lgcosta
fe324259c0
Screencasts: seis videos silenciosos 1080p30 da demonstracao
...
Novo pipeline de video: scripts/screencast/render.py roda uma fase em um pty,
emula o terminal com pyte, gera frames PNG e mux com ffmpeg (H.264,
yuv420p, +faststart, sem trilha de audio). Fallback de encoder: libx264 ->
libopenh264 -> VP9.
Fases (scripts/screencast/phases/, uma sessao real contra o lab por video):
1. implementacao no kernel - fontes OpenBSD + compat + build limpo do pf.ko
2. ativacao - insmod, /dev/pf, pfctl -e, pfctl -s info
3. regras basicas - tabela, anchor, keep state, block drop
4. roteamento - route-to e reply-to (provado com tcpdump nas 2 interfaces)
5. balanceamento - pool round-robin, pool source-hash, dup-to
6. QOS - filas hfsc, pfctl -s queue -v, transferencia de 2 MB pela fila
Os videos ficam versionados em out/screencast/ (.gitignore ajustado para
nao ignorar *.mp4) e o indice/texto de descricao do YouTube em
docs/{en,pt-BR}/screencast.md.
Correcoes na propria demo (encontradas gravando): a acao de uma regra no pf
e pass OU block (nunca os dois); as regras de um anchor vivem em um ruleset
proprio (pfctl -a <anchor> -f); o nc do QOS precisa rodar na VM do servidor,
nao no firewall; o rotulo 'FASE x/6' vem do numero da fase, nao da posicao
na lista de gravacao.
2026-11-12 08:41:41 -03:00
lgcosta
90c51f43fc
M5: queue gate 15 green (hfsc in the data path, pfctl -s queue works); vendor OpenBSD net/hfsc.h + net/fq_codel.h so kernel and pfctl share the ABI; pflog payload anchored; splassert no longer BUGs
2026-11-12 03:10:46 -03:00
lgcosta
4bade69cf9
docs: queue status honest - attach path reached, purge lock assert documented as the blocker (caveats #9 )
2026-11-12 01:42:51 -03:00
lgcosta
f34c4f92a9
M5 step 1: build OpenBSD hfsc/fq_codel back ends into pf.ko (ml_* API, ifq_q handshake, scheduler types); priq still attached, 14/14 suite unchanged
2026-11-12 00:48:56 -03:00
lgcosta
ca75fc49cc
docs: guide milestone tables synced with the verified state (EN+PT-BR)
2026-11-11 23:59:03 -03:00
lgcosta
12e9c1a2f3
reply-to: gate 13 green (reply forced onto the gateway link); docs/README/CHANGELOG for 14 gates
2026-11-11 23:56:01 -03:00
lgcosta
c2d1fc4c53
docs: fail-to is not an OpenBSD 8.0 keyword (removed upstream) - correct all references; reply-to gate added
2026-11-11 23:52:11 -03:00
lgcosta
80396e0b36
docs: patches helpers are in tree (verified PATCHES_APPLIED=0 / UNPATCH_DONE); route pool gate 10 written
2026-11-11 23:37:02 -03:00
lgcosta
b3e7358868
scrub: gate 09 green (min-ttl/max-mss measured on egress); matrix + guides updated EN+PT-BR
2026-11-11 23:32:32 -03:00
lgcosta
e7e941047f
docs: route-to/dup-to verified (matrix EN+PT-BR, guides)
2026-11-11 23:11:56 -03:00
lgcosta
ecab31d704
docs: caveats EN+PT-BR updated to the verified state (hook order, soak, states, divert/pflog consumers)
2026-11-11 22:21:25 -03:00
lgcosta
2668d99d5a
binat: gate 07 green (pfctl's nat-to+rdr-to expansion verified both directions); docs updated
2026-11-11 22:14:44 -03:00
lgcosta
f263b63b8e
docs: guides reflect verified NAT/redirect/divert/pflog and the fixed state listing; CHANGELOG for v0.4.0
2026-11-11 21:58:57 -03:00
lgcosta
92c015b97b
docs: pflog verified (matrix EN+PT-BR, porting notes, README status)
2026-11-11 21:53:55 -03:00
lgcosta
0eb040fcc8
docs: rdr-to verified; porting notes on checksum strategy across translation paths (GSO regression)
2026-11-11 21:27:32 -03:00
lgcosta
6cc4e21ae2
docs+demo: asciinema recording of the lab (stateful filtering, tables, drop, NAT, divert); README/matrix reflect the verified state
2026-11-11 20:33:27 -03:00
lgcosta
3aa0c2d0d0
docs: demo guide (asciinema recording/playback/upload) EN+PT-BR
2026-11-11 19:56:24 -03:00
lgcosta
444a0555c6
docs: divert verified (matrix + porting notes); FORWARD hook evaluates the out ruleset for transit traffic
2026-11-11 19:50:14 -03:00
lgcosta
0fe4d83b93
docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined)
2026-11-11 18:50:29 -03:00
lgcosta
ac56534c3b
AF_DIVERT family restored & compiling: full socket family (PF_DIVERT=32, sock_register), blocking recv/poll, divert_output-compatible sendmsg reinject, mtag type passthrough; pfk_api decls
2026-11-11 18:47:04 -03:00
lgcosta
a0941b77fe
M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics
...
- hooks: packets are queued to pfk_netisr ordered wq (process context) and
re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)
2026-11-11 17:05:53 -03:00
lgcosta