Repository navigation
toyos-net-node: clients' datagram sockets and the machine's mDNS name on ToyOS's own UDP, host-tested and shipped in nothing - #772
Conversation
Stage B of the cut of the own-stack track's stage 5: what netstack's client UDP handlers and the socket half of its mdns module do, as node calls over ToyOS's own UDP. Host-tested, shipped in nothing; netstack's modules and manifest are untouched. datagram: udp_bind, udp_send_to, udp_recv_from, udp_close on a DatagramId only a bind makes, so no client call names the DHCP client's socket or the responder's. [udp]'s refusals are answered in the pipe ABI's words (Refused), by an exhaustive match over [udp]'s counters. name: Node::answer_as joins 224.0.0.251, binds port 5353 with TTL 255 (RFC 6762 §11) and drives toyos_mdns::Responder from the node's clock and the held lease. The record's second announcement and an answer §6 held back are a deadline of the node's. An answer [udp] refuses is counted node.name-unsent. The stack's socket calls are methods of lease.rs's Stack, as #771's review asked of a stage that adds sockets: the shard stays unreachable outside that file. toyos-net-shard gains what the node calls and it lacked: join, udp_port, udp_set_ttl, udp_close, udp_counters. No leave: the node never leaves its one group. Tests are in their own files (tests/datagram.rs, tests/name.rs, tests/lan/mod.rs) beside stage A's, which are unchanged. Every emitted frame is read by etherparse; every mDNS message, asked or expected, is written out from RFC 1035 §4.1 and RFC 6762 and not by toyos-mdns. Nothing was built or run by the author: the build request is the orchestrator's to run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
|
The 14 mutation runs of the body's table, at d1-named-port-ignored diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..4ea70286b 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -98,7 +98,7 @@ impl Node {
/// or, with none named, an ephemeral one, which spends the one draw. Returns the socket and
/// the port it holds.
pub fn udp_bind(&mut self, addr: Ipv4Addr, port: Option<Port>, draw: impl FnOnce() -> u32) -> Result<(DatagramId, Port), Refused> {
- let (id, port) = self.stack.bind(addr, port, draw).map_err(refused)?;
+ let (id, port) = self.stack.bind(addr, port.and(None), draw).map_err(refused)?;
Ok((DatagramId(id), port))
}
d2-port-in-use-answered-invalid-input diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..a84e21a31 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -56,7 +56,8 @@ fn refused(error: Error) -> Refused {
Error::Failed(_) => unreachable!("[udp] reported a network error against a socket that is not connected"),
};
match rule {
- Counter::PortInUse | Counter::NoEphemeralPort => Refused::AddrInUse,
+ Counter::NoEphemeralPort => Refused::AddrInUse,
+ Counter::PortInUse => Refused::InvalidInput,
Counter::NoSourceAddress | Counter::NoRoute | Counter::SourceAddressNotAssigned => Refused::NotConnected,
Counter::BindAddressNotLocal
| Counter::SendLoopbackd3-close-closes-nothing diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..9d29f73a0 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -117,6 +117,7 @@ impl Node {
/// Closes the socket: its port is free at once, what it received is gone, and what it had
/// accepted still leaves, to [udp]'s bound.
pub fn udp_close(&mut self, now: Instant, id: DatagramId) -> Result<(), Refused> {
- self.stack.close(now, id.0).map_err(refused)
+ let _ = (now, id);
+ Ok(())
}
}d4-source-is-the-destination diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..e06bf3ce2 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -111,7 +111,7 @@ impl Node {
/// longer than `out` is cut to it and the rest is gone, as [udp] counts.
