lgcosta
1fcd7b3046
- compat layer extended through the full BSD API surface pf_ioctl/pf_lb/ pf_if/pf_norm/pf_table/pf_ruleset/radix/md5/sha2 need (all compile): cpumem/counters model, ifaddr/ifg groups, cred view, endian+in6 names, NAT46/64, SipHash24, mbuf_list, frag6 helpers, ip6 forward/checksum, tcp options/FSM names, taskqueue & sysctl shims (documented in docs/porting-notes.md) - pfsrc/divert_sock.c: real BSD divert(4) as runtime-registered PF_DIVERT=32 socket family inside the module (sock_register; NPROTO=AF_MAX=45 -> zero core patches); divert_packet/divert6_packet wired for pf.c - compat/pfk_ifq.c: OpenBSD 8.0 ifq framework with priq back end; hfsc and fq_codel aliases pending M5 (recorded in feature matrix as pending) - design + plan updated for the divert decision (user-requested) - stage-port.sh: single deterministic rename program for headers and .c
PF on Linux
Port of the OpenBSD PF (packet filter) to Linux 7.3.4 as out-of-tree
kernel modules — the real PF engine (pf.c, pf_norm.c, pf_table.c,
pf_lb.c, … ported from OpenBSD 8.0 sources) driven by the real OpenBSD
pfctl over the /dev/pf ioctl ABI.
Status: implementation in progress — see
docs/superpowers/plans/2026-11-11-pf-linux-port.md
for task progress and
docs/superpowers/specs/2026-11-11-pf-linux-port-design.md
for the design.
What you get (planned)
| Area | Feature |
|---|---|
| Filtering | rules, anchors, quick, match/block(drop/return/return-rst)/pass, keep state, syncookies |
| State/Tables | stateful firewall engine, pfr tables (radix + hash, pfctl -t) |
| NAT | nat-to (port pools, sticky-port, static-port), rdr-to, binat-to |
| Scrub | fragment reassembly, overlap drop, min-ttl/max-mss/df/no-df, set reassemble |
| QoS (ALTQ successor) | queue/queue on with OpenBSD 8.0 ifq schedulers: default (priq), HFSC, FQ-CoDel, attached via the pfq qdisc; pfctl -s queue -v stats |
| Divert | divert-to / divert tag + pdivert userspace channel (netlink; Linux has no AF_DIVERT) |
| Route | route-to (pools rr/hash-source/hash-state, fail-to), reply-to, dup-to |
| Logging | pflogd via netlink pflog channel (DLT_PFLOG pcap) |
| Control | /dev/pf (0600), OpenBSD 8.0 ioctl ABI, Linux build of pfctl (single binary) |
Not in scope: pfsync/CARP failover, IPsec/pfkey, ftp-proxy, per-netns PF
instances, classic-ALTQ-only schedulers (cbq/wfq/red — removed upstream before
OpenBSD 8.0).
Quick start (after M1+)
./scripts/fetch-sources.sh # OpenBSD 8.0 sources (C3SL mirror, checksummed)
./scripts/apply-patches.sh ../linux-7.3.4 # core export patch(es)
make module tools # pf.ko, pfq.ko, pfctl, pdivert, pflogd
sudo insmod module/pf.ko module/pfq.ko
sudo pfctl -f /etc/pf.conf && sudo pfctl -e
VM validation lab (Alpine on libvirt): see docs/en/vm-lab.md.
Documentação em português: README.pt-BR.md e docs/pt-BR/.
Layout
module/— kernel sources (ported PF + compat layer + pfq qdisc)tools/— pfctl/pdivert/pflogd Linux buildspatches/kernel/— documented Linux core patches (export symbols only)scripts/— fetch/build/patch/VM automationtests/— VM suite (tests/vm/NN-*.sh, scapy helpers)docs/en/+docs/pt-BR/— full bilingual documentationdocs/superpowers/— design spec + implementation plan
License
Ported OpenBSD code retains its original ISC license and copyright notices. New Linux-side code: ISC.