lgcosta
ba81284bd3
- pins OpenBSD 8.0 tarballs (sha256) and Linux 7.3.4 as the port targets
- scripts/fetch-sources.sh (C3SL primary, cdn fallback), scripts/vendorize.sh
- scripts/{kernel-config,build-kernel}.sh for the VM-lab kernel
59 lines
2.7 KiB
Markdown
59 lines
2.7 KiB
Markdown
# PF on Linux
|
|
|
|
Port of the OpenBSD **PF** (packet filter) to **Linux 7.3.4** as out-of-tree
|
|
kernel modules — the real PF engine (`pf.c`, `pf_norm.c`, `pf_table.c`,
|
|
`pf_lb.c`, … ported from OpenBSD 8.0 sources) driven by the real OpenBSD
|
|
`pfctl` over the `/dev/pf` ioctl ABI.
|
|
|
|
**Status:** implementation in progress — see
|
|
[`docs/superpowers/plans/2026-11-11-pf-linux-port.md`](docs/superpowers/plans/2026-11-11-pf-linux-port.md)
|
|
for task progress and
|
|
[`docs/superpowers/specs/2026-11-11-pf-linux-port-design.md`](docs/superpowers/specs/2026-11-11-pf-linux-port-design.md)
|
|
for the design.
|
|
|
|
## What you get (planned)
|
|
|
|
| Area | Feature |
|
|
|---|---|
|
|
| Filtering | rules, anchors, quick, `match`/`block`(drop/return/return-rst)/`pass`, `keep state`, syncookies |
|
|
| State/Tables | stateful firewall engine, `pfr` tables (radix + hash, `pfctl -t`) |
|
|
| NAT | `nat-to` (port pools, sticky-port, static-port), `rdr-to`, `binat-to` |
|
|
| Scrub | fragment reassembly, overlap drop, `min-ttl`/`max-mss`/`df`/`no-df`, `set reassemble` |
|
|
| QoS (ALTQ successor) | `queue`/`queue on` with OpenBSD 8.0 `ifq` schedulers: **default (priq), HFSC, FQ-CoDel**, attached via the `pfq` qdisc; `pfctl -s queue -v` stats |
|
|
| Divert | `divert-to` / `divert` tag + `pdivert` userspace channel (netlink; Linux has no `AF_DIVERT`) |
|
|
| Route | `route-to` (pools rr/hash-source/hash-state, `fail-to`), `reply-to`, `dup-to` |
|
|
| Logging | `pflogd` via netlink pflog channel (DLT_PFLOG pcap) |
|
|
| Control | `/dev/pf` (0600), OpenBSD 8.0 ioctl ABI, Linux build of `pfctl` (single binary) |
|
|
|
|
Not in scope: `pfsync`/CARP failover, IPsec/pfkey, `ftp-proxy`, per-netns PF
|
|
instances, classic-ALTQ-only schedulers (cbq/wfq/red — removed upstream before
|
|
OpenBSD 8.0).
|
|
|
|
## Quick start (after M1+)
|
|
|
|
```sh
|
|
./scripts/fetch-sources.sh # OpenBSD 8.0 sources (C3SL mirror, checksummed)
|
|
./scripts/apply-patches.sh ../linux-7.3.4 # core export patch(es)
|
|
make module tools # pf.ko, pfq.ko, pfctl, pdivert, pflogd
|
|
sudo insmod module/pf.ko module/pfq.ko
|
|
sudo pfctl -f /etc/pf.conf && sudo pfctl -e
|
|
```
|
|
|
|
VM validation lab (Alpine on libvirt): see `docs/en/vm-lab.md`.
|
|
Documentação em português: [`README.pt-BR.md`](README.pt-BR.md) e `docs/pt-BR/`.
|
|
|
|
## Layout
|
|
|
|
- `module/` — kernel sources (ported PF + compat layer + pfq qdisc)
|
|
- `tools/` — pfctl/pdivert/pflogd Linux builds
|
|
- `patches/kernel/` — documented Linux core patches (export symbols only)
|
|
- `scripts/` — fetch/build/patch/VM automation
|
|
- `tests/` — VM suite (`tests/vm/NN-*.sh`, scapy helpers)
|
|
- `docs/en/` + `docs/pt-BR/` — full bilingual documentation
|
|
- `docs/superpowers/` — design spec + implementation plan
|
|
|
|
## License
|
|
|
|
Ported OpenBSD code retains its original [ISC license and copyright notices](LICENSE).
|
|
New Linux-side code: ISC.
|