pub fn udp_recv_from(&mut self, id: DatagramId, out: &mut [u8]) -> Result<Option<Datagram>, Refused> {
let received = self.stack.recv_from(id.0, out).map_err(refused)?;
- Ok(received.map(|received| Datagram { len: received.len, source: received.source, source_port: received.source_port }))
+ Ok(received.map(|received| Datagram { len: received.len, source: received.destination, source_port: received.source_port }))
}
/// Closes the socket: its port is free at once, what it received is gone, and what it hadn1-group-not-joined diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..64b27026b 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -54,7 +54,6 @@ impl Name {
};
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
stack.set_ttl(socket, ttl, ttl)?;
- stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}
n2-deadline-without-the-name diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index e88047e9d..c8ef56867 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -141,7 +141,7 @@ impl Node {
pub fn next_deadline(&self) -> Option<Instant> {
let name = self.name.as_ref().and_then(name::Name::next_deadline);
- self.stack.next_deadline().into_iter().chain(self.client.next_deadline()).chain(name).min()
+ self.stack.next_deadline().into_iter().chain(self.client.next_deadline()).min()
}
/// Every deadline at or before `now`; the frames they make due wait for [`Self::transmit`].n3-every-answer-to-the-group diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..f9ea27f15 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -83,7 +83,7 @@ impl Name {
let Some(answer) = self.record.answer(query, Asker { addr: received.source.octets(), port }, ms) else { continue };
let (to, port) = match answer.to {
To::Group => (group, PORT),
- To::Asker => (received.source, port),
+ To::Asker => (group, PORT),
};
unsent = unsent.saturating_add(send(stack, now, self.socket, to, port, &answer.bytes));
}n4-ttl-left-as-udp-has-it diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..9cf8a1cff 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -53,7 +53,6 @@ impl Name {
unreachable!("255 is a TTL and RFC 6762 §3's group is a group")
};
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
- stack.set_ttl(socket, ttl, ttl)?;
stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}n5-link-kept-when-the-lease-goes diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..892d220a0 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -68,7 +68,7 @@ impl Name {
let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: lease.prefix_len });
let (ms, group) = (millis(now), Ipv4Addr::from(GROUP));
let mut unsent = 0u64;
- if let Some(record) = self.record.on(link, ms) {
+ if let Some(record) = link.and_then(|link| self.record.on(Some(link), ms)) {
unsent = unsent.saturating_add(send(stack, now, self.socket, group, PORT, &record));
}
loop {n6-unsent-not-counted diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index e88047e9d..6489463f0 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -177,7 +177,7 @@ impl Node {
}
if let Some(name) = &mut self.name {
let unsent = name.pass(now, &mut self.stack);
- self.counters.add(Counter::NameUnsent, unsent);
+ let _ = unsent;
}
}
n7-every-source-on-the-link diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..235e57967 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -65,7 +65,7 @@ impl Name {
/// Tells the responder what lease is held, sends what the record is owed now, then answers
/// every query that arrived. Returns how many messages [udp] refused.
pub(crate) fn pass(&mut self, now: Instant, stack: &mut Stack) -> u64 {
- let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: lease.prefix_len });
+ let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: 0 });
let (ms, group) = (millis(now), Ipv4Addr::from(GROUP));
let mut unsent = 0u64;
if let Some(record) = self.record.on(link, ms) {n8-joined-before-the-port-is-bound diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 1498e79d9..9b03918ce 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -52,9 +52,9 @@ impl Name {
let (Ok(ttl), Some(group)) = (Ttl::new(u8::MAX), MulticastAddr::new(Ipv4Addr::from(GROUP))) else {
unreachable!("255 is a TTL and RFC 6762 §3's group is a group")
};
+ stack.join(now, group);
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
stack.set_ttl(socket, ttl, ttl)?;
- stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}
s1-shard-closes-without-settling diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index cf2d47ba7..4de1fe7bc 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -554,9 +554,8 @@ impl Shard {
/// Closes a socket: its port is free at once, and what it had accepted leaves as [udp]'s
/// closed sender, in the round from this call.
