Mac userspace packet filter (D340) #352

New issue

Closed

opened 2026-11-04 19:20:54 +00:00 by kayg · 3 comments

kayg commented

2026-11-04 19:20:54 +00:00

Owner

Request

Implement the Mac userspace inbound packet filter from D340. Apply the compiled access rules after decrypt and before TUN delivery, with fail-closed rule snapshots, bounded per-peer connection state for return traffic, ICMP policy, atomic live updates, truthful mesh status, and a hot path without allocations.

Acceptance evidence

Rule-matching and bounded connection-table tests fail before the implementation and pass after it.
Measure Mac throughput and p99 latency through the filter against the unfiltered path.
Under the Mac VM lock, prove from a Linux peer that an allowed port connects, a denied port times out, the denied coordinator is blocked, a live rule change applies without restart, and return traffic works.
Run verify quick, then scripts/verify fast with the final head SHA recorded here. Do not merge or deploy.

Plan and estimate

Estimate: 6 hours.

Read D228/D235/D336/D337/D340, #265 and J162 F1, Linux policy implementations, and Mac dataplane; trace rule publication and status reporting.
Add red tests for protocol/port/source matching and bounded state/expiry; implement an allocation-free matcher and per-peer bounded return-flow table.
Install an atomic fail-closed rules snapshot in the Mac decrypt-to-TUN path, apply live updates, and report filter status accurately.
Measure filtered/unfiltered throughput and p99 on the Mac; run the five locked Linux-peer integration checks.
Run quick, then fast; record evidence and final head SHA.

Invariants to document in code: no packet is forwarded without a current valid rule snapshot; one published snapshot is used per packet; established return flows only bypass new-flow matching within a bounded peer quota and expiry; malformed packets fail closed; packet processing allocates nothing.

## Request Implement the Mac userspace inbound packet filter from D340. Apply the compiled access rules after decrypt and before TUN delivery, with fail-closed rule snapshots, bounded per-peer connection state for return traffic, ICMP policy, atomic live updates, truthful `mesh status`, and a hot path without allocations. ## Acceptance evidence - Rule-matching and bounded connection-table tests fail before the implementation and pass after it. - Measure Mac throughput and p99 latency through the filter against the unfiltered path. - Under the Mac VM lock, prove from a Linux peer that an allowed port connects, a denied port times out, the denied coordinator is blocked, a live rule change applies without restart, and return traffic works. - Run `verify quick`, then `scripts/verify fast` with the final head SHA recorded here. Do not merge or deploy. ## Plan and estimate Estimate: 6 hours. 1. Read D228/D235/D336/D337/D340, #265 and J162 F1, Linux policy implementations, and Mac dataplane; trace rule publication and status reporting. 2. Add red tests for protocol/port/source matching and bounded state/expiry; implement an allocation-free matcher and per-peer bounded return-flow table. 3. Install an atomic fail-closed rules snapshot in the Mac decrypt-to-TUN path, apply live updates, and report filter status accurately. 4. Measure filtered/unfiltered throughput and p99 on the Mac; run the five locked Linux-peer integration checks. 5. Run quick, then fast; record evidence and final head SHA. Invariants to document in code: no packet is forwarded without a current valid rule snapshot; one published snapshot is used per packet; established return flows only bypass new-flow matching within a bounded peer quota and expiry; malformed packets fail closed; packet processing allocates nothing.

kayg commented

2026-11-04 19:22:29 +00:00

Author

Owner

Start: branch macos-filter-j197, base e8e8d2ff79b328a71faa62e7f764d705a133eeb4 (origin/dev). The requested J197 worktree already exists at /home/kayg/Developer/Worktrees/infraternal-j197, with pushed WIP commit f639f40b8 and an unstaged edit in packet_filter.rs; I am auditing that checkpoint and will preserve it while continuing.

Start: branch `macos-filter-j197`, base `e8e8d2ff79b328a71faa62e7f764d705a133eeb4` (`origin/dev`). The requested J197 worktree already exists at `/home/kayg/Developer/Worktrees/infraternal-j197`, with pushed WIP commit `f639f40b8` and an unstaged edit in `packet_filter.rs`; I am auditing that checkpoint and will preserve it while continuing.

kayg commented

2026-11-04 19:28:08 +00:00

Author

Owner

Duplicate redirect: J197 already has the canonical issue #348 with its plan and implementation history. I created #352 while restarting from the task prompt; it remains open as required by job rules, but I will keep findings, implementation evidence, and gate receipts on #348.

kayg commented

2026-11-05 17:48:48 +00:00

Author

Owner

Canonical issue: #348. Merge commit: not applicable to this duplicate-only record; this closure does not claim the canonical implementation is complete.

Rechecked all comments and issue timestamps immediately before closure; no activity in the last 12 hours. Audit: #369.

J256 housekeeping, authorized by kayg. Closing: The issue explicitly identifies itself as an accidental duplicate of canonical #348. All implementation, findings and acceptance evidence continue there; #348 stays open. Canonical issue: https://git.kayg.org/kayg/infraternal/issues/348. Merge commit: not applicable to this duplicate-only record; this closure does not claim the canonical implementation is complete. Rechecked all comments and issue timestamps immediately before closure; no activity in the last 12 hours. Audit: #369.

kayg closed this issue

2026-11-05 17:48:48 +00:00

kayg referenced this issue

2026-11-05 17:50:38 +00:00

Housekeeping 2026-11-05 #369

kayg referenced this issue

2026-11-05 18:10:54 +00:00

Housekeeping 2026-11-05 #369