feat: replace false CoDel queues with dummynet FQ-CoDel (#532)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -10,7 +10,7 @@ assignees: ''
 e.g. 5.8.0
 
 **FreeBSD Version**
-e.g. FreeBSD 15.0-RELEASE
+e.g. FreeBSD 15.1-RELEASE
 
 **Component**
 Which part of AiFw is affected?

.github/workflows/build-iso.yml

@@ -12,9 +12,11 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 env:
-  FREEBSD_VERSION: "15.0"
+  FREEBSD_VERSION: "15.1"
 
 jobs:
   build-ui:
@@ -187,6 +189,10 @@ jobs:
               if [ -f "$f" ] && [ ! -f "${f}.xz" ]; then
                 xz -T0 -9 "$f"
                 sha256 "${f}.xz" > "${f}.xz.sha256"
+                # build-iso.sh hashed the uncompressed file, which no
+                # longer exists after xz — drop its checksum so we never
+                # sign or publish a sum nobody can verify.
+                rm -f "${f}.sha256"
               fi
             done
             cd /home/runner/work/AiFw/AiFw
@@ -195,6 +201,45 @@ jobs:
             mkdir -p /home/runner/work/AiFw/AiFw/output
             cp /usr/obj/aifw-iso/output/* /home/runner/work/AiFw/AiFw/output/
 
+      # Scan the SOURCE tree, not output/: the release artifacts are
+      # xz-compressed images syft cannot see inside, so an SBOM of output/
+      # would be an empty inventory. The source scan covers Cargo.lock and
+      # aifw-ui/package-lock.json — the dependency set actually compiled
+      # into this release.
+      - name: Generate release CycloneDX SBOM
+        uses: anchore/sbom-action@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: output/aifw-release.cdx.json
+          upload-artifact: false
+
+      - name: Sign release checksums
+        env:
+          MINISIGN_SECRET_KEY: ${{ secrets.MINISIGN_SECRET_KEY }}
+          MINISIGN_PASSWORD: ${{ secrets.MINISIGN_PASSWORD }}
+        run: |
+          set -euo pipefail
+          test -n "$MINISIGN_SECRET_KEY" || { echo "MINISIGN_SECRET_KEY is required" >&2; exit 1; }
+          sudo apt-get update
+          sudo apt-get install -y minisign
+          key_file="$RUNNER_TEMP/minisign.key"
+          trap 'rm -f "$key_file"' EXIT
+          printf '%s' "$MINISIGN_SECRET_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          pubkey=freebsd/overlay/usr/local/etc/aifw/update-signing.pub
+          cp "$pubkey" output/update-signing.pub
+          for checksum in output/*.sha256; do
+            # minisign reads the key password from stdin when there is no
+            # tty; harmless if the key is passwordless.
+            printf '%s\n' "${MINISIGN_PASSWORD:-}" | \
+              minisign -S -s "$key_file" -m "$checksum" -x "${checksum}.minisig"
+            # Verify against the COMMITTED public key immediately: catches a
+            # rotated/mismatched MINISIGN_SECRET_KEY before anything ships,
+            # since appliances verify with the key compiled from this file.
+            minisign -Vm "$checksum" -x "${checksum}.minisig" -p "$pubkey"
+          done
+
       - name: Upload ISO artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -223,6 +268,25 @@ jobs:
           path: output/aifw-components-*.json
           retention-days: 5
 
+      - name: Upload SBOMs and signatures
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: supply-chain
+          path: |
+            output/*.cdx.json
+            output/*.minisig
+            output/update-signing.pub
+          retention-days: 5
+
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        with:
+          subject-path: |
+            output/aifw-*.iso.xz
+            output/aifw-*.img.xz
+            output/aifw-update-*.tar.xz
+            output/aifw-release.cdx.json
+
   smoke-boot:
     name: Appliance boot smoke (qemu)
     needs: build-iso
@@ -263,7 +327,6 @@ jobs:
           name: boot-smoke-artifacts
           path: smoke-artifacts/
           retention-days: 7
-
   release:
     name: Create GitHub Release
     # smoke-boot gates the release: an image nobody booted never ships (#533).
@@ -296,6 +359,25 @@ jobs:
           name: components
           path: release-assets/
 
+      - name: Download supply-chain assets
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: supply-chain
+          path: release-assets/
+
+      - name: Verify signatures before publication
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y minisign
+          # The committed key from checkout — the same file compiled into
+          # the appliance updater — not a copy that traveled with the
+          # artifacts being verified.
+          pubkey=freebsd/overlay/usr/local/etc/aifw/update-signing.pub
+          for checksum in release-assets/*.sha256; do
+            minisign -Vm "$checksum" -x "${checksum}.minisig" -p "$pubkey"
+          done
+
       - name: Extract version from tag
         id: version
         run: if [ -n "${{ inputs.version }}" ]; then
@@ -309,7 +391,12 @@ jobs:
         with:
           name: "AiFw v${{ steps.version.outputs.version }}"
           draft: false
-          prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}
+          # ALWAYS pre-release: field appliances auto-pull /releases/latest,
+          # which skips pre-releases. A plain v* tag used to publish stable
+          # instantly — an untested build every appliance would grab the
+          # moment CI finished. Promote after testing with:
+          #   gh release edit <tag> --prerelease=false --latest
+          prerelease: true
           generate_release_notes: true
           files: |
             release-assets/*
@@ -335,6 +422,15 @@ jobs:
             ### Verify Downloads
 