pub fn udp_close(&mut self, now: Instant, id: SocketId) -> Result<(), toyos_net_udp::Error> {
- let closed = self.udp.close(id);
- self.settle(now);
- closed
+ let _ = now;
+ self.udp.close(id)
}
/// The DHCP client's socket, on port 68: the one socket that may send from 0.0.0.0 and name |
|
Review round 1 of Net lines ( BLOCKER
NOTE
Rulings asked forBroadcast refused. Right, and the only choice the principles leave. A socket nobody permitted must not broadcast: permitting it by default so that the node matches smoltcp would be a silent default on a trust boundary, and matching smoltcp is not a requirement of anything. What is wrong is not in this diff: std's A logged refusal surfacing at the next receive. Acceptable as recorded for a crate that ships in nothing; the exit names both ways out. The flip takes one of them; it does not land on "the next frame will flush it". The host name handed over twice. Acceptable as recorded. At the flip the shell has to give No re-announce on link-up. Acceptable as recorded, with the body's wording corrected as above: it is a difference from today, made by the lease surviving the link, and RFC 6762 §8.3 asks for the announcement. The six methods on Wire inputBy reading, no datagram, mDNS message or IGMP frame reaches a panic or an unbounded allocation through what this diff adds. Who is answered, and where each rule lives:
A query sent to the machine's own address or to a broadcast address on port 5353 also reaches the responder, because the socket is bound to any; §5.5 allows the first, and neither is tested. The oraclesChecked by hand against RFC 1035 §4.1.1 to §4.1.3 and RFC 6762: Independent of the code under test: every expected mDNS message and the IGMP report in The 13 mutations: each patch's hunk is against the head's blobs, each build 0 and test 101, and the step logs show the assertion that fired is the rule's own in the seven I opened (n1 CI's newer clippyI expect no line of stage B to red. For the workers branched from here
SEND BACK |
…get their tests, and the link-local answer is held as it is - a_second_query_inside_a_second_waits_for_the_second_to_end: RFC 6762 §6's bound reached through the node's clock and deadline. - an_answer_to_a_link_local_asker_leaves_by_the_router: the present state the review predicted from reading, held by a test and recorded in the track as wrong, with [ip] owning the exit. - Node::answer_as ends in the name's pass, so a lease already held is announced by the call; a_lease_already_held_is_announced_as_the_name_is_told. - Shard::join no longer settles: a join makes no flow eligible and no event. - The crate's description names what it now holds. - The track's broadcast line gates the move and carries the search still owed; the mDNS unicast-response ID defect is filed. Nothing was built or run by the author. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
…s the permission before the move Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
|
Round 1's 16 mutation runs at The 169.254/16 reading (the review's third finding). d1-named-port-ignored diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..4ea70286b 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -98,7 +98,7 @@ impl Node {
/// or, with none named, an ephemeral one, which spends the one draw. Returns the socket and
/// the port it holds.
pub fn udp_bind(&mut self, addr: Ipv4Addr, port: Option<Port>, draw: impl FnOnce() -> u32) -> Result<(DatagramId, Port), Refused> {
- let (id, port) = self.stack.bind(addr, port, draw).map_err(refused)?;
+ let (id, port) = self.stack.bind(addr, port.and(None), draw).map_err(refused)?;
Ok((DatagramId(id), port))
}
d2-port-in-use-answered-invalid-input diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..a84e21a31 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -56,7 +56,8 @@ fn refused(error: Error) -> Refused {
Error::Failed(_) => unreachable!("[udp] reported a network error against a socket that is not connected"),
};
match rule {
- Counter::PortInUse | Counter::NoEphemeralPort => Refused::AddrInUse,
+ Counter::NoEphemeralPort => Refused::AddrInUse,
+ Counter::PortInUse => Refused::InvalidInput,
Counter::NoSourceAddress | Counter::NoRoute | Counter::SourceAddressNotAssigned => Refused::NotConnected,
Counter::BindAddressNotLocal
| Counter::SendLoopbackd3-close-closes-nothing diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..9d29f73a0 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -117,6 +117,7 @@ impl Node {
/// Closes the socket: its port is free at once, what it received is gone, and what it had
/// accepted still leaves, to [udp]'s bound.
pub fn udp_close(&mut self, now: Instant, id: DatagramId) -> Result<(), Refused> {
- self.stack.close(now, id.0).map_err(refused)
+ let _ = (now, id);
+ Ok(())
}
}d4-source-is-the-destination diff --git a/userland/netstack/node/src/datagram.rs b/userland/netstack/node/src/datagram.rs
index 80b7ab9cf..e06bf3ce2 100644
--- a/userland/netstack/node/src/datagram.rs
+++ b/userland/netstack/node/src/datagram.rs
@@ -111,7 +111,7 @@ impl Node {
/// longer than `out` is cut to it and the rest is gone, as [udp] counts.
