diff options
Diffstat (limited to 'fw/doc')
| -rw-r--r-- | fw/doc/todo.md | 38 |
1 files changed, 28 insertions, 10 deletions
diff --git a/fw/doc/todo.md b/fw/doc/todo.md index 6c39e9b..e83167d 100644 --- a/fw/doc/todo.md +++ b/fw/doc/todo.md @@ -137,21 +137,39 @@ FAILURE in `fw(8)`. The tests assert it in card and namespace mode, because it is exactly the kind of property a later helpful change would reverse without meaning to. +## Tested on a wire + +Two VMs on one ethernet segment, `run.sh -gw` and `-lan`; the procedure +is `test/wire.md` and it is worth keeping, because none of this can be +seen from one machine. + +- **ARP for an address whose card has been taken.** The peer's arp + table says `10.9.9.1 → 52540087c8c1`, which is the firewall's card + and not the peer's own. Nothing else could have answered. +- **The first packet to an unresolved hop is dropped**, exactly as + fw(8) BUGS says: first ping ~1s while fw ARPs for the peer, the rest + sub-millisecond. +- **Filtering rather than forwarding.** `allow=in proto=icmp` alone: + ping works, TCP sits for 290 seconds and times out. Add the rule + through `ctl` and the same connect is refused in 2 seconds — refused + is the far stack's RST, so the packet arrived. +- **Frames addressed to somebody else are ignored.** Forged with + `test/rawether.c`. With the destination check the counter does not + move; without it, a frame for nobody is judged exactly like one for + us. + ## Never tested -- **The wire side of card mode.** The suite can take a spare card — it - does, and everything up to the wire is now covered — but it cannot - make a neighbour send to it. Anything that depends on another machine - on the same segment is unproven: the destination-address filter, ARP - against a real peer, broadcast. -- **Broadcast handling.** Written, reviewed, never observed crossing - `fw`. The mapping is the standard one and normal traffic is - unaffected. +- **Broadcast handling.** Written, reviewed, still never observed + crossing `fw`. The rig above could now show it — a broadcast from the + peer is one `rawether` call away — and it has not been done. - **IPv6 traffic**, in any mode. Under `-e` it cannot work at all: there is no neighbour discovery, so v6 unicast is dropped. IPv6 extension headers are not walked, so v6 fragments do not cross. -- **The gateway with two real machines**, and a real second NIC - carrying real traffic. +- **The gateway between two real machines.** The wire rig proves card + mode; the gateway has still only been run between two synthetic + stacks on one machine. +- **A real NIC on real hardware**, as against an emulated e1000. ## Deliberately not doing |