Repository navigation
fix(device): sweep wedged dispatches, bound the rvt1 hello, and pin the state deny surface (#312) - #324
Merged
Conversation
…he state deny surface (#312) Follow-ups from the #305 gateway review: - Hello read deadline: the rvt1 client's post-authentication hello read carried no budget, so a silent peer held the session forever. It now mirrors the rvd1 post-TLS deadline policy (watchdog closes the channel; a racing deadline cannot close a session that already holds the hello). - Typed handshake failures: pre-hello transport and protocol errors surface as handshakeTimedOut / handshakeFailed instead of raw channel errors. - Wedged-backend capacity: cancelling a request now frees its wire slot immediately and retires the dispatch by token, so a backend task that ignores cancellation cannot keep the slot or answer a reused id; the gateway session likewise reclaims the pending entry at cancel (its vanished-entry rule already suppresses the late response). The backend host drops its work entry at cancel too. - Deny surface: the gateway tests now pin $state/set denial through the ordinary RPC route, both state routes against ungranted names, the write-capability allow path, and an end-to-end $state/set denial. Red-green: the capacity-reclaim test fails against the pre-fix server (rejection error frame) and passes with the fix; the full swift test run is green.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #312 (all four findings from the #305 pre-merge review).
RivetDeviceAppleRVT1Client.start()now bounds the post-authentication hello read with the RVD1 post-TLS deadline policy (rivetDeviceSessionPostTLSTimeout, injectable ashelloTimeout:). A watchdog closes the channel on expiry; a generation token makes the deadline one-shot, so a deadline that races a completed hello cannot close a live session.handshakeTimedOut/handshakeFailed(String)onRivetDeviceAppleRVT1ClientErrorinstead of raw channel errors. No exhaustive switches existed outside the client, so the new cases are additive.RivetDeviceAppleRVT1GatewayServer: cancelling a request frees its wire slot immediately; each dispatch carries a token so a late completion from a task that ignores cancellation can neither answer a reused id nor resurrect the slot.cancelledIDsis gone.RivetDeviceGatewaySession:cancelnow removes the pending entry instead of only flagging it, reclaiming the session's pending capacity even when the host call never completes. Late responses are still suppressed (the vanished-entry rule incancellationWasRequested), and a cancel racing an in-flightstartRPCstill cancels the host call.RivetDeviceRVT1BackendHost:cancelRPCdrops the work entry.$state/setthrough the ordinary RPC route (denied), both state routes against ungranted names, the write-capability allow path, and an end-to-end$state/setdenial through the RVT1 gateway server.Validation
appleRVT1GatewayReclaimsCancelledSlotsWhenBackendIgnoresCancellationfails against the pre-fix code with the rejection error frame (verified locally on the untouched sources) and passes with the fix.swift test --package-path platform/macosgreen locally (10 suites, including the 55-test transport suite).