KKRainbow
4a10d1c2b9
* feat(mobile): add embedded iOS runtime API Add a thin panic-safe C ABI crate for embedding no-TUN instances on iOS. Expose lifecycle, status, JSON-RPC, string ownership, and error handling. Build device and simulator XCFramework static libraries on macOS. Add exact named-instance deletion to the iOS and Android wrappers. Cover wrapper lifecycle and the port-forward patch flow on host targets. * fix(gateway): recover TCP port-forward listeners Release an unusable TCP port-forward listener after an accept failure. Retry binding until the forward is cancelled. Keep the old listener released while rebinding so mobile sockets can recover. Expose opt-in iOS diagnostics for listener and connection events. Trace configuration removal and adapter shutdown. Add tests for recovery, release-before-rebind, and cancellation. * feat(web): persist incremental managed config patches Add a revision-CAS PATCH contract for managed configs while keeping the existing Full PUT path for compatibility and recovery. Apply Full and Patch mutations with their revision in one SQLite transaction. Reject ownership conflicts and invalidate revisions on alternate web-owned writes. Document limits, failure semantics, rollout order, and verification. Cover delta updates, conflicts, idempotency, and transaction rollback. * feat(web): apply managed config patches to live sessions Carry Patch fences and touched instance IDs into live sessions. Reconcile only those instances when the applied revision matches the Patch base. Fall back to Full reconciliation for gaps and restarts. Invalidate the applied revision around every direct runtime mutation. Fence revision advancement with the runtime cache epoch so stale reconcile rounds cannot overwrite a newer invalidation. Require deletion responses to confirm each requested instance before advancing the revision. Raise the managed PUT and PATCH body limit to 32 MiB and return typed conflicts for publisher recovery. * fix(core): retry transient accepted TCP errors Keep TCP tunnel listeners alive when an accepted socket fails during upgrade with a retryable connection-state error. Share the retryable I/O classifier with the socket listener. Cover a rejected connection followed by success and propagation of permanent errors. * feat(core): add internal Peer Relay edge projection Derive the local advertised OSPF row from physical adjacency and transport-authenticated credential relay coverage. Keep full local adjacency only in the temporary SPF snapshot so direct destinations retain a fallback route. Leave Peer Relay disabled at the public configuration seam. A follow-up change can expose the preference without coupling route projection to credential reauthorization. feat(config): expose Peer Relay routing preference Add prefer_peer_relay to public protobuf, TOML, management patch, and hosted runtime surfaces. Read the preference from live peer context so runtime config updates take effect. Refresh authenticated peer metadata when the option is enabled. Cover dynamic enable and disable in a five-node, dual-admin credential topology, including forwarded relay coverage and local fallback.
3.4 KiB
EasyTier Domain Context
Module layers
easytier-core layers dependencies from foundation upward through the
portable networking domains. foundation contains infrastructure Modules
that have no dependency on a networking domain and may be used by any higher
layer.
Operation broker
An operation broker owns the lifecycle of asynchronous work submitted by an external caller to core. It allocates opaque operation IDs, arbitrates completion, cancellation, and disposal, retains terminal outcomes, and publishes a batch-drainable completion queue.
The broker does not interpret operation kinds, outcomes, resources, wire formats, or domain errors. Each domain Module owns those semantics and composes the broker under the same lock as any state that must change atomically with an operation transition.
Host capability operations use a separate seam. They turn Host readiness into Rust task wakeups and do not share the caller-to-core broker state machine.
Credential grant
A credential grant contains the authorization constraints shared by generated, imported, managed, and attached-peer credentials: ACL groups, relay permission, allowed proxy CIDRs, and whether concurrent reuse is allowed. It does not own credential identity, key material, lifetime, persistence, or runtime ownership. Each credential intake path normalizes the grant before installing it.
Peer Relay advertisement
A platform peer may prefer an eligible directly connected credential relay by omitting covered credential-leaf edges from only its own advertised OSPF connection row. Its local route calculation still uses the complete physical adjacency so direct-destination fallback remains available. Other peers' source-owned rows and versions are never rewritten, cached for promotion, or otherwise changed by this projection.
Relay eligibility comes from the transport-authenticated credential identity and grant, not self-reported route metadata. The advertisement Module does not support changing a credential's relay permission in place; such a permission change is a credential revocation and new authenticated Session.
Attached peer
An attached peer is an ordinary PeerManagerCore connected to another
PeerManagerCore through an authenticated in-process transport. Each
authenticated portal client owns one complete peer manager. The managers are
protocol peers; attached describes only the local transport and its trusted
ingress provenance, not a parent/child peer role.
Each manager owns its ACL execution state, route service, RPC endpoint, secure sessions, packet processing, and lifecycle. Portal code supplies raw packets and peer configuration but does not build, reload, or coordinate ACL filters.
When the network manager uses Secure Mode, an attached peer authenticates as a credential peer. Its portal-owned, in-memory credential grant carries ACL groups and is revoked with the attached runtime; the peer never receives the network secret or ACL group secrets. A non-Secure-Mode network retains the legacy admin-attached identity for compatibility. A credential peer cannot host a portal because it cannot issue credential grants.
Compact compatibility Host
A compact compatibility Host retains accepted values in the authoritative TOML model for management readback, while the shared host-aware normalization path omits capabilities that the compact runtime cannot execute. Omitted settings are silent no-ops and must not be advertised as live network capabilities.