softswitch v1.1.0

Added

• An 8-switch demo topology, a ring with two chords (TOPOLOGY=large for scripts/topo.sh
  and scripts/switches.sh, configs in configs/large/), and test_large: three loops for RSTP,
  two data planes per CPU, and a two-step failure that every flow must survive.
• The GUI lays out any number of switches: names sort naturally (sw2 before sw10), larger
  networks get an elliptical layout, and the view grows to fit.
• A second GUI recording in the README, with eight switches and two link failures.

Security

• Frames with stacked 802.1Q tags are dropped (new drop reason stacked-tag). A host on an
  access port could send a priority tag (VID 0) with a second tag behind it; the switch removed
  the first and forwarded the frame with the inner tag still in front, so out of an untagged
  (native) trunk port the next switch classified it by that tag: double-tagging VLAN hopping.
  Found by fuzz_pipeline; the input is kept in fuzz/corpus/pipeline/. Region layout version 4.

Fixed

• The data plane spun at 100 % CPU after any of its links went down: the link loss leaves an
  error pending on the port's AF_PACKET socket, poll() reported POLLERR until it was read, and
  nothing read it. At SCHED_FIFO this starved any other data plane pinned to the same CPU; on an
  8-switch ring the starved bridge stopped hearing BPDUs, declared itself root and cut off its
  hosts. The idle loop now reads (clears) the error.
• RSTP ignored a received topology change if it had handled one in the last 2 x hello, whatever
  port it arrived on. During a multi-step reconvergence the change that mattered was dropped and
  MACs kept pointing into a dead end until the next change (29 of 135 pings lost in the 8-switch
  test). Every received TC now flushes and propagates, as in 802.1D-2004; only the topology-change
  counter is deduplicated.

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_1.1.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v1.0.1

The software is unchanged from 1.0.0. The v1.0.0 tag exists but was never published as a GitHub
release: its release job failed while downloading syft, the SBOM tool, from GitHub Releases
(HTTP 504 for hours). 1.0.1 is the first published 1.x release; its notes for the software are
the 1.0.0 section below.

Fixed

• Release pipeline: the SBOM is generated with syft's container image instead of a per-run
  download from GitHub Releases, so release-asset outages no longer block a release (#58).

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_1.0.1_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.7.0

Added

• Read-only web GUI served by softswitchd (--http-port, --http-bind): topology with
  spanning-tree port states and links that flash as sampled packets cross them, a filterable live
  trace of forwarding decisions, and port/STP/MAC/IGMP/ARP/route/drop tables. Plain JS and SVG,
  embedded in the binary at build time; no external requests.
• HTTP/1.1 server in the control-plane event loop: GET only, bounded request heads, CORS, and
  Server-Sent Events with a bounded per-client backlog (slow clients lose events, counted).
• /api/state, /api/traces and the /events trace stream; trace records carry timestamps.
• fuzz_http fuzz target; scripts/switches.sh serves the GUI on 8081-8083.

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.7.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.6.0

Added

• L3 interfaces: interface vlanN ip address A.B.C.D/N (SVIs), ip arp timeout, show ip interface, show arp, clear arp. sw1 owns 10.0.10.1/24 and 10.0.20.1/24 in the test
  topology and hosts route through them.
• l3::Router (pure): answers ARP and pings for SVI addresses, keeps the neighbour cache (RFC 826
  merge rules), builds ICMP time-exceeded, queues packets per unresolved next hop with ARP
  retries, and computes the route table (connected + static).
• Data plane: in SVI VLANs broadcast ARP is punted as a copy and flooded; frames to the router
  MAC are punted (ARP, IPv4 to an SVI address). fuzz_router target.
• Inter-VLAN routing in the data plane: longest-prefix match, next-hop neighbour lookup, MAC
  rewrite, TTL decrement with an incremental checksum update, and L2 forwarding in the egress
  VLAN with its tagging. Neighbour misses are resolved by the control plane (ARP, packets queued
  and released); TTL expiry is answered with ICMP time exceeded.
• [no] ip routing, [no] ip route PREFIX NEXTHOP, show ip route.

