cloud/redapricot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

break: replace muxed workers with 1:1 tunnels

Browse Source 
Worker frames are now FrameType + payload; there is no stream id.
Each player gets its own worker conn. maxTunnels (default 256)
caps concurrent tunnels. The old maxConn pool size is ignored so
existing configs do not silently admit only a handful of players.

Resume, per-direction windows, the control session, and the
DATA-only shaper stay. A dropped worker still hangs that one
player and reattaches over a fresh conn.

Add a hub-side per-IP limiter for player intents only (default
8/s, burst 16, 64 concurrent). Unmatched hostnames consume a
token; Intent 17 is never counted. 0 disables each knob.
This commit is contained in:
iceBear67
2026-08-15 18:32:51 +08:00
parent da17140583
commit 4df2560331
27 changed files with 1174 additions and 856 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/resume.go
+41 -41
View File
@@ -10,11 +10,10 @@ import (
// Stream resumption (PROTOCOL.md §7.5).
//
// A worker conn carries many players but is only the middle leg of each: when
// it dies, both terminal sockets are usually still perfectly healthy. Tearing
// the streams down therefore throws away working connections because a
// replaceable transport failed — one conntrack expiry disconnects everyone on
// that conn.
// A worker conn is only the middle leg of the player it carries: when it dies,
// both terminal sockets are usually still perfectly healthy. Tearing the
// tunnel down therefore throws away working connections because a replaceable
// transport failed.
//
// Instead the stream parks: the destination socket stays open, the hub hangs the
// player socket, and the client reattaches over a fresh conn. Correctness rests
@@ -104,7 +103,7 @@ func (s *Stream) resumeLoop(grace time.Duration) {
return
}
// errResumeRaced falls through to the retry below. The hub has this
// stream bound to a conn that is not ours — a half-open conn whose
// player bound to a conn that is not ours — a half-open conn whose
// death the hub has not yet learned, or a bind left behind by a racing
// attempt on a now-dead conn. There is no other live attempt: park is
// the only resumeLoop starter and it refuses to double-start. Retrying
@@ -131,10 +130,10 @@ func (s *Stream) resumeLoop(grace time.Duration) {
s.teardown(false)
}
// tryResume performs one reattach attempt: find a live conn, claim a stream id
// on it, send RESUME, and replay from wherever the hub says it got to.
// tryResume performs one reattach attempt: dial a fresh worker conn, send
// RESUME, and replay from wherever the hub says it got to.
func (s *Stream) tryResume() error {
wc, sid, err := s.allocateForResume()
wc, err := s.allocateForResume()
if err != nil {
return err
}
@@ -147,10 +146,10 @@ func (s *Stream) tryResume() error {
s.resumeWait = wait
s.mu.Unlock()
msg := wire.NewWriter().U8(MuxResume).VarInt(sid).Bytes(cid).
msg := wire.NewWriter().U8(MuxResume).Bytes(cid).
I64(accepted).I64(delivered).Out()
if err := wc.fc.WriteFrame(msg); err != nil {
s.abandonAttempt(wc, sid)
s.abandonAttempt(wc)
return err
}
@@ -158,47 +157,51 @@ func (s *Stream) tryResume() error {
select {
case res = <-wait:
case <-s.done:
// Torn down while waiting. teardown only deregisters the leg the stream
// Torn down while waiting. teardown only detaches the conn the stream
// was bound to, which is not this one, so the claim made above has to be
// withdrawn here or it stays in the new conn's table forever.
s.abandonAttempt(wc, sid)
// withdrawn here or the new conn stays bound forever.
s.abandonAttempt(wc)
return errResumeRefused
case <-time.After(ResumeAckTimeout):
s.abandonAttempt(wc, sid)
s.abandonAttempt(wc)
return errResumeTimeout
}
if res.err != nil {
s.abandonAttempt(wc, sid)
s.abandonAttempt(wc)
return res.err
}
return s.completeResume(wc, sid, res)
return s.completeResume(wc, res)
}
// allocateForResume picks a live conn that will honour a reattach.
func (s *Stream) allocateForResume() (*WorkerConn, int, error) {
for attempt := 0; attempt < allocateAttempts; attempt++ {
wc, sid, err := s.client.pool.Allocate()
// allocateForResume dials a dedicated worker conn that will honour a reattach.
