filterframe: a DDoS mitigation control plane that only ever adds BGP objects - #1

Open

lunarthegrey wants to merge 26 commits into

mainfrom

chore/workspace-skeleton

Commits on Aug 20, 2026

chore(workspace): scaffold the crate graph — edition 2024, MSRV 1.90, toolchain pinned exactly

lunarthegrey
and
claude
committed
afa2fb3
build(packaging): ship a .deb and a systemd unit from slice one — packaging breakage now fails the PR that caused it

lunarthegrey
and
claude
committed
bbf8af5
feat(config): line-based grammar with line-cited refusals — a typo stops the daemon at load, not at 3am

lunarthegrey
and
claude
committed
85b702c
feat(daemon): foreground loop, polled signals and an acknowledged reload — a broken config can never take a running daemon down

lunarthegrey
and
claude
committed
e6ff84f
feat(policy): read the mitigation set behind guards for every way the list endpoint lies — a failed poll can never look like an empty world

lunarthegrey
and
claude
committed
46418f5
feat(reconcile): level-triggered convergence with a stale path that cannot withdraw — the invariant is now structural, not aspirational

lunarthegrey
and
claude
committed
2afc8d6
feat(rtbh): the fast tier, with guards that refuse and damping that measures the right clock

lunarthegrey
and
claude
committed
b5b1a89
feat(scrub-divert): the divert sequence as a pure machine, with the safety property proved by exhaustion

lunarthegrey
and
claude
committed
fb60c53
feat(observability): metrics, status and explain — and the rate enrichment that finally lets the divert tier fire

lunarthegrey
and
claude
committed
d216a89
fix(policy): stop rate enrichment from consuming the pagination stub's script

lunarthegrey
and
claude
committed
4300495
feat(probe): gate diversion on the return path, and read the flag the kernel actually sets

lunarthegrey
and
claude
committed
e003baf
feat(bgp): the GoBGP sidecar backend, honest about what a confirmation proves

lunarthegrey
and
claude
committed
98fd197
docs(runbooks): the four things an operator needs at three in the morning, plus tunnel-render

lunarthegrey
and
claude
committed
8ad6cba
fix(module): give refusals distinct variants and a sentence — "protected" was doing double duty

lunarthegrey
and
claude
committed
46c6115

Navigation Menu

Uh oh!

filterframe: a DDoS mitigation control plane that only ever adds BGP objects - #1

filterframe: a DDoS mitigation control plane that only ever adds BGP objects#1
lunarthegrey wants to merge 26 commits into
mainfrom
chore/workspace-skeleton

Commits on Aug 20, 2026

chore(workspace): scaffold the crate graph — edition 2024, MSRV 1.90, toolchain pinned exactly

build(packaging): ship a .deb and a systemd unit from slice one — packaging breakage now fails the PR that caused it

feat(config): line-based grammar with line-cited refusals — a typo stops the daemon at load, not at 3am

feat(daemon): foreground loop, polled signals and an acknowledged reload — a broken config can never take a running daemon down

feat(policy): read the mitigation set behind guards for every way the list endpoint lies — a failed poll can never look like an empty world

feat(reconcile): level-triggered convergence with a stale path that cannot withdraw — the invariant is now structural, not aspirational

feat(rtbh): the fast tier, with guards that refuse and damping that measures the right clock

feat(scrub-divert): the divert sequence as a pure machine, with the safety property proved by exhaustion

feat(observability): metrics, status and explain — and the rate enrichment that finally lets the divert tier fire

fix(policy): stop rate enrichment from consuming the pagination stub's script

feat(probe): gate diversion on the return path, and read the flag the kernel actually sets

feat(bgp): the GoBGP sidecar backend, honest about what a confirmation proves

docs(runbooks): the four things an operator needs at three in the morning, plus tunnel-render

fix(module): give refusals distinct variants and a sentence — "protected" was doing double duty

Commits on Aug 21, 2026

fix(ci): run per-triple clippy inside cross — linting off-target is how a lint goes green while the build goes red

fix(ci): bump cargo-deb to 3.7.0, and point the binary asset at the path it rewrites

fix(packaging): declare procps, and install through apt so declared dependencies are actually resolved

fix(packaging): declare dependencies explicitly and write the .deb to a fixed path

fix(release): apply the fixed output path to release.yml too

fix(rtbh): make never-blackhole a two-way overlap test — a covering prefix walked straight past it

fix(policy): install ca-file, break empty streaks on failure, and stop serialising rate lookups

fix(probe): gate sysfs behind Linux, and keep the reason a failing read gave

fix(config): refuse module edits on reload, and refuse directives this build ignores

fix(divert): drive the quorum from the RIB — nothing could confirm one, so nothing ever diverted

fix(bgp): send TYPE_EXACT for an exact lookup — a literal 0 was TYPE_UNSPECIFIED

docs: stop claiming a clippy.toml that does not exist, and describe the real journal write order