 lgcosta
|
b3e7358868
|
scrub: gate 09 green (min-ttl/max-mss measured on egress); matrix + guides updated EN+PT-BR
|
2026-11-11 23:32:32 -03:00 |
|
|
lgcosta
|
251e5c09e0
|
demo+docs: 11-step recording (adds route-to), README status for 11/11 gates
v0.5.0
|
2026-11-11 23:18:48 -03:00 |
|
|
lgcosta
|
e26c6d4a36
|
changelog: v0.5.0 (binat, route-to/dup-to, checksum correctness)
|
2026-11-11 23:13:07 -03:00 |
|
|
lgcosta
|
e7e941047f
|
docs: route-to/dup-to verified (matrix EN+PT-BR, guides)
|
2026-11-11 23:11:56 -03:00 |
|
|
lgcosta
|
1bda8b4fa2
|
route-to: forced nexthop via rt_gw4/rt_gw_family (Linux resolves neighbours from the gateway only when the route says so); cleanup of debug instrumentation
|
2026-11-11 23:08:11 -03:00 |
|
|
lgcosta
|
dc73274b19
|
route-to: fix skb reference imbalance in if_output_tso (stack output consumed the queue's ref -> double kfree_skb, wedging the box); look up the forced route by destination only
|
2026-11-11 22:35:05 -03:00 |
|
|
lgcosta
|
ecab31d704
|
docs: caveats EN+PT-BR updated to the verified state (hook order, soak, states, divert/pflog consumers)
|
2026-11-11 22:21:25 -03:00 |
|
|
lgcosta
|
2668d99d5a
|
binat: gate 07 green (pfctl's nat-to+rdr-to expansion verified both directions); docs updated
|
2026-11-11 22:14:44 -03:00 |
|
|
lgcosta
|
bc5b8a4a1e
|
demo: pflog step in the asciinema recording (pflogd: 2 records, DLT_PFLOG pcap); re-recorded cast
v0.4.0
|
2026-11-11 22:07:45 -03:00 |
|
|
lgcosta
|
06ad1baa3a
|
runner: deploy pdivert/pflogd alongside pf.ko and pfctl
|
2026-11-11 22:00:15 -03:00 |
|
|
lgcosta
|
f263b63b8e
|
docs: guides reflect verified NAT/redirect/divert/pflog and the fixed state listing; CHANGELOG for v0.4.0
|
2026-11-11 21:58:57 -03:00 |
|
|
lgcosta
|
92c015b97b
|
docs: pflog verified (matrix EN+PT-BR, porting notes, README status)
|
2026-11-11 21:53:55 -03:00 |
|
|
lgcosta
|
7a81076c6a
|
pflog: /dev/pflog chardev backend (BSD pflog_hdr layout, DLT_PFLOG) + tools/pflogd + gate 12
|
2026-11-11 21:52:36 -03:00 |
|
|
lgcosta
|
dbb21048e4
|
tests: 06 gate self-sufficient (bracketed pkill patterns, srv cleanup) - avoids cross-run listener contamination
|
2026-11-11 21:35:50 -03:00 |
|
|
lgcosta
|
0eb040fcc8
|
docs: rdr-to verified; porting notes on checksum strategy across translation paths (GSO regression)
|
2026-11-11 21:27:32 -03:00 |
|
|
lgcosta
|
5af7adb08e
|
checksums: GSO-aware recompute after translation (software for plain skbs, CHECKSUM_PARTIAL for GSO); 06 gate asserts 2MB integrity through rdr
|
2026-11-11 21:24:41 -03:00 |
|
|
lgcosta
|
d9fc3a7e3f
|
checksums: materialize CHECKSUM_PARTIAL before pf so address-rewrite fixups operate on real values; new 06-rdr gate
|
2026-11-11 20:53:03 -03:00 |
|
|
lgcosta
|
b554c9a6ef
|
demo: ship the asciinema recording in the repo (out/demo-pf-linux.cast)
|
2026-11-11 20:33:57 -03:00 |
|
|
lgcosta
|
6cc4e21ae2
|
docs+demo: asciinema recording of the lab (stateful filtering, tables, drop, NAT, divert); README/matrix reflect the verified state
|
2026-11-11 20:33:27 -03:00 |
|
|
lgcosta
|
2cd13eb806
|
tests: soak helper ignores the CPU SRSO advisory
|
2026-11-11 20:29:33 -03:00 |
|
|
lgcosta
|
e03df9adc8
|
docs: data-path semantics and NAT checklist
|
2026-11-11 20:25:57 -03:00 |
|
|
lgcosta
|
7d1e4b81e9
|
cleanup: drop debug instrumentation
|
2026-11-11 20:24:53 -03:00 |
|
|
lgcosta
|
f3143a54a8
|
nat: route the reverse-translated packet with an empty source (kernel rejects non-local saddr)
|
2026-11-11 20:23:44 -03:00 |
|
|
lgcosta
|
917d3e3fe0
|
nat: recompute IPv4 header checksum after pf rewrote the addresses (OpenBSD ip_output does this)
|
2026-11-11 20:20:52 -03:00 |
|
|
lgcosta
|
d520172753
|
nat: re-route inbound packets whose destination pf rewrote (reverse NAT) instead of delivering them locally