pub fn udp_recv_from(&mut self, id: DatagramId, out: &mut [u8]) -> Result<Option<Datagram>, Refused> {
let received = self.stack.recv_from(id.0, out).map_err(refused)?;
- Ok(received.map(|received| Datagram { len: received.len, source: received.source, source_port: received.source_port }))
+ Ok(received.map(|received| Datagram { len: received.len, source: received.destination, source_port: received.source_port }))
}
/// Closes the socket: its port is free at once, what it received is gone, and what it hadn1-group-not-joined diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..9c8943284 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -55,7 +55,6 @@ impl Name {
};
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
stack.set_ttl(socket, ttl, ttl)?;
- stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}
n10-answer-as-runs-no-pass diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..151808f39 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -97,7 +97,6 @@ impl Node {
/// taken, by a client's socket or by an earlier call.
pub fn answer_as(&mut self, now: Instant, host: Host<'static>) -> Result<(), toyos_net_udp::Error> {
self.name = Some(Name::new(now, &mut self.stack, host)?);
- self.serve_name(now);
Ok(())
}
n2-deadline-without-the-name diff --git a/userland/netstack/node/src/lib.rs b/userland/netstack/node/src/lib.rs
index 23338f8e9..f6b9f8025 100644
--- a/userland/netstack/node/src/lib.rs
+++ b/userland/netstack/node/src/lib.rs
@@ -141,7 +141,7 @@ impl Node {
pub fn next_deadline(&self) -> Option<Instant> {
let name = self.name.as_ref().and_then(name::Name::next_deadline);
- self.stack.next_deadline().into_iter().chain(self.client.next_deadline()).chain(name).min()
+ self.stack.next_deadline().into_iter().chain(self.client.next_deadline()).min()
}
/// Every deadline at or before `now`; the frames they make due wait for [`Self::transmit`].n3-every-answer-to-the-group diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..b32a447d0 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -84,7 +84,7 @@ impl Name {
let Some(answer) = self.record.answer(query, Asker { addr: received.source.octets(), port }, ms) else { continue };
let (to, port) = match answer.to {
To::Group => (group, PORT),
- To::Asker => (received.source, port),
+ To::Asker => (group, PORT),
};
unsent = unsent.saturating_add(send(stack, now, self.socket, to, port, &answer.bytes));
}n4-ttl-left-as-udp-has-it diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..ec0f8adbb 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -54,7 +54,6 @@ impl Name {
unreachable!("255 is a TTL and RFC 6762 §3's group is a group")
};
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
- stack.set_ttl(socket, ttl, ttl)?;
stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}n5-link-kept-when-the-lease-goes diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..ad8061764 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -69,7 +69,7 @@ impl Name {
let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: lease.prefix_len });
let (ms, group) = (millis(now), Ipv4Addr::from(GROUP));
let mut unsent = 0u64;
- if let Some(record) = self.record.on(link, ms) {
+ if let Some(record) = link.and_then(|link| self.record.on(Some(link), ms)) {
unsent = unsent.saturating_add(send(stack, now, self.socket, group, PORT, &record));
}
loop {n6-unsent-not-counted diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..c5c161887 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -105,7 +105,7 @@ impl Node {
pub(crate) fn serve_name(&mut self, now: Instant) {
if let Some(name) = &mut self.name {
let unsent = name.pass(now, &mut self.stack);
- self.counters.add(crate::Counter::NameUnsent, unsent);
+ let _ = unsent;
}
}
}n7-every-source-on-the-link diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..d45e52bac 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -66,7 +66,7 @@ impl Name {
/// Tells the responder what lease is held, sends what the record is owed now, then answers
/// every query that arrived. Returns how many messages [udp] refused.
