| Age | Commit message (Collapse) | Author |
|---|
|
One program with three modes, sharing one rule engine and one ndb rule
language. Which mode it is depends on what you point it at, and it says
so at startup rather than choosing silently.
fw -e /net/ether0 rules.ndb a card: every packet in or out
fw rules.ndb <side> <side> two networks: everything crossing
fw rules.ndb one namespace: what programs ask for
The first two filter packets on a wire, using the pkt medium: the stack
gives up its card and gets a synthetic one with fw on the other end, so
nothing reaches it that fw did not pass. Since the stack no longer has
ethernet, fw answers ARP for the address it stands in for.
The third serves a filtered /net and matches connect and announce before
they reach the kernel, so a refusal comes back out of dial(2) with a
reason. That is only a boundary if the program also loses #I, which
/dev/drivers does and cannot be undone; fw.rc does it in the right order.
Rules are ndb, matched top to bottom, first match wins, no match denies.
Connections are tracked, so permitting traffic one way permits the
replies. A rule change drops connections the new rules forbid rather
than letting them finish: a block blocks. Logging is per rule, to
/sys/log/fw.
Tested on the init-test VM in all three modes: a page fetched through a
real card, a TCP handshake across two networks, request filtering with
the escape routes closed, live rule changes killing established
connections, and one rule file working unchanged at both altitudes.
doc/todo.md has what is not done. Item 1 is the one that matters: a fw
that dies takes the card's address with it, so the machine loses its
network and fw cannot restart unaided. That also blocks svc supervision.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
Why this exists, what it replaces and what it does not, and the positions
that decide later arguments. Claims are cited to file:line in the 9front
tree or to Security in Plan 9, so they can be checked rather than believed.
|
|
Works -- partitions are set up -- but svcinit marks it failed, because
diskparts ends on a conditional that is false on a machine with no
/cfg/$sysname/fsconfig, and rc returns the last command status. termrc
never noticed because it ignored the status. A oneshot that does its job
and exits nonzero is a shape the design has no answer for yet.
|
|
eia0 cannot be interrupted -- a plain uart turns DEL into a byte, not a
note -- so a command blocked on eia0 can only be killed from an
independent shell. Both serial shells are deliberately not services:
they are the channel you need when the supervisor is what is broken, so
they start above svcinit and do not depend on it.
|
|
Existing work moved from /storage/vms/9front/svc, previously unversioned.
Object files and linked binaries excluded via .gitignore.
|
