 lgcosta
|
c2d1fc4c53
|
docs: fail-to is not an OpenBSD 8.0 keyword (removed upstream) - correct all references; reply-to gate added
|
2026-11-11 23:52:11 -03:00 |
|
|
lgcosta
|
3235af7f0b
|
pools: gate 10 green (round-robin vs source-hash); docs/README/CHANGELOG for 13 gates
|
2026-11-11 23:45:24 -03:00 |
|
|
lgcosta
|
422a325a56
|
docs: drop leftover line in pt-BR patches note
|
2026-11-11 23:37:38 -03:00 |
|
|
lgcosta
|
80396e0b36
|
docs: patches helpers are in tree (verified PATCHES_APPLIED=0 / UNPATCH_DONE); route pool gate 10 written
|
2026-11-11 23:37:02 -03:00 |
|
|
lgcosta
|
b3e7358868
|
scrub: gate 09 green (min-ttl/max-mss measured on egress); matrix + guides updated EN+PT-BR
|
2026-11-11 23:32:32 -03:00 |
|
|
lgcosta
|
251e5c09e0
|
demo+docs: 11-step recording (adds route-to), README status for 11/11 gates
v0.5.0
|
2026-11-11 23:18:48 -03:00 |
|
|
lgcosta
|
e26c6d4a36
|
changelog: v0.5.0 (binat, route-to/dup-to, checksum correctness)
|
2026-11-11 23:13:07 -03:00 |
|
|
lgcosta
|
e7e941047f
|
docs: route-to/dup-to verified (matrix EN+PT-BR, guides)
|
2026-11-11 23:11:56 -03:00 |
|
|
lgcosta
|
1bda8b4fa2
|
route-to: forced nexthop via rt_gw4/rt_gw_family (Linux resolves neighbours from the gateway only when the route says so); cleanup of debug instrumentation
|
2026-11-11 23:08:11 -03:00 |
|
|
lgcosta
|
dc73274b19
|
route-to: fix skb reference imbalance in if_output_tso (stack output consumed the queue's ref -> double kfree_skb, wedging the box); look up the forced route by destination only
|
2026-11-11 22:35:05 -03:00 |
|
|
lgcosta
|
ecab31d704
|
docs: caveats EN+PT-BR updated to the verified state (hook order, soak, states, divert/pflog consumers)
|
2026-11-11 22:21:25 -03:00 |
|
|
lgcosta
|
2668d99d5a
|
binat: gate 07 green (pfctl's nat-to+rdr-to expansion verified both directions); docs updated
|
2026-11-11 22:14:44 -03:00 |
|
|
lgcosta
|
bc5b8a4a1e
|
demo: pflog step in the asciinema recording (pflogd: 2 records, DLT_PFLOG pcap); re-recorded cast
v0.4.0
|
2026-11-11 22:07:45 -03:00 |
|
|
lgcosta
|
06ad1baa3a
|
runner: deploy pdivert/pflogd alongside pf.ko and pfctl
|
2026-11-11 22:00:15 -03:00 |
|
|
lgcosta
|
f263b63b8e
|
docs: guides reflect verified NAT/redirect/divert/pflog and the fixed state listing; CHANGELOG for v0.4.0
|
2026-11-11 21:58:57 -03:00 |
|
|
lgcosta
|
92c015b97b
|
docs: pflog verified (matrix EN+PT-BR, porting notes, README status)
|
2026-11-11 21:53:55 -03:00 |
|
|
lgcosta
|
7a81076c6a
|
pflog: /dev/pflog chardev backend (BSD pflog_hdr layout, DLT_PFLOG) + tools/pflogd + gate 12
|
2026-11-11 21:52:36 -03:00 |
|
|
lgcosta
|
dbb21048e4
|
tests: 06 gate self-sufficient (bracketed pkill patterns, srv cleanup) - avoids cross-run listener contamination
|
2026-11-11 21:35:50 -03:00 |
|
|
lgcosta
|
0eb040fcc8
|
docs: rdr-to verified; porting notes on checksum strategy across translation paths (GSO regression)
|
2026-11-11 21:27:32 -03:00 |
|
|
lgcosta
|
5af7adb08e
|
checksums: GSO-aware recompute after translation (software for plain skbs, CHECKSUM_PARTIAL for GSO); 06 gate asserts 2MB integrity through rdr
|
2026-11-11 21:24:41 -03:00 |
|
|
lgcosta
|
d9fc3a7e3f
|
checksums: materialize CHECKSUM_PARTIAL before pf so address-rewrite fixups operate on real values; new 06-rdr gate
|
2026-11-11 20:53:03 -03:00 |
|
|
lgcosta
|
b554c9a6ef
|
demo: ship the asciinema recording in the repo (out/demo-pf-linux.cast)
|
2026-11-11 20:33:57 -03:00 |
|
|
lgcosta
|
6cc4e21ae2
|
docs+demo: asciinema recording of the lab (stateful filtering, tables, drop, NAT, divert); README/matrix reflect the verified state
|
2026-11-11 20:33:27 -03:00 |
|
|
lgcosta
|
2cd13eb806
|
tests: soak helper ignores the CPU SRSO advisory
|
2026-11-11 20:29:33 -03:00 |
|
|
lgcosta
|
e03df9adc8