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.6.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.5.0

Added

• IGMP snooping (RFC 4541): igmp::Snooper tracks members per (VLAN, group) with membership
  timeouts and mrouter ports learned from queries. The data plane punts IGMP as a copy, floods
  queries, sends reports/leaves only to mrouter ports, and forwards multicast data to members and
  mrouter ports only (unregistered groups are never flooded; 224.0.0.0/24 always is).
• Fast-leave on portfast (host) ports; on other ports a leave shortens the membership to 2 s and
  the querier sends a group-specific query so remaining listeners can re-report.
• Snooping querier for networks without a multicast router (startup queries, then every query
  interval); sw1 is the querier in the test topology.
• [no] ip igmp snooping [vlan ID | querier | fast-leave], ip igmp snooping query-interval,
  show ip igmp snooping; scripts/mcast.py test helper.

Fixed

• TCP and UDP through the switch were dropped by receivers: senders on veth offload checksums
  and AF_PACKET delivers such frames with only the pseudo-header sum (TP_STATUS_CSUMNOTREADY).
  The data plane now completes those checksums before forwarding (#47).

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.5.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.4.0

Added

• Reduced Rapid Spanning Tree state machine (stp::Rstp): priority-vector role selection,
  proposal/agreement with sync, instant alternate-to-root failover, forward-delay fallback,
  received-information expiry, edge ports and topology-change flushing/propagation. Agreements
  from root ports are only accepted from bridges that are really downstream, which closes the
  forwarding loop RSTP's count-to-infinity can otherwise open after a root bridge is lost.
• RSTP simulation tests (triangle convergence, failover, silent failure, root loss, priority
  change, edge, fallback, backup port) and a property test over 500 random meshes asserting a
  loop-free spanning tree after convergence and after link failures; fuzz_rstp fuzz target.
• rtnetlink link monitoring in softswitchd: an initial RTM_GETLINK dump plus RTMGRP_LINK
  events set each port's operational state (admin up and carrier); a port going down flushes the
  MACs learned on it. Re-dumps after a netlink overrun. Bounds-checked parser with tests and a
  fuzz_netlink target.
• RSTP runs in every switch: the data plane punts BPDUs (before VLAN and STP-state filtering);
  softswitchd feeds them to stp::Rstp, injects its BPDUs raw on the egress port, publishes
  port states, flushes the FDB on topology changes and drives port enablement from link state.
• Spanning-tree configuration: [no] spanning-tree, spanning-tree priority|hello-time|max-age| forward-time, interface PORT spanning-tree portfast|cost|port-priority; show spanning-tree.
• The test configs make sw1 the root and host ports portfast; test_stp.sh runs the looped
  triangle: one alternate port, no storm, and failover under traffic without lost pings.

Changed

• Outstanding RSTP proposals are retried every 500 ms, and a proposing port re-proposes at once
  when the neighbour shows up, so BPDUs lost while a link comes up cost < 1 s instead of a hello.
• Config and link changes publish tables before RSTP reacts, so BPDUs on a port that just came
  up are not dropped by the data plane.

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.4.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.3.0

Added

• CLI: switch configuration model (VLANs, access/trunk ports, native VLAN, allowed VLAN lists,
  descriptions, shutdown, MAC aging time, trace sampling) with Cisco-style one-line commands.
• show version | running-config | interfaces | vlan | counters | dataplane; show running-config output replays as a startup config (round-trip tested and fuzzed).
• CLI Unix socket in softswitchd and the sscli client (one-shot or interactive);
  softswitchd --config FILE loads a startup config.
• Startup configs for the test topology (configs/sw{1,2,3}.conf): VLAN 10/20 with 802.1Q trunks.
• fuzz_config fuzz target with a seed corpus under fuzz/corpus/config.
• 802.1Q VLAN enforcement in the data plane: tagged frames dropped on access ports
  (priority-tagged accepted), untagged frames classified to the PVID or dropped when the port has
  none, ingress filtering on VLAN membership, egress only to members with per-port tagging, and
  IEEE reserved group addresses (01:80:C2:00:00:0x) never forwarded. Drops are counted per reason.
• fuzz_pipeline fuzz target asserting the VLAN forwarding invariants on arbitrary frames.
• MAC learning and aging: the control plane owns the FDB (l2::Fdb, keyed by MAC+VLAN); the data
  plane reports new and moved source MACs on the learn ring (with 10 ms repeat suppression) and
  marks hits in a hash-indexed bitmap the control plane harvests every second for aging.
• Known unicast is forwarded to a single port; frames to the ingress port are filtered; unknown
  unicast, broadcast and multicast are flooded within the VLAN.
• show mac address-table [vlan ID] [interface PORT], clear mac address-table,
  mac address-table static MAC vlan ID interface PORT; entries invalidated by configuration
  (port shut down, VLAN pruned) are flushed.
• STP port state honoured on ingress: discarding ports neither learn nor forward, learning ports
  only learn.
• fuzz_fdb fuzz target and FDB learn/publish benchmarks.