             ```bash
-            sha256sum -c aifw-${{ steps.version.outputs.version }}-amd64.iso.sha256
-            sha256sum -c aifw-${{ steps.version.outputs.version }}-amd64.img.sha256
+            minisign -Vm aifw-${{ steps.version.outputs.version }}-amd64.iso.xz.sha256 \
+              -x aifw-${{ steps.version.outputs.version }}-amd64.iso.xz.sha256.minisig \
+              -p update-signing.pub
+            sha256sum -c aifw-${{ steps.version.outputs.version }}-amd64.iso.xz.sha256
+            ```
+
+            GitHub build provenance can also be verified with:
+
+            ```bash
+            gh attestation verify aifw-${{ steps.version.outputs.version }}-amd64.iso.xz \
+              --repo ${{ github.repository }}
             ```

.github/workflows/fq-codel-freebsd.yml

@@ -0,0 +1,37 @@
+name: FQ-CoDel FreeBSD qualification
+
+on:
+  pull_request:
+    paths:
+      - "aifw-common/src/ratelimit.rs"
+      - "aifw-core/src/shaping.rs"
+      - "freebsd/overlay/usr/local/libexec/aifw*dummynet*"
+      - "freebsd/tests/t08-fq-codel.sh"
+      - ".github/workflows/fq-codel-freebsd.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  functional:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: Exercise real FreeBSD dummynet
+        uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2
+        with:
+          release: "15.0"
+          usesh: true
+          prepare: |
+            install -m 755 freebsd/overlay/usr/local/libexec/aifw-dummynet-control /usr/local/libexec/aifw-dummynet-control
+          run: |
+            sh freebsd/tests/t08-fq-codel.sh 2>&1 | tee fq-codel-results.txt
+      - name: Upload raw result
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fq-codel-freebsd-${{ github.sha }}
+          path: fq-codel-results.txt
+          if-no-files-found: warn

.github/workflows/freebsd-functional.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Run harness in FreeBSD VM
         uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2
         with:
-          release: "15.0"
+          release: "15.1"
           usesh: true
           copyback: true
           prepare: |

.gitignore

@@ -29,5 +29,8 @@ node_modules/
 freebsd/release/
 freebsd/ui-export/
 
+# Local-only review/status ledger
+/status.md
+
 # CLAUDE.md is project policy and is tracked in the repo — do not ignore it.
 Cargo.lock

CLAUDE.md

@@ -99,6 +99,10 @@ Central type: `Database` struct in `aifw-core/src/db.rs` wrapping `SqlitePool`.
 - `Authorization: ApiKey <key>` header
 - `?ticket=<id>` query param (WebSocket/SSE) — single-use, 30-second
   ticket issued by `POST /auth/ws-ticket` (see `auth::ws_ticket`).
+- `aifw_at` HttpOnly session cookie (browser UI; SEC-M7 #304, see
+  `auth::cookies`) — fallback when no header/ticket is present. Cookie-authed
+  non-GET requests must also send the `X-AiFw-Csrf` header; the UI never
+  stores the JWT in `localStorage`.
 
 **AppState** holds all engines as `Arc<T>`, shared `Arc<dyn PfBackend>`, and `SqlitePool`. Passed to handlers via Axum's `State` extractor.
 

Cargo.toml

@@ -20,7 +20,7 @@ resolver = "2"
 
 [workspace.package]
 
-version = "5.109.4"
+version = "5.111.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/ZerosAndOnesLLC/AiFw"

README.md

@@ -74,7 +74,7 @@ High-performance firewall for FreeBSD built in Rust on top of pf. Optional AI/ML
 ## Features
 
 - **Stateful packet filtering** via FreeBSD's pf with anchor isolation
-- **NAT** — SNAT, DNAT/RDR, masquerade, binat (NAT64/NAT46 in development — rule types exist, cross-family translation data plane is being built, #531)
+- **NAT** — SNAT, DNAT/RDR, masquerade, binat, NAT64/NAT46 (real cross-family translation via pf af-to, FreeBSD 15+, with DNS64 in the resolver)
 - **Connection tracking** — real-time state table monitoring, top talkers, protocol breakdown
 - **Rate limiting & traffic shaping** — HFSC/PriQ queues, per-IP overload tables, SYN flood protection (CoDel via dummynet FQ-CoDel in development, #532)
 - **AI/ML threat detection** *(optional, WIP)* — experimental port scan, DDoS, brute force, C2 beacon, DNS tunnel detection with auto-response (disabled by default, not yet production-ready)