Block a user
1bda8b4fa2
route-to: forced nexthop via rt_gw4/rt_gw_family (Linux resolves neighbours from the gateway only when the route says so); cleanup of debug instrumentation
dc73274b19
route-to: fix skb reference imbalance in if_output_tso (stack output consumed the queue's ref -> double kfree_skb, wedging the box); look up the forced route by destination only
bc5b8a4a1e
demo: pflog step in the asciinema recording (pflogd: 2 records, DLT_PFLOG pcap); re-recorded cast
f263b63b8e
docs: guides reflect verified NAT/redirect/divert/pflog and the fixed state listing; CHANGELOG for v0.4.0
7a81076c6a
pflog: /dev/pflog chardev backend (BSD pflog_hdr layout, DLT_PFLOG) + tools/pflogd + gate 12
dbb21048e4
tests: 06 gate self-sufficient (bracketed pkill patterns, srv cleanup) - avoids cross-run listener contamination
0eb040fcc8
docs: rdr-to verified; porting notes on checksum strategy across translation paths (GSO regression)
5af7adb08e
checksums: GSO-aware recompute after translation (software for plain skbs, CHECKSUM_PARTIAL for GSO); 06 gate asserts 2MB integrity through rdr
6cc4e21ae2
docs+demo: asciinema recording of the lab (stateful filtering, tables, drop, NAT, divert); README/matrix reflect the verified state
f3143a54a8
nat: route the reverse-translated packet with an empty source (kernel rejects non-local saddr)
917d3e3fe0
nat: recompute IPv4 header checksum after pf rewrote the addresses (OpenBSD ip_output does this)
66939c839a
tests: 04 gate rewritten to OpenBSD-correct anchor semantics (reply is evaluated by the in ruleset); 05 gate uses 8.0 nat-to syntax; 14 quoting fixed; demo session + asciinema recorder
444a0555c6
docs: divert verified (matrix + porting notes); FORWARD hook evaluates the out ruleset for transit traffic
57ecc15606
divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix)
4728648a0c
divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path
da1f678125
divert: fix NULL-deref on empty listener list (wedged pf0 in gate 11); gate 11 pdivert path; runner accepts gate filter arg
4994c577cd
tests: divert gate syntax fixed (divert-to <host> port <n>), pdivert deploy; new 05-nat gate (nat-to egress, tcpdump proof)
7014628e8d
M2: refcnt_rele polarity, radix SALEN by family, LIST_HEAD dispatch + harness scp-failure hardening (gates 01-03 green)
0fe4d83b93
docs: divert status corrected after AF_DIVERT restore (COMPILES untested, M4 e2e gate defined)