diff options
| author | Calvin Morrison <calvin@pobox.com> | 2026-08-19 13:00:43 -0400 |
|---|---|---|
| committer | Calvin Morrison <calvin@pobox.com> | 2026-08-19 13:00:43 -0400 |
| commit | 5ef4699d05bc919255449a9af780f216a0589a72 (patch) | |
| tree | da490e5e3278a9832c0e224657272b59369cc0c7 /fw/doc/design.md | |
| parent | e8d83b79247f25095346041d4af65c3e0dc3da16 (diff) | |
doc: 91 checks, and a wire
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Diffstat (limited to 'fw/doc/design.md')
| -rw-r--r-- | fw/doc/design.md | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/fw/doc/design.md b/fw/doc/design.md index 98eca29..1019735 100644 --- a/fw/doc/design.md +++ b/fw/doc/design.md @@ -3,11 +3,13 @@ **A firewall for 9front. One program, filtering at a network card, between two networks, or in front of one namespace.** -Status: working on the init-test VM in all three modes, with 87 checks -in `test/fwtest.rc` covering every bug that has shipped. What is left -open is in `todo.md`, and none of it is a reason not to run this any -more; what has never been tested is the wire — a second machine on the -same segment, and IPv6 anywhere. +Status: working in all three modes, with 91 checks in `test/fwtest.rc` +covering every bug that has shipped and every property that must not +quietly stop being true. Card mode has also been run against a second +machine on the same ethernet segment — `test/wire.md` — which is the +only way to see ARP, filtering-versus-forwarding, and frames addressed +to somebody else. What is left open is in `todo.md`. IPv6 is the +untested one, and under `-e` it is unimplemented rather than untested. ## Why |