.c			npf
file	net/npf/npf_tableset.c			npf
file	net/npf/npf_inet.c			npf
file	net/npf/npf_session.c			npf
file	net/npf/npf_nat.c			npf
file	net/npf/npf_alg.c			npf
file	net/npf/npf_sendpkt.c			npf

# ALGs
file	net/npf/npf_alg_icmp.c			npf
@


1.2.2.1
log
@file files.npf was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000
@
text
@d1 28
@


1.2.2.2
log
@sync with head
@
text
@a0 28
# $NetBSD$
#
# Public Domain.
#

#
# NPF pseudo device and modules.
#

defpseudo	npf:	ifnet

# Core
file	net/npf/npf.c				npf
file	net/npf/npf_ctl.c			npf
file	net/npf/npf_handler.c			npf
file	net/npf/npf_instr.c			npf
file	net/npf/npf_mbuf.c			npf
file	net/npf/npf_processor.c			npf
file	net/npf/npf_ruleset.c			npf
file	net/npf/npf_tableset.c			npf
file	net/npf/npf_inet.c			npf
file	net/npf/npf_session.c			npf
file	net/npf/npf_nat.c			npf
file	net/npf/npf_alg.c			npf
file	net/npf/npf_sendpkt.c			npf

# ALGs
file	net/npf/npf_alg_icmp.c			npf
@


1.1
log
@Import NPF - a packet filter.  Some features:

- Designed to be fully MP-safe and highly efficient.

- Tables/IP sets (hash or red-black tree) for high performance lookups.

- Stateful filtering and Network Address Port Translation (NAPT).
  Framework for application level gateways (ALGs).

- Packet inspection engine called n-code processor - inspired by BPF -
  supporting generic RISC-like and specific CISC-like instructions for
  common patterns (e.g. IPv4 address matching).  See npf_ncode(9) manual.

- Convenient userland utility npfctl(8) with npf.conf(8).

NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.

Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@@
@
text
@d1 1
a1 1
# $NetBSD$
d12 1
d25 4
@