lgcosta
45ba489672
test(vm): add stress gate 16 and its report runner
...
Gate 16 asserts invariants under load: states tracked under concurrent
connections and drained again, 200 ruleset reloads without failure, 2000
table entries flushed back to zero, 2 MB intact through NAT under a
concurrent stream, no kernel faults. Throughput is measured and reported
rather than gated, and the traffic phases run at a bounded rate because
the PF workqueue backlog exhausts a 1 GB guest above ~1 Gbit/s.
The runner writes out/stress/<timestamp>/report.md and captures the guest
serial console so a panic stays diagnosable.
2026-11-12 20:11:05 -03:00
lgcosta
90c51f43fc
M5: queue gate 15 green (hfsc in the data path, pfctl -s queue works); vendor OpenBSD net/hfsc.h + net/fq_codel.h so kernel and pfctl share the ABI; pflog payload anchored; splassert no longer BUGs
2026-11-12 03:10:46 -03:00
lgcosta
c2d1fc4c53
docs: fail-to is not an OpenBSD 8.0 keyword (removed upstream) - correct all references; reply-to gate added
2026-11-11 23:52:11 -03:00
lgcosta
3235af7f0b
pools: gate 10 green (round-robin vs source-hash); docs/README/CHANGELOG for 13 gates
2026-11-11 23:45:24 -03:00
lgcosta
80396e0b36
docs: patches helpers are in tree (verified PATCHES_APPLIED=0 / UNPATCH_DONE); route pool gate 10 written
2026-11-11 23:37:02 -03:00
lgcosta
b3e7358868
scrub: gate 09 green (min-ttl/max-mss measured on egress); matrix + guides updated EN+PT-BR
2026-11-11 23:32:32 -03:00
lgcosta
1bda8b4fa2
route-to: forced nexthop via rt_gw4/rt_gw_family (Linux resolves neighbours from the gateway only when the route says so); cleanup of debug instrumentation
2026-11-11 23:08:11 -03:00
lgcosta
ecab31d704
docs: caveats EN+PT-BR updated to the verified state (hook order, soak, states, divert/pflog consumers)
2026-11-11 22:21:25 -03:00
lgcosta
2668d99d5a
binat: gate 07 green (pfctl's nat-to+rdr-to expansion verified both directions); docs updated
2026-11-11 22:14:44 -03:00
lgcosta
7a81076c6a
pflog: /dev/pflog chardev backend (BSD pflog_hdr layout, DLT_PFLOG) + tools/pflogd + gate 12
2026-11-11 21:52:36 -03:00
lgcosta
dbb21048e4
tests: 06 gate self-sufficient (bracketed pkill patterns, srv cleanup) - avoids cross-run listener contamination
2026-11-11 21:35:50 -03:00
lgcosta
5af7adb08e
checksums: GSO-aware recompute after translation (software for plain skbs, CHECKSUM_PARTIAL for GSO); 06 gate asserts 2MB integrity through rdr
2026-11-11 21:24:41 -03:00
lgcosta
d9fc3a7e3f
checksums: materialize CHECKSUM_PARTIAL before pf so address-rewrite fixups operate on real values; new 06-rdr gate
2026-11-11 20:53:03 -03:00
lgcosta
2cd13eb806
tests: soak helper ignores the CPU SRSO advisory
2026-11-11 20:29:33 -03:00
lgcosta
d520172753
nat: re-route inbound packets whose destination pf rewrote (reverse NAT) instead of delivering them locally
2026-11-11 20:17:27 -03:00
lgcosta
525fe7ee28
tests: gate assertions corrected (pfctl state format, transit egress device, CPU SRSO advisory excluded); Makefile demo target
2026-11-11 20:04:16 -03:00
lgcosta
18c0a69f74
tests: soak gate via uploaded helper (quoting), 04/05 assertions fixed (pf interface name vs OS device)
2026-11-11 19:59:27 -03:00
lgcosta
66939c839a
tests: 04 gate rewritten to OpenBSD-correct anchor semantics (reply is evaluated by the in ruleset); 05 gate uses 8.0 nat-to syntax; 14 quoting fixed; demo session + asciinema recorder
2026-11-11 19:54:29 -03:00
lgcosta
57ecc15606
divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix)
2026-11-11 19:45:29 -03:00
lgcosta
4728648a0c
divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path
2026-11-11 19:19:53 -03:00
lgcosta
da1f678125
divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg
2026-11-11 19:15:48 -03:00
lgcosta
fd0be917fe
tests: 14-soak gate (state/traffic soak, dmesg clean, unload/reload cycles, slab delta)
2026-11-11 19:14:27 -03:00
lgcosta
4994c577cd
tests: divert gate syntax fixed (divert-to <host> port <n>), pdivert deploy; new 05-nat gate (nat-to egress, tcpdump proof)
2026-11-11 19:13:00 -03:00
lgcosta
7014628e8d
M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green)
2026-11-11 19:11:25 -03:00
lgcosta
493ec25fb3
tests: 11-divert gate design (noport drop + pdivert rewrite proof)
2026-11-11 18:52:57 -03:00
lgcosta
ac56534c3b
AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls
2026-11-11 18:47:04 -03:00
lgcosta
2690d6145c
tests: deterministic runner (per-gate VM reset), hardened unload path
2026-11-11 18:03:57 -03:00
lgcosta
a0941b77fe
M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics
...
- hooks: packets are queued to pfk_netisr ordered wq (process context) and
re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)
2026-11-11 17:05:53 -03:00
lgcosta