fn pass(&mut self, now: Instant, stack: &mut Stack) -> u64 {
- let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: lease.prefix_len });
+ let link = stack.lease().map(|lease| Link { addr: lease.address.octets(), prefix: 0 });
let (ms, group) = (millis(now), Ipv4Addr::from(GROUP));
let mut unsent = 0u64;
if let Some(record) = self.record.on(link, ms) {n8-joined-before-the-port-is-bound diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..f4fb9ed01 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -53,9 +53,9 @@ impl Name {
let (Ok(ttl), Some(group)) = (Ttl::new(u8::MAX), MulticastAddr::new(Ipv4Addr::from(GROUP))) else {
unreachable!("255 is a TTL and RFC 6762 §3's group is a group")
};
+ stack.join(now, group);
let (socket, _) = stack.bind(Ipv4Addr::UNSPECIFIED, Port::new(PORT), || 0)?;
stack.set_ttl(socket, ttl, ttl)?;
- stack.join(now, group);
Ok(Self { socket, record: Responder::new(host), query: vec![0; toyos_net_udp::limits::MAX_PAYLOAD] })
}
n9-answers-on-a-clock-a-second-ahead diff --git a/userland/netstack/node/src/name.rs b/userland/netstack/node/src/name.rs
index 20c163243..430380e24 100644
--- a/userland/netstack/node/src/name.rs
+++ b/userland/netstack/node/src/name.rs
@@ -81,7 +81,7 @@ impl Name {
let Some(query) = self.query.get(..received.len) else { continue };
// Port 0 is no port to answer at: [udp] refuses the answer.
let port = received.source_port.map_or(0, Port::get);
- let Some(answer) = self.record.answer(query, Asker { addr: received.source.octets(), port }, ms) else { continue };
+ let Some(answer) = self.record.answer(query, Asker { addr: received.source.octets(), port }, ms.saturating_add(1_000)) else { continue };
let (to, port) = match answer.to {
To::Group => (group, PORT),
To::Asker => (received.source, port),s1-shard-closes-without-settling diff --git a/toyos-net-shard/src/lib.rs b/toyos-net-shard/src/lib.rs
index 05c4b94b8..c83df218d 100644
--- a/toyos-net-shard/src/lib.rs
+++ b/toyos-net-shard/src/lib.rs
@@ -553,9 +553,8 @@ impl Shard {
/// Closes a socket: its port is free at once, and what it had accepted leaves as [udp]'s
/// closed sender, in the round from this call.
pub fn udp_close(&mut self, now: Instant, id: SocketId) -> Result<(), toyos_net_udp::Error> {
- let closed = self.udp.close(id);
- self.settle(now);
- closed
+ let _ = now;
+ self.udp.close(id)
}
/// The DHCP client's socket, on port 68: the one socket that may send from 0.0.0.0 and name |
|
Review round 2 of Net lines of stage B ( The head is one commit past the measured Round 1's BLOCKERs
Round 1's NOTEs
BLOCKER
NOTE
The test that asks with ID 0Acceptable, and not a test that cannot fail on its claim. LandingBLOCKER 2 of this round needs one commit that deletes the one file. The run at BLOCKER 1 closes on CI's log, and the orchestrator may land on reading it, with no further round, when all of this holds; if any of it does not, it comes back here:
I expect none of the round's new test lines to red CI's newer clippy: no For the resolver stage (
|
…led no defect RFC 6762 §18.1's rule that a response carries the query's ID is for legacy unicast responses, which toyos-mdns already echoes; the reviewer withdrew the reading the file was filed from. Nothing in the tree cited it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
|
CI at From the
Round 2's open BLOCKER closes on this. |
Resolved by hand, each to carry both stages: - `userland/netstack/node/src/lib.rs`, the modules: `mod name;` of main's and `mod streams;` with its `pub use` of this branch's, both kept. - `userland/netstack/node/src/lib.rs`, `Node::next_deadline`: one chain of the stack's, the DHCP client's, the name's and the streams' deadlines. - `userland/netstack/node/Cargo.toml`, `description`: one sentence naming the datagram sockets, the streams and the mDNS name. - `issues/toyos-has-its-own-network-stack.md`, the stage 5 paragraph: in the tree are the lease, the datagram sockets, the mDNS name and streams; still to build are the resolver and listeners. - `issues/toyos-has-its-own-network-stack.md`, "What the node does not yet meet": this branch's six lines, then main's six, none changed. Merged by git and read: `settle` ends in main's `serve_name`, and `receive` and `fire` run the stream pass after it; `transmit` ends in the pass over the connects; `lease.rs` has main's datagram forwards and `mod tcp;`. `Stack`'s TCP forwards stay `tcp_*`; main's datagram forwards (`bind`, `send_to`, `recv_from`, `close`, `set_ttl`, `join`) have no prefix and are left as landed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
