From 5ef4699d05bc919255449a9af780f216a0589a72 Mon Sep 17 00:00:00 2001 From: Calvin Morrison Date: Wed, 19 Aug 2026 13:00:43 -0400 Subject: doc: 91 checks, and a wire Co-Authored-By: Claude Opus 5 --- fw/doc/design.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) (limited to 'fw/doc/design.md') diff --git a/fw/doc/design.md b/fw/doc/design.md index 98eca29..1019735 100644 --- a/fw/doc/design.md +++ b/fw/doc/design.md @@ -3,11 +3,13 @@ **A firewall for 9front. One program, filtering at a network card, between two networks, or in front of one namespace.** -Status: working on the init-test VM in all three modes, with 87 checks -in `test/fwtest.rc` covering every bug that has shipped. What is left -open is in `todo.md`, and none of it is a reason not to run this any -more; what has never been tested is the wire — a second machine on the -same segment, and IPv6 anywhere. +Status: working in all three modes, with 91 checks in `test/fwtest.rc` +covering every bug that has shipped and every property that must not +quietly stop being true. Card mode has also been run against a second +machine on the same ethernet segment — `test/wire.md` — which is the +only way to see ARP, filtering-versus-forwarding, and frames addressed +to somebody else. What is left open is in `todo.md`. IPv6 is the +untested one, and under `-e` it is unimplemented rather than untested. ## Why -- cgit v1.2.3