lgcosta/pf-linux-port
1
0 Fork 0
mirror of https://github.com/lgcosta/pf-linux-port.git synced 2026-11-13 05:18:03 -03:00
Code Issues Packages Projects Releases Wiki Activity

Screencasts v2: real shell sessions, MiniMax narration (EN/PT), lab diagram

Browse Source 
O problema da primeira serie era a sensacao de 'quadro a quadro': a captura
era a saida de um script despejada em blocos.  Agora cada video e uma sessao
shell de verdade.

- record.py: abre um pty, faz SSH no firewall e digita os comandos tecla a
  tecla (~34 c/s, com jitter).  O tty remoto ecoa, o kernel responde ao vivo;
  a captura e asciicast v2 com timestamps.  'bash --noediting' evita que o
  editor de linha redesenhe o comando e o tty o repita (a linha aparecia
  duplicada).
- record.py --pace: segura a tela enquanto a voz fala - cada batida dura o
  trecho de audio que a acompanha, de modo que uma unica captura serve as
  duas versoes de idioma.
- record.py --ensure-pf: garante pf.ko carregado antes de gravar.  Sem isso
  uma fase que roda 'rmmod' (ativacao) pode derrubar o /dev/pf de outra
  gravacao concorrentes - foi exatamente o que quebrou a fase de roteamento
  na primeira tentativa.
- make_audio.py: geracao da narracao pelo MiniMax TTS, uma voz feminina por
  idioma (English_ConfidentWoman / Portuguese_ConfidentWoman), um arquivo
  por segmento.  A API devolve o audio em hexadecimal, nao base64.
- render_video.py: reproduz a captura por um emulador de terminal e escreve
  os frames direto no ffmpeg como RGB bruto (um PNG por frame era uma ordem
  de grandeza mais lento).  Desenha o diagrama de rede do lab por cima do
  terminal nas fases de roteamento e balanceamento, destacando o caminho em
  discussao, e queima a legenda da narracao.
- assemble.py: mixa os segmentos de audio na linha do tempo.
- join.py: emenda as fases com crossfade sobre um cartao de capitulo e
  sincroniza o audio na mesma linha do tempo.
- build-all.sh: roda o pipeline inteiro.

Arte de fundo e audio vem do MiniMax; a geracao de video do MiniMax nao esta
habilitada nesta conta (erro 2068 em todos os modelos), entao as transicoes
sao renderizadas localmente com ffmpeg.

16 videos: 7 fases + filme completo, em ingles e portugues, com legenda
queimada.
This commit is contained in:
lgcosta committed 2026-11-12 10:57:29 -03:00
1 parent fe324259c0
commit cc67531602
51 files changed
+2818 -71
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

