lgcosta/pf-linux-port
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
26 Commits 1 Branch 8 Tags
18c0a69f749f2206cdb33b7dc721cb2aa2108cc4
Commit Graph
26 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
lgcosta 18c0a69f74 tests: soak gate via uploaded helper (quoting), 04/05 assertions fixed (pf interface name vs OS device) 2026-11-11 19:59:27 -03:00
lgcosta 3aa0c2d0d0 docs: demo guide (asciinema recording/playback/upload) EN+PT-BR 2026-11-11 19:56:24 -03:00
lgcosta 66939c839a tests: 04 gate rewritten to OpenBSD-correct anchor semantics (reply is evaluated by the in ruleset); 05 gate uses 8.0 nat-to syntax; 14 quoting fixed; demo session + asciinema recorder 2026-11-11 19:54:29 -03:00
lgcosta 444a0555c6 docs: divert verified (matrix + porting notes); FORWARD hook evaluates the out ruleset for transit traffic 2026-11-11 19:50:14 -03:00
lgcosta bdf9db7a21 fix: remove leftover debug fragment in pfk_hooks 2026-11-11 19:45:43 -03:00
lgcosta 57ecc15606 divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix) 2026-11-11 19:45:29 -03:00
lgcosta 4728648a0c divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path 2026-11-11 19:19:53 -03:00
lgcosta da1f678125 divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg 2026-11-11 19:15:48 -03:00
lgcosta fd0be917fe tests: 14-soak gate (state/traffic soak, dmesg clean, unload/reload cycles, slab delta) 2026-11-11 19:14:27 -03:00
lgcosta 4994c577cd tests: divert gate syntax fixed (divert-to <host> port <n>), pdivert deploy; new 05-nat gate (nat-to egress, tcpdump proof) 2026-11-11 19:13:00 -03:00
lgcosta 7014628e8d M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green) 2026-11-11 19:11:25 -03:00
lgcosta 493ec25fb3 tests: 11-divert gate design (noport drop + pdivert rewrite proof) 2026-11-11 18:52:57 -03:00
lgcosta 1ec52e890d tools: build pdivert (static), single 'all' target 2026-11-11 18:50:56 -03:00
lgcosta 0fe4d83b93 docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined) 2026-11-11 18:50:29 -03:00
lgcosta ac56534c3b AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls 2026-11-11 18:47:04 -03:00
lgcosta fe6f767561 queue.h: arg-count dispatch so BSD LIST_HEAD(name,type) and Linux LIST_HEAD(name) coexist 2026-11-11 18:44:22 -03:00
lgcosta f121f496b4 patches infra: empty-by-design series + apply/unpatch mechanism (verified: zero missing exports via modpost) 2026-11-11 18:26:07 -03:00
lgcosta 50389d0d39 tools: pdivert — userspace relay for in-module AF_DIVERT family (M4 pending e2e) 2026-11-11 18:25:05 -03:00
lgcosta 2690d6145c tests: deterministic runner (per-gate VM reset), hardened unload path 2026-11-11 18:03:57 -03:00
lgcosta a0941b77fe M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics 
- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)
 2026-11-11 17:05:53 -03:00
lgcosta 5323ee2c71 M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl 
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs
 2026-11-11 15:20:01 -03:00
lgcosta 0119e70960 M1: pf.c compiles into pf.ko 2026-11-11 14:55:20 -03:00
lgcosta 1fcd7b3046 M1 progress: engine port compiles except pf.c; AF_DIVERT socket family; ifq framework 
- compat layer extended through the full BSD API surface pf_ioctl/pf_lb/
  pf_if/pf_norm/pf_table/pf_ruleset/radix/md5/sha2 need (all compile):
  cpumem/counters model, ifaddr/ifg groups, cred view, endian+in6 names,
  NAT46/64, SipHash24, mbuf_list, frag6 helpers, ip6 forward/checksum,
  tcp options/FSM names, taskqueue & sysctl shims (documented in
  docs/porting-notes.md)
- pfsrc/divert_sock.c: real BSD divert(4) as runtime-registered PF_DIVERT=32
  socket family inside the module (sock_register; NPROTO=AF_MAX=45 -> zero
  core patches); divert_packet/divert6_packet wired for pf.c
- compat/pfk_ifq.c: OpenBSD 8.0 ifq framework with priq back end; hfsc and
  fq_codel aliases pending M5 (recorded in feature matrix as pending)
- design + plan updated for the divert decision (user-requested)
- stage-port.sh: single deterministic rename program for headers and .c
 2026-11-11 13:35:53 -03:00
lgcosta a84b2c91f3 M1: vendored sha2/md5 (OpenBSD 8.0) + endian/swap compat; module builds green 2026-11-11 12:20:27 -03:00
lgcosta da2e9b679a M1: compat layer + pf.ko skeleton builds against Linux 7.3.4 
- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds
 2026-11-11 12:09:34 -03:00
lgcosta ba81284bd3 chore: repo scaffold, READMEs (EN/pt-BR), version pins, source fetch+vendorize scripts 
- pins OpenBSD 8.0 tarballs (sha256) and Linux 7.3.4 as the port targets
- scripts/fetch-sources.sh (C3SL primary, cdn fallback), scripts/vendorize.sh
- scripts/{kernel-config,build-kernel}.sh for the VM-lab kernel
 2026-11-11 11:26:43 -03:00