Removed

• MacTable (replaced by l2::Fdb).

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.3.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.2.0

Added

• Packet library (softswitch::pkt): bounds-checked parsers and builders for Ethernet/802.1Q
  (tag insert/strip in place and on copy), ARP, IPv4 (RFC 1071 checksum, RFC 1624 incremental
  TTL update), ICMP echo/error, IGMP v1/v2/v3 and spanning-tree BPDUs (config, TCN, RST).

• Common vocabulary types: MacAddress, Ipv4Address, Ipv4Prefix, port masks.

• fuzz_packet libFuzzer target, packet micro-benchmarks, scripts/check.sh (local CI gates).

• Shared-memory IPC (softswitch::shm): fixed-capacity forwarding tables (FDB, MDB, neighbors,
  routes, VLANs, ports), lock-free SPSC rings for learn/punt/inject/trace messages, and
  double-buffered table publication with a quiescent-state grace period, so the data plane never
  waits for the control plane.

• System wrappers (softswitch::sys): RAII descriptors, eventfd, sealed memfd shared memory,
  Unix sockets with SCM_RIGHTS descriptor passing.

• softswitchd (control plane): epoll event loop with timerfd/signalfd, creates the shared
  region, publishes tables and hands the region to the data plane over a SEQPACKET socket.

• ss-dataplane (data plane): attaches over the handshake, opens one AF_PACKET port per switch
  port (TPACKET_V2 RX/TX rings, promiscuous, qdisc bypass) and forwards on a pinned SCHED_FIFO
  thread with mlockall. Flood-only forwarding for now.

• netns integration tests: scripts/topo.sh (3 switches, 5 hosts), scripts/switches.sh,
  tests/integration/ registered in ctest (ctest --preset integration) and run in CI.

• shellcheck in pre-commit.

Removed

• scripts/setup_netns.sh / teardown_netns.sh (superseded by topo.sh).
• The placeholder softswitch executable (replaced by softswitchd and ss-dataplane).

Changed

• Release dry runs (workflow_dispatch) now run the publish job too (download, SBOM, checksums, notes) and upload the bundle as an artifact instead of creating a release.
• GitHub Actions bumped: upload-artifact v7, download-artifact v8, upload-pages-artifact v5, codeql-action v4, sticky-pull-request-comment v3.

Fixed

• PR-title lint accepts capitalized subjects (Dependabot's ci: Bump …); only a trailing period is rejected.

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.2.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.

softswitch v0.1.0

Added

• Project infrastructure: CMake presets, CPack (.deb/.tar.gz), sanitizer, coverage and fuzz builds.
• CI pipeline: pre-commit/format, gcc and clang builds on x86-64 and arm64, Debian bookworm (Pi)
  compatibility, ASan/UBSan, TSan, clang-tidy, Cppcheck and Valgrind reports, coverage, libFuzzer,
  Google Benchmark regression tracking, CodeQL, and PR-title linting.
• Release pipeline: arm64 packages, SHA256SUMS, SPDX SBOM, Doxygen docs on GitHub Pages.
• MacTable: a MAC learning table with aging (starter L2 forwarding database).

Install on Raspberry Pi OS / Debian bookworm (arm64)

sudo apt install ./softswitch_0.1.0_arm64.deb

Verify downloads with sha256sum -c SHA256SUMS.