Mac userspace packet filter (D340) #364

New issue

Open

opened 2026-11-05 06:27:35 +00:00 by kayg · 1 comment

kayg commented

2026-11-05 06:27:35 +00:00

Owner

Implement the D340 Mac userspace inbound packet filter on branch macos-filter-j197. Match decrypted inbound packets against compiled access rules before TUN delivery; fail closed on missing or stale rules; allow bounded per-peer stateful return traffic; apply ICMP policy and atomic rule updates; update mesh status reachability reporting. Add failing-first rule-matching and connection-table tests, measure Mac throughput and p99 latency with and without filtering, and prove allowed/denied ports, coordinator denial, live rule changes, and return traffic against the real Mac VM with a Linux peer. Document security invariants, use the Mac VM lock, and run quick then fast verification. Do not merge or deploy.

kayg commented

2026-11-05 06:30:50 +00:00

Author

Owner

Resumed J197 on branch macos-filter-j197, based on origin/dev at a8b4ee7206. The inherited branch is at 14fc4478c1 with a clean worktree. Existing implementation and detailed historical evidence are tracked in #348. This restart will audit the inherited changes and pending foreground runs, finish the Mac measurements and real Linux-peer proof, rerun quick and fast at the final head, and attach evidence. Estimated remaining active work is about 2 hours plus shared VM and Mac lock wait. This issue is the restart record; #348 remains the implementation history.

Resumed J197 on branch macos-filter-j197, based on origin/dev at a8b4ee7206d3d72f4e04aeb432d86869a3ae532c. The inherited branch is at 14fc4478c1fcf90599b5854023a542cb7f115e92 with a clean worktree. Existing implementation and detailed historical evidence are tracked in #348. This restart will audit the inherited changes and pending foreground runs, finish the Mac measurements and real Linux-peer proof, rerun quick and fast at the final head, and attach evidence. Estimated remaining active work is about 2 hours plus shared VM and Mac lock wait. This issue is the restart record; #348 remains the implementation history.

kayg referenced this issue

2026-11-05 06:33:17 +00:00

Mac userspace packet filter (D340) #348

No labels

launch-qa

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#364

No description provided.

Rows
Columns