|
2026-11-11 20:17:27 -03:00 |
|
|
lgcosta
|
9c3c4b6bbc
|
fix: skb->mark masks were multi-bit (IN mark matched OUT test) - transit traffic never reached the out ruleset; ingress/egress interface groups; pfctl resolves (egress) pool locally
|
2026-11-11 20:15:35 -03:00 |
|
|
lgcosta
|
c449e01b9a
|
pf: emulate OpenBSD ingress/egress interface groups as any-interface (Linux has no ifgroups)
|
2026-11-11 20:07:17 -03:00 |
|
|
lgcosta
|
525fe7ee28
|
tests: gate assertions corrected (pfctl state format, transit egress device, CPU SRSO advisory excluded); Makefile demo target
|
2026-11-11 20:04:16 -03:00 |
|
|
lgcosta
|
18c0a69f74
|
tests: soak gate via uploaded helper (quoting), 04/05 assertions fixed (pf interface name vs OS device)
|
2026-11-11 19:59:27 -03:00 |
|
|
lgcosta
|
3aa0c2d0d0
|
docs: demo guide (asciinema recording/playback/upload) EN+PT-BR
|
2026-11-11 19:56:24 -03:00 |
|
|
lgcosta
|
66939c839a
|
tests: 04 gate rewritten to OpenBSD-correct anchor semantics (reply is evaluated by the in ruleset); 05 gate uses 8.0 nat-to syntax; 14 quoting fixed; demo session + asciinema recorder
|
2026-11-11 19:54:29 -03:00 |
|
|
lgcosta
|
444a0555c6
|
docs: divert verified (matrix + porting notes); FORWARD hook evaluates the out ruleset for transit traffic
|
2026-11-11 19:50:14 -03:00 |
|
|
lgcosta
|
bdf9db7a21
|
fix: remove leftover debug fragment in pfk_hooks
|
2026-11-11 19:45:43 -03:00 |
|
|
lgcosta
|
57ecc15606
|
divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix)
|
2026-11-11 19:45:29 -03:00 |
|
|
lgcosta
|
4728648a0c
|
divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path
|
2026-11-11 19:19:53 -03:00 |
|
|
lgcosta
|
da1f678125
|
divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg
|
2026-11-11 19:15:48 -03:00 |
|
|
lgcosta
|
fd0be917fe
|
tests: 14-soak gate (state/traffic soak, dmesg clean, unload/reload cycles, slab delta)
|
2026-11-11 19:14:27 -03:00 |
|
|
lgcosta
|
4994c577cd
|
tests: divert gate syntax fixed (divert-to <host> port <n>), pdivert deploy; new 05-nat gate (nat-to egress, tcpdump proof)
|
2026-11-11 19:13:00 -03:00 |
|
|
lgcosta
|
7014628e8d
|
M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green)
|
2026-11-11 19:11:25 -03:00 |
|
|
lgcosta
|
493ec25fb3
|
tests: 11-divert gate design (noport drop + pdivert rewrite proof)
|
2026-11-11 18:52:57 -03:00 |
|
|
lgcosta
|
1ec52e890d
|
tools: build pdivert (static), single 'all' target
|
2026-11-11 18:50:56 -03:00 |
|
|
lgcosta
|
0fe4d83b93
|
docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined)
|
2026-11-11 18:50:29 -03:00 |
|
|
lgcosta
|
ac56534c3b
|
AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls
|
2026-11-11 18:47:04 -03:00 |
|
|
lgcosta
|
fe6f767561
|
queue.h: arg-count dispatch so BSD LIST_HEAD(name,type) and Linux LIST_HEAD(name) coexist
|
2026-11-11 18:44:22 -03:00 |
|
|
lgcosta
|
f121f496b4
|
patches infra: empty-by-design series + apply/unpatch mechanism (verified: zero missing exports via modpost)
|
2026-11-11 18:26:07 -03:00 |
|
|
lgcosta
|
50389d0d39
|
tools: pdivert — userspace relay for in-module AF_DIVERT family (M4 pending e2e)
|
2026-11-11 18:25:05 -03:00 |
|
|
lgcosta
|
2690d6145c
|
tests: deterministic runner (per-gate VM reset), hardened unload path
|
2026-11-11 18:03:57 -03:00 |
|
|
lgcosta
|
a0941b77fe
|
M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics
- hooks: packets are queued to pfk_netisr ordered wq (process context) and
re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)
|
2026-11-11 17:05:53 -03:00 |
|
|
lgcosta
|
5323ee2c71
|
M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl
- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs
|
2026-11-11 15:20:01 -03:00 |
|
|
lgcosta
|
0119e70960
|
M1: pf.c compiles into pf.ko
|
2026-11-11 14:55:20 -03:00 |
|