Stage D's head carries origin/main at 35d3585 (#772): the node's datagram sockets and its mDNS name. Resolved by hand: - userland/netstack/node/src/lib.rs, the module list: both sides whole, in order: datagram, lease, listeners, name, places, streams. Every other hunk of the file merged by itself: receive and fire still end in bridge after settle, transmit in pass(now, true), and next_deadline is stage D's four terms. - userland/netstack/node/Cargo.toml, description: names what both sides put in the package, and says the bound is on streams and listeners. - the track, the stage 5 paragraph: in the tree are the node, its lease, the datagram sockets, the name, streams, listeners and the bound on streams and listeners; still to build are the resolver and the move. - the track, "What the node does not yet meet": stage E's line on Tcp::ready and Tcp::orphans and stage D's six lines from main, all kept, none reworded. The node's tests at this tree: exit 0 (datagram 5, lease 18, listeners 22, name 13, slirp 3, streams 34). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A
1 participant
Stage B of the cut of the own-stack track's stage 5 (
issues/toyos-has-its-own-network-stack.md): what netstack's client UDP handlers and the socket half of itsmdns.rsdo today, as calls oftoyos-net-nodeover ToyOS's own UDP. Host-tested and shipped in nothing: netstack's modules, its manifest and every image are unchanged. smoltcp is named nowhere in what this adds, by the owner's "no more smoltcp. fast track make it gone".Built on #771, which has landed:
main(26f5ef205) is merged here at6ef68789dwith no hand resolution, andgit diff --shortstat origin/main...6ef68789dis stage B alone: 11 files, +1,100, -8.Behaviour that differs from what ships today
A client's datagram to a broadcast address is refused. On smoltcp, netstack sends a datagram to 255.255.255.255 or a subnet's broadcast like any other. On the node,
toyos-net-udprefuses itudp.broadcast-not-permittedunless the socket was permitted, the client is answered invalid input, and nothing leaves. The pipe ABI has no request that carries the permission, and std'sUdpSocket::set_broadcastisOk(())and reaches netstack with nothing (sdk/std/sys/net/connection.rs:602).Who sends to broadcast today, by search of this tree outside
rust/,issues/and the stack crates (rg -n "set_broadcast|SO_BROADCAST|Ipv4Addr::BROADCAST|255\.255\.255\.255|255, 255, 255, 255|is_broadcast"): nobody. The only hits are std's stub above and a test string insrc/sourcegate.rs. No program underuserland/ortests/opens a datagram socket of its own at all (rg -l "UdpSocket|udp_bind|udp_send_to|SOCK_DGRAM"finds only std, libc,toyos::net, netstack and two build-crate files,src/icmp.rsandsrc/metaltalk.rs, which run on the development host). Not searched: the source of third-party C programs built from recipes, which is not in the tree; one of them callingsendtoto a broadcast address through libc would be refused after the move. The review ruled the refusal right and the owner ruled on the rest: "Of course carry the permission why would you even ask. The premise is and always has been to do things properly". So the track's line gates the move of netstack onto the node on two things, a stage of their own and not this diff: that search posted, and the pipe ABI carrying the permission from std's and libc's setters toUdp::set_broadcast, with a send refused for want of it answered in a word that says permission and not input.The name is not announced again when the link comes back. Today link-up resets netstack's DHCP client, the address is new again and
mdns.rsannounces it. Here the lease outlives the link, so the responder sees no new address and announces nothing, where RFC 6762 §8.3 asks for the announcement. Recorded in the track; the exit istoyos-mdns's.An answer to a 169.254/16 asker leaves by the router. Measured here on the own stack, wrong by RFC 3927, and recorded below under the review's third finding; what smoltcp does with the same query was not measured.