scripts/screencast/plans/00-ambiente.json
+36
View File
@@ -0,0 +1,36 @@
{
"title": "The lab environment",
"subtitle": "4 Alpine VMs under libvirt, kernel 7.3.4 built from source",
"beats": [
{
"id": "b1",
"cmds": [
"hostname",
"uname -r",
"cat /etc/os-release | head -2"
]
},
{
"id": "b2",
"cmds": [
"ip -br addr",
"ip route"
]
},
{
"id": "b3",
"cmds": [
"ls -l /opt/pf/",
"lsmod | grep '^pf ' || echo 'pf module: not loaded yet'"
]
},
{
"id": "b4",
"cmds": [
"ssh cli 'hostname; ip -br addr | head -2'",
"ssh srv 'hostname; ip -br addr | head -2'"
]
}
],
"phase": "00-ambiente"
}
scripts/screencast/plans/01-implementacao.json
+31
View File
@@ -0,0 +1,31 @@
{
"title": "Implementation in the kernel",
"subtitle": "OpenBSD 8.0 sources + a Linux compatibility layer = pf.ko",
"beats": [
{
"id": "b1",
"cmds": [
"ls /opt/pf/src 2>/dev/null | head -20 || echo 'source tree is on the build host'"
]
},
{
"id": "b2",
"cmds": [
"modinfo /opt/pf/pf.ko | head -6"
]
},
{
"id": "b3",
"cmds": [
"modinfo /opt/pf/pf.ko | grep -E 'license|description|vermagic'"
]
},
{
"id": "b4",
"cmds": [
"ls -la /opt/pf/pf.ko"
]
}
],
"phase": "01-implementacao"
}
scripts/screencast/plans/02-ativacao.json
+41
View File
@@ -0,0 +1,41 @@
{
"title": "Activation",
"subtitle": "insmod pf.ko, then pfctl talks to it over the OpenBSD ioctl ABI",
"beats": [
{
"id": "b1",
"cmds": [
"rmmod pf 2>/dev/null; lsmod | grep '^pf ' || echo 'pf: not loaded'"
]
},
{
"id": "b2",
"cmds": [
"insmod /opt/pf/pf.ko && echo 'pf.ko loaded'",
"dmesg | tail -4"
]
},
{
"id": "b3",
"cmds": [
"ls -l /dev/pf",
"lsmod | grep '^pf '"
]
},
{
"id": "b4",
"cmds": [
"pfctl -e && echo 'pf enabled'",
"pfctl -si | head -6"
]
},
{
"id": "b5",
"cmds": [
"pfctl -sr",
"pfctl -s Tables"
]
}
],
"phase": "02-ativacao"
}
scripts/screencast/plans/03-regras.json
+51
View File
@@ -0,0 +1,51 @@
{
"title": "Basic rules",
"subtitle": "tables, anchors, keep state and block drop",
"beats": [
{
"id": "b1",
"cmds": [
"cat > /tmp/demo.conf <<'EOF'\nset block-policy return\ntable <trusted> { 10.0.1.0/24 }\nanchor \"demo\"\npass in quick on ingress proto icmp from <trusted> keep state\npass out quick on egress proto icmp keep state\npass in quick\npass out quick\nEOF",
"pfctl -f /tmp/demo.conf && echo 'ruleset loaded'"
]
},
{
"id": "b2",
"cmds": [
"pfctl -sr",
"pfctl -s Tables",
"pfctl -t trusted -T show"
]
},
{
"id": "b3",
"cmds": [
"ssh cli 'ping -c2 -W2 10.0.2.20 | tail -3'",
"pfctl -ss | head -5"
]
},
{
"id": "b4",
"cmds": [
"cat > /tmp/block.conf <<'EOF'\nset block-policy return\nblock drop in quick on ingress proto icmp from 10.0.1.0/24\npass in quick\npass out quick\nEOF",
"pfctl -f /tmp/block.conf && echo 'blocking ruleset loaded'"
]
},
{
"id": "b5",
"cmds": [
"ssh cli 'ping -c2 -W2 10.0.2.20 | tail -3'",
"pfctl -sr -vv | head -4"
]
},
{
"id": "b6",
"cmds": [
"cat > /tmp/anchor.conf <<'EOF'\npass in quick on ingress proto icmp from 10.0.1.10 to 10.0.2.20 keep state\npass in quick\npass out quick\nEOF",
"pfctl -a demo -f /tmp/anchor.conf && echo 'anchor ruleset loaded'",
"pfctl -a demo -sr"
]
}
],
"phase": "03-regras"
}
scripts/screencast/plans/04-roteamento.json
+60
View File
@@ -0,0 +1,60 @@
{
"title": "Routing",
"subtitle": "route-to forces the next hop, reply-to forces the way back",
"beats": [
{
"id": "b1",
"cmds": [
"cat > /tmp/route.conf <<'EOF'\npass in quick proto icmp from 10.0.1.10 to 10.0.2.20 route-to { 10.0.3.2 } keep state\npass out quick\nEOF",
"pfctl -f /tmp/route.conf && echo 'route-to loaded'",
"pfctl -sr"
]
},
{
"id": "b2",
"cmds": [
"pkill tcpdump; tcpdump -ni eth3 -c 4 -e icmp > /tmp/gw.td 2>&1 &",
"tcpdump -ni eth2 -c 4 -e icmp > /tmp/srv.td 2>&1 &",
"sleep 1"
]
},
{
"id": "b3",
"cmds": [
"ssh cli 'ping -c2 -W2 10.0.2.20 | tail -2'"
]
},
{
"id": "b4",
"cmds": [
"sleep 2",
"echo 'forced egress eth3 -> gw2:'; grep -c 'echo request' /tmp/gw.td; echo 'normal egress eth2 -> srv:'; grep -c 'echo request' /tmp/srv.td"
]
},
{
"id": "b5",
"cmds": [