// 1:1: this must never land on someone else's tunnel.
func (s *Stream) allocateForResume() (*WorkerConn, error) {
for attempt := 0; attempt < dialAttempts; attempt++ {
wc, err := s.client.pool.Dial()
if err != nil {
return nil, 0, err
return nil, err
}
// Re-checked per conn, not assumed from the dead one: this may be a
// different or restarted hub. Sending RESUME to a hub that does not know
// the frame type would hang the player for the rest of the grace waiting
// for an answer that is never coming.
if !wc.resume {
return nil, 0, errResumeNoResume
_ = wc.fc.Close()
return nil, errResumeNoResume
}
if wc.registerStream(sid, s) {
return wc, sid, nil
if wc.attach(s) {
return wc, nil
}
_ = wc.fc.Close()
}
return nil, 0, errResumeRefused
return nil, errResumeRefused
}
// abandonAttempt withdraws a failed attempt from the conn it was made on, so a
// retry can never leave two RESUMEs outstanding for one stream.
func (s *Stream) abandonAttempt(wc *WorkerConn, sid int) {
wc.removeStream(sid)
// abandonAttempt withdraws a failed attempt from the conn it was made on and
// closes that conn — 1:1, it exists only for this attempt.
func (s *Stream) abandonAttempt(wc *WorkerConn) {
wc.detach()
_ = wc.fc.Close()
s.mu.Lock()
s.resumeWait = nil
s.mu.Unlock()
@@ -206,7 +209,7 @@ func (s *Stream) abandonAttempt(wc *WorkerConn, sid int) {
// completeResume rebinds the stream to its new conn and replays what the hub is
// missing, holding sendMu throughout so live traffic cannot overtake the replay.
func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error {
func (s *Stream) completeResume(wc *WorkerConn, res resumeResult) error {
s.sendMu.Lock()
// Delivery is a strictly stronger fact than credit — the hub only credits what
// it has delivered — so the reported offset can be adopted wholesale. Doing so
@@ -218,7 +221,7 @@ func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error
replay := s.un.from(res.accepted)
if replay == nil {
s.sendMu.Unlock()
s.abandonAttempt(wc, sid)
s.abandonAttempt(wc)
return errResumeTooOld
}
// Three offsets, three jobs, and conflating any two of them breaks something
@@ -235,10 +238,8 @@ func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error
outstanding := s.un.length()
replayed := s.un.end() - res.accepted
// Publish the new binding before any frame goes out on it, and as one value:
// stream ids restart at 1 per conn, so a half-updated pair would address a
// different player's stream.
s.leg.Store(&leg{wc: wc, sid: sid})
// Publish the new binding before any frame goes out on it.
s.wc.Store(wc)
s.mu.Lock()
// Restated, not patched. The window is a delta ledger and the outage tore a
@@ -251,7 +252,6 @@ func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error
// Symmetrically, our own pending credit is discarded rather than flushed:
// the delivered offset we reported already tells the hub everything those
// deltas would have, and sending both would grant the same bytes twice.
// Counting resumes from this baseline.
s.consumed = 0
if len(res.cid) == CIDLen {
s.cid = res.cid // fresh capability, so a CID is never reusable twice
@@ -267,9 +267,9 @@ func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error
if n > s.client.chunk {
n = s.client.chunk
}
if err := wc.sendData(sid, replay[:n]); err != nil {
if err := wc.sendData(replay[:n]); err != nil {
// The conn died mid-replay. The stream is still resumable, but not
// from this leg — put it back in the parked state before returning
// from this conn — put it back in the parked state before returning
// so the conn's teardown takes park()'s already-branch instead of
// starting a second resumeLoop. The loop we came from keeps
// retrying with the fresh CID, which the hub re-parked alongside
@@ -300,11 +300,11 @@ func (s *Stream) completeResume(wc *WorkerConn, sid int, res resumeResult) error
// A destination that closed while we were parked owed the hub a FIN that had
// nowhere to go at the time.
if owedFin {
wc.sendFin(sid)
wc.sendFin()
s.teardown(false)
return nil
}
log.Printf("stream conn%d/sid%d resumed (%d bytes replayed, %d outstanding)", wc.id, sid, replayed, outstanding)
log.Printf("stream %s resumed (%d bytes replayed, %d outstanding)", s.name(), replayed, outstanding)
return nil
}