Smaller differences, each [udp]'s own tested rule, none a decision of this diff: a send with no lease held is answered not connected (
udp.no-source-address), where today's handler answers whatever smoltcp'ssend_sliceaccepted; a payload past 1,472 octets is refused (udp.exceeds-mtu), where today's stack is built without fragmentation; a datagram longer than the client's buffer is cut to it and countedudp.rx-truncated, where today netstack answersERR_OTHERfor it; a full send queue is answered resource exhausted, where today it isERR_OTHER; a bind to an address the machine does not hold is refused, where today it binds; a send to the machine's own address or to 127/8 is refused (udp.send-to-self,udp.send-loopback): the own stack has no loopback path.What changed, per decision
src/datagram.rs:Node::udp_bind,udp_send_to,udp_recv_from,udp_close. A socket is aDatagramId, which only a bind makes, so no client call can name the DHCP client's socket or the responder's.Refusedis the pipe ABI's four words a datagram call can be answered in; the map from [udp]'s rule to the word is one exhaustive match over [udp]'sCounter, so a rule [udp] gains later does not compile here until it has a word. The node does not depend ontoyosand writes no error code: the shell maps word to code at the move.src/name.rs:Node::answer_as(now, host)binds 5353, sets TTL 255 (RFC 6762 §11), joins 224.0.0.251, runs the name's pass once, so a lease already held is announced by the call, and from then on drivestoyos_mdns::Responderat the end of every pass over the stack's reports: it is told the held lease's address and prefix, or that there is none; what the record is owed later is one more term ofNode::next_deadline. An answer goes where the responder says. One [udp] refuses is countednode.name-unsentand dropped. Bind comes before join, so a refused start joins nothing.src/lease.rs: six crate-private methods onStack(bind,send_to,recv_from,close,set_ttl,join), each one call passed on to the shard. toyos-net-node: the node and its DHCP lease on ToyOS's own stack, host-tested and shipped in nothing #771's review asked this shape of a stage that adds sockets;shardis still reachable only in that file, and none of the six writes the lease.src/lib.rs: the two modules, the re-exports, one field, one counter, the name's deadline, andsettleending in the name's pass (returnbecamebreak).Node's existing public shape did not move.toyos-net-shard, each a missing piece the node calls:join(Ip::join, with nothing to settle: a join makes no flow eligible and no event),udp_port(the port a bind got, forudp_bind's answer),udp_set_ttl(for §11),udp_close(Udp::closethen settle, so what a closed socket had accepted joins the round at once),udp_counters(read by the tests here, and byinspectat the move). Noleave: the node never leaves its one group.toyos-net-udpis untouched.Cargo.lock:toyos-net-nodegains the edge totoyos-mdns, already a package of the lock. No new dependency and no new fetch.Departures from the cut
answer_as, not inNode::new:toyos_mdns::Hostborrows its label andNode::new'stoyos_dhcp::HostNameowns it, and neither crate is in this fence. The track records it.mdns.rs's one test across": that test is that the loop is woken for exactly what the record owes. Here it isa_held_lease_is_announced_at_once_and_a_second_later, on the node'snext_deadline.The checks (a trust boundary)
Untrusted input. The node slices nothing off the wire: a frame goes through
toyos-net-wirein the shard, a query's bytes throughtoyos-mdns's parser, and a query's source is a destination only after the responder found it on the lease's prefix and [udp] accepted it.no_cut_of_a_query_is_answereddelivers every prefix of a query. A client's numbers (address, port, length) are refused by [udp], never trusted:each_refusal_is_answered_in_the_pipes_word_for_it. Time is an argument everywhere; there is no wait.Independent oracles.
tests/lan/mod.rs,outside: every frame the node emits in every test here is parsed byetherparse0.21.0 (already stage A's dev-dependency), which recomputes the IPv4 header checksum, the lengths, and the UDP, ICMP or IGMP checksum.tests/name.rs: every mDNS message, asked or expected, is written out byte by byte from RFC 1035 §4.1 and RFC 6762 (§3, §5.4, §6, §6.7, §8.3, §10, §10.2, §11, §18) and never bytoyos-mdns; the IGMP report is compared against bytes written from RFC 9776 §4 and §4.2 and RFC 2113.tests/datagram.rs: the dynamic range and the port after a draw from RFC 6335 §6 and RFC 6056 §3.3.1; the port unreachable from RFC 1122 §4.1.3.1.The scripted DHCP server and the peers' frames are the tests' own: consistency, not independence.
