Mac userspace packet filter (D340) #361

New issue

Closed

opened 2026-11-05 02:14:04 +00:00 by kayg · 2 comments

kayg commented

2026-11-05 02:14:04 +00:00

Owner

Goal

Add an inbound userspace packet filter to macOS mesh nodes, using the compiled access rules also enforced on Linux. Drop inbound packets before they reach the TUN when policy is absent or stale; allow established return traffic for Mac-initiated connections with bounded per-peer state; apply protocol, port, source peer, and ICMP policy; swap rule updates atomically; report effective access in mesh status.

Plan and estimate (12 hours)

Read D228, D235, D336, D337, D340, #265/J162, and the Linux and macOS dataplane paths.
Add failing tests for rule matching and bounded connection tracking, then implement the minimal matcher/table.
Wire filtering after decryption and before TUN delivery, enforce fail-closed stale/missing rules and atomic updates, and report active filtering in status.
Measure Mac throughput and p99 packet latency with and without the filter.
Prove on the locked Mac VM with a Linux peer: allowed port, denied port timeout, coordinator denied by policy, live rule update, and return traffic.
Run verify quick, then scripts/verify fast; commit and push the branch in atomic increments, and record evidence here.

No merge or deploy in this job.

## Goal Add an inbound userspace packet filter to macOS mesh nodes, using the compiled access rules also enforced on Linux. Drop inbound packets before they reach the TUN when policy is absent or stale; allow established return traffic for Mac-initiated connections with bounded per-peer state; apply protocol, port, source peer, and ICMP policy; swap rule updates atomically; report effective access in `mesh status`. ## Plan and estimate (12 hours) 1. Read D228, D235, D336, D337, D340, #265/J162, and the Linux and macOS dataplane paths. 2. Add failing tests for rule matching and bounded connection tracking, then implement the minimal matcher/table. 3. Wire filtering after decryption and before TUN delivery, enforce fail-closed stale/missing rules and atomic updates, and report active filtering in status. 4. Measure Mac throughput and p99 packet latency with and without the filter. 5. Prove on the locked Mac VM with a Linux peer: allowed port, denied port timeout, coordinator denied by policy, live rule update, and return traffic. 6. Run `verify quick`, then `scripts/verify fast`; commit and push the branch in atomic increments, and record evidence here. No merge or deploy in this job.

kayg commented

2026-11-05 02:25:04 +00:00

Author

Owner

This issue duplicates the existing canonical D340 tracking issue #348, which already contains the implementation branch and evidence. It was created accidentally during the restart because fj issue search returned the first page of issues instead of filtering to the exact title. All code, findings, tests and gates continue on #348; no code is associated with this duplicate.

This issue duplicates the existing canonical D340 tracking issue #348, which already contains the implementation branch and evidence. It was created accidentally during the restart because `fj issue search` returned the first page of issues instead of filtering to the exact title. All code, findings, tests and gates continue on #348; no code is associated with this duplicate.

kayg commented

2026-11-05 17:48:49 +00:00

Author

Owner

Canonical issue: #348. Merge commit: not applicable to this duplicate-only record; this closure does not claim the canonical implementation is complete.

Rechecked all comments and issue timestamps immediately before closure; no activity in the last 12 hours. Audit: #369.

J256 housekeeping, authorized by kayg. Closing: The issue explicitly identifies itself as an accidental duplicate of canonical #348. All implementation, findings and acceptance evidence continue there; #348 stays open. Canonical issue: https://git.kayg.org/kayg/infraternal/issues/348. Merge commit: not applicable to this duplicate-only record; this closure does not claim the canonical implementation is complete. Rechecked all comments and issue timestamps immediately before closure; no activity in the last 12 hours. Audit: #369.

kayg closed this issue

2026-11-05 17:48:49 +00:00

kayg referenced this issue

2026-11-05 17:50:38 +00:00

Housekeeping 2026-11-05 #369

kayg referenced this issue

2026-11-05 18:10:54 +00:00

Housekeeping 2026-11-05 #369