"cat > /tmp/reply.conf <<'EOF'\npass in quick proto icmp from 10.0.1.10 to 10.0.2.20 reply-to { 10.0.3.2 } keep state\npass out quick\nEOF",
"pfctl -f /tmp/reply.conf && echo 'reply-to loaded'",
"pfctl -sr"
]
},
{
"id": "b6",
"cmds": [
"pkill tcpdump; tcpdump -ni eth3 -c 6 -e icmp > /tmp/rgw.td 2>&1 &",
"tcpdump -ni eth1 -c 6 -e icmp > /tmp/rcli.td 2>&1 &",
"sleep 1",
"ssh cli 'ping -c2 -W2 10.0.2.20 | tail -2'"
]
},
{
"id": "b7",
"cmds": [
"sleep 2",
"echo 'reply forced onto eth3:'; grep -c 'echo reply' /tmp/rgw.td; echo 'reply on the client link:'; grep -c 'echo reply' /tmp/rcli.td"
]
}
],
"phase": "04-roteamento"
}
scripts/screencast/plans/05-balanceamento.json
+65
View File
@@ -0,0 +1,65 @@
{
"title": "Load balancing",
"subtitle": "NAT pools in round-robin and source-hash, plus dup-to",
"beats": [
{
"id": "b1",
"cmds": [
"cat > /tmp/pool.conf <<'EOF'\npass out quick on egress from 10.0.1.0/24 to any nat-to { 10.0.2.1, 10.0.3.1 } round-robin\npass in quick on ingress proto icmp keep state\npass out quick on egress proto icmp keep state\nEOF",
"pfctl -f /tmp/pool.conf && echo 'round-robin pool loaded'",
"pfctl -sr"
]
},
{
"id": "b2",
"cmds": [
"pkill tcpdump; tcpdump -ni eth2 -c 12 -e icmp > /tmp/pool.td 2>&1 &",
"sleep 1"
]
},
{
"id": "b3",
"cmds": [
"ssh cli 'for i in 1 2 3 4 5 6; do ping -c1 -W2 10.0.2.20 >/dev/null 2>&1; done; echo sent'"
]
},
{
"id": "b4",
"cmds": [
"sleep 2",
"echo 'source seen by the server (the pool alternates):'; grep 'echo request' /tmp/pool.td | sed 's/.*: \\([0-9.]*\\) > .*/\\1/' | sort | uniq -c"
]
},
{
"id": "b5",
"cmds": [
"cat > /tmp/hash.conf <<'EOF'\npass out quick on egress from 10.0.1.0/24 to any nat-to { 10.0.2.1, 10.0.3.1 } source-hash\npass in quick on ingress proto icmp keep state\npass out quick on egress proto icmp keep state\nEOF",
"pfctl -f /tmp/hash.conf && echo 'source-hash pool loaded'"
]
},
{
"id": "b6",
"cmds": [
"pkill tcpdump; tcpdump -ni eth2 -c 8 -e icmp > /tmp/hash.td 2>&1 &",
"sleep 1",
"ssh cli 'for i in 1 2 3 4; do ping -c1 -W2 10.0.2.20 >/dev/null 2>&1; done; echo sent'",
"sleep 2",
"echo 'source-hash keeps the same origin on the same member:'; grep 'echo request' /tmp/hash.td | sed 's/.*: \\([0-9.]*\\) > .*/\\1/' | sort | uniq -c"
]
},
{
"id": "b7",
"cmds": [
"cat > /tmp/dup.conf <<'EOF'\npass in quick proto icmp from 10.0.1.10 to 10.0.2.20 dup-to { 10.0.3.2 } keep state\npass out quick\nEOF",
"pfctl -f /tmp/dup.conf && echo 'dup-to loaded'",
"pkill tcpdump; tcpdump -ni eth2 -c 4 -e icmp > /tmp/d1.td 2>&1 &",
"tcpdump -ni eth3 -c 4 -e icmp > /tmp/d2.td 2>&1 &",
"sleep 1",
"ssh cli 'ping -c2 -W2 10.0.2.20 | tail -2'",
"sleep 2",
"echo 'normal path eth2:'; grep -c 'echo request' /tmp/d1.td; echo 'mirrored copy eth3:'; grep -c 'echo request' /tmp/d2.td"
]
}
],
"phase": "05-balanceamento"
}
scripts/screencast/plans/06-qos.json
+42
View File
@@ -0,0 +1,42 @@
{
"title": "Quality of service",
"subtitle": "OpenBSD 8.0 queues: hfsc classes attached to the interface",
"beats": [
{
"id": "b1",
"cmds": [
"cat > /tmp/q.conf <<'EOF'\nqueue rootq on eth2 bandwidth 10Mbit\nqueue leafq on eth2 bandwidth 2Mbit parent rootq default\npass in quick proto tcp from 10.0.1.10 to 10.0.2.20 port 9095 queue leafq keep state\npass out quick keep state\nEOF",
"pfctl -f /tmp/q.conf && echo 'queues loaded'",
"pfctl -sr"
]
},
{
"id": "b2",
"cmds": [
"pfctl -s queue -v"
]
},
{
"id": "b3",
"cmds": [
"ssh srv 'head -c 2000000 /dev/zero | tr \"\\0\" A > /tmp/data.bin; ls -l /tmp/data.bin'",
"ssh srv 'pkill nc 2>/dev/null; (setsid nc -l -p 9095 < /tmp/data.bin >/dev/null 2>&1 &); sleep 1; echo listening'"
]
},
{
"id": "b4",
"cmds": [
"ssh cli 'nc -w60 10.0.2.20 9095 > /tmp/out.bin; wc -c < /tmp/out.bin'"
]
},
{
"id": "b5",
"cmds": [
"sleep 1",
"pfctl -s queue -v",
"pfctl -sr -vv | head -6"
]
}
],
"phase": "06-qos"
}
scripts/screencast/plans/_smoke.sh
+3
View File
@@ -0,0 +1,3 @@
@run clear
uname -r
lsmod | grep '^pf ' || echo 'pf: not loaded yet'