mirror of
https://github.com/jmcorgan/fips.git
synced 2026-09-14 00:45:08 +00:00
fr34akyandJohnathan Corgan
b922568dca
An established UDP peer gets its own `connect()`-ed socket for the send fast path. `open_connected_fd` binds the wildcard and then calls `connect(2)`, which makes the kernel resolve the route once and auto-bind the local source address to whichever interface was carrying it at that moment. It never re-evaluates. So after the host changed transport medium — a laptop between WLAN and LAN, a phone between Wi-Fi and cellular — every established peer went on transmitting from an address the routing table had abandoned. The peer, which re-pins to whatever address it last heard from, answered somewhere the node was no longer sending from. The peering stayed marked connected and carried nothing until `link_dead_timeout_secs` tore it down: 60-90s of black-holed traffic per switch on a live node, then a full re-handshake and tree re-convergence. The mirror-image case, the peer rotating its address, was already handled where the rotation is observed. This is the local half, and it had no signal to hang off, because a local move is invisible in the data plane. Medium-change detection supplies that signal. `node.netmon.*` controls it and it is on by default. The node samples a coarse fingerprint of its network attachment — the source addresses the routing table would pick for an off-link destination, plus the set of up, non-loopback interface addresses — and reports a change once the picture settles. A handover is not atomic, so a short debounce coalesces the burst into one event, and a fingerprint that settles back where it started reports nothing. Linux and Android subscribe to `NETLINK_ROUTE` multicast and macOS and FreeBSD to a `PF_ROUTE` socket, both reacting in milliseconds; every other platform samples on a timer, which also runs underneath the kernel sources as a backstop. A backend decides only when to look, so the remaining ones land behind the same seam. The reaction is two steps. Drop the stale connected sockets, which is self-healing rather than disruptive: the wildcard listen socket resolves a route per packet, so sends keep working immediately, and a correctly-bound socket is reinstalled on a later tick. Then heartbeat every peer whose send path cannot block, so the far side re-pins at once rather than waiting out its own interval. That filter is the whole point rather than an optimisation. A connectionless send completes without awaiting the wire. A connection-oriented one awaits an unbounded `write_all` on a stream that the medium change has very likely just stranded, and this reaction runs on the rx loop, so it would hold every other arm of the select for as long as that socket took to fail. A peer on such a transport keeps the periodic heartbeat it had before, with `link_dead_timeout_secs` as the backstop. Covered by unit tests, by a regression test that pins the fan-out filter, and by a new `medium-change` integration suite: a multi-homed node whose default route moves between two live access paths while mesh traffic is in flight, with the far peer off-link behind a router. The changelog entries land under Unreleased rather than in the released `0.5.1` section, since none of this is in that release.
52 lines
938 B
Plaintext
52 lines
938 B
Plaintext
# macOS
|
|
.DS_Store
|
|
|
|
# Build
|
|
/target
|
|
|
|
# Editor/IDE
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
.vscode/
|
|
.idea/
|
|
|
|
# AI Agents
|
|
.claude/
|
|
AGENTS.md
|
|
CLAUDE.md
|
|
agents/
|
|
|
|
deploy/
|
|
vps.env
|
|
|
|
/reference/
|
|
|
|
dist/
|
|
*.ipk
|
|
|
|
sim-results/
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.py[cod]
|
|
*.egg-info/
|
|
*.egg
|
|
|
|
# Per-run build contexts created by testing/ci-local.sh. Its teardown normally
|
|
# removes them, but the CI worker's SIGKILL runs no trap, so one can survive a
|
|
# preempted run; ci-cleanup.sh sweeps the survivors.
|
|
/testing/docker-*/
|
|
|
|
# Runtime artifacts from running fips in-tree during local testing.
|
|
# Root-anchored so legitimately-tracked fips.yaml under packaging/ and
|
|
# examples/ stays included.
|
|
/fips.key
|
|
/fips.pub
|
|
/fips.yaml
|
|
|
|
# Per-run node configs written by the medium-change suite. `test.sh` renders
|
|
# them from the topology before compose starts and leaves them for post-mortem,
|
|
# and the run suffix means each run leaves its own directory behind.
|
|
/testing/medium-change/generated-configs*/
|