Negative control. The whole change reverted is modules that do not exist, so the control is named mutations, one per rule, each applied as a checked patch, built, run and reversed (patches in the comment below):
a_query_in_a_frame_to_the_groups_address_reaches_the_responderthe_group_is_joined_and_its_membership_reportednext_deadlinewithout the name'sa_held_lease_is_announced_at_once_and_a_second_lateran_answer_goes_to_the_group_or_to_the_asker_as_the_query_askedevery_response_leaves_with_ttl_255the_name_is_answered_only_while_its_lease_is_heldan_answer_udp_refuses_is_counted_and_droppeda_query_from_off_the_link_is_not_answeredthe_names_port_is_held_by_one_socketa_socket_holds_the_port_it_named_or_the_one_its_draw_pickedeach_refusal_is_answered_in_the_pipes_word_for_ita_closed_socket_frees_its_port_and_what_it_accepted_still_leavesa_datagram_for_a_bound_port_is_handed_over_with_where_it_came_froma_second_query_inside_a_second_waits_for_the_second_to_endanswer_asruns no passa_lease_already_held_is_announced_as_the_name_is_tolda_closed_socket_frees_its_port_and_what_it_accepted_still_leavesGates
One run at
56f03de2a, by the orchestrator (the author builds and runs nothing), script exit 0, the tree clean at its end. The head,288484ba4, differs from it by one line of the track, the owner's ruling quoted, and the deletion of an issue file the first round filed (git diff --stat 56f03de2a 288484ba4: two files, +1, -23); nothing was run again for it, nor for the merge ofmainat6ef68789d, which brings #770 and stage A's own landed head. All 16 mutation runs of the table above are from this run, their patches regenerated against56f03de2a. The first round's run, atbd325cb82, was the same steps and the first 14 mutation runs, all as expected.cargo metadata --locked --format-version 1cargo test --locked --manifest-path userland/netstack/node/Cargo.tomlcargo test --locked -p toyos-net-shardcargo test --locked --lib -- hostws:: userlandhost:: sourcegate:: licence::cargo clippy --locked --manifest-path userland/netstack/node/Cargo.toml --all-targets -- <adopted> -D warningscargo clippy --locked -p toyos-net-shard --all-targets -- <adopted> -D warningsThe gates step ran 45 tests (
running 45 tests, 45 passed, 361 filtered out). The node's run:datagram5,lease18,name13,slirp3.Not run here:
cargo run -- --ci hostand the guest suite are CI's; the commands above are a subset of--ci host. No guest test is added or changed, and no shipped package depends ontoyos-net-nodeortoyos-net-shard.The first review, answered
--ci hostgreen at the head: CI's, once toyos-net-node: the node and its DHCP lease on ToyOS's own stack, host-tested and shipped in nothing #771 has landed and this is ready; no change to the branch.a_second_query_inside_a_second_waits_for_the_second_to_end: three queries from port 5353 in one instant, the first multicast at once, the others held, the node's next deadline within the second, exactly one more multicast between 999 ms and 1 s after the first, none after. The review's patch (n9) builds 0 and reds it 101, at the deadline assertion (tests/name.rs:206).an_answer_to_a_link_local_asker_leaves_by_the_routerdelivers a legacy query from 169.254.3.4 port 53000 on a lease with a router and is green on exactly one datagram: frame to the router's link address, from the leased address port 5353 to 169.254.3.4 port 53000, TTL 255, the legacy answer. The track records it as present-state wrong behaviour (RFC 3927 §2.6.2, §7) with [ip] owning the exit: [ip] sends to 169.254/16 on the link and that test finds the frame at the asker's own link address.name.rs's header now says what the responder takes for on-link.answer_aswith a lease held: the call ends in the name's pass;a_lease_already_held_is_announced_as_the_name_is_told, red under n10. The signature did not move.Shard::join'ssettle: deleted; it carried nothing.No signature the resolver stage builds on moved:
Stack's six methods,Node::udp_*,Refused,DatagramId,lan::Lan.Unsure of, and weak
udp.no-ephemeral-porthas a word (address in use) and no test that reaches it: 16,384 binds. Recorded in the track.udp.broadcast-not-permitted,udp.send-unspecified-destination) comes out ofdrain_eventsonly after the node's nextreceive,fireorlink: the datagram calls take no draw and so cannot run the pass that reads the stack's reports. Recorded in the track.lease.rsgrew by 31 lines in a file whose header says it is the lease's one writer; the section's comment says the six calls write none of it.Net lines of stage B: +1,100, -8: production 312 (node 282, shard 30), tests 778, manifest, lockfile and the track 10.
🤖 Generated with Claude Code
https://claude.ai/code/session_01RvnWQFcMuGqTHYhvSnTe8A