|
docs: data-path semantics and NAT checklist
|
2026-11-11 20:25:57 -03:00 |
|
|
lgcosta
|
7d1e4b81e9
|
cleanup: drop debug instrumentation
|
2026-11-11 20:24:53 -03:00 |
|
|
lgcosta
|
f3143a54a8
|
nat: route the reverse-translated packet with an empty source (kernel rejects non-local saddr)
|
2026-11-11 20:23:44 -03:00 |
|
|
lgcosta
|
917d3e3fe0
|
nat: recompute IPv4 header checksum after pf rewrote the addresses (OpenBSD ip_output does this)
|
2026-11-11 20:20:52 -03:00 |
|
|
lgcosta
|
d520172753
|
nat: re-route inbound packets whose destination pf rewrote (reverse NAT) instead of delivering them locally
|
2026-11-11 20:17:27 -03:00 |
|
|
lgcosta
|
9c3c4b6bbc
|
fix: skb->mark masks were multi-bit (IN mark matched OUT test) - transit traffic never reached the out ruleset; ingress/egress interface groups; pfctl resolves (egress) pool locally
|
2026-11-11 20:15:35 -03:00 |
|
|
lgcosta
|
c449e01b9a
|
pf: emulate OpenBSD ingress/egress interface groups as any-interface (Linux has no ifgroups)
|
2026-11-11 20:07:17 -03:00 |
|
|
lgcosta
|
525fe7ee28
|
tests: gate assertions corrected (pfctl state format, transit egress device, CPU SRSO advisory excluded); Makefile demo target
|
2026-11-11 20:04:16 -03:00 |
|
|
lgcosta
|
18c0a69f74
|
tests: soak gate via uploaded helper (quoting), 04/05 assertions fixed (pf interface name vs OS device)
|
2026-11-11 19:59:27 -03:00 |
|
|
lgcosta
|
3aa0c2d0d0
|
docs: demo guide (asciinema recording/playback/upload) EN+PT-BR
|
2026-11-11 19:56:24 -03:00 |
|
|
lgcosta
|
66939c839a
|
tests: 04 gate rewritten to OpenBSD-correct anchor semantics (reply is evaluated by the in ruleset); 05 gate uses 8.0 nat-to syntax; 14 quoting fixed; demo session + asciinema recorder
|
2026-11-11 19:54:29 -03:00 |
|
|
lgcosta
|
444a0555c6
|
docs: divert verified (matrix + porting notes); FORWARD hook evaluates the out ruleset for transit traffic
|
2026-11-11 19:50:14 -03:00 |
|
|
lgcosta
|
bdf9db7a21
|
fix: remove leftover debug fragment in pfk_hooks
|
2026-11-11 19:45:43 -03:00 |
|
|
lgcosta
|
57ecc15606
|
divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix)
|
2026-11-11 19:45:29 -03:00 |
|
|
lgcosta
|
4728648a0c
|
divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path
|
2026-11-11 19:19:53 -03:00 |
|
|
lgcosta
|
da1f678125
|
divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg
|
2026-11-11 19:15:48 -03:00 |
|
|
lgcosta
|
fd0be917fe
|
tests: 14-soak gate (state/traffic soak, dmesg clean, unload/reload cycles, slab delta)
|
2026-11-11 19:14:27 -03:00 |
|
|
lgcosta
|
4994c577cd
|
tests: divert gate syntax fixed (divert-to <host> port <n>), pdivert deploy; new 05-nat gate (nat-to egress, tcpdump proof)
|
2026-11-11 19:13:00 -03:00 |
|
|
lgcosta
|
7014628e8d
|
M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green)
|
2026-11-11 19:11:25 -03:00 |
|
|
lgcosta
|
493ec25fb3
|
tests: 11-divert gate design (noport drop + pdivert rewrite proof)
|
2026-11-11 18:52:57 -03:00 |
|
|
lgcosta
|
1ec52e890d
|
tools: build pdivert (static), single 'all' target
|
2026-11-11 18:50:56 -03:00 |
|
|
lgcosta
|
0fe4d83b93
|
docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined)
|
2026-11-11 18:50:29 -03:00 |
|
|
lgcosta
|
ac56534c3b
|
AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls
|
2026-11-11 18:47:04 -03:00 |
|
|
lgcosta
|
fe6f767561
|
queue.h: arg-count dispatch so BSD LIST_HEAD(name,type) and Linux LIST_HEAD(name) coexist
|
2026-11-11 18:44:22 -03:00 |
|
|
lgcosta
|
f121f496b4
|
patches infra: empty-by-design series + apply/unpatch mechanism (verified: zero missing exports via modpost)
|
2026-11-11 18:26:07 -03:00 |
|
|
lgcosta
|
50389d0d39
|
tools: pdivert — userspace relay for in-module AF_DIVERT family (M4 pending e2e)
|
2026-11-11 18:25:05 -03:00 |
|